H96 Max RK3528 - Cannot boot Armbian from TF/SD card

[Alexander Polko]

Hello,
I have H96 Max TV box with RK3528 chip (4GB RAM, 64GB eMMC, Android 13, build RZX.V01.20240924). Board: RK3528_DDR3_8X4_V12.
Problem: Box does not boot from TF card at all. No HDMI output, no DHCP lease, nothing.
What I have:

TF card slot on the box
1x USB 2.0 port, 1x USB 3.0 port
No serial/UART adapter (DEBUG header visible on PCB but not connected)
Android 13 still working on EMMC
ADB access with root

What I tried:

Built Armbian with BOARD=rk3528-tvbox BRANCH=legacy BUILD_MINIMAL=yes RELEASE=trixie
Extracted DTB from Android boot partition, added to image
Wrote image to TF card with dd
Verified RKNS header at sector 64 - correct
Tried replacing idbloader with one from our custom U-Boot build
Original U-Boot on EMMC appears to ignore TF card completely

Question: How to make original U-Boot boot from TF card? Or is there a way to install Armbian to EMMC safely while keeping ability to recover?
Device AIDA64 info:

Model: H96_Max_RK3528
Device: rk3528_box
Hardware: rk30board

Thank you!

[jock]

Hello, you can only boot from sdcard with that device if you follow the rockchip boot sequence, ie: you have to pack u-boot and trust.img using loaderimage tool from rockchip rkbin repository.

 

That tools decorates the uboot/trust.img binaries with some signature and checksum, then you have to put on specific positions on your sdcard and the miniloader, residing in the emmc, will boot from sdcard once it validates correctly the binaries you supplied.

 

You may take a look to my multitool github project for some reference. I have you same box and it boots on mine.

 

Unfortunately on this particular box, the manufacturer disabled the sdcard boot at SoC/hardware level: this means that the trick to erase the internal flash to boot from sdcard, which worked fine for older SoCs, does not always work with rk3528-based (and probably other rk35xx) boards

 

[kalama yzd]

@jock hi,

 

I have the same box same prb, I used your multitool , same prb black screen like images from ophub, or I created IMG multitool in wrong way, I'm newby in this, plz I want a step by step. Or tutorial I will thankfull

 

Have a good day 

[Alexander Polko]

Hi @jock, thank you very much for your detailed explanation and for pointing me to the multitool project!

I successfully built the multitool image for rk3528 and wrote it to the SD card, but unfortunately the box does not boot from it — it stuck every time.

I also tried connecting via UART (FT232 adapter, 1500000 baud, 8N1) but I only get garbage/noise in the terminal — no readable output at all, even right after powering on the device.

Edited Monday at 07:11 PM by Alexander Polko

[Alexander Polko]

I also tried different U-Boot SPL variants, but I was unable to get Armbian to boot. However, I noticed something interesting — on my MikroTik router I saw a DHCP lease that was issued to a client identified as "uboot", though I only noticed this after the fact and missed the chance to investigate further.

[jock]

@Alexander Polko Do you still have stock firmware in eMMC? You should get some output from the serial uart if you have the stock firmware, otherwise your serial is not working correctly.

Also, boot from sdcard only works via u-boot from stock firmware on this board, for the reason I stated above.

[Alexander Polko]

I've been working on getting Armbian running on an H96 Max RK3528 TV-box (board marking RK3528_DDR3_8X4_V12) with 4GB DDR3 and 64GB eMMC running stock Android 13. I'm building on Ilya Kurdyukov's work (github.com/ilyakurdyukov/rk3528-tvbox) and have made significant progress, but I've hit a wall and need guidance.

 

 

WHAT WORKS

 

1. Flashed custom U-Boot (2017.09 Rockchip with Ilya's patches + my custom patches for USB host activation and USB-first boot) via rkdeveloptool.

 

2. Added patches to enable USB host in U-Boot DTS: &u2phy_host, &usb_host0_ehci, &usb_host0_ohci all set to status = "okay"; &usbdrd_dwc3 set to dr_mode = "host", status = "okay".

 

3. Modified distro_bootcmd so boot_targets = "usb0 mmc1 mtd2 mtd1 mtd0 pxe dhcp" — network boot is attempted before Android fallback.

