Unable to use ceemmc

After updating my VIM3 to 9.2.1, it no longer boots. Screen stays blank and no network connectivity either.
Wrote 9.2.1 to an SD and booted from that. This is how it looks:

Unfortunately the ceemmc tool doesn’t seem to work:

CoreELEC:~ # ceemmc

Starting CoreELEC eMMC installation tool v0.1...

eMMC size: 0x000747c00000 [32GB]
Error opening file for reading '/dev/reserved'!
Failed to read original partition table!

I’m probably doing something wrong but to be honest the ceemmc help text is not very clear. How do I tell it what function to use? I tried running it without any arguments hoping it would ask me what to do, or ceemmc 1, but I keep getting the same error as above.

Attached an USB2TTL, here is the output:

G12B:BL:6e7c85:2a3b91;FEAT:E0F83180:402000;POC:F;RCY:0;EMMC:0;READ:0;0.
bl2_stage_init 0x01
bl2_stage_init 0x81
hw id: 0x0000 - pwm id 0x01
bl2_stage_init 0xc1
bl2_stage_init 0x02

L0:00000000
L1:20000703
L2:00008067
L3:14000000
B2:00402000
B1:e0f83180

TE: 163199

BL2 Built : 19:22:01, Jul 31 2019. g12b ge9a9000 - zhiguang.ouyang@droid07-sz

Board ID = 8
Set A53 clk to 24M
Set A73 clk to 24M
Set clk81 to 24M
A53 clk: 1200 MHz
A73 clk: 1200 MHz
CLK81: 166.6M
smccc: 0002c769
eMMC boot @ 0
sw8 s
DDR driver_vesion: LPDDR4_PHY_V_0_1_18 build time: Jul 31 2019 19:21:56
board id: 8
Load FIP HDR from eMMC, src: 0x00010200, des: 0xfffd0000, size: 0x00004000, part: 0
fw parse done
Load ddrfw from eMMC, src: 0x00060200, des: 0xfffd0000, size: 0x0000c000, part: 0
Load ddrfw from eMMC, src: 0x00038200, des: 0xfffd0000, size: 0x00004000, part: 0
PIEI prepare done
fastboot data load
00000000
emmc switch 1 ok
ddr saved addr:00016000
Load ddr parameter from eMMC, src: 0x02c00000, des: 0xfffd0000, size: 0x00001000, part: 0
00000000
emmc switch 0 ok
fastboot data verify
verify result: 267
Cfg max: 4, cur: 1. Board id: 255. Force loop cfg
LPDDR4 probe
ddr clk to 1608MHz
Load ddrfw from eMMC, src: 0x0003c200, des: 0xfffd0000, size: 0x0000c000, part: 0

dmc_version 0001
Check phy result
INFO : End of CA training
INFO : End of initialization
INFO : Training has run successfully!
Check phy result
INFO : End of initialization
INFO : End of read enable training
INFO : End of fine write leveling
INFO : End of Write leveling coarse delay
INFO : Training has run successfully!
Check phy result
INFO : End of initialization
INFO : End of read dq deskew training
INFO : End of MPR read delay center optimization
INFO : End of write delay center optimization
INFO : End of read delay center optimization
INFO : End of max read latency training
INFO : Training has run successfully!
1D training succeed
Load ddrfw from eMMC, src: 0x00048200, des: 0xfffd0000, size: 0x0000c000, part: 0
Check phy result
INFO : End of initialization
INFO : End of 2D read delay Voltage center optimization
INFO : End of 2D read delay Voltage center optimization
INFO : End of 2D write delay Voltage center optimization
INFO : End of 2D write delay Voltage center optimization
INFO : Training has run successfully!

