User Tools

Site Tools


doc:appunti:hardware:mxq_s805

Android TV-Box MXQ (Amlogic S805)

I purchased two of this, for about 35 € each. They came with different firmware, also the remote control is different and not interchangeable.

Hostname m201d m201C
Date of purchase 2016-04 2016-10
Android 4.4.2 4.4.2
Firmware build number MXQ.V2.0.201601260953 KOT49H.20151225 test-keys
Factory rooted Yes No
Linux kernel 3.10.33 3.10.33
CPU ARMv7 revision 1 ARMv7 revision 1
Machine Amlogic Meson8B Amlogic Meson8B
Total RAM memory 510 Mib (345 Mb total free with LibreELEC).
The original Linux kernel gives fake values: 824 Mb with /proc/meminfo or 1926 Mb with free
1022 MiB
NAND Storage 8GiB 8 GiB
WiFi driver RTL871X: rtl8189es RTL871X: rtl8189es
Remote factory_code 0x40400001 remote.conf 0xfe010001 remote.conf
Recovery mode Yes, toothpick method Only from external SD card
Kszaq LibreELEC LibreELEC-S805.m201d.arm-7.0.3.3d.img LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img
Note Time from the internet sometimes does not work. Overscan problem: image borders drop out of the screen.

The device does not have a clock inside, it relies on the time it gets from the internet. With the latest firmware (2016-01-26) there is a very annoying bug: from the Android settings we enabled time from the internet and set the proper timezone, this settings works just once, after a reboot the time is almost always unset.

Video Resolution

We don't know the actual video adapter capabilities of the MXQ, using the LibreELEC distribution we suspect that it cannot cope well with the native resolution of any HDMI monitor we connect to it. For example we attached a Samsung SyncMaster capable of 1440×900 pixel, but the Kodi interface offered only 1920×1080, 1280×720 and 720×480. So no native resultion can be used and it relays in downscaling or upscaling.

Partitions and storage space

For some insight of partitions content, see the post Boot Android from SdCard.

root@m201d:/ # cat /proc/partitions                                            
major minor  #blocks  name

 253        0     512000 zram0
 250        0     524288 cache
 250        1      32768 logo
 250        2      32768 recovery
 250        3      32768 misc
 250        4      32768 boot
 250        5    1048576 system
 250        6    5275648 data
Size Free (at factory)
Partition m201d m201C m201d m201C
/system 991.9M 1.5G 144.0M 578.5M
/data 4.9G 4.4G 3.9G 3.6G
/cache 495.9M 495.9M 495.4M 495.5M

Remotes are different

From various posts on the internet it seems that very similar devices are shipped with different remotes. The two of mine are different and are not interchangeable. Remote factory code and configuration is stored into /system/etc/remote.conf.

MXQ Remote factory_code 0x40400001 MXQ Remote factory_code 0xfe010001

Some devices are factory rooted

No need to root the device on model m201d, because it is already. You can install a terminal application and issue the su command. If you don't want to register into Google to access the Play Store from the MXQ, you can get the .apk file somewhere, put it into the SD card, browse the folders and install it. Another useful app to install is an SSH server, used to open a shell session from a PC into the device or to transfer files via scp. There is also an FTP server, etc.

If the device does not have its su binary installed, you have to boot in TWRP recovery mode and install superuser from a zip file. You need an update .zip archive, not the .apk Android package, this is why the SuperSU app is distributed also as a zip file (see below for download link). Save it into an SD card along with the TWRP recovery, boot from it and install.

The su binary installed by SuperSU is not standalone: when invoked (e.g. from the command line) it will bring-up the graphical interface of SuperSU, which asks to allow superuser privileges to the requesting app. May be there are superuser binaries which does not require this (e.g. the one shipped with model m201d).

Recovery Mode and Backup

Booting into Recovery Mode

Like others Android devices, this one too can boot into Recovery Mode. This is a minimal operating system where it is possible to delete all or some user data and files, perform system updates, etc.

Unlike many Android devices, the MXQ can boot from any recovery image, it does not need a signed one and it is not required to root the device to select a non-stock recovery.

To enter the recovery mode follow the toothpick method. It should be possible to sart the built-in (stock) recovery, or pick one from the SD card. My device with firmware 2016-01-26 is unable to start from the built-in, it just keep on rebooting, so it definitely needed one on the SD card.

