pessimism

Is it possible to run your 6.1 DTB testing image from a USB stick to avoid touching the working installation on EMMC? I tried flashing the image to a thumb drive with Rufus and on startup the box tries to read the stick (the stick has an activity light so I can see if its being read) but doesn't boot from it and goes on to boot from EMMC. Is there a u-boot config tweak needed?

The infamous undocumented running production changes that make TV boxes such a nightmare

A thank you to @Hqnicolas and success report. Did a trunk build with kernel 6.6 and flashed using rkdevtool and your instructions (had a little trouble finding the required H96-MAX-8gb-MiniLoaderAll.bin buried in the threads), and it worked like a charm. I did need to supply an NVRAM file for the wifi adapter, that is missing from your wifi bringup instructions. I found one in the libreelec repo that did not work, I ended up extracting the factory image from the h96max website and grabbing the stock nvram_bcm4335.txt, renaming to brcmfmac4335-sdio.txt and placing in /lib/firmware/brcm. Once that was done, wireless worked. Display works, HDMI audio works, video acceleration sort of works but drops frames under any load and throws audio sync warnings, i chock that up to hantro not being as developed as rkvdec2? Chromium appears to have acceleration too. Great result for a first try trunk build. cd /lib/firmware/brcm/ sudo wget https://github.com/CoreELEC/brcmfmac_sdio-firmware-aml/raw/master/firmware/brcm/fw_bcm4335b0_ag.bin sudo ln -s fw_bcm4335b0_ag.bin brcmfmac4335-sdio.h96-TVbox,rk3566.bin sudo cat > /lib/firmware/brcm/brcmfmac4335-sdio.txt << "EOF" # bcm94335wlcspMS_ES50_RC171p24p23_04052013_AM_mdfy_PAparam.txt -- 4/5/2013 by Murata, based on bcm94335wlcspMS_ES50_RC171p24p20_04022013_AM.txt, changed PA parameters and txidxcap parameters and ccode. # bcm94335wlcspMS_ES50_RC171p24p20_04022013_AM.txt -- 4/2/2013 by Broadcom Corporation # Use with AARDVARK_REL_6_30_171_24_23 -- Murata BCM4335 WLCSP 11AC Module # Sample variables file for Murata Type-XJ ES5.0 (0x00 0x11) -- bcm94335wlcspMS_AM_P400.txt as original sromrev=11 boardrev=0x1500 boardtype=0x064b boardflags=0x10401001 boardflags2=0x0 #updated boardflags3 for forcing to enable external LPO boardflags3=0x0800c08b macaddr=00:90:4c:c5:12:38 #ccode modified by Murata #ccode=0 ccode=XS regrev=0 antswitch=0 pdgain5g=1 pdgain2g=1 tworangetssi2g=0 tworangetssi5g=0 femctrl=4 vendid=0x14e4 devid=0x43ae manfid=0x2d0 #prodid=0x052e nocrc=1 #otpimagesize=502 xtalfreq=37400 extpagain2g=1 extpagain5g=1 rxgains2gelnagaina0=2 rxgains2gtrisoa0=6 rxgains2gtrelnabypa0=1 rxgains5gelnagaina0=3 rxgains5gtrisoa0=5 rxgains5gtrelnabypa0=1 rxchain=1 txchain=1 aa2g=1 aa5g=1 ag0=0 ag1=0 tssipos5g=1 tssipos2g=1 #PA parameters (2G20M/2G40M/5G20M/5G40M/5G80M) #PA parameters modified by Murata #pa2ga0=-208,6208,-764 #pa2ga1=-203,6429,-793 #pa5ga0=-167,5736,-685,-157,5669,-670,-157,5548,-665,-141,5621,-664 #pa5ga1=-101,6543,-735,-99,6452,-731,-147,5743,-695,-75,6468,-723 #pa5ga2=-172,5903,-708,-160,5868,-698,-113,6264,-722,-125,5915,-684 pa2ga0=0xff31,0x1759,0xFD1D pa2ga1=0xff35,0x18BB,0xFCEC pa5ga0=0xff78,0x1715,0xFD49,0xff89,0x1714,0xFD57,0xff86,0x1652,0xFD62,0xffa9,0x1760,0xFD5E pa5ga1=0xff56,0x1596,0xFD5F,0xff88,0x1764,0xFD45,0xff89,0x1632,0xFD65,0xff69,0x160E,0xFD49 pa5ga2=0xff5a,0x1667,0xFD4E,0xff5f,0x15F7,0xFD5E,0xff5a,0x1531,0xFD68,0xff6e,0x1587,0xFD6A # Default Target Power for 2G -- 17dBm(11)/14dBm(54)/13dBm(MCS7,MCS8)/16dBm(6,MCS0) maxp2ga0=74 cckbw202gpo=0 cckbw20ul2gpo=0 dot11agofdmhrbw202gpo=0x6666 ofdmlrbw202gpo=0x0022 mcsbw202gpo=0x88866662 # Default Target Power for 5G -- 14dBm(54)/13dBm(HT20-MCS7,VHT20-MCS8)/12dBm(HT40-MCS7,VHT40-MCS9)/11dBm(VHT80-MCS8/MCS9)/16dBm(6,20HT-MCS0) maxp5ga0=74,74,74,74 # Low mcslr5glpo=0 mcsbw205glpo=0x88866662 mcsbw405glpo=0xAAA88884 mcsbw805glpo=0xCCCAAAA6 # Mid mcslr5gmpo=0 mcsbw205gmpo=0x88866662 mcsbw405gmpo=0xAAA88884 mcsbw805gmpo=0xCCCAAAA6 # High mcslr5ghpo=0 mcsbw205ghpo=0x88866662 mcsbw405ghpo=0xAAA88884 mcsbw805ghpo=0xCCCAAAA6 #20MHz High Rate sb20in40hrpo=0x0 sb20in80and160hr5glpo=0x0 sb20in80and160hr5gmpo=0x0 sb20in80and160hr5ghpo=0x0 #40MHz High Rate sb40and80hr5glpo=0x0 sb40and80hr5gmpo=0x0 sb40and80hr5ghpo=0x0 #20MHz Low Rate sb20in40lrpo=0x0 sb20in80and160lr5glpo=0x0 sb20in80and160lr5gmpo=0x0 sb20in80and160lr5ghpo=0x0 #40MHz Low Rate sb40and80lr5glpo=0x0 sb40and80lr5gmpo=0x0 sb40and80lr5ghpo=0x0 dot11agduphrpo=0x0 dot11agduplrpo=0x0 tssifloor2g=80 tssifloor5g=160,190,240,260 #rpcal:use with 171.17 or later, compensates filter ripple rpcal2g=0x0 rpcal5gb0=0x0 #cckdigfilttype[0-7] 0:default cckdigfilttype=2 phycal_tempdelta=25 #GPIO 0 for SDIO HW OOB interruption muxenab=0x10 #sd_gpout=0 #sd_oobonly=1 rssicorrnorm_c0=-3,-2 rssicorrnorm5g_c0=-1,0,-3,-1,0,-3,-3,-2,-4,-3,-2,-4 #txidxcap2g and txidxcap5g modified by Murata #txidxcap2g=32 #txidxcap5g=44 txidxcap2g=36 txidxcap5g=36 paparambwver=1 EOF sudo rmmod brcmfmac_wcc brcmfmac brcmutil modprobe brcmfmac brcmfmac4335-sdio.txt

