T95

Note! This page was (initially at least) assembled by a rank amateur who was just doing his best. Read with skepticism!

= Identification =

The top of the device has a logo with a large "T95" in a circle.

On the bottom the device is printed: T95 (5G) RAM: 4GB ROM: 32GB

The PCB has the following silkscreened on it: H616-T95MAX-AXP313A-v3.0

In android, under Settings->About Tablet, you will find:
 * Model Number: MBOX
 * Build Number: 10.1.A29-0712

= Sunxi support =

Current status
Support is work in progress.

Manual build
You can build things for yourself by following our Manual build howto and by choosing from the configurations available below.

Mainline U-Boot
While I was able to boot Mainline U-Boot (tagged v2023.01-rc2) from an SD card, I did not succeed in getting a working prompt. I used the U-Boot configuration  as a starting point, and went through many variations of this configuration.

The one configuration change/addition that I was able to determine was absolutely necessary was:

I'm told the T95 has secure boot enabled, and it won't load Mainline U-Boot without TOC0. With TOC0 enabled, the T95 output was:

U-Boot SPL 2023.01-rc2 (Dec 01 2022 - 13:43:28 -0700) DRAM: 4096 MiB Failed to set core voltage! Can't set CPU frequency SP

What's wrong?

I was just a conduit through which apritzel was troubleshooting, but my impression was the issue related to RAM timing. With  present in every configuration attempt, we tried:


 * Removing every line with I2C in the configuration and add
 * Setting/Lowering DRAM frequency with
 * Copying DRAM parameters from the  U-Boot configuration
 * and

All these attempts resulted in U-Boot quickly freezing on boot.

A basic U-Boot compile workflow: $ git clone git://git.denx.de/u-boot.git $ cd u-boot $ git checkout v2023.01-rc2 $ cd .. $ git clone https://github.com/ARM-software/arm-trusted-firmware.git $ cd arm-trusted-firmware $ make CROSS_COMPILE=aarch64-linux-gnu- PLAT=sun50i_h616 DEBUG=1 bl31 $ cd ../u-boot $ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin x96_mate_defconfig $ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin menuconfig $ make CROSS_COMPILE=aarch64-linux-gnu- BL31=../arm-trusted-firmware/build/sun50i_h616/debug/bl31.bin $ dd if=u-boot-sunxi-with-spl.bin of=/dev/sdX bs=1024 seek=8

Use the  build target.

Mainline Linux kernel
Use the  device-tree binary.

= Tips, Tricks, Caveats =

FEL mode
The button behind the 3.5mm audio jack (labeled UBOOT on the board) triggers FEL mode. This button can be pressed even while the board is in its case by sticking something like a paperclip straight through the 3.5mm jack. Feel around for something that "clicks".

Board V4.0 comes with an XR819 Wi-Fi module. It sits behind the SD card slot. On the top side of the board sits an AXP305 PMIC. I have a 16 GB NAND flash + 2 GB RAM (8x Hynix H5TC2G43BFR) variant.

= Adding a serial port (voids warranty) = This thing had a warranty?

To attach a serial console you'll need to open the T95 case and solder on wires or headers to the UART pads. Afterwards, you'll need to a UART-USB dongle or similar. See the UART howto for more details.



Device disassembly
You can pop off the bottom of the T95 case using the average Plastic tool. The bottom is held in using small clips only. If your case is like mine I'd suggest starting at the side with the Ethernet and HDMI connector.

Locating the UART
The UART pads are located between the USB0 port and the µSD slot. Refer to the picture at the side.

Connecting your serial console to these pads alone will be sufficient to read T95 console output, but the T95 will not receive any input. To allow console input two pads will need to be shorted on the underside of the board. Look for three tightly-grouped pads on the underside of the board, about 10mm off the back of USB0. Also, see the picture at the side.

