AM7256(X96_Max_Plus2_T) WiFi driver for CoreELEC

IMPORTANT UPDATE:

I worked with the CoreELEC developers a little bit and they have patched the system in rc3 to make the WiFi work. Therefore this tutorial is no longer needed lol.

(However the Bluetooth still doesn’t work. I’m hoping this article can provide a little help to those who are still interested in this device!)

Background

Purchased a X96 Max Plus tv box from a seller who claimed that this box is compatible with CoreELEC. However turns out the specific variant(X96_Max_Plus2_T) uses an unsupported WiFi chip(AM7256).

After playing with dmesg and udevadm, and comparing dmesg outputs from the stock firmware, I discovered that the AM7256 chip is actually a Broadcom BCM4354(Rev 01) chip(At least it’s compatible with the bcm driver…)!

Disclaimer

I’m not the manufacturer of X96 Max Plus, nor am I in CoreELEC development team.
The following instructions are not guaranteed to work, nor will I hold responsibility for damaged devices or something else.

I can only say that the method described below works on my box. Use it at your own risk!

Be careful when it comes to identifying your device: follow the instruction if and only if your udevadm info /sys/bus/sdio/devices/sdio* returns something like this.

Steps to install the driver on CoreELEC

1. Extract driver files from stock system

Note: In case you erased your stock firmware without backing it up, drivers from http://sources.buildroot.net/armbian-firmware/git/rkwifi/ will also work. However I just can’t confirm who was uploading firmware to BuildRoot(The official armbian repo does not contain these drivers), so use them at your own risk!!

Run

adb pull /vendor/etc/wifi/buildin/fw_bcm4354a1_ag.bin
adb pull /vendor/etc/wifi/buildin/nvram_ap6354.txt

to extract the needed files.

If you made a TWRP backup before, you can also open vendor.ext4.win and cd into /etc/wifi/buildin/ to locate these files.

2. Use overlay filesystem to load driver files

Update notes:

With hints from the CoreELEC forum @VPeter, I realized a way to drop in firmware files without unpacking and repacking the SYSTEM image. You must have a wired connection to your box to use the new method; If you can’t, follow the old method

  • 2.1 ssh into your CoreELEC box and execute
mkdir -p /storage/.config/firmware/brcm/
cp /usr/lib/firmware/brcm/config.txt /storage/.config/firmware/brcm/
  • 2.2 Edit the copied config.txt following the steps in 2.1.2

  • 2.3 logout from the ssh session and use scp command to copy obtained driver files from previous steps to `/storage/.config/firmware/brcm/

scp /path/to/your/fw_bcm4354a1_ag.bin [email protected]_coreelec_ip_address:/storage/.config/firmware/brcm/
scp /path/to/your/nvram_ap6354.txt [email protected]_coreelec_ip_address:/storage/.config/firmware/brcm/

(You can also use Samba to create the folder and upload firmware files, but I’m not sure if accessing Linux Samba share from Windows will work…)

  • 2.4 Finally, reboot your CoreELEC box and you should have your WiFi running!

WiFi works!

2.1 Modify CoreELEC SYSTEM partition image

You will have to use the old and nasty method if you can’t make a wire connection to your CoreELEC box.

2.1.1 Add driver files

After you’ve done extracting driver files from stock firmware, burn CoreELEC to a flash disk or TF card as usual. Then pull SYSTEM from the FAT partition to a Linux machine.

Decompress the SYSTEM using unsquashfs:(Assume you mounted the FAT partition on )

unsquashfs /mnt/SYSTEM

You will get squashfs-root where you ran the command.

Then copy fw_bcm4354a1_ag.bin and nvram_ap6354.txt to /usr/lib/kernel-overlays/base/lib/firmware/

2.1.2 Modify Broadcom controller config

Edit /usr/lib/kernel-overlays/base/lib/firmware/config.txt with your favorite text editor.

Locate the line nv_by_chip=15 \ , and add 1 to the number to make it nv_by_chip=16 \ .

Then insert 17236 1 nvram_ap6354.txt \ somewhere between nv_by_chip=16\ and the last line containing .txt.

