Sorry, I haven't checked the thread in a while. Honestly, I'm not sure if the nand would be of any help. It seemed like someone had maybe attempted a firmware update that failed or something before I got it. I couldn't get it to boot up. If you are interested in it though, I could probably send it to you if you're in the US.
Because of the behavior of the bootloader -- even
bootm start performs the whole boot process on its own -- it's likely a u-boot replacement will be necessary.
That is, unless we can use the "
bidio" to tell U-boot how to perform the boot process. Perhaps the addresses of the kernel, dtb and rootfs are defined there somehow? It's very clear that
bidio is parsed, because its values determine whether or not u-boot interacts with the secondary serial console.
I will send out a letter to Hewlett Packard this week and see if they respond to snail-mail requests for GPL sources for their U-boot. I'll also look closer at the
bidio file to see whether it contains any sort of encoding of the address scheme ...
Because I saw them, and because they were too well-priced to avoid, I purchased 7 of these: https://fccid.io/RTP-MRLBB1003S
So far as I can tell (I haven't received them yet) they are very similar to the prototype described above, but probably without GPS. We'll find out.