12:06 <permheaddamage> Hello~Nice you meet y. I am trying to boot mainline kernel on a secured H6 TV box. I have root access on the uart console so I made a KO driver to invoke a smc call to let ATF boot EL1 firmware again. I am able to make it boot mainline U-boot, the uboot also reports found the kernel/dtb file on SD card, but when it jumps into kernel, the board hangs.

15:57 <apritzel> permheaddamage: have you tried booting mainline U-Boot (SPL+TF-A+U-Boot) directly (from SD), while defining CONFIG_SPL_IMAGE_TYPE_SUNXI_TOC0 ?

15:58 <apritzel> most (if not all) "secure" boxes we have seen do not actually define a key, so any key will do, the SPL just has to be in TOC0 format

16:07 <apritzel> even though I don't know if this "rebooting via smc" is supposed to work: make sure that the load addresses for kernel and DTB do not overlap, and add "earlycon=uart,mmio32,0x05000000" to your command line

16:42 <permheaddamage> Yes I tried that, it went into fel. I can see by "cat /sys/class/sunxi_info/sys_info", the key is burned.

19:09 <apritzel> mmh, IIRC bauen1 had a relatively easy exploit for the H6(?) secure BROM ...