The section should now look like this:

nv_by_chip=16 \
43362 0 nvram_ap6181.txt \
43362 1 nvram_ap6210.txt \
17236 1 nvram_ap6354.txt
...
43752 2 nvram_ap6275s.txt

(17236 is the DEC representation of 0x4354, the chip name of BCM4354; 1 is rev number of the chip)

2.1.3. Rebuild SYSTEM image

cd to where you decompressed SYSTEM, then run

mksquashfs squashfs-root/ SYSTEM -noappend -comp gzip

Then copy SYSTEM back to the flash storage, update SYSTEM.md5 with a new checksum, and you are good to go! Just resume normal CoreELEC installation steps and you should see your WiFi working.

TBD…

I don’t have any bluetooth keyboard/mouse or speakers, so I cannot test if Bluetooth is fully functional.

  • My Android Phone can pair to CoreELEC with no problem, however I can’t really do anything with it, as CoreELEC does not act as an audio receiver… Feedback is welcomed on Bluetooth functionality!

In case you can’t make the image yourself…

I’m not clever enough to figure out law issues: CoreELEC is GPLv2, Broadcom driver is likely proprietary, and I can’t imagine how much legal trouble I will get into if I ship them together. Therefore, I will post any link to already modified image in this post.

However, if you are patient enough to search for some Chinese posts regarding AM7256 and CoreELEC, you should be able to find someone who has made the SYSTEM file for you.

  • Chinese courts had a different explanation to ‘mere aggregation vs combining’ in the past, so people there might need to think a bit less when distributing GPL related software(Not really…
    • Good news is, in that case, violators of GPL was fined accordingly! It was just the explation on ‘mere aggregation vs combining’ needs improvement
    • Even better news is, Chinese court and law system does not rely on past cases to make judgement. That means free software might be even better protected in the future!

5 responses on “AM7256(X96_Max_Plus2_T) WiFi driver for CoreELEC

  1. Kevinrivm

    Hello,
    I’ve followed your tutorial, wifi seems to work fine, but BT have some issues.
    I’ve posted in CE forum, they ask for the complete drivers for linux 4.9, I’m wondering if you have them or you have found a more stable fix.

    1. AlexHalogen

      Hi Thanks for the comment!
      I was having issues with some BT devices as well(some works, others don’t), but since my other devices had shitty bluetooth implementation, I thought it was other devices’ fault.

      I’m far away from home at this moment so I can’t do any further testing on it… But I will keep up with the developers from the CoreELEC team and see if I can help them with some of the logs I obtained back when I still had that device.

  2. Kevin Rivas

    Hello,
    I’ve followed your tutorial, wifi is working ok, but bluetooth are having some issues.
    I have been comparing the stock system with CoreELEC and there are several differencies

    1. In dmesg | grep dhd there is a difference in the 4th line
    CoreELEC
    [ [email protected]] dhd_module_init: in Dongle Host Driver, version 1.363.59.144.10 (r)
    Stock
    [ 10.808428] [ [email protected]] dhd_module_init: in Dongle Host Driver, version 100.10.545.5 (r826445-20190922-1) (amlogic-20191015-3)

    Are CE loading the wrong drivers?

    Also, I’ve talked with my vendor and he gave me this files:
    https://www.mediafire.com/folder/j4b06z42q5rze/System_files_4354

    Containing bcm4350.hcd and bcm4354a1.hcd I think they are the bluetooth driver or bluetooth config files and should be placed in some place….

    Thanks

    1. AlexHalogen

      Hi Thanks for the information!
      I was having issues with some BT devices as well(some works, others don’t), but since my other devices had shitty bluetooth implementation, I thought it was other devices’ fault.

      Regarding the dhd section in the log – Yes, stock and CoreELEC uses different versions of dhd module, and we can’t just use dhd from stock because stock is 32bit(CE is 64bit). However based on my (limited) knowledge in real-world Linux, dhd isn’t likely the culprit.

      The bluetooth drivers you provided might be useful. I don’t have the device with me right now, so I can’t do any testing on that. Can you place them in under `/storage/.config/firmware/brcm/` ? CoreELEC can recognize these names and load them. Thanks for your help!!

  3. Kevin Rivas

    Hello Alex,

    Have you achieved to make bluetooth work fine ?

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.