Modified from the original script from Armbian 5.67, credits to them.

It seems that u-boot on Phicomm N1 hardcoded 0x27400000 for reading / storing its environment variables, and is overwritten with default values even when it’s invalid (from u-boot’s parser’s perspective).

Previously it looks like to me that everything after 128M on /dev/mmcblk1 may be overwritten, and now it turns out it’s not. Even if the system boots, data in range [0x27400000, 0x27400000 + 0x800000) might get corrupted by u-boot at any time.

The script works around this by marking sectors used by u-boot for environment variables as bad sectors, preventing them from being used by Linux.

Undoubtedly it would be better if I could change the offset in bootloader to somewhere near the begining, but that would be hard as the bootloader seems to be signed with RSA 2048 (“R2048 check pass”):

Load fip header from eMMC, src: 0x0000c200, des: 0x01400000, size: 0x00004000
aml log : R2048 check pass!
New fip structure!
Load bl30 from eMMC, src: 0x00010200, des: 0x01700000, size: 0x0000d600
aml log : R2048 check pass!
Load bl31 from eMMC, src: 0x00020200, des: 0x01700000, size: 0x0002c600
aml log : R2048 check pass!
Load bl33 from eMMC, src: 0x00050200, des: 0x01700000, size: 0x00053400
aml log : R2048 check pass!

Update: This seems not to be the case, as a script here reflashes the u-boot with a seemingly custom one (presumbly compiled by the author?), which I think is not signed by Phicomm. Or Phicomm/Amlogic just published the signature key so that anybody can sign their u-boot binary?

This script is also capable of replacing boot logo (splash) of Phicomm N1. It will write /boot/n1-logo.img to appropriate position on /dev/mmcblk1 and mark those sectors as bad as well, if /boot/n1-logo.img exists. But note that /boot/n1-logo.img may not be greater than 8M, or you will need to modify the script yourself.

As for how to build a customized n1-boot.img, check this.

If you’re interested, I’m using this image as my boot splash. Credits to the creator(s).

The first 100M is used by bootloader and reserved partition. The reserved partition actually contains a (not-used-by-us) partition table, as well as DTB, which is critical for booting the system, and thus cannot be overwritten. (Yes I did tried to overwrite reserved partition, even if I said I was not gonna to do this, and successfully bricked my N1 box.)

#!/bin/sh

echo "Start script create MBR and filesystem"

DEV_EMMC=/dev/mmcblk1

echo "Start backup u-boot default"

dd if="${DEV_EMMC}" of=/boot/u-boot-default.img bs=1M count=4

echo "Start create MBR and partittion"

parted -s "${DEV_EMMC}" mklabel msdos
# `bootloader` / `reserved` occupies [0, 100M).
# Sector size is 512B.
parted -s "${DEV_EMMC}" unit s mkpart primary fat32 204800 466943  # [100M, 228M)
parted -s "${DEV_EMMC}" unit s mkpart primary ext4 466944 100%     # [228M, ...]

echo "Start restore u-boot"

dd if=/boot/u-boot-default.img of="${DEV_EMMC}" conv=fsync bs=1 count=442
dd if=/boot/u-boot-default.img of="${DEV_EMMC}" conv=fsync bs=512 skip=1 seek=1

sync

echo "Done"

echo "Start copy system for eMMC."

mkdir -p /ddbr
chmod 777 /ddbr

PART_BOOT="/dev/mmcblk1p1"
PART_ROOT="/dev/mmcblk1p2"
DIR_INSTALL="/ddbr/install"

if [ -d $DIR_INSTALL ] ; then
    rm -rf $DIR_INSTALL
fi
mkdir -p $DIR_INSTALL

if grep -q $PART_BOOT /proc/mounts ; then
    echo "Unmounting BOOT partiton."
    umount -f $PART_BOOT
fi
echo -n "Formatting BOOT partition..."
mkfs.vfat -n "BOOT_EMMC" $PART_BOOT
echo "done."

mount -o rw $PART_BOOT $DIR_INSTALL

echo -n "Cppying BOOT..."
cp -r /boot/* $DIR_INSTALL && sync
echo "done."

echo -n "Edit init config..."
sed -e "s/ROOTFS/ROOT_EMMC/g" \
 -i "$DIR_INSTALL/uEnv.ini"
echo "done."

