Yes @Nick A. Tried that also. Copilot mentioned this to me: 🟦 If you want to keep fighting this board… I can help you explore: - FEL mode flashing - Using the vendor Android recovery to write eMMC - Dumping the vendor kernel and trying to boot it - Porting the vendor MMC driver (very advanced) But I want to be honest with you: none of these paths are easy, and none guarantee success. Now, I asked it to elaborate on the idea: Let’s unpack this in a way that actually makes sense, Brow — because FEL sounds simple (“just plug in USB and flash it”), but on H618 TV boxes it becomes a whole different beast. I’ll keep it clean, structured, and honest. --- 🟦 Why FEL mode sounds easy On paper, FEL is Allwinner’s built‑in USB recovery mode: - You connect the box to a PC - Press a button or short two pads - The SoC enters FEL - You use sunxi-fel to upload U‑Boot or write eMMC In theory, it’s the “ultimate backdoor” for fixing a broken board. --- 🟥 Why FEL is complicated on your specific device Your Transpeed 8K618‑T is not a dev board. It’s a mass‑produced TV box with: - No FEL button - No exposed pads - No documentation - No schematic - No guarantee the USB port even supports FEL - Vendor boot ROM sometimes disables FEL - USB port may be wired through a hub or switch - Some boxes require opening the case and shorting tiny test pads - Some require holding reset while powering - Some require UART strap pins - Some require a special cable - Some simply do not support FEL at all So the first complication is: You don’t know how to enter FEL on this board. --- 🟥 Second complication: FEL only gives you RAM access FEL lets you: - Upload a U‑Boot binary into RAM - Execute it - Use that U‑Boot to access eMMC But here’s the catch: You must provide a U‑Boot binary that supports your hardware. Mainline U‑Boot does not support: - Your weird SD wiring - Your PMIC - Your DRAM timing - Your eMMC layout - Your HDMI - Your regulators Vendor U‑Boot does, but: - You don’t have the vendor U‑Boot binary - You don’t have the vendor DRAM init code - You don’t have the vendor MMC driver - You don’t have the vendor DTB So even if FEL works, you still need a working U‑Boot image to upload — and we don’t have one. --- 🟥 Third complication: writing eMMC through FEL is slow and fragile Even if you get FEL working and even if you get a working U‑Boot: - Writing eMMC over FEL is extremely slow - If the connection drops, you brick the device - You must manually partition eMMC - You must manually install boot0, boot1, U‑Boot, DTB, rootfs - You must manually fix extlinux.conf - You must manually fix environment variables This is not like flashing a Raspberry Pi. It’s more like doing open‑heart surgery with a butter knife. --- 🟥 Fourth complication: your board’s MMC subsystem is already unstable We’ve already seen: - SD card hangs - MMC controller wedges - Linux freezes on /dev/mmcblk* - Armbian initramfs fails - MiniArch freezes - Vendor kernel is the only thing that works If the MMC hardware is unstable under Linux, it may also be unstable under FEL‑booted U‑Boot. Meaning: Even if FEL works, you might not be able to write eMMC reliably. --- 🟦 So why did I say FEL is complicated? Because on a proper Allwinner dev board, FEL is easy. But on a cheap TV box with undocumented wiring, FEL becomes a puzzle with these problems: | Problem | Why it matters | |--------|----------------| | No FEL button | You don’t know how to enter FEL | | Unknown test pads | You may need to open the board | | Vendor may disable FEL | Some boxes block FEL in BOOT0 | | USB wiring unknown | FEL may not work on the exposed port | | Need vendor U‑Boot | Mainline U‑Boot won’t boot your hardware | | Need vendor DRAM init | Otherwise RAM won’t initialize | | Need vendor MMC driver | Otherwise eMMC won’t be writable | | MMC hardware unstable | Even FEL‑booted U‑Boot may hang | This is why FEL is not a magic fix here. --- 🟩 Could we try FEL anyway? Yes — if you want, I can guide you through: - Checking if FEL is available - Finding the FEL pads - Using sunxi-fel - Dumping BOOT0 - Dumping vendor U‑Boot - Rebuilding a hybrid U‑Boot - Flashing eMMC manually But I want you to understand the reality: It’s a research project, not a guaranteed solution. --- 🟦 If you want to try FEL, I can walk you through step 1 right now Step 1 is simple: Connect the box to your PC via USB‑A to USB‑A cable, then power it on. On your PC, run: ` sunxi-fel version ` If it prints something → FEL works. If it says “no device found” → we need to try hardware tricks. Just tell me if you want to go down this path.

