IMPORTANT UPDATE:

I worked with the CoreELEC developers a little bit and they have patched the system in rc3 to make the WiFi work. Therefore this tutorial is no longer needed lol.

(However the Bluetooth still doesn’t work. I’m hoping this article can provide a little help to those who are still interested in this device!)

Background

Purchased a X96 Max Plus tv box from a seller who claimed that this box is compatible with CoreELEC. However turns out the specific variant(X96_Max_Plus2_T) uses an unsupported WiFi chip(AM7256).

After playing with dmesg and udevadm, and comparing dmesg outputs from the stock firmware, I discovered that the AM7256 chip is actually a Broadcom BCM4354(Rev 01) chip(At least it’s compatible with the bcm driver…)!

Disclaimer

I’m not the manufacturer of X96 Max Plus, nor am I in CoreELEC development team.
The following instructions are not guaranteed to work, nor will I hold responsibility for damaged devices or something else.

I can only say that the method described below works on my box. Use it at your own risk!

Be careful when it comes to identifying your device: follow the instruction if and only if your udevadm info /sys/bus/sdio/devices/sdio* returns something like this.

Steps to install the driver on CoreELEC

1. Extract driver files from stock system

Note: In case you erased your stock firmware without backing it up, drivers from http://sources.buildroot.net/armbian-firmware/git/rkwifi/ will also work. However I just can’t confirm who was uploading firmware to BuildRoot(The official armbian repo does not contain these drivers), so use them at your own risk!!

Run

adb pull /vendor/etc/wifi/buildin/fw_bcm4354a1_ag.bin
adb pull /vendor/etc/wifi/buildin/nvram_ap6354.txt

to extract the needed files.

If you made a TWRP backup before, you can also open vendor.ext4.win and cd into /etc/wifi/buildin/ to locate these files.

2. Use overlay filesystem to load driver files

Update notes:

With hints from the CoreELEC forum @VPeter, I realized a way to drop in firmware files without unpacking and repacking the SYSTEM image. You must have a wired connection to your box to use the new method; If you can’t, follow the old method

• 2.1 ssh into your CoreELEC box and execute

mkdir -p /storage/.config/firmware/brcm/
cp /usr/lib/firmware/brcm/config.txt /storage/.config/firmware/brcm/

• 2.2 Edit the copied config.txt following the steps in 2.1.2

• 2.3 logout from the ssh session and use scp command to copy obtained driver files from previous steps to `/storage/.config/firmware/brcm/

scp /path/to/your/fw_bcm4354a1_ag.bin [email protected]_coreelec_ip_address:/storage/.config/firmware/brcm/
scp /path/to/your/nvram_ap6354.txt [email protected]_coreelec_ip_address:/storage/.config/firmware/brcm/

(You can also use Samba to create the folder and upload firmware files, but I’m not sure if accessing Linux Samba share from Windows will work…）

• 2.4 Finally, reboot your CoreELEC box and you should have your WiFi running!

2.1 Modify CoreELEC SYSTEM partition image

You will have to use the old and nasty method if you can’t make a wire connection to your CoreELEC box.

2.1.1 Add driver files

After you’ve done extracting driver files from stock firmware, burn CoreELEC to a flash disk or TF card as usual. Then pull SYSTEM from the FAT partition to a Linux machine.

Decompress the SYSTEM using unsquashfs:(Assume you mounted the FAT partition on )

unsquashfs /mnt/SYSTEM

You will get squashfs-root where you ran the command.

Then copy fw_bcm4354a1_ag.bin and nvram_ap6354.txt to /usr/lib/kernel-overlays/base/lib/firmware/

2.1.2 Modify Broadcom controller config

Edit /usr/lib/kernel-overlays/base/lib/firmware/config.txt with your favorite text editor.

Locate the line nv_by_chip=15 \ , and add 1 to the number to make it nv_by_chip=16 \ .

Then insert 17236 1 nvram_ap6354.txt \ somewhere between nv_by_chip=16\ and the last line containing .txt.

The section should now look like this:

nv_by_chip=16 \
43362 0 nvram_ap6181.txt \
43362 1 nvram_ap6210.txt \
17236 1 nvram_ap6354.txt
...
43752 2 nvram_ap6275s.txt

(17236 is the DEC representation of 0x4354, the chip name of BCM4354; 1 is rev number of the chip)

2.1.3. Rebuild SYSTEM image

cd to where you decompressed SYSTEM, then run

mksquashfs squashfs-root/ SYSTEM -noappend -comp gzip

Then copy SYSTEM back to the flash storage, update SYSTEM.md5 with a new checksum, and you are good to go! Just resume normal CoreELEC installation steps and you should see your WiFi working.

TBD…

I don’t have any bluetooth keyboard/mouse or speakers, so I cannot test if Bluetooth is fully functional.

• My Android Phone can pair to CoreELEC with no problem, however I can’t really do anything with it, as CoreELEC does not act as an audio receiver… Feedback is welcomed on Bluetooth functionality!

In case you can’t make the image yourself…

I’m not clever enough to figure out law issues: CoreELEC is GPLv2, Broadcom driver is likely proprietary, and I can’t imagine how much legal trouble I will get into if I ship them together. Therefore, I will post any link to already modified image in this post.

However, if you are patient enough to search for some Chinese posts regarding AM7256 and CoreELEC, you should be able to find someone who has made the SYSTEM file for you.

• Chinese courts had a different explanation to ‘mere aggregation vs combining’ in the past, so people there might need to think a bit less when distributing GPL related software(Not really…
  • Good news is, in that case, violators of GPL was fined accordingly! It was just the explation on ‘mere aggregation vs combining’ needs improvement
  • Even better news is, Chinese court and law system does not rely on past cases to make judgement. That means free software might be even better protected in the future!