pessimism

Haha yes, here we go again Sent from my iPad using Tapatalk

In Canada law didn’t change but AliExpress decided to be much more expensive, I paid $43 CAD (170 Real) in April, same box now $87/340Real Sent from my iPad using Tapatalk

Sent from my iPad using Tapatalk

No, just soldered the socket. There are seven unpopulated passive components behind it but it didn’t matter for me… Sent from my iPad using Tapatalk

VICTORY The H96 Max DEVELOPER EDITION Sent from my iPad using Tapatalk

card slot part just arrived. fingers crossed i dont destroy the board trying to solder the TINY pins

I think you're right. I can't easily test using the factory image as its wifi was hardcoded to China region in the kernel commandline so the channels don't work in north america, i had to string a 50 foot ethernet cable just to sign into the thing hilarious they put 8K on the case of this thing, I doubt the wifi would stream 720P stably let alone 8K I think the wifi component may be used and salvaged, the RF shielding over it is discolored and has dents in it, like it was heated and pulled off another device

Updated wireless enablement, use ap6330 files for both firmware and nvram, I goofed and didn't see it before: mv ./brcmfmac4330-sdio.bin ./brcmfmac4330-sdio.bin.org ln -sf ./brcmfmac-ap6330-sdio.bin brcmfmac4330-sdio.bin ln -sf ./brcmfmac-ap6330-sdio.bin brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.bin ln -sf ./brcmfmac-ap6330-sdio.txt brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.txt Performance is still quite slow. May be more DTB work needed for it. Though it is only an SDIO connected single-stream, single-band 2.4/5.8 wireless N adapter with a top speed of 72 megabit, so we can't be asking for miracles here. The internal antenna is also just a tiny piece of stamped steel soldered to the PCB. Also edit the NVRAM file (brcmfmac-ap6330-sdio.txt) and change ccode=ALL to your country code

wifi operational with: ln -sf /lib/firmware/brcm/brcmfmac4330.bin /lib/firmware/brcm/brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.bin ln -sf /lib/firmware/brcm/brcmfmac-ap6330-sdio.txt /lib/firmware/brcm/brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.txt and a reboot, then nmtui to set up a connection

Purchase Link This should be a fun one. Bought the 4GB/128GB variant. AP6330 Wifi Stock software is a really, really bad Android TV port. Looks like a Google Pixel 5 image that has had RK3528 support hacked into it. Some parts report the device as Pixel 5, others MX10. RKdumper wouldn't work. Wifi is hardcoded to China region in the kernel commandline, so wifi doesn't work in North America. Boots into a setup wizard that can't be closed, and forces an internet connection. Since wifi is broken out of the box, had to use ethernet to get past the setup wizard. Transpeed does not have a website or offer stock firmware. The vendor I purchased it from refused to supply a stock image. Image was pre-rooted, so used ethernet+adb to adb pull the entire flash chip. Unfortunately the Android partitions appear to be encrypted and only show gibberish directory names. Was able to use extract-dtb on one of the raw binary partitions to get the stock DTB, which is all I cared about anyway. It is pretty close to an existing one in Armbian (rk3528-demo1-lp4-v10) Located and soldered the tiny UART pads without destroying the box. Tried my different garbage clone USB UART adapters to find one that could handle RockChip 1.5 megabit over serial, fake CH340G did the job, fake CP2102 would not. May the best fake product win! Followed @Hqnicolas guidance from this thread and used the hinlink-h28k trunk release with 5.10 kernel as a base, and changed the dtb referenced in armbianenv to the stock android DTB extracted from the device, and of course it would not boot. Lots of errors, kernel panics on UART, errors from SD reader. Changed to Kernel 6.1 base hinlink-h28k image, and tried rk3528-demo1-lp4-v10.dtb, that one almost boots but doesn't see the SD card so can't mount root filesystem. Began DTB surgery, added pieces of the SD card initialization from the factory DTB to the rk3528-demo1-lp4-v10.dtb, got it to boot. Black USB port dead, Blue USB port working. No HDMI output on console (only UART) but does load XFCE when the GUI autostarts. Will keep slicing and dicing DTB to gain functions. Will need to drop in proper NVRAM file to get AP6330 working as I've had to do on other boards. //rk3528-demo1-lp4-v10.dts SD Not Detected mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; clocks = <0x02 0x198 0x02 0x197 0x7a 0x01 0x7a 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; status = "disabled"; phandle = <0x10e>; }; //Factory DTB - SD reader stuck Busy, can't select voltage etc. mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; clocks = <0x02 0x198 0x02 0x197 0x68 0x01 0x68 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; //status = "disabled" status = "okay"; bus-width = <0x04>; cap-mmc-highspeed; cap-sd-highspeed; disable-wp; pinctrl-names = "default"; pinctrl-0 = <0x6d 0x6e 0x6f 0x70>; rockchip,default-sample-phase = <0x5a>; supports-sd; sd-uhs-sdr12; sd-uhs-sdr25; sd-uhs-sdr50; sd-uhs-sdr104; phandle = <0xff>; }; //Combo that works enough to boot mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; //clocks = <0x02 0x198 0x02 0x197 0x7a 0x01 0x7a 0x02>; clocks = <0x02 0x198 0x02 0x197 0x68 0x01 0x68 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; //status = "disabled"; //from stock dtb status = "okay"; bus-width = <0x04>; //cap-mmc-highspeed; //cap-sd-highspeed; disable-wp; pinctrl-names = "default"; pinctrl-0 = <0x6d 0x6e 0x6f 0x70>; //rockchip,default-sample-phase = <0x5a>; supports-sd; //sd-uhs-sdr12; //sd-uhs-sdr25; //sd-uhs-sdr50; //sd-uhs-sdr104; //end from stock dtb phandle = <0x10e>; }; rk3528-transpeed-8k-ultra-hd-mx10.dts