Perhaps you need to set the UART baud rate to 115200bps. Original stock firmware and binaries uses 1.5Mbps, armbian bootloader is set to 115200bps for broader compatibility. You should at least get the ddr initialization messages, there are no chances you get no uart output with armbian unless the image is invalid itself.

@Harleyyyu, I tried swapping uboot and trust offsets as you suggested. I performed a full erase, injected the parameter, and flashed them at 0x2000 (Trust) and 0x4000 (U-Boot). Here is the log of the process: ./rkdeveloptool ld DevNo=1 Vid=0x2207,Pid=0x320b,LocationID=101 Maskrom ./rkdeveloptool db rk322x_loader_v1.10.238_256.bin Downloading bootloader succeeded. ./rkdeveloptool ef Erasing flash complete. ./rkdeveloptool rfi Flash Info: Manufacturer: SAMSUNG, value=00 Flash Size: 7216 MB Flash Size: 14778368 Sectors Block Size: 512 KB Page Size: 2 KB ECC Bits: 0 Access Time: 40 Flash CS: Flash<0> ./rkdeveloptool ul rk322x_loader_v1.10.238_256.bin Upgrading loader succeeded. ./rkdeveloptool prm parameter.txt Writing parameter succeeded. ./rkdeveloptool ppt **********Partition Info(parameter)********** NO LBA Name 00 00002000 uboot 01 00004000 trust 02 0000A800 resource 03 00012000 kernel 04 00018000 boot 05 00028000 system ./rkdeveloptool wl 0x2000 BBtrust_with_ta_ga4fd2d1.img Write LBA from file (100%) ./rkdeveloptool wl 0x4000 AAuboot_extraido.img Write LBA from file (100%) ./rkdeveloptool wl 0xA800 CCresources-linux.img Write LBA from file (100%) ./rkdeveloptool wl 0x12000 DDkernel.img Write LBA from file (100%) ./rkdeveloptool wl 0x18000 EEboot.img Write LBA from file (100%) ./rkdeveloptool wl 0x28000 FFparticao_linux.ext4 Write LBA from file (100%) ./rkdeveloptool rd Reset Device OK. Resulting Boot Log (Swapped Offsets): Still fails with the signature error. Interestingly, at addr:0x2000, the header now reads 0x4d524150 (ASCII for "PARM"), meaning the Bootrom is seeing the parameter/GPT signature where it expected a loader component. DDR Version V1.10 20190926 In ID:0xFFF 300MHz LPDDR3 Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=32 Size=1024MB mach:4 OUT Boot1 Release Time: May 13 2019 17:02:59, version: 2.56 ChipType = 0xc, 421 mmc2:cmd19,100 SdmmcInit=2 0 BootCapSize=2000 UserCapSize=7216MB FwPartOffset=2000 , 2000 SdmmcInit=0 NOT PRESENT StorageInit ok = 163350 SecureMode = 0 SecureInit ret = 0, SecureMode = 0 atags_set_bootdev: ret:(0) GPT 0x63337df8 signature is wrong recovery gpt... GPT 0x63337df8 signature is wrong recovery gpt fail! tag:LOADER error,addr:0x2000 hdr 633377e0 + 0x0:0x4d524150,0x000002f8,0x4d524946,0x45524157, tag:LOADER error,addr:0x4000 hdr 633377e0 + 0x0:0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,57, tag:LOADER error,addr:0x4800 hdr 633377e0 + 0x0:0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00x00000000,0x00000000,0x00000000,0x00000000, tag:LOADER error,addr:0x6000 hdr 633377e0 + 0x0:0x00,0x00,0x00,0x00,0x00,ag:LOADER error,addr:0x5800 hdr 633377e0 + 0x0:0x00000000,0x00000000,0x00000000,0x00000000, tag:LOADER error,addr:0x780000000,0x00000000,0x00000000,0x00000000, tag:TOS error,addr:0x6800 hdr 633377e0 + 0x0:0x00,0x00,0x00,0x00,0x00,0x0TOS error,addr:0x6000 hdr 633377e0 + 