pessimism Posted May 22, 2024 Posted May 22, 2024 Purchase Link This should be a fun one. Bought the 4GB/128GB variant. AP6330 Wifi Stock software is a really, really bad Android TV port. Looks like a Google Pixel 5 image that has had RK3528 support hacked into it. Some parts report the device as Pixel 5, others MX10. RKdumper wouldn't work. Wifi is hardcoded to China region in the kernel commandline, so wifi doesn't work in North America. Boots into a setup wizard that can't be closed, and forces an internet connection. Since wifi is broken out of the box, had to use ethernet to get past the setup wizard. Transpeed does not have a website or offer stock firmware. The vendor I purchased it from refused to supply a stock image. Image was pre-rooted, so used ethernet+adb to adb pull the entire flash chip. Unfortunately the Android partitions appear to be encrypted and only show gibberish directory names. Was able to use extract-dtb on one of the raw binary partitions to get the stock DTB, which is all I cared about anyway. It is pretty close to an existing one in Armbian (rk3528-demo1-lp4-v10) Located and soldered the tiny UART pads without destroying the box. Tried my different garbage clone USB UART adapters to find one that could handle RockChip 1.5 megabit over serial, fake CH340G did the job, fake CP2102 would not. May the best fake product win! Followed @Hqnicolas guidance from this thread and used the hinlink-h28k trunk release with 5.10 kernel as a base, and changed the dtb referenced in armbianenv to the stock android DTB extracted from the device, and of course it would not boot. Lots of errors, kernel panics on UART, errors from SD reader. Changed to Kernel 6.1 base hinlink-h28k image, and tried rk3528-demo1-lp4-v10.dtb, that one almost boots but doesn't see the SD card so can't mount root filesystem. Began DTB surgery, added pieces of the SD card initialization from the factory DTB to the rk3528-demo1-lp4-v10.dtb, got it to boot. Black USB port dead, Blue USB port working. No HDMI output on console (only UART) but does load XFCE when the GUI autostarts. Will keep slicing and dicing DTB to gain functions. Will need to drop in proper NVRAM file to get AP6330 working as I've had to do on other boards. //rk3528-demo1-lp4-v10.dts SD Not Detected mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; clocks = <0x02 0x198 0x02 0x197 0x7a 0x01 0x7a 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; status = "disabled"; phandle = <0x10e>; }; //Factory DTB - SD reader stuck Busy, can't select voltage etc. mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; clocks = <0x02 0x198 0x02 0x197 0x68 0x01 0x68 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; //status = "disabled" status = "okay"; bus-width = <0x04>; cap-mmc-highspeed; cap-sd-highspeed; disable-wp; pinctrl-names = "default"; pinctrl-0 = <0x6d 0x6e 0x6f 0x70>; rockchip,default-sample-phase = <0x5a>; supports-sd; sd-uhs-sdr12; sd-uhs-sdr25; sd-uhs-sdr50; sd-uhs-sdr104; phandle = <0xff>; }; //Combo that works enough to boot mmc@ffc30000 { compatible = "rockchip,rk3528-dw-mshc\0rockchip,rk3288-dw-mshc"; reg = <0x00 0xffc30000 0x00 0x4000>; interrupts = <0x00 0x85 0x04>; max-frequency = <0x8f0d180>; //clocks = <0x02 0x198 0x02 0x197 0x7a 0x01 0x7a 0x02>; clocks = <0x02 0x198 0x02 0x197 0x68 0x01 0x68 0x02>; clock-names = "biu\0ciu\0ciu-drive\0ciu-sample"; fifo-depth = <0x100>; resets = <0x02 0x2a9>; reset-names = "reset"; rockchip,use-v2-tuning; //status = "disabled"; //from stock dtb status = "okay"; bus-width = <0x04>; //cap-mmc-highspeed; //cap-sd-highspeed; disable-wp; pinctrl-names = "default"; pinctrl-0 = <0x6d 0x6e 0x6f 0x70>; //rockchip,default-sample-phase = <0x5a>; supports-sd; //sd-uhs-sdr12; //sd-uhs-sdr25; //sd-uhs-sdr50; //sd-uhs-sdr104; //end from stock dtb phandle = <0x10e>; }; rk3528-transpeed-8k-ultra-hd-mx10.dts 0 Quote
