Jump to content

Xiaomi Mi TV Stick (xiaomi-aquaman): Difference between revisions

From postmarketOS Wiki
Exkc (talk | contribs)
No edit summary
 
(43 intermediate revisions by 3 users not shown)
Line 17: Line 17:
| architecture = aarch64
| architecture = aarch64
<!-- the following status_* questions should be answered with Y for yes, P for partial, N for no, - for N/A or unavailable, or left blank for untested or unknown -->
<!-- the following status_* questions should be answered with Y for yes, P for partial, N for no, - for N/A or unavailable, or left blank for untested or unknown -->
| status_usbnet = N <!-- can't really do it given the needed Hub stuff -->
| status_usbnet = Y <!-- can't really do it given the needed Hub stuff though -->
| status_flashing = -
| status_flashing = -
| status_touch = -
| status_touch = -
Line 54: Line 54:
| status_powersensor =
| status_powersensor =
| status_fossbootloader = N
| status_fossbootloader = N
| status_emmc =  
| status_emmc = P <!-- ONLY for EXPERIENCED users -->
| status_sdcard = -
| booting = yes
| booting = yes
| packaged = no
| packaged = no
Line 84: Line 85:
== How to enter recovery mode ==
== How to enter recovery mode ==


{{note|On older firmware versions, you can get a shell in recovery via UART, however it is heavily restricted due to SELinux. Newer firmware versions do not expose a shell via UART.}}
{{note|On older firmware versions and Android 10, you can get a shell in recovery via UART, however it is heavily restricted due to SELinux. Newer firmware versions do not expose a shell via UART.}}
{{note|OTG does not work in the recovery, unlike on the Mi Box 3.}}


Hold down the OK+Back keys on the remote while booting to boot into recovery.
Hold down the OK+Back keys on the remote while booting to boot into recovery.
Line 93: Line 95:
* Enable devloader mode in settings
* Enable devloader mode in settings
* Run <code>adb reboot recovery</code>
* Run <code>adb reboot recovery</code>
Note that OTG does not work in the recovery, unlike on the Mi Box 3.


== How to enter fastboot ==
== How to enter fastboot ==


{{note|There is currently no known way to unlock the bootloader.}}


* Plug in to PC
* Plug in to PC
Line 104: Line 103:
* Run <code>adb reboot fastboot</code>
* Run <code>adb reboot fastboot</code>


== WiFi ==
== Variants ==


There are many variants with many different WiFi chips, including ones from Amlogic (not supported in mainline) or Realtek (some are supported, others aren't).
There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.


== PCB variants ==
There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.It seem that the third variant are manufactured in 2024 and there are sticker on the box of  third variant saying it is manufactured at 2024.
v
UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).
UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).


The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).
The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).It seem that the third variant are manufactured in 2024 and there are sticker on the box of third variant saying it is manufactured at 2024.


<gallery>
<gallery>
File:Old variant xiaomi-aquaman.png|1st variant
File:Aquaman variant 1 pcb top.jpg|1st variant (top of PCB, with UART header soldered in)
File:New variant.png|2nd variant
File:Aquaman variant 1 pcb bottom.jpg|1st variant (bottom of PCB, with UART header soldered in)
File:Old variant xiaomi-aquaman.png|1st variant (bottom of PCB without metal shield + component descriptions)
File:Aquaman variant 2 pcb top.jpg|2nd variant (top of PCB)
File:3rd variant.jpeg|3rd variant
</gallery>
</gallery>
===WiFI===


== Researching ==
{| class="wikitable sortable"
|+ Known WiFI Chip that used in mi stick
|-
! Known WifI Chip that used in Known !! Known variants  that come with that chip !! Work in pmos?
|-
| Amlogic W155S1  || variant 1/3 || {{feature|N}} 
|-
|  Realtek RTL8821CS  || variant 1  || {{feature|}} 
|}


Implementing "Multiboot" mode (see [[Amlogic#Boot process]]) in the U-Boot environment via the U-Boot shell is needed to boot pmOS but in newer revision of Android 9 the u-boot shell is disabled. Sadly, there is no way to downgrade.
== Identify your firmware versions ==
Based on what we know so far, multiple firmware versions emerged:


However, it was found that <code>fastboot</code> can run U-Boot commands, and that it does not seem to do any checks on what commands are being ran. Might be exploitable (see [https://irc.vitali64.duckdns.org/oftc/amlogic-postmarketos/2025-01-12.log.html #amlogic-postmarketos OFTC IRC logs (2025-01-12)]).
# Android 10
You can enter fastboot with <code>adb reboot fastboot</code>.
# Latest Android 9
# Older Android 9


So the guides in [[Xiaomi Mi Box 3 (xiaomi-once)]] might work for this device if it is done via fastboot, although it might need some changes because the buffer in which the fastboot commands are stored before being ran is limited. However that is currently untested.
We can identify the firmware by inspecting their behavior in Fastboot mode.