  1. Unplug the power from the device.
  2. Connect a screen to the HDMI socket.
  3. Connect an USB keyboard and/or an USB mouse (mouse required for some recovery, e.g. TWRP).
  4. (May be optional) insert the SD card with the recovery.img on its root directory (FAT32 format).
  5. Insert a toothpick into the A/V hole, and push it untill you feel the click of a microswitch.
  6. Keeping the toothpick pressed, insert the power plug.
  7. Wait until you see the recovery screen (about 15 seconds).

Choosing the right Recovery: Stock vs TWRP

NOTICE: the recovery image must be unzipped and renamed recovery.img before copying it into the root direcotry of the SD card.

MXQ Stock Recovery Some Recovery images are very limited, e.g. the stock one installed at factory. This is much like the one I extracted from the OpenELEC 6.0.0.2 archive (which has a build version KOT49H.20151225 test-keys, see web resources for the download link) you can get a copy here: recovery-openelec-6.0.0.2.tgz. It does not permit backup and it has just some basic functions:

  • reboot system now
  • apply update from ADB
  • apply update from EXT
  • apply update from cache
  • wipe data/factory reset
  • wipe cache partition

MXQ TWRP Recovery A totally different recovery is TWRP, which needs a mouse and support a ton of functions, I reccomend it to make a full backup of the firmware before re-flashing it. See web resources below for the original link, a copy of the image is here: recovery-twrp-amlogic-mxq.tgz (TWRP v.3.0.2, md5sum a5e5cc5faa4cdddd58b8e62470c18ff9). It can perform backup and restore of partitions, it can install packages from zip files on the external SD card, can copy or delete files, …

Performing the backup

In Android world, the backup of NAND flash memory partitions is called a NANDroid backup; it contains everything, from operating system to user data. Beware that backup images created with one tool (e.g. TWRP) are generally not compatible with another tool (e.g. CWM Recovery).

Once booted into TWRP, you can click the Backup button and save the images of installed firmware. The archives will be stored into the internal storage of the MXQ, under the directory /storage/sdcard0/TWRP/mxq/ (really a link into /mnt/shell/emulated mounting point). In my case it required 1.5 Gb, where the free space was about 3.9 Gb. The saved images are (see below for info about their content):

  • boot.emmc.win (32M)
  • logo.emmc.win (32M)
  • recovery.emmc.win (32M)
  • data.ext4.win (560M)
  • system.ext4.win (846M)

FIXME: Some of the backup files created by TWRP are not readable from the internal storage where TWRP crated them, they give permission denied even if accessed as root. Is this a bug? Is there something I miss? The unreadable files are data.ext4.win and system.ext4.win.

A workaround is to move them from the internal storage to the external SD card using the AdvancedFile Manager function in TWRP.

Flashing a different firmware

Flashing a different firmware can be useful to upgrade or downgrade the stock software, or to flash a totally different image, e.g. OpenELEC or LibreELEC (we need a version specifically built for our hardware/model).

Burning the firmware from the SD card

Some posts tell to flash a new firmware using a Windows PC and the AMLogic USB Burning Tool, while the MXQ device is connected via an OTG USB cable. We don't have a Windows PC and our MXQ box does not have the OTG USB socket, so we definitely go with the alternative SD card method.

For the SD card method we need to find a firmware archive which contains three files:

  • recovery.img, the recovery which will do the upgrade. A simple stock should suffice.
  • factory_update_param.aml this file contains recovery instructions to flash the firmware.
  • one .zip archive, e.g. m201-ota-20150915.zip, which is actually a JAR archive.

The file factory_update_param.aml just tells what is the archive to use for the upgrade and if erasing user data is required, this is an example:

--update_package=/sdcard/m201-ota-20150915.zip
--wipe_data
--wipe_cache
--wipe_media

The update zip file is actualy a JAR archive, it can be extracted using jar xvf file.zip. Into the root directory of this archive there is the /system directory and there are also the images to flash into the relative partitions. This is an example:

/META-INF The most important file is /META-INF/com/google/android/updater-script, which is the script that actually does the upgrade.
/recovery May contains patches to be applied to the recovery.
/system Contains the software that will be flashed into the system partition. It can be the full structure of directories and files, or a single image of a squashfs filesystem, …
boot.img Image usually raw-flashed into /dev/block/boot partition. It should contain an Android bootimg with kernel, ramdisk and second stage.
bootloader.img The u-boot image (much like a DOS/MBR boot sector). This is the first boot loader (FIXME which is flashed where?). When Android is running there is a /dev/bootloader device and a /sys/devices/virtual/bootloader/bootloader.
file_contexts
logo.img Image usually raw-flashed into /dev/block/logo partition.
recovery.img Image usually raw-flashed into /dev/block/recovery partition. Like the boot.img, it should contains the kernel, the ramdisk and a second stage.

