This page needs to be properly filled according to the New Device Howto and the New Device Page guide.

Note! This page was (initially at least) assembled by a rank amateur who was just doing his best. Read with skepticism!

Identification

T95
Manufacturer	Manufacturer
Dimensions	100mm x 100mm x 18mm
Release Date	Month year
Website	Device Product Page
Specifications
SoC	H616 @ 1.5Ghz
DRAM	real 1/2/4GB DDR3 @ 600MHz never 8GB
eMMC	real 8/16/32/64GB eMMC (declared as NAND)
Power	DC 5V @ 2A
Features
Video	HDMI (Type A - full)
Audio	3.5mm headphone plug
Network	WiFi 802.11 b/g/n (BCM4334 or AW859A or XR819), 10/100Mbps Ethernet (integrated H616 PHY)
Storage	µSD, eMMC
USB	2 USB2.0 Host
Headers	UART, ... ?

The top of the device has a logo with a large "T95" in a circle.

On the bottom the device is printed:

T95 (5G)
RAM: 4GB  ROM: 32GB

The PCB has the following silkscreened on it:

H616-T95MAX-AXP313A-v3.0

or in some case you can found:

H616-T95MAX-v4.0

If the motherboard is the V4.0 the box is the same as T95H.

In android, under Settings->About Tablet, you will find:

Model Number: MBOX
Build Number: 10.1.X18 or 10.1.X19 or 10.1.A27 or 10.1.A29-0712 or 10.1.A32-1201

the build number with the 'X' is used for XR819 version WiFi 2.4GHz only; the build number with the 'A' is used for AW859A/BCM4334 version Wi-Fi dual-band 2.4/5GHz and bluetooth 4.0.

Sunxi support

Current status

Support is work in progress.

Manual build

You can build things for yourself by following our Manual build howto and by choosing from the configurations available below.

Mainline U-Boot

While I was able to boot Mainline U-Boot (tagged v2023.01-rc2) from an SD card, I did not succeed in getting a working prompt. I used the U-Boot configuration x96_mate_defconfig as a starting point, and went through many variations of this configuration.

The one configuration change/addition that I was able to determine was absolutely necessary was: CONFIG_SPL_IMAGE_TYPE_SUNXI_TOC0=y

I'm told the T95 has secure boot enabled, and it won't load Mainline U-Boot without TOC0. With TOC0 enabled, the T95 output was:

U-Boot SPL 2023.01-rc2 (Dec 01 2022 - 13:43:28 -0700)
DRAM: 4096 MiB
Failed to set core voltage! Can't set CPU frequency
SP

What's wrong?

I was just a conduit through which apritzel was troubleshooting, but my impression was the issue related to RAM timing. With CONFIG_SPL_IMAGE_TYPE_SUNXI_TOC0=y present in every configuration attempt, we tried:

Removing every line with I2C in the configuration and add CONFIG_SUNXI_NO_PMIC=y
Setting/Lowering DRAM frequency with CONFIG_DRAM_CLK=624
Copying DRAM parameters from the orangepi_zero2_defconfig U-Boot configuration
CONFIG_DRAM_SUN50I_H616_READ_CALIBRATION=y and "CONFIG_DRAM_SUN50I_H616_UNKNOWN_FEATURE=y

All these attempts resulted in U-Boot quickly freezing on boot.

A basic U-Boot compile workflow:

$ git clone git://git.denx.de/u-boot.git
$ cd u-boot
$ git checkout v2023.01-rc2
$ cd ..
$ git clone https://github.com/ARM-software/arm-trusted-firmware.git
$ cd arm-trusted-firmware
$ make CROSS_COMPILE=aarch64-linux-gnu- PLAT=sun50i_h616 DEBUG=1 bl31
$ cd ../u-boot
$ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin x96_mate_defconfig
$ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin menuconfig
$ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin
$ dd if=u-boot-sunxi-with-spl.bin of=/dev/sdX bs=1024 seek=8

Probably U-Boot need AXP313a Power Managment PMIC support, that is in WIP[1]

Also a locked bootloader seems to be a problem, firmware until X/A23 should have an unlocked/unlockable bootloader, since X/A24 you cannot unlock your bootloader (I'm tryng with brute force actually, if fail I will try FEL mode).