From apritzel on IRC: [12:48]  upnix: as for the serial console: some of those TV boxes tend to drop a FET and resistor for the some UART pins, so you may be able to see output, but not be able to talk to the box

[12:49]  see here for an example: https://linux-sunxi.org/Eachlink_H6_Mini#Adding_a_serial_port_.28might_void_warranty.3F.29

Boot log with factory firmware (And unbootable OS, in this instance) [194]HELLO! SBOOT is starting! [197]sboot commit : d1e4f83e [200]set pll start [202]periph0 has been enabled [205]set pll end [207]unknow PMU [209]unknow PMU [211]PMU: AXP1530 [213]dram return write ok [215]board init ok [217]try to probe rtc region [220]DRAM BOOT DRIVE INFO: V0.649 [223]the chip id is 0x5000 [226]chip id check OK [230]DRAM_VCC set to 1500 mv [233]DRAM CLK =600 MHZ [235]DRAM Type =3 (3:DDR3,4:DDR4,7:LPDDR3,8:LPDDR4) [243]Actual DRAM SIZE =4096 M [246]DRAM SIZE =4096 MBytes, para1 = 310b, para2 = 10000000, dram_tpr13 = 6041 [255]DRAM simple test OK. [257]rtc standby flag is 0x0, super standby flag is 0x0 [263][mmc]: mmc driver ver 2021-10-12 13:56 [267][mmc]: b mmc 2 bias 0 [275][mmc]: Wrong media type 0x0, but host sdc2, try mmc first [281][mmc]: ***Try MMC card 2*** [313]mmc_read_info 1138:region magic is not right, retry more time 0 [331]mmc_read_info 1138:region magic is not right, retry more time 0 [348]mmc_read_info 1138:region magic is not right, retry more time 0 [365]mmc_read_info 1138:region magic is not right, go err 0 [371]dump info registers:[373] 0x36ba4 : [375]0 [376]0 [376]0 [377]0 [378] [378][mmc]: RMCA FAIL! [380][mmc]: mmc read timing info fail [384][mmc]: wrong freq 2 at spd md 2 [388][mmc]: force 25m [391][mmc]: MMC 4.5 [393][mmc]: HSSDR52/SDR25 8 bit [396][mmc]: 25000000 Hz [398][mmc]: 29820 MB [400][mmc]: ***SD/MMC 2 init OK!!!*** [518]read toc1 from emmc 32800 sector [521]OLD version: 0.0 [523]NEW version: 0.0 [599]load rotpk hash [663]load monitor-key hash [665]load monitor hash [870]load boot-key hash [872]load boot hash [938]load vbmeta-key hash [940]load vbmeta hash [1008]load recovery-key hash [1011]load recovery hash [1014]monitor entry=0x48000000 [1017]uboot entry=0x4a000000 [1020]optee entry=0x48600000 [1023]mmc not para [1027]run out of boot0 NOTICE: BL3-1: v1.0(debug):be96482 NOTICE: BL3-1: Built : 18:32:32, 2021-04-21 NOTICE: BL3-1 commit: 8 NOTICE: cpuidle init version V1.0 NOTICE: secure os exist MESSAGE: [0x0] TEE-CORE: OP-TEE version: 5c40397e #1 Tue Feb 2 07:45:37 UTC 2021 arm NOTICE: BL3-1: Preparing for EL3 exit to normal world NOTICE: BL3-1: Next image address = 0x4a000000 NOTICE: BL3-1: Next image spsr = 0x1d3

U-Boot 2018.05 (Jun 22 2022 - 11:19:57 +0800) Allwinner Technology

[01.119]CPU:  Allwinner Family [01.122]Model: sun50iw9 I2C:  ready [01.126]DRAM: 2 GiB [01.129]Relocation Offset is: 75ec5000 [01.168]secure enable bit: 1 [01.171]pmu_axp152_probe pmic_bus_read fail [01.175]PMU: AXP1530 [01.181]CPU=1008 MHz,PLL6=600 Mhz,AHB=200 Mhz, APB1=100Mhz MBus=400Mhz [01.189]drv_disp_init [01.218]__clk_enable: clk is null. [01.224]drv_disp_init finish [01.227]gic: sec monitor mode [01.254]flash init start [01.256]workmode = 0,storage type = 2 [01.260]MMC:    2 [01.261]get mem for descripter OK ! [01.270]get sdc2 sdc_boot0_sup_1v8 fail. [01.275]io is 1.8V