channel==0
RxClkDly_Margin_A0==87 ps 9
TxDqDly_Margin_A0==106 ps 11
RxClkDly_Margin_A1==97 ps 10
TxDqDly_Margin_A1==106 ps 11
TrainedVREFDQ_A0==26
TrainedVREFDQ_A1==26
VrefDac_Margin_A0==28
DeviceVref_Margin_A0==26
VrefDac_Margin_A1==28
DeviceVref_Margin_A1==26


channel==1
RxClkDly_Margin_A0==87 ps 9
TxDqDly_Margin_A0==106 ps 11
RxClkDly_Margin_A1==87 ps 9
TxDqDly_Margin_A1==106 ps 11
TrainedVREFDQ_A0==26
TrainedVREFDQ_A1==24
VrefDac_Margin_A0==27
DeviceVref_Margin_A0==25
VrefDac_Margin_A1==29
DeviceVref_Margin_A1==24

 dwc_ddrphy_apb_wr((0<<20)|(2<<16)|(0<<12)|(0xb0):0004 

soc_vref_reg_value 0x 00000027 00000026 00000026 00000027 00000025 00000025 00000026 00000027 00000028 00000026 00000024 00000027 00000025 00000027 00000026 00000026 00000026 00000028 00000027 00000025 00000026 00000026 00000026 00000025 00000029 00000027 00000027 00000029 00000027 00000025 00000025 00000026 dram_vref_reg_value 0x 00000013
2D training succeed
aml_ddr_fw_vesion: LPDDR4_PHY_V_0_1_18 build time: Jul 31 2019 19:22:05
auto size-- 65535DDR cs0 size: 2048MB
DDR cs1 size: 2048MB
DMC_DDR_CTRL: 00e00024DDR size: 3928MB
cs0 DataBus test pass
cs1 DataBus test pass
cs0 AddrBus test pass
cs1 AddrBus test pass

100bdlr_step_size ps== 457
result report
boot times 0Enable ddr reg access
00000000
emmc switch 3 ok
Authentication key not yet programmed
get rpmb counter error 0x00000007
00000000
emmc switch 0 ok
Load FIP HDR from eMMC, src: 0x00010200, des: 0x01700000, size: 0x00004000, part: 0
Load BL3X from eMMC, src: 0x00078200, des: 0x01768000, size: 0x000c3e00, part: 0
0.0;M3 CHK:0;cm4_sp_mode 0
MVN_1=0x00000000
MVN_2=0x00000000
[Image: g12b_v1.1.3389-92241b5 2019-07-02 17:23:01 luan.yuan@droid15-sz]
OPS=0x10
ring efuse init
chipver efuse init
29 0b 10 00 01 09 0a 00 00 02 37 30 4e 42 4e 50 
[0.018960 Inits done]
secure task start!
high task start!
low task start!
run into bl31
NOTICE:  BL31: v1.3(release):4fc40b1
NOTICE:  BL31: Built : 15:58:17, May 22 2019
NOTICE:  BL31: G12A normal boot!
NOTICE:  BL31: BL33 decompress pass
ERROR:   Error initializing runtime service opteed_fast


U-Boot 2015.01 (Sep 01 2019 - 02:17:27)

DRAM:  3.8 GiB
Relocation Offset is: d6e5b000
spi_post_bind(spifc): req_seq = 0
register usb cfg[0][1] = 00000000d7f3c640
aml_i2c_init_port init regs for 0
MMC:   aml_priv->desc_buf = 0x00000000d3e4ba70
aml_priv->desc_buf = 0x00000000d3e4ddb0
SDIO Port B: 0, SDIO Port C: 1
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x3, tx-dly 0, clock 400000
emmc/sd response timeout, cmd8, status=0x3ff2800
emmc/sd response timeout, cmd55, status=0x3ff2800
co-phase 0x3, tx-dly 0, clock 400000
co-phase 0x1, tx-dly 0, clock 40000000
aml_sd_retry_refix[983]:delay = 0x0,gadjust =0x2000
[mmc_startup] mmc refix success
init_part() 282: PART_TYPE_DOS
[mmc_init] mmc init success
start dts,buffer=00000000d3e50620,dt_addr=00000000d3e50620
check_valid_dts: FDT_ERR_BADMAGIC
get_partition_from_dts() 91: ret -9
get_partition_from_dts() 94: ret -9
get_ptbl_from_dtb()-272: get partition table from dts faild
mmc_device_init()-1254: get partition table from dtb failed
get_ptbl_rsv()-494: magic faild MPT, �%\
mmc_device_init()-1281: dtb&rsv are not exist, no LPT source
get partition info failed !!
Using default environment

