config.txt

uart_2ndstage=1

# Mark the EEPROM as write protected when the EEPROM /WIP pin is pulled low.
# See https://www.raspberrypi.com/documentation/computers/raspberry-pi.html#eeprom-write-protect
#eeprom_write_protect=1

# Uncomment to write to enable secure-boot by writing. This
# locks the device to the public key in the EEPROM by storing the
# sha256 hash of the public key in OTP.
#
# This option also prevents the ROM from loading recovery.bin from SD/EMMC
# which means that the bootloader can only be updated via RPIBOOT or self-update.
#
# Uncomment program_pubkey=1 to enable this
# WARNING: THIS OPTION MODIFIES THE BCM2712 CHIP AND IS IRREVERSIBLE.
#
# N.B The revoke_keydey option is not required and not currently implemented
# because on 2712 the bootloader firmware must also be signed by the customer
# key if secure-boot is enabled.
#program_pubkey=1

# Permanently disable VideoCore JTAG access.
# Warning: This option limits the ability to do failure analysis on
# boards returned to resellers or Raspberry Pi.
#program_jtag_lock=1

# If recovery_reboot is set then the Pi will disconnect USB and
# reboot after the flashing the firmware.
#recovery_reboot=1

# Uncomment to instruct recovery.bin to send metadata including OTP fields
# Specify -j dirname on the command line to specify the directory where
# metadata should be stored (JSON format)
#recovery_metadata=1