Xiaomi Mi TV Stick (xiaomi-aquaman)

== Contributors ==
* exkc (initial research)
* FerassElHafidi (some more research)
* knuxify
== Users owning this device ==
== How to enter bootROM USB mode ==
Plug an Amlogic HDMI boot dongle.
The USB mode does not seem to be password-locked, although SecureBoot is enabled.
== How to enter recovery mode ==
Hold down the OK+Back keys on the remote while booting to boot into recovery.
Alternatively,
* Plug in to PC
* Enable devloader mode in settings
* Run adb reboot recovery
Note that OTG does not work in the recovery, unlike on the Mi Box 3.
== How to enter fastboot ==
* Plug in to PC
* Enable devloader mode in settings
* Run adb reboot fastboot
== WiFi ==
There are many variants with many different WiFi chips, including ones from Amlogic (not supported in mainline) or Realtek (some are supported, others aren't).
== PCB variants ==
There are three variants of the stick. The first one has a green PCB, and was presumably sold in 2020. The second one is recognisable because of its blue PCB, and very different layout. It has been discovered that there is a third variant, which is similar to the first one, with a green PCB, and some minor layout changes.
UART pinout is known for the first and third variant, but not for the second variant (with the blue PCB).
The third variant seems to come with Android 10 out of the box, although upgrades to Android 10 are available in some regions for the other 2 variants. All three are functionally identical (if you don't take the Wi-Fi chip into account).
File:Old variant xiaomi-aquaman.png|1st variant
File:New variant.png|2nd variant
== Researching ==
Implementing "Multiboot" mode (see Amlogic#Boot process) in the U-Boot environment via the U-Boot shell is needed to boot pmOS but in newer revision of Android 9 the u-boot shell is disabled. Sadly, there is no way to downgrade.
However, it was found that fastboot can run U-Boot commands, and that it does not seem to do any checks on what commands are being ran. Might be exploitable (see #amlogic-postmarketos OFTC IRC logs (2025-01-12)).
You can enter fastboot with adb reboot fastboot.
So the guides in Xiaomi Mi Box 3 (xiaomi-once) might work for this device if it is done via fastboot, although it might need some changes because the buffer in which the fastboot commands are stored before being ran is limited. However that is currently untested.
Some dumps are available: https://dumps.tadiphone.dev/dumps/xiaomi/aquaman.
Some XDA Forum posts and YouTube videos imply that the bootROM USB mode is not password-protected, so the TV stick might be vulnerable to a bug in the USB mode, that allows running unsigned code. Additionally, some other XDA posts claim that there is a way to enter USB mode, by shorting pins (at your own risk!) on the green variant. It may be possible to enter USB mode with the HDMI boot dongle as well.
The TV Stick can be upgraded to Android 10. It was discovered that the Android 10 upgrade brought back the U-Boot shell, so it is possible to enter it via UART:
U-Boot 2015.01 aquaman_q-user (Aug 01 2023 - 16:50:19), Build: jenkins-Aquaman_Q_uboot-2493
<...>
Hit Enter or space or Ctrl+C key to stop autoboot -- : 0
aquaman_q#
However the go command got removed in android 10 since newer android 9. However, "bootm" can be used to boot a kernel instead.
== see also ==
* Armbian booting on Xiaomi Mi TV Stick via "multiboot" mode
* Xiaomi Mi Box 3 (xiaomi-once)