Jump to content

Xiaomi Mi TV Stick (xiaomi-aquaman)

From postmarketOS Wiki
Note This device is supported as part of a generic port. Refer to Amlogic Generic TV Box (amlogic-tvbox) for installation instructions and more information.
This device has been tested with postmarketOS, but its device package has not yet been added to the postmarketOS repositories.
This means that it cannot be selected in pmbootstrap.
Xiaomi Mi TV Stick
Manufacturer Xiaomi
Name Mi TV Stick
Codename xiaomi-aquaman
Released 2020
Type set-top box
Hardware
Chipset Amlogic S805Y
CPU Quad-core 1.2 GHz Cortex-A53
GPU ARM Mali-450
Display Up to 1080p over HDMI
Storage 8GB
Memory 1GB
Architecture aarch64
Software
Original software Android (TV)
Original version 9
Extended version 10
FOSS bootloader no
postmarketOS
Category testing
Pre-built images no
Mainline partial
Generic port Amlogic Generic TV Box (amlogic-tvbox)
Features
USB Networking
Broken
Internal storage
SD card
Multimedia
3D Acceleration
Partial
Audio
Works
Connectivity
WiFi
Broken
Bluetooth
Broken
Miscellaneous
FDE
USB OTG
Works
HDMI/DP
Works
Sensors
Power Sensor


Contributors

Users owning this device

  • 19atlas (Notes: 1080p version, heats up easily)
  • Exkc
  • FerassElHafidi (Notes: Green 3rd variant. Runs Android 10.)
  • Knuxify (Notes: 2x; one works (blue variant), one has random shutdowns which seem to be caused by it overheating, since it works fine with the top of the casing taken off (green variant). Both running Android 9)
  • Mertoalex (Notes: family uses it, I debloated it with UAD-ng.)


How to enter recovery mode

Note On older firmware versions, you can get a shell in recovery via UART, however it is heavily restricted due to SELinux. Newer firmware versions do not expose a shell via UART.

Hold down the OK+Back keys on the remote while booting to boot into recovery.

Alternatively,

  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot recovery

Note that OTG does not work in the recovery, unlike on the Mi Box 3.

How to enter fastboot

Note There is currently no known way to unlock the bootloader.
  • Plug in to PC
  • Enable devloader mode in settings
  • Run adb reboot fastboot

WiFi

There are many variants with many different WiFi chips, including ones from Amlogic (not supported in mainline) or Realtek (some are supported, others aren't).

PCB variants

There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.

UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).

The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).

Researching

Implementing "Multiboot" mode (see Amlogic#Boot process) in the U-Boot environment via the U-Boot shell is needed to boot pmOS but in newer revision of Android 9 the u-boot shell is disabled. Sadly, there is no way to downgrade.

However, it was found that fastboot can run U-Boot commands, and that it does not seem to do any checks on what commands are being ran. Might be exploitable (see #amlogic-postmarketos OFTC IRC logs (2025-01-12)). You can enter fastboot with adb reboot fastboot.

So the guides in Xiaomi Mi Box 3 (xiaomi-once) might work for this device if it is done via fastboot, although it might need some changes because the buffer in which the fastboot commands are stored before being ran is limited. However that is currently untested.

Some dumps are available: https://dumps.tadiphone.dev/dumps/xiaomi/aquaman.

Some XDA Forum posts and YouTube videos imply that the bootROM USB mode is not password-protected, so the TV stick might be vulnerable to a bug in the USB mode, that allows running unsigned code. Additionally, some other XDA posts claim that there is a way to enter USB mode, by shorting pins (at your own risk!) on the green variant. It may be possible to enter USB mode with the HDMI boot dongle as well.

The TV Stick can be upgraded to Android 10. It was discovered that the Android 10 upgrade brought back the U-Boot shell, so it is possible to enter it via UART:

U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- :  0
aquaman_q#

However the go command got removed in android 10. It is unknown in newer android 9. However, "bootm" can be used to boot a kernel instead.

see also