[HD Mini Android Development] munjeni:
Did you tried...? Hmmm pfw 0xa8250800 0 ?? Maybe MPU realy need to be disabled before boot? Ok, but why zImage/haret not need mpu disabling? What address is for mpu? Where you found that info about haret/lk/mpu ?? Have link? Also, maybe problem is: we need new radio (I tried magldr in hd2 phone with new radio and magldr could not boot if you not have old radio!!!)...so hard job will be geting tinboot or lk working!

See memory map

v=virtual
p=physhical
==========================================================
v80000000-8cb00000 -> p00100000-0cc00000 cb00000
v8cb00000-8cc00000 -> p00000000-00100000 100000
v8cc00000-8cd00000 -> p0ff00000-10000000 100000
v8cd00000-8da00000 -> p0f200000-0ff00000 d00000
v90000000-90100000 -> p98000000-98100000 100000
v90100000-90200000 -> p9c000000-9c100000 100000
v90200000-90f00000 -> pac000000-acd00000 d00000
v90f00000-91000000 -> pa0e00000-a0f00000 100000
v91000000-91100000 -> pa0d00000-a0e00000 100000
v91100000-91200000 -> pa0d00000-a0e00000 100000
v91200000-91300000 -> pa0c00000-a0d00000 100000
v91300000-91500000 -> pa0a00000-a0c00000 200000
v91500000-91600000 -> pa0800000-a0900000 100000
v91600000-91700000 -> pa0700000-a0800000 100000
v91700000-91800000 -> pa0600000-a0700000 100000
v91800000-91900000 -> pa0500000-a0600000 100000
v91900000-91a00000 -> pa0400000-a0500000 100000
v91a00000-91c00000 -> pa0200000-a0400000 200000
v91c00000-91d00000 -> pa0100000-a0200000 100000
v91d00000-91e00000 -> pa0000000-a0100000 100000
v91e00000-91f00000 -> paa600000-aa700000 100000
v91f00000-92000000 -> paa500000-aa600000 100000
v92000000-92100000 -> paa300000-aa400000 100000
v92100000-92200000 -> pa8100000-a8200000 100000
v92200000-92300000 -> pa9d00000-a9e00000 100000
v92300000-92400000 -> pa9900000-a9a00000 100000
v92400000-92500000 -> pa8700000-a8800000 100000
v92500000-92600000 -> paa200000-aa300000 100000
v92600000-92700000 -> pa9c00000-a9d00000 100000
v92700000-92800000 -> pa9b00000-a9c00000 100000
v92800000-92900000 -> pa9a00000-a9b00000 100000
v92900000-92a00000 -> pa9800000-a9900000 100000
v92a00000-92b00000 -> pa9700000-a9800000 100000
v92b00000-92c00000 -> pa9600000-a9700000 100000
v92c00000-92d00000 -> pa9500000-a9600000 100000
v92d00000-92e00000 -> pa9400000-a9500000 100000
v92e00000-92f00000 -> pa9300000-a9400000 100000
v92f00000-93000000 -> pa9200000-a9300000 100000
v93000000-93100000 -> pa9100000-a9200000 100000
v93100000-93200000 -> pa9000000-a9100000 100000
v93200000-93300000 -> pa8800000-a8900000 100000
v93300000-93400000 -> pa8600000-a8700000 100000
v93400000-93500000 -> pa8500000-a8600000 100000
v93500000-93600000 -> pa8300000-a8400000 100000
v93600000-93700000 -> pa8200000-a8300000 100000
v93700000-93800000 -> pa8200000-a8300000 100000
v93800000-93900000 -> pa8200000-a8300000 100000
v93900000-93a00000 -> pa8200000-a8300000 100000
v93a00000-93b00000 -> pa8200000-a8300000 100000
v93b00000-93c00000 -> pa8000000-a8100000 100000
v93c00000-94100000 -> pc0000000-c0500000 500000
v94100000-94200000 -> p80100000-80200000 100000
v96000000-96200000 -> p88000000-88200000 200000
v96200000-98000000 -> p20000000-21e00000 1e00000
v98000000-98200000 -> p8c000000-8c200000 200000
v98200000-9a000000 -> p21e00000-23c00000 1e00000
v9a000000-9a200000 -> p90000000-90200000 200000
v9a200000-9c000000 -> p23c00000-25a00000 1e00000
v9c000000-9c100000 -> p94000000-94100000 100000
v9c100000-9d000000 -> p25a00000-26900000 f00000
v9d000000-9d100000 -> p98000000-98100000 100000
v9d100000-9e000000 -> p26900000-27800000 f00000
v9e000000-9e200000 -> p9c000000-9c200000 200000
v9e200000-9ea00000 -> p27800000-28000000 800000
v9f000000-9f100000 -> p80000000-80100000 100000
vf0400000-f0500000 -> p00000000-00100000 100000
vfffd0000-fffd4000 -> p01a10000-01a14000 4000
vffff0000-ffff1000 -> p01a14000-01a15000 1000
vffffc000-ffffd000 -> p01a15000-01a16000 1000