[01.310]rto or no error or software timeout,no need retry [01.317]already at HSSDR52_SDR25 mode [02.234]speed mode: HSSDR52/SDR25 [02.237]---400000Hz: [02.239]--best 255 [02.241]---25000000Hz: [02.243]--best 255 [02.245]---50000000Hz: [02.247]--best 22 [02.249]already at HSSDR52_SDR25 mode [02.252]already at HSSDR52_SDR25 mode [02.256]sunxi flash init ok [02.259]Loading Environment from SUNXI_FLASH... OK secure storage read hdcpkey fail [02.273]secure storage read hdcpkey fail with:-1 secure storage read widevine fail [02.280]secure storage read widevine fail with:-1 [02.286]usb burn from boot delay time 0 weak:otg_phy_config [02.299]usb prepare ok [03.102]overtime [03.106]do_burn_from_boot usb : no usb exist [03.110]boot_gui_init:start FAT: Misaligned buffer address (bbe7e678) 32 bytes read in 4 ms (7.8 KiB/s) [03.393]boot_gui_init:finish [03.396]bmp_name=bootlogo.bmp 2764922 bytes read in 60 ms (43.9 MiB/s) [03.477]get max-frequency ok 100000000 Hz [03.481]1 1 1: 1 1 1 [03.483]delete mmc-hs400-1_8v from dtb [03.486]delete mmc-hs200-1_8v from dtb [03.490]delete mmc-ddr-1_8v from dtb [03.493]get max-frequency ok 50000000 Hz [03.506]update dts [03.517]load file(ULI/factory/rootwait init.txt) error. [03.531]load file(ULI/factory/snum.txt) error. [03.535]name in map mac [03.547]load file(ULI/factory/wifi_mac.txt) error. [03.561]load file(ULI/factory/bt_mac.txt) error. [03.575]load file(ULI/factory/selinux.txt) error. [03.588]load file(ULI/factory/specialstr.txt) error. [03.600]update part info [03.624]update bootcmd [03.626]No ethernet found. Hit any key to stop autoboot: 0 [04.133]not supported key [04.135]actual n size:1000, e:10001 [04.138]exptect n size:800, e:10001 show hash of file 9c 4f 9a 0a a2 d1 89 50 66 7d 92 6a 19 a1 ac 18 ff 0d 01 83 43 4f 99 3f e3 3c eb 1e 68 c1 3d 03
 * Unrecognized filesystem type **
 * Unrecognized filesystem type **
 * Unrecognized filesystem type **
 * Unrecognized filesystem type **
 * Unrecognized filesystem type **
 * Unrecognized filesystem type **

image vbmeta hash valid [04.154]image_len not match, actual:19466240, expected:19234816 [04.159]bmp_name=red_warning.bmp [04.167]sunxi bmp info error : unable to open logo file red_warning.bmp [34.176]mmc exit start [34.211]mmc 2 exit ok
 * Unable to read file red_warning.bmp **

= Pictures =

= Schematic =

= Also known as =

"T95" seems to be a popular name, used in many different TV boxes, with different SoCs. This is the version without any suffix (just "T95"), but make sure you get the "H616" version of it.

= See also =
 * X96 Mate - The device with a U-Boot configuration used to boot the T95 from an SD card (discussed above)

Manufacturer images

 * Potential T95 firmware (Scroll down, look for "T95 Firmware (H616) 2.4G/5G")
 * Use with PhoenixSuit and USB type-A male-male cable