Use the MANUFACTURER_DEVICE build target.

Mainline Linux kernel

Use the sun50i-h616-t95max-axp313.dtb device-tree binary. (WIP)[2]

Tips, Tricks, Caveats

Add MANUFACTURER DEVICE specific tips, tricks, Caveats and nice to have changes here.

FEL mode

The button behind the 3.5mm audio jack (labeled UBOOT on the board) triggers FEL mode. This button can be pressed even while the board is in its case by sticking something like a paperclip straight through the 3.5mm jack. Feel around for something that "clicks".

Device specific topic

Board V4.0 comes with an XR819 Wi-Fi module. It sits behind the SD card slot. On the top side of the board sits an AXP305 PMIC. I have a 16 GB NAND flash + 2 GB RAM (8x Hynix H5TC2G43BFR) variant.

Exist much different variant of MBOX T95 many of which have malware pre-installed[3].

on the label in the retro of the base will be printed:

T95 or T95 (5G)
RAM: 2 or 4 or 8 GB  ROM: 16 or 32 or 64 or 128 GB

In all or probably much cases this info are totally fake (as is now customary in many TV boxes), a modification (hack) has been installed to cheat on the amount of total space in both RAM and ROM.

Furthermore, recently the chips were printed with false information, so (in much case) it is useless to open the case and read them. Also please note that H616 cannot recognize over 4GB of RAM.

To find exactly your RAM amount you can install a RAM filler app or better examine with a hex editor the file '/proc/device-tree/memory@40000000/reg', the last bytes stands for the real amount of RAM:

00 00 00 00 40 00 00 00 you have only 1GiB of RAM;
00 00 00 00 80 00 00 00 you have only 2GiB of RAM;
00 00 00 01 00 00 00 00 you are very very lucky, 4GiB of RAM.

To find your ROM dimension you can fill it with file and the analyze every file with rdiff or other tools.

The board can have different Wi-Fi module: XR819 Wi-Fi 2.4GHz only or AW859A/BCM4334 Wi-Fi dual-band 2.4/5GHz and bluetooth 4.0 and FM support (probably antenna to jack not soldered on the board, not supported by official ROM).

...

Adding a serial port (voids warranty)

This thing had a warranty?

To attach a serial console you'll need to open the T95 case and solder on wires or headers to the UART pads. Afterwards, you'll need to a UART-USB dongle or similar. See the UART howto for more details.

UART pads - with headers already soldered on.

Pads to short to enable console RX

Device disassembly

You can pop off the bottom of the T95 case using the average Plastic tool. The bottom is held in using small clips only. If your case is like mine I'd suggest starting at the side with the Ethernet and HDMI connector.

Locating the UART

The UART pads are located between the USB0 port and the µSD slot. Refer to the picture at the side.

Connecting your serial console to these pads alone will be sufficient to read T95 console output, but the T95 will not receive any input. To allow console input two pads will need to be shorted on the underside of the board. Look for three tightly-grouped pads on the underside of the board, about 10mm off the back of USB0. Also, see the picture at the side.