pessimism Posted May 22, 2024 Author Posted May 22, 2024 wifi operational with: ln -sf /lib/firmware/brcm/brcmfmac4330.bin /lib/firmware/brcm/brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.bin ln -sf /lib/firmware/brcm/brcmfmac-ap6330-sdio.txt /lib/firmware/brcm/brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.txt and a reboot, then nmtui to set up a connection 0 Quote
Hqnicolas Posted May 23, 2024 Posted May 23, 2024 (edited) Nice! 18 hours ago, pessimism said: that one almost boots but doesn't see the SD card so can't mount root filesystem. Enable SDHCI + emmc1 + emmc2 + emmc3 on DTS and recompile 18 hours ago, pessimism said: Black USB port dead, Check if usb*_dphy it's OTG or HOST on DTS Edited May 23, 2024 by Hqnicolas 0 Quote
Pico Posted May 25, 2024 Posted May 25, 2024 Hi Pessimism, I have this box ( purchased from same vendor) it worked well for me,.....since I've mistakenly deleted the build.prop file in root/system. Would you mind to send me the file? Tks for your help. Regards Pietro 0 Quote
Pico Posted May 25, 2024 Posted May 25, 2024 Olà Farlei, Thanks for your prompt reply. I do not need the complete archive .If you have the TV box , then you can copy the bulid.prop file( it's a text file) from root/system with ES explorer or any other file management apk. Thanks again 0 Quote
pessimism Posted May 30, 2024 Author Posted May 30, 2024 (edited) Updated wireless enablement, use ap6330 files for both firmware and nvram, I goofed and didn't see it before: mv ./brcmfmac4330-sdio.bin ./brcmfmac4330-sdio.bin.org ln -sf ./brcmfmac-ap6330-sdio.bin brcmfmac4330-sdio.bin ln -sf ./brcmfmac-ap6330-sdio.bin brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.bin ln -sf ./brcmfmac-ap6330-sdio.txt brcmfmac4330-sdio.rockchip,rk3528-demo1-lp4-v10.txt Performance is still quite slow. May be more DTB work needed for it. Though it is only an SDIO connected single-stream, single-band 2.4/5.8 wireless N adapter with a top speed of 72 megabit, so we can't be asking for miracles here. The internal antenna is also just a tiny piece of stamped steel soldered to the PCB. Also edit the NVRAM file (brcmfmac-ap6330-sdio.txt) and change ccode=ALL to your country code Edited May 30, 2024 by pessimism 1 Quote
Hqnicolas Posted May 30, 2024 Posted May 30, 2024 1 hour ago, pessimism said: single-band 2.4/5.8 wireless N adapter with a top speed of 72 megabit I think this is the top performance. you can swap to android and benchmark VPU, GPU, WIFI, LAN, CPU. and bring this tests to the forum. after that. you can compare if you reach 100% of performance 0 Quote
pessimism Posted May 30, 2024 Author Posted May 30, 2024 (edited) I think you're right. I can't easily test using the factory image as its wifi was hardcoded to China region in the kernel commandline so the channels don't work in north america, i had to string a 50 foot ethernet cable just to sign into the thing hilarious they put 8K on the case of this thing, I doubt the wifi would stream 720P stably let alone 8K I think the wifi component may be used and salvaged, the RF shielding over it is discolored and has dents in it, like it was heated and pulled off another device Edited May 30, 2024 by pessimism 0 Quote
alencar Posted June 1, 2024 Posted June 1, 2024 Got this device to use as a media player, it turns out that it's awful at it, so I'll try to repurpose it. Got 2 Mbps max over wireless on mine. Anyways, I extracted these files using root adb shell. rk-kernel.dts build.prop config 0 Quote
omem Posted July 3, 2024 Posted July 3, 2024 H i need Firmware for this Box, can you help me? 0 Quote
rickb Posted July 20, 2024 Posted July 20, 2024 Hello, unfortunately I bought the same box, I would like to test armbian. Could you give me more hint for downloading and starting the image? I think I can manage the dts and links thing. Many thanks Riccardo 0 Quote