rm $DIR_INSTALL/s9*
rm $DIR_INSTALL/aml*
rm -rf $DIR_INSTALL/n1*

umount $DIR_INSTALL

if grep -q $PART_ROOT /proc/mounts ; then
    echo "Unmounting ROOT partiton."
    umount -f $PART_ROOT
fi

if [ -e /boot/n1-logo.img ] ; then
# The logo should be no greater than 8M. (It's less than 5M in my case.)
echo "Installing Ubuntu logo..."
dd if=/boot/n1-logo.img of=/dev/mmcblk1 bs=1M seek=644
echo "done."
fi

echo "Formatting ROOT partition..."
# 0x27400000 ~ +0x800000 is used by `/dev/env`. Mark them as bad blocks
# so that they won't be used by Linux. (It seems that they're overwritten
# each time system boots if invalid.)
#
# As `ROOT_EMMC` starts from 228M, offset of `/dev/env` in this partition
# is 400M.
#
# Here we generates a sequence of block number in range [400M, 408M), with
# block size = 4K, and pass them as bad blocks to `mke2fs`.
#
# Given that we're using 4K blocks, the mapped block number will be [102400,
# 104448), or [102400, 104447].
#
# `/dev/logo` is in range [644M, 772M) (of the whole `/dev/mmcblk1`, not this
# partition. Minus 228M yourself.). Mark them as bad blocks if you want to
# preserve or replace the boot logo.
#
# All other partitions (`recovery`, `rsv`, `tee`, `crypt`, `misc`, `boot`,
# `system`, `data` is already overwritten by the original script, as it
# places the first partition at 700M.)
echo "Marked blocks used by /dev/env as bad to protected them from being overwritten."
seq 102400 104447 > /tmp/reservedblks
if [ -e /boot/n1-logo.img ] ; then
echo "Marked blocks used by /dev/logo as bad."
seq 106496 108543 >> /tmp/reservedblks  # Only first 8M of `/dev/logo` is reserved.
fi
mke2fs -F -q -t ext4 -L ROOT_EMMC -m 0 $PART_ROOT -b 4096 -l /tmp/reservedblks
e2fsck -n $PART_ROOT
echo "done."

echo "Copying ROOTFS."

mount -o rw $PART_ROOT $DIR_INSTALL

cd /
echo "Copy BIN"
tar -cf - bin | (cd $DIR_INSTALL; tar -xpf -)
#echo "Copy BOOT"
#mkdir -p $DIR_INSTALL/boot
#tar -cf - boot | (cd $DIR_INSTALL; tar -xpf -)
echo "Create DEV"
mkdir -p $DIR_INSTALL/dev
#tar -cf - dev | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy ETC"
tar -cf - etc | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy HOME"
tar -cf - home | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy LIB"
tar -cf - lib | (cd $DIR_INSTALL; tar -xpf -)
echo "Create MEDIA"
mkdir -p $DIR_INSTALL/media
#tar -cf - media | (cd $DIR_INSTALL; tar -xpf -)
echo "Create MNT"
mkdir -p $DIR_INSTALL/mnt
#tar -cf - mnt | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy OPT"
tar -cf - opt | (cd $DIR_INSTALL; tar -xpf -)
echo "Create PROC"
mkdir -p $DIR_INSTALL/proc
echo "Copy ROOT"
tar -cf - root | (cd $DIR_INSTALL; tar -xpf -)
echo "Create RUN"
mkdir -p $DIR_INSTALL/run
echo "Copy SBIN"
tar -cf - sbin | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy SELINUX"
tar -cf - selinux | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy SRV"
tar -cf - srv | (cd $DIR_INSTALL; tar -xpf -)
echo "Create SYS"
mkdir -p $DIR_INSTALL/sys
echo "Create TMP"
mkdir -p $DIR_INSTALL/tmp
echo "Copy USR"
tar -cf - usr | (cd $DIR_INSTALL; tar -xpf -)
echo "Copy VAR"
tar -cf - var | (cd $DIR_INSTALL; tar -xpf -)

echo "Copy fstab"

rm $DIR_INSTALL/etc/fstab
cp -a /root/fstab $DIR_INSTALL/etc/fstab

rm $DIR_INSTALL/root/install.sh
rm $DIR_INSTALL/root/fstab
rm $DIR_INSTALL/usr/bin/ddbr
rm $DIR_INSTALL/usr/bin/ddbr_backup_nand
rm $DIR_INSTALL/usr/bin/ddbr_backup_nand_full
rm $DIR_INSTALL/usr/bin/ddbr_restore_nand


cd /
sync

umount $DIR_INSTALL

echo "*******************************************"
echo "Complete copy OS to eMMC "
echo "*******************************************"