Is it possible to run your 6.1 DTB testing image from a USB stick to avoid touching the working installation on EMMC? I tried flashing the image to a thumb drive with Rufus and on startup the box tries to read the stick (the stick has an activity light so I can see if its being read) but doesn't boot from it and goes on to boot from EMMC. Is there a u-boot config tweak needed?

The infamous undocumented running production changes that make TV boxes such a nightmare

A thank you to @Hqnicolas and success report. Did a trunk build with kernel 6.6 and flashed using rkdevtool and your instructions (had a little trouble finding the required H96-MAX-8gb-MiniLoaderAll.bin buried in the threads), and it worked like a charm. I did need to supply an NVRAM file for the wifi adapter, that is missing from your wifi bringup instructions. I found one in the libreelec repo that did not work, I ended up extracting the factory image from the h96max website and grabbing the stock nvram_bcm4335.txt, renaming to brcmfmac4335-sdio.txt and placing in /lib/firmware/brcm. Once that was done, wireless worked. Display works, HDMI audio works, video acceleration sort of works but drops frames under any load and throws audio sync warnings, i chock that up to hantro not being as developed as rkvdec2? Chromium appears to have acceleration too. Great result for a first try trunk build. cd /lib/firmware/brcm/ sudo wget https://github.com/CoreELEC/brcmfmac_sdio-firmware-aml/raw/master/firmware/brcm/fw_bcm4335b0_ag.bin sudo ln -s fw_bcm4335b0_ag.bin brcmfmac4335-sdio.h96-TVbox,rk3566.bin sudo cat > /lib/firmware/brcm/brcmfmac4335-sdio.txt << "EOF" # bcm94335wlcspMS_ES50_RC171p24p23_04052013_AM_mdfy_PAparam.txt -- 4/5/2013 by Murata, based on bcm94335wlcspMS_ES50_RC171p24p20_04022013_AM.txt, changed PA parameters and txidxcap parameters and ccode. # bcm94335wlcspMS_ES50_RC171p24p20_04022013_AM.txt -- 4/2/2013 by Broadcom Corporation # Use with AARDVARK_REL_6_30_171_24_23 -- Murata BCM4335 WLCSP 11AC Module # Sample variables file for Murata Type-XJ ES5.0 (0x00 0x11) -- bcm94335wlcspMS_AM_P400.txt as original sromrev=11 boardrev=0x1500 boardtype=0x064b boardflags=0x10401001 boardflags2=0x0 #updated boardflags3 for forcing to enable external LPO boardflags3=0x0800c08b macaddr=00:90:4c:c5:12:38 #ccode modified by Murata #ccode=0 ccode=XS regrev=0 antswitch=0 pdgain5g=1 pdgain2g=1 tworangetssi2g=0 tworangetssi5g=0 femctrl=4 vendid=0x14e4 devid=0x43ae manfid=0x2d0 #prodid=0x052e nocrc=1 #otpimagesize=502 xtalfreq=37400 extpagain2g=1 extpagain5g=1 rxgains2gelnagaina0=2 rxgains2gtrisoa0=6 rxgains2gtrelnabypa0=1 rxgains5gelnagaina0=3 rxgains5gtrisoa0=5 rxgains5gtrelnabypa0=1 rxchain=1 txchain=1 aa2g=1 aa5g=1 ag0=0 ag1=0 tssipos5g=1 tssipos2g=1 #PA parameters (2G20M/2G40M/5G20M/5G40M/5G80M) #PA parameters modified by Murata #pa2ga0=-208,6208,-764 #pa2ga1=-203,6429,-793 #pa5ga0=-167,5736,-685,-157,5669,-670,-157,5548,-665,-141,5621,-664 #pa5ga1=-101,6543,-735,-99,6452,-731,-147,5743,-695,-75,6468,-723 #pa5ga2=-172,5903,-708,-160,5868,-698,-113,6264,-722,-125,5915,-684 pa2ga0=0xff31,0x1759,0xFD1D pa2ga1=0xff35,0x18BB,0xFCEC pa5ga0=0xff78,0x1715,0xFD49,0xff89,0x1714,0xFD57,0xff86,0x1652,0xFD62,0xffa9,0x1760,0xFD5E pa5ga1=0xff56,0x1596,0xFD5F,0xff88,0x1764,0xFD45,0xff89,0x1632,0xFD65,0xff69,0x160E,0xFD49 pa5ga2=0xff5a,0x1667,0xFD4E,0xff5f,0x15F7,0xFD5E,0xff5a,0x1531,0xFD68,0xff6e,0x1587,0xFD6A # Default Target Power for 2G -- 17dBm(11)/14dBm(54)/13dBm(MCS7,MCS8)/16dBm(6,MCS0) maxp2ga0=74 cckbw202gpo=0 cckbw20ul2gpo=0 dot11agofdmhrbw202gpo=0x6666 ofdmlrbw202gpo=0x0022 mcsbw202gpo=0x88866662 # Default Target Power for 5G -- 14dBm(54)/13dBm(HT20-MCS7,VHT20-MCS8)/12dBm(HT40-MCS7,VHT40-MCS9)/11dBm(VHT80-MCS8/MCS9)/16dBm(6,20HT-MCS0) maxp5ga0=74,74,74,74 # Low mcslr5glpo=0 mcsbw205glpo=0x88866662 mcsbw405glpo=0xAAA88884 mcsbw805glpo=0xCCCAAAA6 # Mid mcslr5gmpo=0 mcsbw205gmpo=0x88866662 mcsbw405gmpo=0xAAA88884 mcsbw805gmpo=0xCCCAAAA6 # High mcslr5ghpo=0 mcsbw205ghpo=0x88866662 mcsbw405ghpo=0xAAA88884 mcsbw805ghpo=0xCCCAAAA6 #20MHz High Rate sb20in40hrpo=0x0 sb20in80and160hr5glpo=0x0 sb20in80and160hr5gmpo=0x0 sb20in80and160hr5ghpo=0x0 #40MHz High Rate sb40and80hr5glpo=0x0 sb40and80hr5gmpo=0x0 sb40and80hr5ghpo=0x0 #20MHz Low Rate sb20in40lrpo=0x0 sb20in80and160lr5glpo=0x0 sb20in80and160lr5gmpo=0x0 sb20in80and160lr5ghpo=0x0 #40MHz Low Rate sb40and80lr5glpo=0x0 sb40and80lr5gmpo=0x0 sb40and80lr5ghpo=0x0 dot11agduphrpo=0x0 dot11agduplrpo=0x0 tssifloor2g=80 tssifloor5g=160,190,240,260 #rpcal:use with 171.17 or later, compensates filter ripple rpcal2g=0x0 rpcal5gb0=0x0 #cckdigfilttype[0-7] 0:default cckdigfilttype=2 phycal_tempdelta=25 #GPIO 0 for SDIO HW OOB interruption muxenab=0x10 #sd_gpout=0 #sd_oobonly=1 rssicorrnorm_c0=-3,-2 rssicorrnorm5g_c0=-1,0,-3,-1,0,-3,-3,-2,-4,-3,-2,-4 #txidxcap2g and txidxcap5g modified by Murata #txidxcap2g=32 #txidxcap5g=44 txidxcap2g=36 txidxcap5g=36 paparambwver=1 EOF sudo rmmod brcmfmac_wcc brcmfmac brcmutil modprobe brcmfmac brcmfmac4335-sdio.txt