From apritzel on IRC:

[12:48] <apritzel> upnix: as for the serial console: some of those TV boxes tend to drop a FET and resistor for the some UART pins, so you may be able to see output, but not be able to talk to the box
[12:49] <apritzel> see here for an example: https://linux-sunxi.org/Eachlink_H6_Mini#Adding_a_serial_port_.28might_void_warranty.3F.29

Boot log with factory firmware (And unbootable OS, in this instance)

[194]HELLO! SBOOT is starting!
[197]sboot commit : d1e4f83e
[200]set pll start
[202]periph0 has been enabled
[205]set pll end
[207]unknow PMU
[209]unknow PMU
[211]PMU: AXP1530
[213]dram return write ok
[215]board init ok
[217]try to probe rtc region
[220]DRAM BOOT DRIVE INFO: V0.649
[223]the chip id is 0x5000
[226]chip id check OK
[230]DRAM_VCC set to 1500 mv
[233]DRAM CLK =600 MHZ
[235]DRAM Type =3 (3:DDR3,4:DDR4,7:LPDDR3,8:LPDDR4)
[243]Actual DRAM SIZE =4096 M
[246]DRAM SIZE =4096 MBytes, para1 = 310b, para2 = 10000000, dram_tpr13 = 6041
[255]DRAM simple test OK.
[257]rtc standby flag is 0x0, super standby flag is 0x0
[263][mmc]: mmc driver ver 2021-10-12 13:56
[267][mmc]: b mmc 2 bias 0
[275][mmc]: Wrong media type 0x0, but host sdc2, try mmc first
[281][mmc]: ***Try MMC card 2***
[313]mmc_read_info 1138:region magic is not right, retry more time 0
[331]mmc_read_info 1138:region magic is not right, retry more time 0
[348]mmc_read_info 1138:region magic is not right, retry more time 0
[365]mmc_read_info 1138:region magic is not right, go err 0
[371]dump info registers:[373]
0x36ba4 : [375]0 [376]0 [376]0 [377]0 [378]
[378][mmc]: RMCA FAIL!
[380][mmc]: mmc read timing info fail
[384][mmc]: wrong freq 2 at spd md 2
[388][mmc]: force 25m
[391][mmc]: MMC 4.5
[393][mmc]: HSSDR52/SDR25 8 bit
[396][mmc]: 25000000 Hz
[398][mmc]: 29820 MB
[400][mmc]: ***SD/MMC 2 init OK!!!***
[518]read toc1 from emmc 32800 sector
[521]OLD version: 0.0
[523]NEW version: 0.0
[599]load rotpk hash
[663]load monitor-key hash
[665]load monitor hash
[870]load boot-key hash
[872]load boot hash
[938]load vbmeta-key hash
[940]load vbmeta hash
[1008]load recovery-key hash
[1011]load recovery hash
[1014]monitor entry=0x48000000
[1017]uboot entry=0x4a000000
[1020]optee entry=0x48600000
[1023]mmc not para
[1027]run out of boot0
NOTICE:  BL3-1: v1.0(debug):be96482
NOTICE:  BL3-1: Built : 18:32:32, 2021-04-21
NOTICE:  BL3-1 commit: 8
NOTICE:  cpuidle init version V1.0
NOTICE:  secure os exist
MESSAGE: [0x0] TEE-CORE: OP-TEE version: 5c40397e #1 Tue Feb  2 07:45:37 UTC 2021 arm
NOTICE:  BL3-1: Preparing for EL3 exit to normal world
NOTICE:  BL3-1: Next image address = 0x4a000000
NOTICE:  BL3-1: Next image spsr = 0x1d3


U-Boot 2018.05 (Jun 22 2022 - 11:19:57 +0800) Allwinner Technology

[01.119]CPU:   Allwinner Family
[01.122]Model: sun50iw9
I2C:   ready
[01.126]DRAM:  2 GiB
[01.129]Relocation Offset is: 75ec5000
[01.168]secure enable bit: 1
[01.171]pmu_axp152_probe pmic_bus_read fail
[01.175]PMU: AXP1530
[01.181]CPU=1008 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz  MBus=400Mhz
[01.189]drv_disp_init
[01.218]__clk_enable: clk is null.
[01.224]drv_disp_init finish
[01.227]gic: sec monitor mode
[01.254]flash init start
[01.256]workmode = 0,storage type = 2
[01.260]MMC:     2
[01.261]get mem for descripter OK !
[01.270]get sdc2 sdc_boot0_sup_1v8 fail.
[01.275]io is 1.8V