LibreELEC

Which LibreELEC image to use?

From http://kszaq.libreelec.tv/s805/ you can find several images to flash to the device, you have to experiment which one is the best fit for you. Putting the wrong image onto the SD card, results in boot freeze at MXQ logo, just remove the SD card and reboot to recover.

  1. HD18Q for all black MXQ box and OTT ones.
  2. MXQ for all black and Beelink MXQ with “red stripe” on a corner.
  3. m201d for boxes with 512 Mb RAM (instead of 1 Gb).

One MXQ box all black, labeled OTT, with the remote 0xfe010001 (see above) worked flawlessy with the HD18Q image. Another MXQ box all black, with the remote 0x40400001 worked with the m201d image.

Prepare the SD card and boot from it

To prepare the SD card (will be entirely erased, it must be umounted, change the name /dev/sdX to your entire device, not the partition):

gunzip LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img.gz
dd if=if=LibreELEC-S805.arm-8.2-8.1.5-HD18Q.img of=/dev/sdX bs=4M

At the end the SD card will contains two partitions; one FAT32 and one Linux. The first one contains three files (plus their MD5 checksum):

  1. aml_autoscript a boot loader script
  2. kernel.img the Linux kernel image
  3. SYSTEM the LibreELEC filesystem image

The Linux partition is empty, it will be resized to occupy the entire space available on the SD card and it will contain runtime data for LibreELEC.

Once you prepared the SD card, insert it into the unpowered MXQ and use the toothpick method: insert a toothpick into the A/V socket untill you feel the click of a microswitch, then power-on the MXQ while keeping the microswitch pressed. This procedure seems required only once: the following times the MXQ will boot directly from the SD card just because it is inserted.

You will need an USB keyboard to configure the Kodi program (the remote control should work, but it is not very friendly selecting IP addresses, etc.). At least you should configure the network and enable the SSH server.

Copy LibreELEC to the internal NAND memory

Once connected via the SSH server (default root password is libreelec) run this command to copy the LibreELEC software to the internal NAND memory (overwriting the Android system):

LibreELEC:~ # installtointernal 
...
Formatting SYSTEM partition.../dev/system contains a ext4 file system
...
Writing kernel image...76+1 records in
...
Copying SYSTEM files...done.
Copying remote.conf...done.
Formatting DATA partition...done.
Do you want to copy your user data to internal data partition? [Y/n] 
...

Problems (Solved and Unsolved)

LibreELEC-S805.arm-8.2-8.1.5a-m201d

The power button of the remote control does power off the device, but it is unable to wake it up. You must disconnect the power supply and connect it again.

Sometimes we get Kodi reboot, Kodi interface or video play freeze. The system is installed into the NAND memory, into the dmesg log there are plenty of that messages:

nftl _nand_discard, start sector=282632, length=72
nftl _nand_discard, start sector=274440, length=24
nftl _nand_discard, start sector=4608120, length=32

The Kodi program crashes with the following message:

Program terminated with signal SIGBUS, Bus error.

The problem seem to be fixed downgrading to LibreELEC-S805.m201d.arm-7.0.3.3d image. Some kernel problem? Was the image 8.2-8.1.5a corrupt on flashing? Quién sabe?

LibreELEC-S805.arm-8.2-8.1.5-HD18Q

The volume buttons of the remote control do not work. You can instead press OK when playing a vide, then use the gear icon to access the menu.

LibreELEC-S805.m201d.arm-7.0.3.3d.img

We disabled CEC remote control, because we don't use it and we get dmesg full of

##### cec write error! #####

Go to System –> System –> Input devices –> Peripherals –> CEC Adapter. Select the plugin and disable it. You must to reboot to have it dsabled.

TWRP Backup images

See this paragraph about Android partitions.

boot.emmc.win

data.ext4.win

logo.emmc.win

It is the raw dump of /dev/block/logo partition, it contains the BMP files of boot logos packed into a special Amlogic format. There is a tool called aml-imgpack which was able to extract the image files. Browsing the partition image you can see the Amlogic magic number 0x27051956 and the magic number of several BMP images (which is BM).

recovery.emmc.win

system.ext4.win

Web Resources

doc/appunti/hardware/mxq_s805.txt · Last modified: 2020/01/27 12:01 by niccolo