Hello, wanted to post up a success note and thank you to Jock and everyone else who has contributed to this work. I bought myself a stack of four tv boxes to play with each with different processors. Started with the H96 Max V11 RK3318 4GB/64GB. I read up on this thread and this person's guide and opted to build myself a trunk image from mainline to see how its doing, using the non-edge 6.6 kernel. So far its been the most painless bringup on a TV box I've done so far (owned a couple of older amlogic ones in the past that were pretty rough to work with), the tooling has come a long way in the past few years. I found a copy of the vendor firmware and used AmlogicKitchen to unpack it and retrieve the nvram file for the broadcom-based wifi to work, its an HS2734C, with the proper nvram file I have 2.4 and 5ghz wifi working. I've attached a copy if its of any use, I see now that there are a few versions floating around the internet already. TODO: Get HDMI audio to work. Don't see an HDMI audio output and haven't had time to investigate. Will report back. I applied your 1.3ghz CPU tweaks in rk3318-config along with both EMMC tweaks (DDR and HS200) and they appear to be holding. I see an HS200 message in dmesg about the EMMC and the CPU is boosting to 1.296ghz. I'm currently burn-in testing it by bootstrapping a gentoo prefix inside the armbian environment, she's been maxed out for an hour now and holding strong, core temps are peaking at 82C maximum load then settle into the low to mid 60s, which is pretty good for this QC reject chip from what I've been reading about how leaky they are One question: When I did the installation, I opted to do a full emmc backup. I am able to see that the resulting (60GB!) image has a GPT and named partitions inside. I attempted to loopback mount them via kpartx and mount, but only a couple out of the 15 partitions will mount. The rest seem to have no recognizable file system. AmlogicKitchen won't work as it doesn't start out as a rockchip packed image like the recovery firmware from the vendor's website. Do you have a script or tool to fully unpack the backups that multitool creates? (for grabbing nvram, firmware, dtb etc.) Anyhow, sketchy TV box made of reject parts now a functioning desktop computer compiling software for itself.... awesome! brcmfmac4334-sdio.rockchip,rk3318-box.txt