[01.310]rto or no error or software timeout,no need retry
[01.317]already at HSSDR52_SDR25 mode
[02.234]speed mode: HSSDR52/SDR25
[02.237]---400000Hz:
[02.239]--best 255
[02.241]---25000000Hz:
[02.243]--best 255
[02.245]---50000000Hz:
[02.247]--best 22
[02.249]already at HSSDR52_SDR25 mode
[02.252]already at HSSDR52_SDR25 mode
[02.256]sunxi flash init ok
[02.259]Loading Environment from SUNXI_FLASH... OK
secure storage read hdcpkey fail
[02.273]secure storage read hdcpkey fail with:-1
secure storage read widevine fail
[02.280]secure storage read widevine fail with:-1
[02.286]usb burn from boot
delay time 0
weak:otg_phy_config
[02.299]usb prepare ok
[03.102]overtime
[03.106]do_burn_from_boot usb : no usb exist
[03.110]boot_gui_init:start
FAT: Misaligned buffer address (bbe7e678)
32 bytes read in 4 ms (7.8 KiB/s)
[03.393]boot_gui_init:finish
[03.396]bmp_name=bootlogo.bmp
2764922 bytes read in 60 ms (43.9 MiB/s)
[03.477]get max-frequency ok 100000000 Hz
[03.481]1 1 1: 1 1 1
[03.483]delete mmc-hs400-1_8v from dtb
[03.486]delete mmc-hs200-1_8v from dtb
[03.490]delete mmc-ddr-1_8v from dtb
[03.493]get max-frequency ok 50000000 Hz
[03.506]update dts
** Unrecognized filesystem type **
[03.517]load file(ULI/factory/rootwait init.txt) error.
** Unrecognized filesystem type **
[03.531]load file(ULI/factory/snum.txt) error.
[03.535]name in map mac
** Unrecognized filesystem type **
[03.547]load file(ULI/factory/wifi_mac.txt) error.
** Unrecognized filesystem type **
[03.561]load file(ULI/factory/bt_mac.txt) error.
** Unrecognized filesystem type **
[03.575]load file(ULI/factory/selinux.txt) error.
** Unrecognized filesystem type **
[03.588]load file(ULI/factory/specialstr.txt) error.
[03.600]update part info
[03.624]update bootcmd
[03.626]No ethernet found.
Hit any key to stop autoboot:  0
[04.133]not supported key
[04.135]actual n size:1000, e:10001
[04.138]exptect n size:800, e:10001
show hash of file
9c 4f 9a 0a a2 d1 89 50 66 7d 92 6a 19 a1 ac 18
ff 0d 01 83 43 4f 99 3f e3 3c eb 1e 68 c1 3d 03

image vbmeta hash valid
[04.154]image_len not match, actual:19466240, expected:19234816
[04.159]bmp_name=red_warning.bmp
** Unable to read file red_warning.bmp **
[04.167]sunxi bmp info error : unable to open logo file red_warning.bmp
[34.176]mmc exit start
[34.211]mmc 2 exit ok

Pictures

Schematic

List schematics, board layout, cad files, etc here.

Also known as

"T95" seems to be a popular name, used in many different TV boxes, with different SoCs. This is the version without any suffix (just "T95"), but make sure you get the "H616" version of it.

The brand name can change, like "Pendoo" or "Antfraer" or "LinQ" or much others, normally printed on the circle upper the T95 logo. This is pretty normal, since if you buy this tvbox (but also others) online in big quantity you can choose your own "custom" logo (and add your own logo or rewrite totally the image on the box) and rebrand the tvbox. They offer also custom chipset (RAM, ROM and Wi-Fi), so you can found different chipset on it.

T95

Contents