In:    serial
Out:   serial
Err:   serial
reboot_mode=cold_boot
[store]To run cmd[emmc dtb_read 0x1000000 0x40000]
_verify_dtb_checksum()-3406: calc 4337a102, store 785c07cf
update_dtb_info()-3514: cpy 1 is not valid
_verify_dtb_checksum()-3406: calc 28a2da70, store 35cd240f
update_dtb_info()-3514: cpy 0 is not valid
dtb_read()-3623: total valid 0
emmc - EMMC sub system

Usage:
emmc dtb_read addr size
emmc dtb_write addr size
emmc erase dtb
emmc erase key
emmc fastboot_read addr size
emmc fastboot_write addr size

aml_i2c_init_port init regs for 0
fusb302_init: Device ID: 0x91
CC connected in 0 as UFP
fusb302 detect chip.port_num = 0
[KM]Error:f[keymanage_dts_parse]L307:not a fdt at 0x0000000001000000
vpu: error: vpu: check dts: FDT_ERR_BADMAGIC, load default parameters
vpu: clk_level = 7
vpu: vpu_power_on
vpu: set clk: 666667000Hz, readback: 666666667Hz(0x100)
vpu: vpu_module_init_config
vpp: vpp_init
vpp: g12a/b osd1 matrix rgb2yuv ..............
vpp: g12a/b osd2 matrix rgb2yuv..............
vpp: g12a/b osd3 matrix rgb2yuv..............
cvbs: cpuid:0x29
LCD_RESET PIN: 0
lcd: error: check dts: FDT_ERR_BADMAGIC, load default lcd parameters
lcd: detect mode: tablet, key_valid: 0
lcd: load config from bsp
lcd: use panel_type=lcd_0
lcd: bl: name: lcd_0, method: 1
lcd: bl: aml_bl_power_ctrl: 0
Net:   dwmac.ff3f0000[KM]Error:f[keymanage_dts_parse]L307:not a fdt at 0x0000000001000000
MACADDR:02:00:00:0a:09:01(from chipid)

upgrade_step=0
reboot_mode:::: cold_boot
[KM]Error:f[keymanage_dts_parse]L307:not a fdt at 0x0000000001000000
lcd: error: outputmode[1080p60hz] is not support
hpd_state=0
edid preferred_mode is <NULL>[0]
hdr mode is 0
dv  mode is ver:0  len: 0
hdr10+ mode is 0
[OSD]check dts: FDT_ERR_BADMAGIC, load default fb_addr parameters
[OSD]set initrd_high: 0x3d800000
[OSD]fb_addr for logo: 0x3d800000
[OSD]check dts: FDT_ERR_BADMAGIC, load default fb_addr parameters
[OSD]fb_addr for logo: 0x3d800000
[OSD]VPP_OFIFO_SIZE:0xfff01fff
[CANVAS]canvas init
[CANVAS]addr=0x3d800000 width=3840, height=2160
Cannot find dev.
amlmmc cmd <NULL> failed 

store - STORE sub-system

Usage:
store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data: 
        erase the area which is uboot or data 
store erase partition <partition_name>: 
        erase the area which partition in u-boot 
store erase dtb 
store erase key 
store disprotect key 
store rom_protect on/off 
store scrub off|partition size
        scrub the area from offset and size 
store dtb iread/read/write addr <size>
        read/write dtb, size is optional 
store key read/write addr <size>
        read/write key, size is optional 
store ddr_parameter read/write addr <size>
        read/write ddr parameter, size is optional 
store mbr addr
   update mbr/partition table by dtb

