Hey @jock and @fabiobassa, thanks for all the work you put on this!
My team has been messing around with TV boxes (TX9) and the tools you made.
I have some questions about the boot process of these TV boxes, and I'm hoping you could share some insights we don't have yet.
Sorry in advance for the long post!
Question 1.
According to the rockchip wiki, the SD card boot process and the eMMC boot process are the same, only the boot device changes.
We understand the first 16 MiB of the boot device should contain multiple stages of bootloaders (the rockchip miniloader, trust.img and U-boot) in specific sectors.
Looking at the multitool image, we find the expected data at the expected offsets (sectors 0x40, 0x4000 and 0x6000).
On the armbian image, there's a difference!
We could find idbloader at sector 0x40, but the user partition starts at sector 0x2000, so there isn't any more rockchip-specific "magic" data after that!
So my question is: why does the eMMC only need the idbloader, while the other boot stages are required for the SD card to boot?
I have a theory that trust.img and u-boot are there in the eMMC, but offset behind what the operating system can access (for example, Linux wants to read sector 42 of the eMMC, and the controller translates that to a read to sector 42+0x8000).
But that doesn't account for the need for the idbloader to be in the armbian image.
In the end, the idbloader would be located at sector 0x8040, which isn't where it would be expected.
Question 2.
Armbian installed in the eMMC works. We tested kernel versions 4.4, 5.something and 6.1. All work as expected.
We were able to extract the "magic" rockchip section from the multitool image and use that to create bootable SD card images from backups of the eMMC (armbian).
We create a FAT partition similar to the multitool partition and put there an extlinux config and the kernel and DTB from multitool.
The extlinux config is modified so it points to the correct rootfs, and the system boots (even the UI works)!
However, replacing the multitool (or modified armbian) kernel.img with a more recent kernel doesn't boot.
We expected that just changing the kernel and adding to the command line "console=tty1 verbose=1" should at least show something if the kernel is able to start the HDMI driver. (even if it would eventually panic because it couldn't find the rootfs or a initramfs)
But because nothing shows up, either the kernel isn't being loaded at all or it isn't able to start the HDMI driver or it panicked very early in the boot.
We tried using the DTB that comes with multitool and the DTB in the armbian image, to no avail.
Why is it that the same kernel that works on armbian installed in the eMMC doesn't even boot on multitool installed on the SD card?
Have you had luck with newer kernels + multitool?
Questions 3.1 and 3.2.
To work around the problem of only one kernel being sure to boot from the SD card, we tried kexec'ing newer kernels.
We recompiled the kernel to enable the kexec feature and it boots from the SD card.
We kexec the same kernel, to make sure it works, passing the same command line used to boot it.
The HDMI output instantly turns off, but the device starts responding to pings after a while, so it's somewhat working.
CTRL+ALT+DEL resets the device, as expected.
Do you know why the HDMI output is instantly disabled and never turns on again?
I don't have access to a dmesg log right now, but I can provide one on monday.
But from what I read, there wasn't any difference in the HDMI related messages.
And back to kexec: kexec'ing a newer kernel doesn't work!
We don't have video feedback, the same as after the successful kexec, but it never responds to pings, and CTRL+ALT+DEL doesn't reset the device, so we assume it panicked.
Have you had luck kexec'ing newer kernels?
We still haven't tried kexec'ing after booting armbian. I will report on how that goes on monday.