Some dumps are available: https://dumps.tadiphone.dev/dumps/xiaomi/aquaman.
After running the command:
<syntaxhighlight lang=shell-session>
$ fastboot oem go 0x1000
</syntaxhighlight>


Some XDA Forum posts and YouTube videos imply that the bootROM USB mode is not password-protected, so the TV stick might be vulnerable to [https://fredericb.info/2021/02/amlogic-usbdl-unsigned-code-loader-for-amlogic-bootrom.html#amlogic-usbdl-unsigned-code-loader-for-amlogic-bootrom a bug in the USB mode, that allows running unsigned code].  Additionally, some other XDA posts claim that there is a way to enter USB mode, by [https://xdaforums.com/attachments/mi_tv_stick-png.5641397/ shorting pins] (at your own risk!) on the green variant.  It may be possible to enter USB mode with the HDMI boot dongle as well.
The device should behave as follows, depending on the firmware:


The TV Stick can be upgraded to Android 10. It was discovered that the Android 10 upgrade brought back the U-Boot shell, so it is possible to enter it via UART:
* '''Crashes and reboots''' → you are likely on '''older Android 9'''
* '''Bootloader is locked''' (fastboot returns <code>FAILED (remote: 'locked device')</code>) → you are likely on '''Android 10''' (with u-boot locked)
* '''Nothing happens''' → you are likely on '''Android 10 or newer Android 9'''


<pre>
==Installation==
=== Installing to USB ===
{{warning|DO NOT PLUG multiple USB sticks during boot. If you do have multiple USB drives plugged in during boot, please make sure that <code>usb 0</code> in u-boot is the pmOS USB stick.}}
 
First use [[pmbootstrap]] to build your own image, like so:
 
<syntaxhighlight lang="shell-session">
$ pmbootstrap init
$ pmbootstrap install --sdcard=/dev/sdX # change 'sdX' with the path of your USB drive
</syntaxhighlight>
 
Then find the way to plug the USB stick to the micro USB port while powering the TV Stick. (You can use one of these [https://linux-sunxi.org/USB_OTG_Charging_Hub USB OTG Charging Hubs])
 
=== Booting ===
Due to the different behaviour mentioned above there are different ways to boot pmOS on the stick depending on the firmware present.
 
==== Android 10/Older Android 9 ====
Plug your UART adapter to your disassembled TV Stick.
 
Then interrupt U-Boot when it's booting. You should get a shell, e.g.:
<syntaxhighlight lang=shell-session>
U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
                                                                   
DRAM:  1 GiB                                                       
Relocation Offset is: 36e8b000                                     
mmu cfg end: 0x40000000                                             
mmu cfg end: 0x40000000                                             
<...>
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0  
aquaman_q#
aquaman_q#
</pre>
</syntaxhighlight>
 
 
{{Note|U-Boot will run commands that are saved in the <code>bootcmd</code> environment variable. By default <code>bootcmd</code> contains commands to load Android TV.}}
 
Run these commands to modify the default boot behavior so that it tries to boot from a USB drive first:
 
<syntaxhighlight lang="shell-session">
aquaman_q# setenv bootandroid "${bootcmd}"
aquaman_q# setenv bootcmd "usb start;fatload usb 0 1080000 aml_autoscript;autoscr 1080000 ;run bootandroid"
</syntaxhighlight>
 
Save the changes and reboot:
<syntaxhighlight lang=shell-session>
aquaman_q# saveenv
aquaman_q# reset
</syntaxhighlight>
 
You can still boot into Android by unplugging the USB stick after you have modified the default boot behavior.
 
You can manually boot pmOS if you don't want to modify the default boot behavior.
 
Run these commands to boot pmOS:
 
<syntaxhighlight lang="shell-session">
aquaman_q# usb start
aquaman_q# fatload usb 0:1 ${loadaddr} aml_autoscript
aquaman_q# autoscr ${loadaddr}
</syntaxhighlight>
 
==== Newer Android 9 ====
There are no known methods to boot pmOS currently.


However the go command got removed in android 10 since newer android 9. However, "bootm" can be used to boot a kernel instead.
# The stock u-boot bootloader can only boot signed image (bootm)
# The <code>go</code> has been removed, hence we cannot chainload modern u-boot to bypass that


== see also ==
== See also ==


* [https://www.youtube.com/watch?v=UaRMF0nqqTI Armbian booting on Xiaomi Mi TV Stick via "multiboot" mode]
* [https://www.youtube.com/watch?v=UaRMF0nqqTI Armbian booting on Xiaomi Mi TV Stick via "multiboot" mode]
* [[Xiaomi Mi Box 3 (xiaomi-once)]]
* [[Xiaomi Mi Box 3 (xiaomi-once)]]
* [[Xiaomi Mi TV Stick (xiaomi-aquaman)/Hacking and Researching]]

