What is it?

Meson HDMI Recovery Boot Plug

Why did you make it?

For selecting a recovery boot target of an Amlogic SoC. By default requesting USB boot, on request can be switched to SDCard or SPI.

What makes it special?

The amlogic BootROM reads 8bytes at the EEPROM address 0x52, offset 0xf8 (248). If the 8bytes content is boot@USB it will request USB boot mode. You should be able to request SDCard with boot@SDC.

NB: this is not a "hack", but a hidden feature of the Boot ROM used to recover a broken board when the eMMC is corrupted. For example, it can recover a Khadas VIM1 with corrupted eMMC, Libre Computer La Frite with corrupted SPI NOR, or any corrupted Amlogic based Android Set-top-boxes without having to physically hack the board by shorting some tiny pins. The feature is partially documented in the various SoCs datasheets, like https://dl.khadas.com/Hardware/VIM2/Datasheet/S912_Datasheet_V0.220170314publicversion-Wesion.pdf page 57, described as "Read Recovery Signal from HDMI i2c port".

NB2: If the Set-top-box has been protected, forcing USB or SDCard boot won't work since the BootROM will require a password to boot an unsigned binary.