Jump to content

Xiaomi Mi TV Stick (xiaomi-aquaman)

From postmarketOS Wiki
Revision as of 15:20, 23 February 2025 by Exkc (talk | contribs) (see also)
Note This device is supported as part of a generic port. Refer to Amlogic Generic TV Box (amlogic-tvbox) for installation instructions and more information.
This device has been tested with postmarketOS, but its device package has not yet been added to the postmarketOS repositories.
This means that it cannot be selected in pmbootstrap.
Xiaomi Mi TV Stick
Manufacturer Xiaomi
Name Mi TV Stick
Codename xiaomi-aquaman
Released 2020
Type set-top box
Hardware
Chipset Amlogic S805Y
CPU Quad-core 1.2 GHz Cortex-A53
GPU ARM Mali-450
Display Up to 1080p over HDMI
Storage 8GB
Memory 1GB
Architecture aarch64
Software
Original software Android (TV)
Original version 9
Extended version 10
FOSS bootloader no
postmarketOS
Category testing
Pre-built images no
Mainline partial
Generic port Amlogic Generic TV Box (amlogic-tvbox)
Features
USB Networking
Broken
Internal storage
No data
SD card
No data
Multimedia
3D Acceleration
Partial
Audio
Works
Connectivity
WiFi
Broken
Bluetooth
Broken
Miscellaneous
FDE
No data
USB OTG
Works
HDMI/DP
Works
Sensors
Power Sensor
No data


Contributors

Users owning this device

  • 19atlas (Notes: 1080p green version, No go command, edited bootcmd)
  • Exkc
  • FerassElHafidi (Notes: Green 3rd variant. Runs Android 10.)
  • Knuxify (Notes: 2x; one works (blue variant), one has random shutdowns which seem to be caused by it overheating, since it works fine with the top of the casing taken off (green variant). Both running Android 9)
  • Mertoalex (Notes: family uses it, I debloated it with UAD-ng.)


How to enter bootROM USB mode

Plug an Amlogic HDMI boot dongle.

The USB mode does not seem to be password-locked, although SecureBoot is enabled.

How to enter recovery mode

Note On older firmware versions, you can get a shell in recovery via UART, however it is heavily restricted due to SELinux. Newer firmware versions do not expose a shell via UART.

Hold down the OK+Back keys on the remote while booting to boot into recovery.

Alternatively,

  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot recovery

Note that OTG does not work in the recovery, unlike on the Mi Box 3.

How to enter fastboot

  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot fastboot

WiFi

There are many variants with many different WiFi chips, including ones from Amlogic (not supported in mainline) or Realtek (some are supported, others aren't).

PCB variants

There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.

UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).

The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).It seem that the third variant are manufactured in 2024 and there are sticker on the box of third variant saying it is manufactured at 2024.

Researching

Warning WARNING: This is just an unorganised section for notes.

Implementing "Multiboot" mode (see Amlogic#Boot process) in the U-Boot environment via the U-Boot shell is needed to boot pmOS and older android 9 uboot has uboot shell.

U-Boot 2015.01-g0a28df3-dirty (May 26 2020 - 19:23:51), Build: jenkins-aquaman_release-293
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0 
gxl_aquaman_v1#

Unfortunately in newer revision of Android 9 the u-boot shell is disabled. Sadly, there is no way to downgrade.

However, it was found that fastboot can run U-Boot commands, and that it does not seem to do any checks on what commands are being ran. Might be exploitable (see #amlogic-postmarketos OFTC IRC logs (2025-01-12)). You can enter fastboot with adb reboot fastboot.

So the guides in Xiaomi Mi Box 3 (xiaomi-once) might work for this device if it is done via fastboot, although it might need some changes because the buffer in which the fastboot commands are stored before being ran is limited. However that is currently untested.

Some dumps are available: https://dumps.tadiphone.dev/dumps/xiaomi/aquaman.

Some XDA Forum posts and YouTube videos imply that the bootROM USB mode is not password-protected, so the TV stick might be vulnerable to a bug in the USB mode, that allows running unsigned code. Additionally, some other XDA posts claim that there is a way to enter USB mode, by shorting pins (at your own risk!) on the green variant. It may be possible to enter USB mode with the HDMI boot dongle as well.

The TV Stick can be upgraded to Android 10. It was discovered that the Android 10 upgrade brought back the U-Boot shell, so it is possible to enter it via UART:

U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
aquaman_q#

However the go command got removed in android 10 since newer android 9. However, "bootm" can be used to boot a kernel instead.

see also