[burnup]Err:store_read_ops,L84:cmd failed, ret=1, [store  read logo 0x1080000  0x0  0x2000]
Err imgread(L537):Fail to read 0x2000B from part[logo] at offset 0
There is no valid bmp file at the given address
[OSD]osd_hw.free_dst_data: 0,767,0,1023
[OSD]osd1_update_disp_freescale_enable
cvbs: outputmode[panel] is invalid
hdmitx: outputmode[panel] is invalid
vpp: vpp_matrix_update: 0
vpp: g12a/b post2(bit12) matrix: YUV limit -> RGB ..............
lcd: enable: lcd_0, mipi, 768x1024@60.0Hz
lcd: tablet driver init(ver 20180718): mipi
lcd: lcd_pll_wait_lock: pll_lock=1, wait_loop=1
vpp: vpp_init_lcd_gamma_table
lcd: pixel_clk = 64.843MHz, bit_rate = 518.744MHz, lanebyteclk = 64.843MHz
lcd:  Waiting STOP STATE LANE
lcd: dsi init on
lcd: bl: set level: 100, last level: 0
lcd: bl: aml_bl_power_ctrl: 1
lcd: clear mute
vpp: sdr_mode = 2
vpp: Rx hdr_info.hdr_sup_eotf_smpte_st_2084 = 0
[KM]Error:f[keymanage_dts_parse]L307:not a fdt at 0x0000000001000000
gpio: pin GPIOAO_7 (gpio 7) value is 1
saradc: 0x289, hw_ver: 0x32 (VIM3.V12)
Product checking: pass! Hardware version: VIM3.V12
reboot_mode=cold_boot
** Invalid partition 5 **
normal power on
boot wol: disable
libfdt fdt_check_header(): FDT_ERR_BADMAGIC
port mode is usb3.0
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
No FDT memory address configured. Please configure
the FDT address via "fdt addr <address>" command.
Aborting!
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
pll tsensor avg: 0x1ecb, u_efuse: 0x801d
temp1: 29
ddr tsensor avg: 0x1f0b, u_efuse: 0x8066
temp2: 30
device cool done
cfgload: start ...
cfgload: reading /boot.ini from mmc 0:1 ...
card out
** Bad device mmc 0 **
cfgload: no /boot.ini or empty file on mmc 0:1
cfgload: reading /boot.ini from mmc 1:1 ...
reading /boot.ini
1515 bytes read in 2 ms (739.3 KiB/s)
cfgload: applying boot.ini...
[#] Script a:d3e6bb20 l:1495 c:0 s:0 - run
reading config.ini
4800 bytes read in 3 ms (1.5 MiB/s)
reading kernel.img
emmckey_is_access_range_legal, keys 73760, keye 74271, start 73524, blkcnt 24664
Emmckey: Access range is illegal!
Error reading cluster
** Unable to read file kernel.img **
reading dtb.img
87387 bytes read in 4 ms (20.8 MiB/s)
Bad Linux ARM64 Image magic!
CONFIG_AVB2:  
avb2: 0
ee_gate_off ...
avb2: 0
Wrong Image Format for bootm command
ERROR: can't get kernel image!
ERROR: booting os 'Invalid OS' (0) is not supported
ee_gate_on ...
card out
** Bad device mmc 0 **
reading s905_autoscript
** Unable to read file s905_autoscript **
** Invalid partition 5 **
** Invalid partition 5 **
** Invalid partition 5 **
** Invalid partition 5 **
Bad Linux ARM64 Image magic!
InUsbBurn
noSof
sof timeout, reset usb phy tuning
card out
[MSG]mmcinfo failed!
card out
(Re)start USB...
USB0:   USB3.0 XHCI init start
Register 3000140 NbrPorts 2
Starting the controller
USB XHCI 1.10
scanning bus 0 for devices... 2 USB Device(s) found
       scanning usb for storage devices... 0 Storage Device(s) found
** Bad device usb 0 **
** Bad device usb 0 **
Start read misc partition datas!
Cannot find dev.
amlmmc cmd <NULL> failed 

store - STORE sub-system

Usage:
store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data: 
        erase the area which is uboot or data 
store erase partition <partition_name>: 
        erase the area which partition in u-boot 
store erase dtb 
store erase key 
store disprotect key 
store rom_protect on/off 
store scrub off|partition size
        scrub the area from offset and size 
store dtb iread/read/write addr <size>
        read/write dtb, size is optional 
store key read/write addr <size>
        read/write key, size is optional 
store ddr_parameter read/write addr <size>
        read/write ddr parameter, size is optional 
store mbr addr
   update mbr/partition table by dtb