Also zImage from haret is loaded to 0x200000 ...etc

Also disabling memory protection is risic becouse if you disable memory protection maybe you overwrite spl (brick your device)... so I think disabling mpu is not necesarry!

Also I found good nbh generator (auto generate mbr record, 0xff bute, auto size "proper size"...etc), also there is explanation how mbr record working, how to calculate partition size and add to mbr...etc...etc:

/*
* nbgen.c
*
* Created on: Mar 22, 2011
* Author: cedesmith
*/

#include <sys/stat.h>
#include <stdlib.h>
#include <stdio.h>
#include <strings.h>
#include <string.h>
#include <stdint.h>

struct NbgPart
{
char* fileName;
int start;
int end;
};
struct NbgData
{
char header[2*0x800];
int noParts;
struct NbgPart parts[16];
};
struct NbgData data;

struct PartEntry {
uint8_t BootInd;
uint8_t FirstHead;
uint8_t FirstSector;
uint8_t FirstTrack;
uint8_t FileSystem;
uint8_t LastHead;
uint8_t LastSector;
uint8_t LastTrack;
uint32_t StartSector;
uint32_t TotalSectors;
};

//#define blocks(x)((x)/0x20000+((x)%0x20000!=0?1:0))
void save(char* file, int nb);
int blocks(size_t bytes);
void PartSetCHS(struct PartEntry* part);

int main(int argc, char* argv[])
{
printf("nbgen v1.0 by cedesmith\n");
if(argc<2){
fprintf(stderr, "	Usage: os.nb|os.payload\n", argv[0]);
return 1;
}

struct stat st;
if(stat("lk.bin", &st)!=0){
fprintf(stderr, "lk.bin not found\n", argv[1]);
return 3;
}
data.parts[0].fileName="lk.bin";
data.parts[0].start=2;
data.parts[0].end=blocks(st.st_size+0x800*2)*64;
data.noParts++;

//make file header
memset(data.header, 0, 0x800);	//fill 1st sector with 00
data.header[0]=0xE9;	//fill signature bytes
data.header[1]=0xFD;
data.header[2]=0xFF;
data.header[512-2]=0x55;
data.header[512-1]=0xAA;
//write partition
struct PartEntry* part = (struct PartEntry*)(data.header+0x1BE);
part->BootInd=0;
part->FileSystem=0x23;
part->StartSector=data.parts[0].start;
part->TotalSectors=data.parts[0].end-data.parts[0].start;

//cardsharing-x:
printf("part->BootInd=%x\n", part->BootInd);
printf("part->FileSystem=%x\n", part->FileSystem);
printf("part->StartSector=%x\n", part->StartSector);
printf("part->TotalSectors=%x\n", part->TotalSectors);

PartSetCHS(part);

//write MSFLASH50
memset(data.header+0x800, 0xFF, 0x800);	//fill 2nd sector with FF
memset(data.header+0x800, 00, 0x64);
strncpy(data.header+0x800, "MSFLSH50", sizeof("MSFLSH50")-1);	//MSFLSH50 signature