 

4. Built Armbian image with BOARD=rk3528-tvbox, BRANCH=legacy, RELEASE=jammy, xfce desktop.

 

5. TF-slot does not work (box hangs when microSD inserted in TF slot, likely BootROM SD-boot disabled via OTP as @jock mentioned in other RK3528 threads).

 

6. USB card reader with microSD works in U-Boot — I see "U-Boot.armv8" DHCP client on my Mikrotik router at IP 192.168.55.114.

 

7. Set up PXE boot infrastructure: dnsmasq TFTP server on 192.168.55.228, NFS rootfs export on same server (/srv/nfs/armbian-rootfs), Mikrotik DHCP configured with next-server and boot-filename options.

 

8. U-Boot successfully downloads via TFTP: pxelinux.cfg/01-c6-33-00-3f-cb-3c (PXE config by MAC), Image (kernel, 34 MB), and dtb/rockchip/rk3528-android.dtb (extracted from stock Android boot.img, compatible: "rockchip,rk3528-evb2-ddr3-v10", "rockchip,rk3528").

 

 

WHAT DOES NOT WORK

 

After TFTP downloads complete, the kernel appears to never start:

 

— HDMI shows only grey screen (U-Boot logo from Ilya's gray_square_logo patch).

— No kernel DHCP request on network (would indicate IP_PNP starting).

— No NFS activity (nfsstat -s shows calls = 0).

— No ARP responses from the box — only Mikrotik ARP requests to .114 appear in tcpdump.

— Eventually Android fallback loads (boot_android runs after distro_bootcmd fails).

 

 

EVIDENCE — NETWORK TRACES

 

dnsmasq log confirms successful TFTP downloads:

 

Apr 24 01:33:38 dnsmasq-tftp: sent /srv/tftp/pxelinux.cfg/01-c6-33-00-3f-cb-3c to 192.168.55.114

Apr 24 01:33:45 dnsmasq-tftp: sent /srv/tftp/Image to 192.168.55.114

Apr 24 01:33:45 dnsmasq-tftp: sent /srv/tftp/dtb/rockchip/rk3528-android.dtb to 192.168.55.114

 

Then complete silence from the box.

 

tcpdump — U-Boot DHCP + TFTP sequence (this part works):

 

00:45:24.375253 IP 0.0.0.0.68 > 255.255.255.255.67:

BOOTP/DHCP, Request from c6:33:00:3f:cb:3c, length 300

DHCP-Message: Discover, ARCH=22, Vendor-Class: "U-Boot.armv8"

 

00:45:24.878890 IP 0.0.0.0.68 > 255.255.255.255.67:

BOOTP/DHCP, Request from c6:33:00:3f:cb:3c

DHCP-Message: Request, Server-ID: 192.168.55.1,

Requested-IP: 192.168.55.114, Vendor-Class: "U-Boot.armv8"

 

00:45:24.942243 IP 192.168.55.114.1583 > 192.168.55.228.69:

TFTP, RRQ "pxelinux.cfg/01-c6-33-00-3f-cb-3c" octet timeout 5 blksize 1468

 

00:45:25.005127 IP 192.168.55.114.1646 > 192.168.55.228.69:

TFTP, RRQ "uInitrd" octet timeout 5 blksize 1468

 

00:45:28.349357 IP 192.168.55.114.1918 > 192.168.55.228.69:

TFTP, RRQ "Image" octet timeout 5 blksize 1468

 

00:45:35.412847 IP 192.168.55.114.2837 > 192.168.55.228.69:

TFTP, RRQ "dtb/rockchip/rk3528-evb2-ddr3-v10.dtb" octet timeout 5 blksize 1468

 

All files transfer successfully (observed via TFTP ACK packets).

 

tcpdump — after booti, everything goes silent. The only traffic about the box is Mikrotik's ARP probes:

 

00:55:19.283404 ARP, Request who-has 192.168.55.114 tell 192.168.55.1

00:55:20.296683 ARP, Request who-has 192.168.55.114 tell 192.168.55.1

00:55:21.346711 ARP, Request who-has 192.168.55.114 tell 192.168.55.1

00:55:23.441524 ARP, Request who-has 192.168.55.114 tell 192.168.55.1

... continues for minutes with no response from the box ...

 

The box does not respond to any ARP, does not send new DHCP, does not contact NFS (port 2049 or 111). It is as if the kernel never actually starts — or it starts but hangs so early that no network driver comes up.