Latest revision as of 20:14, 13 March 2025

Note This device is supported as part of a generic port. Refer to Amlogic Generic TV Box (amlogic-tvbox) for installation instructions and more information.
This device has been tested with postmarketOS, but its device package has not yet been added to the postmarketOS repositories.
This means that it cannot be selected in pmbootstrap.
Xiaomi Mi TV Stick
Manufacturer Xiaomi
Name Mi TV Stick
Codename xiaomi-aquaman
Released 2020
Type set-top box
Hardware
Chipset Amlogic S805Y
CPU Quad-core 1.2 GHz Cortex-A53
GPU ARM Mali-450
Display Up to 1080p over HDMI
Storage 8GB
Memory 1GB
Architecture aarch64
Software
Original software Android (TV)
Original version 9
Extended version 10
FOSS bootloader no
postmarketOS
Category testing
Pre-built images no
Mainline partial
Generic port Amlogic Generic TV Box (amlogic-tvbox)
Features
USB Networking
Works
Internal storage
Partial
Multimedia
3D Acceleration
Partial
Audio
Works
Connectivity
WiFi
Broken
Bluetooth
Broken
Miscellaneous
FDE
No data
USB OTG
Works
HDMI/DP
Works
Sensors
Power Sensor
No data


Contributors

Users owning this device

  • 19atlas (Notes: 1080p green version, No go command, edited bootcmd)
  • Exkc
  • FerassElHafidi (Notes: Green 3rd variant. Runs Android 10.)
  • Knuxify (Notes: 2x; one works (blue variant), one has random shutdowns which seem to be caused by it overheating, since it works fine with the top of the casing taken off (green variant). Both running Android 9)
  • Mertoalex (Notes: family uses it, I debloated it with UAD-ng.)


How to enter bootROM USB mode

Plug an Amlogic HDMI boot dongle.

The USB mode does not seem to be password-locked, although SecureBoot is enabled.

How to enter recovery mode

Note On older firmware versions and Android 10, you can get a shell in recovery via UART, however it is heavily restricted due to SELinux. Newer firmware versions do not expose a shell via UART.
Note OTG does not work in the recovery, unlike on the Mi Box 3.

Hold down the OK+Back keys on the remote while booting to boot into recovery.

Alternatively,

  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot recovery

How to enter fastboot

  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot fastboot

Variants

There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.

UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).

The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).It seem that the third variant are manufactured in 2024 and there are sticker on the box of third variant saying it is manufactured at 2024.

WiFI

Known WiFI Chip that used in mi stick
Known WifI Chip that used in Known Known variants that come with that chip Work in pmos?
Amlogic W155S1 variant 1/3
Broken
Realtek RTL8821CS variant 1
No data

Identify your firmware versions

Based on what we know so far, multiple firmware versions emerged:

  1. Android 10
  2. Latest Android 9
  3. Older Android 9

We can identify the firmware by inspecting their behavior in Fastboot mode.

After running the command:

$ fastboot oem go 0x1000

The device should behave as follows, depending on the firmware:

  • Crashes and reboots → you are likely on older Android 9
  • Bootloader is locked (fastboot returns FAILED (remote: 'locked device')) → you are likely on Android 10 (with u-boot locked)
  • Nothing happens → you are likely on Android 10 or newer Android 9

Installation

Installing to USB

Warning WARNING: DO NOT PLUG multiple USB sticks during boot. If you do have multiple USB drives plugged in during boot, please make sure that usb 0 in u-boot is the pmOS USB stick.

First use pmbootstrap to build your own image, like so:

$ pmbootstrap init
$ pmbootstrap install --sdcard=/dev/sdX # change 'sdX' with the path of your USB drive

Then find the way to plug the USB stick to the micro USB port while powering the TV Stick. (You can use one of these USB OTG Charging Hubs)

Booting

Due to the different behaviour mentioned above there are different ways to boot pmOS on the stick depending on the firmware present.

Android 10/Older Android 9

Plug your UART adapter to your disassembled TV Stick.

Then interrupt U-Boot when it's booting. You should get a shell, e.g.:

U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
                                                                     
DRAM:  1 GiB                                                         
Relocation Offset is: 36e8b000                                       
mmu cfg end: 0x40000000                                              
mmu cfg end: 0x40000000                                              
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
aquaman_q#


Note U-Boot will run commands that are saved in the bootcmd environment variable. By default bootcmd contains commands to load Android TV.

Run these commands to modify the default boot behavior so that it tries to boot from a USB drive first:

aquaman_q# setenv bootandroid "${bootcmd}"
aquaman_q# setenv bootcmd "usb start;fatload usb 0 1080000 aml_autoscript;autoscr 1080000 ;run bootandroid"

Save the changes and reboot:

aquaman_q# saveenv
aquaman_q# reset

You can still boot into Android by unplugging the USB stick after you have modified the default boot behavior.

You can manually boot pmOS if you don't want to modify the default boot behavior.

Run these commands to boot pmOS:

aquaman_q# usb start
aquaman_q# fatload usb 0:1 ${loadaddr} aml_autoscript
aquaman_q# autoscr ${loadaddr}

Newer Android 9

There are no known methods to boot pmOS currently.

  1. The stock u-boot bootloader can only boot signed image (bootm)
  2. The go has been removed, hence we cannot chainload modern u-boot to bypass that

See also