//save
int nb=0;
if(strcasecmp(strrchr(argv[1], '.'), ".nb")==0) nb=1;
save(argv[1], nb);
return 0;
}
void PartSetCHS(struct PartEntry* part)
{
uint32_t first=part->StartSector, last=part->StartSector+part->TotalSectors-1;
part->FirstHead=(uint8_t)(first%0x40 & 0xFF);
part->FirstTrack=(uint8_t)(first/0x40 & 0xFF);
part->FirstSector=(uint8_t)(((((first/0x40)>>8)<<6) & 0xFF)+1);
part->LastHead=(uint8_t) (last%0x40 & 0xFF);
part->LastTrack=(uint8_t)(last/0x40 & 0xFF);
part->LastSector=(uint8_t)(((((last/40)>>8)<<6) & 0xFF)+1);

//cardsharing-x:
printf("first head=%02x\n", part->FirstHead);
printf("first track=%02x\n", part->FirstTrack);
printf("first sector=%02x\n", part->FirstSector);
printf("last head=%02x\n", part->LastHead);
printf("last track=%02x\n", part->LastTrack);
printf("last sector=%02x\n", part->LastSector);
}

int blocks(size_t bytes)
{
// 1 physical nand block = 64 sectors = 0x20000 bytes
return bytes/0x20000+(bytes%0x20000!=0 ? 1 : 0);
}
void writetag(uint32_t no, uint32_t tag, FILE* out)
{
fwrite(&no, sizeof(no), 1, out);
fwrite(&tag, sizeof(tag), 1, out);
}
void save(char* file, int nb)
{
FILE* out=fopen(file, "w");
if(out==NULL){
fprintf(stderr, "failed to open %s\n", file);
exit(20);
}
uint32_t sectorNo=0x0, tag=0xFFFBFFFD;

// write file header block
fwrite(data.header, 1, 0x800, out);
if(nb) writetag(sectorNo, tag, out);
sectorNo++;

//write MSFLASH50 block
fwrite(data.header+0x800, 1, 0x800, out);
if(nb) writetag(sectorNo, tag, out);
sectorNo++;

char sector[0x800];
for(int i=0; i<data.noParts; i++){
struct NbgPart* part=&data.parts[i];

//write empty sectors before part
memset(sector, 0xFF, 0x800);
for(int is=sectorNo; is<part->start; is++){
fwrite(sector, 0x800, 1, out);
if(nb) writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
sectorNo++;
}

//write part from file
printf("writing %s\n", part->fileName);
FILE* in=fopen(part->fileName, "r");
if(in==NULL){
fprintf(stderr, "Failed to open %s\n", part->fileName);
exit(21);
}
while(!feof(in)){
int readed=0;
memset(sector, 0xFF, 0x800);
while(!feof(in) && readed<0x800) readed+=fread(sector+readed, 1, 0x800-readed, in);
fwrite(sector, 0x800, 1, out);
if(nb){
tag=0xFFFFFFFF;
for(int ib=0; ib<0x800; ib++)
if(sector[ib]!=0xFF)
tag=(i==0?0xFFFBFFFD:0xFFFBFFFF);
if(tag!=0xFFFFFFFF) writetag(sectorNo, tag, out);
else writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
}
sectorNo++;
}
fclose(in);

//printf("write empty sectors from %d to %d\n", sectorNo, part->end);
//write empty sectors at the end
memset(sector, 0xFF, 0x800);
for(int is=sectorNo; is<part->end; is++){
fwrite(sector, 0x800, 1, out);
if(nb) writetag(0xFFFFFFFF, 0xFFFFFFFF, out);
sectorNo++;
}
} //for(int i=0; i<data.noParts; i++)

fclose(out);
}

But huh huh no way to see my zImage boot (black screen with white text:)) , maybe protection is very good (radio or spl or something other or I am wrong with something, wrong offsets?)

Also lk bootloader is bassed on kernel, so I no want to use lk now, I want first to see my zImage with tinboot, if I see my zImage booting I will try to port lk. I will add asm for mpu but I can not try it and I can not responsible if you brick your device. I will use my phone back to try with nbgen again