0x0:0x00000000,0x00000000,0x00000000,0x00000000, tag:TOS error,addr:0x8000 0000,0x00000000,0x00000000,0x00000000, tag:TOS error,addr:0x9000 hdr 633377e0 + 0x0:0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, UsbHook ...251116 powerOn 772192 @jock, the flash chip is definitely healthy as it was working perfectly with the stock Android firmware yesterday. I am following the guides strictly and initializing with the db command every time. To give you a clear reference, here is what happens when I follow your "Installation without SD card" (flashing the raw image to eMMC) after a full ef (erase flash): ./rkdeveloptool ld DevNo=1 Vid=0x2207,Pid=0x320b,LocationID=101 Maskrom ./rkdeveloptool rd 3 Reset Device failed! ./rkdeveloptool db rk322x_loader_v1.10.238_256.bin Downloading bootloader succeeded. ./rkdeveloptool ef Erasing flash complete. ./rkdeveloptool wl 0x0 Armbian_community_26.2.0-trunk.357_Rk322x-box_forky_current_6.18.7_minimal.img Write LBA from file (100%) Result: Absolute silence. No LED, no UART output. Finally, if I try to boot Multitool from the SD Card after zeroing the internal flash, I get the specific Trust OS freeze I mentioned before. The serial output confirms that TEE-CORE starts but hangs right after: Internal flash zeroing process: ./rkdeveloptool ld DevNo=1 Vid=0x2207,Pid=0x320b,LocationID=101 Maskrom ./rkdeveloptool db rk322x_loader_v1.10.238_256.bin Downloading bootloader succeeded. ./rkdeveloptool ppt Not found any partition table! ./rkdeveloptool ppt Not found any partition table! ./rkdeveloptool ef Erasing flash complete. Result: □□DDR Version V1.11 20200910_dbg In ID:0xFFF 300MHz LPDDR3 Bus Width=32 Col=11 Bank=8 Row=14 CS=1 Die Bus-Width=32 Size=1024MB mach:4 OUT Boot1 Release Time: May 13 2019 17:02:59, version: 2.56 ChipType = 0xc, 423 mmc2:cmd19,100 SdmmcInit=2 0 BootCapSize=2000 UserCapSize=7216MB FwPartOffset=2000 , 2000 mmc0:cmd5,20 SdmmcInit=0 0 BootCapSize=0 UserCapSize=7604MB FwPartOffset=2000 , 0 StorageInit ok = 179763 SecureMode = 0 SecureInit ret = 0, SecureMode = 0 atags_set_bootdev: ret:(0) GPT 0x63337df8 signature is wrong recovery gpt... GPT 0x63337df8 signature is wrong recovery gpt fail! LOADER Check OK! 0x61000000, 290821 TOS Check OK! 0x68400000, 359530 Enter Trust OS INF [0x0] TEE-CORE:init_primary_helper:377: Initializing (1.1.0-333-gc9d95d1 #2 2018年 08月 17日 星期五 03:32:22 UTC arm) INF [0x0] TEE-CORE:init_primary_helper:378: Release version: 2.0 INF [0x0] TEE-CORE:init_primary_helper:379: Next entry point address: 0x61000000 [2accGZ3G��غ��ؾeػؼ The device is identified as SAMSUNG by the loader, but it's physically a Kingston eMCP (O8EMCP08). Could this manufacturer ID mismatch be causing the Trust OS to misconfigure the RAM timings and freeze? Is there a patched loader or a specific trust.img for these Kingston eMCP variants?

Version 3.1.0 Has been released! I won't be going into details like last time, this build also includes the fixes for "known issues" from version 3 Alpha build. Bugs Found? Open a ticket in https://github.com/Harleythetech/openauto-rk3229-armbian/issues Download: Github: OpenAuto RK322x - oark322x-3.1.0-beta

@Bones558 I made custom u-boot to fix the boot splash but so far it only works on mico-HDMI.