Hello, wanted to post up a success note and thank you to Jock and everyone else who has contributed to this work. I bought myself a stack of four tv boxes to play with each with different processors. Started with the H96 Max V11 RK3318 4GB/64GB. I read up on this thread and this person's guide and opted to build myself a trunk image from mainline to see how its doing, using the non-edge 6.6 kernel. So far its been the most painless bringup on a TV box I've done so far (owned a couple of older amlogic ones in the past that were pretty rough to work with), the tooling has come a long way in the past few years. I found a copy of the vendor firmware and used AmlogicKitchen to unpack it and retrieve the nvram file for the broadcom-based wifi to work, its an HS2734C, with the proper nvram file I have 2.4 and 5ghz wifi working. I've attached a copy if its of any use, I see now that there are a few versions floating around the internet already. TODO: Get HDMI audio to work. Don't see an HDMI audio output and haven't had time to investigate. Will report back. I applied your 1.3ghz CPU tweaks in rk3318-config along with both EMMC tweaks (DDR and HS200) and they appear to be holding. I see an HS200 message in dmesg about the EMMC and the CPU is boosting to 1.296ghz. I'm currently burn-in testing it by bootstrapping a gentoo prefix inside the armbian environment, she's been maxed out for an hour now and holding strong, core temps are peaking at 82C maximum load then settle into the low to mid 60s, which is pretty good for this QC reject chip from what I've been reading about how leaky they are One question: When I did the installation, I opted to do a full emmc backup. I am able to see that the resulting (60GB!) image has a GPT and named partitions inside. I attempted to loopback mount them via kpartx and mount, but only a couple out of the 15 partitions will mount. The rest seem to have no recognizable file system. AmlogicKitchen won't work as it doesn't start out as a rockchip packed image like the recovery firmware from the vendor's website. Do you have a script or tool to fully unpack the backups that multitool creates? (for grabbing nvram, firmware, dtb etc.) Anyhow, sketchy TV box made of reject parts now a functioning desktop computer compiling software for itself.... awesome! brcmfmac4334-sdio.rockchip,rk3318-box.txt