[burnup]Err:store_read_ops,L84:cmd failed, ret=1, [store  read misc 0xd3e49c70  0x0  0x820]
failed to store read misc.
info->magic = 
info->version_major = 0
info->version_minor = 0
info->slots[0].priority = 0
info->slots[0].tries_remaining = 0
info->slots[0].successful_boot = 0
info->slots[1].priority = 0
info->slots[1].tries_remaining = 0
info->slots[1].successful_boot = 0
info->crc32 = 0
Magic  is incorrect.
boot-info is invalid. Resetting.
save boot-info 
info->magic = 
info->version_major = 1
info->version_minor = 0
info->slots[0].priority = 15
info->slots[0].tries_remaining = 7
info->slots[0].successful_boot = 0
info->slots[1].priority = 14
info->slots[1].tries_remaining = 7
info->slots[1].successful_boot = 0
info->crc32 = -1075449479
Cannot find dev.
amlmmc cmd <NULL> failed 

store - STORE sub-system

Usage:
store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data:
        erase the area which is uboot or data
store erase partition <partition_name>:
        erase the area which partition in u-boot
store erase dtb
store erase key
store disprotect key
store rom_protect on/off
store scrub off|partition size
        scrub the area from offset and size
store dtb iread/read/write addr <size>
        read/write dtb, size is optional
store key read/write addr <size>
        read/write key, size is optional
store ddr_parameter read/write addr <size>
        read/write ddr parameter, size is optional
store mbr addr
   update mbr/partition table by dtb

[burnup]Err:store_write_ops,L148:cmd [store  write misc 0xd3e49c70  0x0  0x820] failed active slot = 0
active_slot: normal
Cannot find dev.
amlmmc cmd <NULL> failed

store - STORE sub-system

Usage:
store init flag
store read name addr off|partition size
    read 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store write name addr off|partition size
    write 'size' bytes starting at offset 'off'
    to/from memory address 'addr', skipping bad blocks.
store rom_write add off size.
        write uboot to the boot device
store erase boot/data:
        erase the area which is uboot or data
store erase partition <partition_name>:
        erase the area which partition in u-boot
store erase dtb
store erase key
store disprotect key
store rom_protect on/off
store scrub off|partition size
        scrub the area from offset and size
store dtb iread/read/write addr <size>
        read/write dtb, size is optional
store key read/write addr <size>
        read/write key, size is optional
store ddr_parameter read/write addr <size>
        read/write ddr parameter, size is optional
store mbr addr
   update mbr/partition table by dtb

[burnup]Err:store_read_ops,L84:cmd failed, ret=1, [store  read recovery 0x11000000  0x0  0x100000]
Err imgread(L328):Fail to read 0x100000B from part[recovery] at offset 0
kvim3#

Please advise.

What OS do you have installed on your eMMC currently?

I had CoreELEC 9.2.0 on the eMMC. Started the update from Kodi by answering “yes” on the update popup.

I’m not sure why your VIM3 didn’t boot after updating, the VIM3 is one of the main devices that we use for testing updates.

You need to reflash Android to your eMMC and then you can run ceemmc again and your colour issue should also resolve itself.

After booting from the SD, it mounts the filesystems on the eMMC:

/dev/mmcblk0p1 on /var/media/COREELEC type vfat (rw,nosuid,nodev,noexec,noatime,fmask=0133,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)
/dev/mmcblk0p2 on /var/media/STORAGE type ext4 (rw,nosuid,nodev,noexec,noatime,data=ordered)

What I don’t get is why u-boot is complaining the kernel.img or dtb.img are invalid. They have the same checksums as the files on the SD:

CoreELEC:~ # sha512sum /flash/kernel.img /var/media/COREELEC/kernel.img
b404c136022f923a9759315acbfdc34785ad93b930bdc3b42e41b86d8e0030f49aad111aeaa434450ccf986af0ebdf76487a818f4c08a4beefc74de02280cf6e  /flash/kernel.img
b404c136022f923a9759315acbfdc34785ad93b930bdc3b42e41b86d8e0030f49aad111aeaa434450ccf986af0ebdf76487a818f4c08a4beefc74de02280cf6e  /var/media/COREELEC/kernel.img
CoreELEC:~ # sha512sum /flash/device_trees/g12b_a311d_khadas_vim3.dtb /var/media
/COREELEC/dtb.img
1740aacb1ce7beea3e44386331ba5cdb77ddac0e63e06f87ce149a8bdae859e07df6ebcc49abbb402d5b3e73fe50aa3a597ca015a89d8002d1cde12988420000  /flash/device_trees/g12b_a311d_khadas_vim3.dtb
1740aacb1ce7beea3e44386331ba5cdb77ddac0e63e06f87ce149a8bdae859e07df6ebcc49abbb402d5b3e73fe50aa3a597ca015a89d8002d1cde12988420000  /var/media/COREELEC/dtb.img

After reinstalling Android on the eMMC, I am unable to boot the 9.2.1 nor the 9.2.0 image from the SD card. It is stuck on the Khadas logo.

On the serial console, nothing seems to happen after:

Starting kernel ...

uboot time: 5889137 us
[    0.000000@0] Booting Linux on physical CPU 0x0
[    0.000000@0] Linux version 4.9.190 (adamg@zulu) (gcc version 8.3.0 (GNU Toolchain for the A-profile Architecture 8.3-2019.03 (arm-rel-8.36)) ) #1 SMP PREEMPT Sun Sep 15 17:53:52 BST 2019
[    0.000000@0] Boot CPU: AArch64 Processor [410fd034]
[    0.000000@0] Machine model: Khadas
[    0.000000@0] earlycon: aml-uart0 at MMIO 0x00000000ff803000 (options '')
[    0.000000@0] bootconsole [aml-uart0] enabled
bl31 reboot reason: 0x0
bl31 reboot reason: 0x0

You have to recover your VIM3 with Burncardmaker or USB burning tool.
You have a “old” bootloader on the device and the eMMC needs to be reset to default.
Like the log is showing the bootloader does not work properly. Be sure to enable erase flash in the Burncardmaker tool.

I used the USB burning tool to reinstall Android. It appeared to work fine:

Rebooting the board ........[OK]
Unpacking image [OK]
Initializing ddr ........[OK]
Running u-boot ........[OK]
Create partitions [OK]
Writing device tree [OK]
Writing bootloader [OK]
Wiping  data partition [OK]
Wiping  cache partition [OK]
Writing boot partition [OK]
Writing dtbo partition [OK]
Writing logo partition [OK]
Writing odm partition [OK]
Writing product partition [OK]
Writing recovery partition [OK]
Writing system partition [OK]
Writing vbmeta partition [OK]
Writing vendor partition [OK]
Resetting board [OK]

I tried restoring all of the Android images for VIM3 available here, but I have the same problem with all of them. CoreELEC does not boot from the SD, it gets stuck the same way as in this post.

I would appreciate any other suggestions, as my VIM3 is now basically a brick.

I think within tool instruction there should be mentioned, what eMMC content should be used for ceemmc tool, as this is need to correct one. For VIM3L for example, HTPC is shipped with kinda CE on eMMC (what could also differ in time, when CE will have newer versions than Khadas bundle), and not sure what Android image is bundled with bare board.

It should work from sd card for all Android versions

  1. Try both methods reboot update from Android and reset button method for first installation.
  2. Confirm that you use correct dtb and it was renamed to dtb.img
  3. Try different SD or usb card.
1 Like

You need to use the latest Windows version, older versions will not work on the latest SoC’s.

https://dl.khadas.com/Tools/USB_Burning_Tool_v2.1.7.3_zh.zip

I don’t have Windows …

Apparently this was the reason I could no longer boot from the SD card. Thanks!
The reason I did not think of this, is that yesterday, after the 9.2.1 update broke the installation on my eMMC, I could boot 9.2.1 from the SD without copying the correct dtb to dtb.img.