 

NFS server stats — zero kernel activity:

 

$ sudo nfsstat -s

Server rpc stats:

calls badcalls badfmt badauth badclnt

0 0 0 0 0

 

Confirms the kernel never reached NFS root mounting.

 

 

WHAT I HAVE TRIED

 

Tested multiple combinations, all fail the same way:

 

— 3 different DTBs: rk3528-evb1-ddr4-v10.dtb, rk3528-evb2-ddr3-v10.dtb, and the extracted Android DTB (which matches exactly: "Rockchip RK3528 EVB2 DDR3 V10 Board").

— 4 console configs: console=tty0, console=tty1, console=ttyFIQ0,1500000, and combinations.

— With and without initrd (both uInitrd and no initrd).

— USB card reader with microSD for rootfs (UUID-based mount).

— NFS rootfs (CONFIG_ROOT_NFS=y confirmed in kernel config).

— Various bootargs: earlycon=uart8250,mmio32,0xff9f0000, ignore_loglevel, panic=10, rootdelay=5.

 

Current PXE config (last attempt):

 

default linux

timeout 10

 

label linux

kernel Image

fdt dtb/rockchip/rk3528-android.dtb

append root=/dev/nfs nfsroot=192.168.55.228:/srv/nfs/armbian-rootfs,vers=3,tcp,nolock,rsize=32768,wsize=32768 rw ip=dhcp console=ttyFIQ0,1500000 console=tty1 earlycon=uart8250,mmio32,0xff9f0000 loglevel=8 ignore_loglevel panic=10 rootdelay=5

 

 

FILE VALIDATION

 

All files check out:

 

Image: Linux kernel ARM64 boot executable Image, little-endian, 4K pages

ARM64 magic "ARMd" at offset 0x38 confirmed.

DTB: Device Tree Blob version 17, correct compatible string.

Kernel: CONFIG_NFS_FS=y, CONFIG_NFS_V3=y, CONFIG_ROOT_NFS=y,

CONFIG_IP_PNP=y, CONFIG_IP_PNP_DHCP=y — all built-in.

 

 

THE DIAGNOSTIC ROADBLOCK — UART

 

I cannot use UART for debugging. My board has DEBUG pins marked (TX/RX/GND/VCC near the WiFi module) but UART output is pure garbage at every standard rate (115200, 460800, 921600, 1500000). I suspect either: the DEBUG pins are poorly soldered on this unit, the UART configuration is different from what Ilya documented, or the pins are actually for a different UART or purpose entirely.

 

Without readable UART, I am completely blind to what happens after U-Boot's booti command — whether the kernel panics, hangs on early init, or starts silently.

 

 

MY QUESTIONS

 

1. Is PXE/TFTP network boot actually expected to work on this U-Boot 2017.09 from Rockchip? The bootcmd_pxe in this U-Boot is:

 

run boot_net_usb_start; dhcp; if pxe get; then pxe boot; fi

 

Has anyone successfully booted Armbian this way on RK3528?

 

2. Is there a known issue where Ilya's U-Boot + Armbian kernel don't hand off properly? Is there a specific bootm/booti command format required that PXE might not follow?

 

3. Could the issue be that the Armbian kernel expects specific arguments (like androidboot.* or bootloader-specific init params) that my PXE append line does not provide?

 

4. Are there any known-working examples of Armbian RK3528 TV-box boot that do NOT rely on on-device storage (microSD/USB flash)?

 

5. Given that U-Boot runs and gets DHCP fine, all files transfer via TFTP fine, file formats are correct, but the kernel is silent after booti — is this a known class of problem with a known solution besides UART?

 

 

BOARD DETAILS

 

Model: H96 Max RK3528 (board RK3528_DDR3_8X4_V12)

SoC: Rockchip RK3528

RAM: 4GB DDR3 (8x Samsung K4B4G0446B)

eMMC: Samsung KLMCG2KETM-B041 64GB

WiFi: SKYWB8800 (AIC8800)

Stock: Android 13 (RZX.V01.20240924)

MAC: C6:33:00:3F:CB:3C

 

 

I'm happy to run any diagnostic commands or provide additional info. Thank you for any guidance.

Edited 1 hour ago by Alexander Polko