Hqnicolas Posted July 23, 2024 Posted July 23, 2024 On 7/20/2024 at 9:50 AM, rickb said: Could you give me more hint for downloading and starting the image? https://docs.armbian.com/Developer-Guide_Build-Preparation/ Custom kernel config change DTS build 0 Quote
Prince Posted October 12, 2024 Posted October 12, 2024 On 5/23/2024 at 2:16 AM, pessimism said: I had the same issue, but after that I download DQ08 android tv box firmware from china gadget review and uploaded to my transpeed 8k android box via factory driver tool. Now the problem is solved and everything is working much better than previous. 0 Quote
Виталий П Posted January 31 Posted January 31 Good time of the day. You can update the link to the firmware. Transpeed 8K Ultra HD MX10 RK3528 BOX 0 Quote
Fièvre Posted February 13 Posted February 13 Hello how are you Can help me with dq08 flash memory size 32Mo. 0 Quote
micron Posted May 14 Posted May 14 @pessimism want are the PINouts of this board? I see you have connected to it with UART. Can you please map RX/TX/GND to GREY/WHITE/BLACK based on you photo. I have tried CP2102 usb adaptor, looks like same case as you had - no transmission on 1.5Mb speed. Meanwhile ordered CH340G. 0 Quote
Hqnicolas Posted May 16 Posted May 16 On 5/14/2025 at 2:45 AM, micron said: I have tried CP2102 usb adaptor, did you try it on windows? https://forum.armbian.com/topic/28895-efforts-to-develop-firmware-for-h96-max-v56-rk3566-8g64g/page/8/#findComment-187561 0 Quote
micron Posted May 16 Posted May 16 I'm using debian, no access to windows. with RX-TX locked adapter sends echos, but no data from box. will tryCH340G once it arrives, cause I saw in this post was same issue. 0 Quote
Hqnicolas Posted May 17 Posted May 17 20 hours ago, micron said: I'm using debian CP2102 are not capable of 1.5 megabaud in linux 0 Quote
micron Posted May 22 Posted May 22 Meanwhile, I have enabled ADB and debugging over wifi, and have connected to cli: 127|rk3528_box:/ $ uname -a Linux localhost 5.10.157-ab10 #319 SMP PREEMPT Sat Nov 11 21:49:28 CST 2023 aarch64 Toybox I think it is possible to copy firmware image from ADB session. If someone did/have instructions please point here. 0 Quote
micron Posted May 24 Posted May 24 kernel_ramfs is located at /dev/block/mmcblk2p6 Have extracted with dd and copying through wifi adb. Interesting usb debugging is enabled in tvbox, but when connecting usb v3 cable to tvbox, host machine does not see the 'adb device', adb connection over wifi is ok. Has anybody used USB adb on this device? 0 Quote
micron Posted Wednesday at 04:27 PM Posted Wednesday at 04:27 PM Hello, finally CH340G usb-uart has arrived - I have checked it performs data transfer on 1.5M speed in RX/TX loop normally. But when connecting to board - there is no output to console at all. Have tried RX/TX changing still no output, just regular start of android TV box. Please suggest does UART needs to be enabled in some screen/menu? 0 Quote
micron Posted Wednesday at 04:44 PM Posted Wednesday at 04:44 PM update: if disconnect TX from USB-UART adaptor - then there is infinite output that changes every microsecond with more strings: ESC[1;47rESC[46;1H[ 45.827723][ Tible6] [dhd-wlan0] w l_ext_iapsta_evefs.readdy=1 (/system/etcb/init/hw/init.uo sr not foun db^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Hnt : [S] Link UP with c8::ca:98^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1HESC[1;46rESC[46;1H ESC[1;47rESC[46;1H[ 45.827747][ T6] [dhd-wlan0] wconsole:/ $ ^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Hl_notify_connect_status : wl_bss_conn.127^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Hect_done succeeded with c8:ca:98 ^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1HESC[1;46rESC[46;1H ESC[1;47rESC[46;1H[ 45.843270][ T6] [dhd-wlan0] wl_notify_connect_sonso le:/ $ c^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Htatus : wl_bss_connect_done succeeded127|^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H with c8:7f:54:e0:ca:98 vndr_oui: 00-90-127|^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H4C 00-0C-43 00-0C-E7 ^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1HESC[1;46rESC[46;1H ESC[1;47rESC[46;1H[ 45.881840][ T165] type=1400 audit(1699712132.610:14conssole:/ $ ^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H4): avc: denied { open } for comm="FD655_Demo" path="/sys/class/fd655/fd65console:/ $ ^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H5_vpause_127|y^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Hflag" dev="s127fig=|^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1Hysfs" ino=19647 sc[ 82.040633][ T386] read descriptors^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H[ 82.040698][ T386] read strings^MESC[1;46rESC[46;1H ESC[1;47rESC[46;1H[ 82.043097][ T1] init: processing action (sys.usb.config=adb && sys.usb.configfs=1 && sys.usb.ffs.ready=1) f82.045159][ T1] init: Co mmand 'symlink /coESC[46;159HnESC[46;159HfESC[46;159HiESC[46;159HgESC[46;159H But still no active shell session 0 Quote
micron Posted 20 hours ago Posted 20 hours ago I have resolved the problem with UART communication - was soldering point between TX and capacitor on board, so after desoldering connection through UART works. Armbian does not boot from USB via flash-drive, but when writing it to SDCard - I see start of the system, but it hungs on "Starting kernel" Adding boot logs: DDR V1.05 4bit PCB 2eef4a672d huan.he 23/04/14-10:58:56 LP4/4x derate disable, other dram:1x trefi ddrconfig:15 DDR3, 324MHz BW=32 Col=11 Bk=8 CS0 Row=16 CS=1 Die BW=16 Size=4096MB tdqss: cs0 dqs0: 626ps, dqs1: 482ps, dqs2: 723ps, dqs3: 723ps, change to: 324MHz clk skew:0x64 change to: 528MHz clk skew:0x64 change to: 666MHz clk skew:0x64 change to: 786MHz(final freq) clk skew:0x64 PHY drv:clk:50,ca:28,DQ:40,odt:145 vrefinner:50%, vrefout:50% dram drv:34,odt:60 cs 0: the read training result: DQS0:0x5b, DQS1:0x51, DQS2:0x53, DQS3:0x53, min : 0x6 0x13 0x10 0x10 0x10 0x2 0x1 0x6 , 0x8 0x8 0x4 0x3 0x5 0x4 0x2 0x2 , 0x7 0x5 0x1 0x6 , 0x2 0x10 0x10 0x3 0x13 0x5 0x12 0x6 , mid 0x2f 0x2f 0x29 0x29 0x2b 0x2a 0x29 0x27 , 0x2a 0x32 0x2e 0x29 0x3b 0x2c 0x39 0x2d , max :0x56 0x65 0x60 0x5f 0x62 0x52x50 0x50 0x4d , 0x4d 0x5a 0x54 0x56 0x57 0x4c 0x4f 0x54 ,, range:0x50 0x52 0x50 0x4f 0x52 0x50 0x50 0x4e ,0x4e 0x4e 0x4b0x50 0x4c 0x51 0x4f 0x47 0x4e 0x4e ,0x4c 0x4f 0x50 0x4c 0x51 0x4: DQS0:0xa2, DQS1:0x94, DQS2:0xac, DQS3:0xac, min :0x83 0x8ab 0x7a 0x79 0x78 0x74 0x73 0x73 0x73 0x79 , 0x8f 0x96 0x95 0x96 0x8d 0x98 0x90 0x97 0x92 0x93 , mid :0x9d 0xa5 0xa2 0xax94 0x92 0x90 0x8e 0x8d 0x8c 0x95 , 0xa8 0xaf 0xab 0xac 0xa9 0xb4 0xab 0xb1 0xad 0xb0 , max :0xb8 0xc1 0xbb 0xbb 0xbd 0 0xac 0xa9 0xa8 0xa6 0xb1 , 0xc1 0xc9 0xc4 0xc7 0xc6 0xbdd0 0xc6 0xcc 0xc9 0xce , range:0x35 0x37 0x31 0x32 0x35 0x36 0x0x36 0x35 0x33 0x38 , 0x32 0x33 0x31 0x36 0x32 0x2f 0x37 0x35 0x37 0x3b , out U-Boot SPL board init U-Boot SPL 2017.09-g0fbedd0675-230404 #zyf (Apr 11 2023 - 09:25:18) unknown raw ID 0 0 0 unrecognized JEDEC id bytes: 00, 00, 00 Trying to boot from MMC2 No misc partition spl: partition error Trying fit image at 0x4000 sector ## Verified-boot: 0 ## Checking atf-1 0x00080000 ... sha256(2493d19c1e...) + OK ## Checking uboot 0x00200000 ... sha256(01c15fcf12...) + OK ## Checking fdt 0x00308958 ... sha256(2867f75977...) + OK ## Checking atf-2 0xfe48d000 ... sha256(8ce3689111...) + OK ## Checking atf-3 0xfe490000 ... sha256(bc35c9ef85...) + OK Jumping to U-Boot(0x00200000) via ARM Trusted Firmware(0x00080000) Total: 334.426 ms INFO: Preloader serial: 0 NOTICE: BL31: v2.3():v2.3-679-geda1f5ce4:cl, fwver: v1.17 NOTICE: BL31: Built : 23:57:18, Dec 20 2023 INFO: rk_otp_init finish! INFO: ARM GICv2 driver initialized INFO: nonboot_cpus_off: clst_st=0xc0e, core_st=0xe1e0 boot_cpu=0 INFO: dfs].freq_mhz= 786MHz INFO: dfs DDR fsp_param[1].freq_mhz= 324MDR fsp_param[3].freq_mhz= 666MHz INFO: idle_st=0x0, pd_st=0xask: 1 INFO: rk_otp_init finish! INFO: RK3528 SoC (0x101) INFO: BL31: Initializing runtime services WARNING: No OPTE provided by BL2 boot loader, Booting device without OPTEE init Error initializing runtime service opteed_fast INFO: BL31: dress = 0x200000 INFO: SPSR = 0x3c9 U-Boot 2017.09-armbian-2017.09-S3264-Pda90-H7573-V3999-Bb703-R448a (May 13 2025 - 12:27:23 +0300) Model: Rockchip RK3528 Evaluation Board MPIDR: 0x80000000 PreSerial: 0, raw, 0xff9f003.9 GiB Sysmem: init Relocation Offset: f9a58000 Relocation fdt: f79fa630 - f79fecd8 CR: M/C/I Using default environment DM: v2 no mmc device at slot 1 mmc@ffbf0000: 0, mmc@ffc30000: 1 (SD) Bootdev(atags): mmc 1 MMC1: Legacy, 52Mhz PartType: EFI No misc partition boot mode: None FIT: No boot partition Failed to load DTB, ret=-19 No valid DTB, ret=-22 Failed to get kernel dtb, ret=-22 Model: Rockchip RK3528 Evaluation Board MPIDR: 0x80000000 rockchip_set_serialno: could not find efuse/otp device CLK: (sync kernel. arm: enter 600000 KHz, init 1200000 KHz, kernel 0N/A) apll 600000 KHz gpll 1188000 KHz cpll 996000 KHz dpll 393000 KHz ppll 10KHz clk_100m 99600 KHz clk_150m 148500 KHz clk_200m 198KHz clk_400m 396000 KHz clk_500m 498000 KHz clk_600m 59clk_ppll_125m 125000 KHz No misc partition Net: No ethernet found. Hit key to stop autoboot('CTRL+C'): 0 Could not find misc partition ANDROID: reboot reason: "(none)" Not AVB images, AVB skip android_image_load_by_partname: Can't find part: boot Android image load failed Android boot failed, error -1. ## Booting FITFIT: No boot partition FIT: No fit blob FIT: No FIT image Unknown command 'bootrkp' - try 'help' switch to partitions #0, OK mmc1 is current device Scanning mmc 1:1... Found U-Boot script /boot.scr 3906 bytes read in 23 ms (165 KiB/s) ## Executing script at 00c00000 Boot script loaded from mmc 1:1 176 bytes read in 18 ms (8.8 KiB/s) 6460789 bytes read in 563 ms (10.9 MiB/s) 28610568 bytes read in 2345 ms (11.6 MiB/s) 102238 bytes read in 289 ms (344.7 KiB/s) Trying kaslrseed command... Info: Unknown command can be safely ignored since kaslrseed does not apply to all boards. Unknown command 'kaslrseed' - try 'help' Fdt Ramdisk skip relocation No misc partition ## Loading init Ramdisk from Legacy Image at 0a200000 ... Image Name: uInitrd Image Type: AArch64 Linux RAMDisk Imagd) Data Size: 6460725 Bytes = 6.2 MiB Load Address: 0OK ## Flattened Device Tree blob at 0x08300000 Booting using the fdt blob at 0x08300000 reserving fdt memory region: addr=8300000 size=7f000 Using Device Tree in place at 0000000008300000, end 0000000008381fff WARNING: could not set reg FDT_ERR_BADOFFSET. ## reserved-memory: ramoops@110000: addr=110000 size=e0000 Adding bank: 0x00200000 - 0xfc000000 (size: 0xfbe00000) Total: 4660.229/5052.326 ms Starting kernel ... I think that MMC1 is sdcard, MMC2 is internal EMMC, so uboot is loaded from MMC1 sdcard (it has different version compared to standard boot), but the output is different compared to standard boot: Some suspicious data in log: MMC1: Legacy, 52Mhz PartType: EFI No misc partition FIT: No boot partition Failed to load DTB, ret=-19 No valid DTB, ret=-22 Failed to get kernel dtb, ret=-22 rockchip_set_serialno: could not find efuse/otp device Net: No ethernet found. I have full access to EMMC with all partitions and initial data to extract if needed. Will appreciate if someone could point me to custom armbian build steps for this board and suggest next steps. (https://gist.github.com/fensoft/1ff3ef81ab2bd9ed9364a564aa2cbcd5?permalink_comment_id=5576642#file-build-sh is what I tried and it does not work) 0 Quote
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.