Hacking ARM TrustZone / Secure Boot on Amlogic S905 SoC

Amlogic S905 processor used in many Android TV boxes and ODROID-C2 development board implements ARM TrustZone security extensions to run a Trusted Execution Environment (TEE) used for DRM & other security features. However, Frédéric Basse, a security engineer, worked with others and managed to bypass secure boot in one Amlogic S905 powered Android TV box, namely Inphic i7, but any other device based on the processor would have made the same thing possible. He explains the steps they went through and how they managed to exploit vulnerability to bypass secure boot in a detailed technical blog post. They first started by looking for info in Amlogic S905 datasheet, but most info about TrustZone had been removed from the public version. So not that much help here except a potential address for BOM Root (ROMBOOT_START   0xD9040000). The next step was to connect the UART pins in order to access the […]

Amlogic S905L Processor Drops VP9 Codec, TS Inputs for Tuners, and the Camera Interface

[Update: I’ve received updated documentation for Amlogic S905X too, and the main differences are only the lack of VP9 codec, and HDMI 2.0b interface] Amlogic has apparently decided to launch yet another quad core Cortex A53 processor with Amlogic S905L, which appears to be based on  Amlogic S905X with built-in stereo audio codec and 10/100M Ethernet PHY & MAC, HDR support, but without VP9 codec, camera interface, nor TS inputs, so it looks like a cost-down version purely designed for OTT/IP TV boxes. The document I have is dated June 2016, before the 1.5 GHz “limit” was discovered on Amlogic processors, and the maximum frequency is rated @ 2.0 GHz in the document. Amlogic S905L specifications (based on S905L Quick Referent Manual): CPU – Quad core ARM Cortex-A53 CPU up to 2GHz (DVFS) with Neon and Crypto extensions, unified L2 cache 3D GPU – Penta-core ARM Mali-450 GPU up to […]

Amlogic S905 vs Amlogic S912 Benchmarks Comparison

Amlogic has unveiled three new processors this year with Amlogic S905X, S912 and S905D. The latter is not found in devices yet, we’ve seen Amlogic S905X is a bit slower than Amlogic S905, but surely Amlogic S912 with eight Cortex A53 cores and its “multi-core high performance 3D GPU”, namely ARM Mali-T820MP3 must deliver a significant boost in performance. I now have full benchmarks results for two devices: M12N MXQ Plus and Qintaix Q912. M12N is the fastest devices of the two according to benchmarks, and I’ve been told YokaTV KB2 has about the same Antutu score (41K points) as M12N, so I feel confident enough that we have relevant benchmark’s results to compare Amlogic S912 and Amlogic S905 performance using M12N (MXQ Plus) and MINIX NEO U1 TV boxes. The comparison table below contains scores for Antutu 6.x, Vellamo 3.x, and 3DMark Ice Storm Extreme. MINI NEO U1 runs […]

Kodi 17 Setup and Audio/Video Support in Amlogic S912 TV Boxes (as of September 2016)

Most people installing Kodi are going to select Kodi 16.1 as of today, since it is the latest stable release. But I’m currently reviewing Qintaix Q912 TV box based on Amlogic S912 octa-core processor, whose Android 6.0 firmware includes Kodi 17 Alpha 3, so since that’s the first time I run Kodi 17 “Krypton”. I’ve decided to report my experience about the interface, and the current status about audio and video support by testing some 4K videos, and audio files. I used the latest available firmware for the test. Kodi 17 can be found on the main launcher, and for the first launch, we’ll see the default skin has been replaced from Confluence to the new Estuary skin. It’s a little confusing a first. We can access the setup menu by going to the icon on the bottom left, just on the right on the power button, and then select […]

Amlogic S905, S905X, and S912 Processors Appear to be Limited to 1.5 GHz, not 2 GHz as Advertised

When I compared the performance Amlogic S905 and Rockchip RK3368 processors  last year, I noticed Amlogic S905 single thread performance not being much faster than the one of Rockchip RK3368, despite the former allegedly clocked at 2.0 GHz against the latter 1.2 GHz. But early this month one member (koschi) on ODROID forums started a thread entitled “No performance difference between 1.5, 1.75 & 2GHz” about ODROID-C2 board. The first post link to Ant-computing website about choosing a processor for a build farm, and one of the tables comparing various ARM and x86 processors with the claim that Amlogic S905 was listed to 1.536 GHz, because “the device claims to run at 2.016 GHz but the kernel silently ignores frequencies above 1.536 GHz!” So koschi did his own tests with 7z and sysbench, using cpufreq-set -u $FREQ to set a fixed frequency between test, and could confirm the issue:

[…]

Amlogic Releases Linux 3.14 Source Code for S905X, S905D, and S912 Processors, Has Started Working on Linux 4.4 / Android 7.0

Amlogic has just released buildroot with Linux 3.14 with support for Amlogic S905X (p212 board), S905D (p230 board), and S912 (Q200 board) processors, and the company appears to have started working on Linux 4.4 likely for future support for Android 7.0. You can check the source code as follows:

If you have the wrong toolchain the code won’t build (See comments section). So I installed several toolchains provided by Amlogic (all may not be needed) in /opt:

I also downloaded a shell script to add the toolchains to my path:

Once toolchains are setup, you can select one of three boards config (Q200 / S912 as example) and start building the code:

If you are interested in S905X or S905D instead, use respectively mesongxl_p212_release_defconfig or mesongxl_p230_release_defconfig. I built both S912:

and S905X images successfully:

Separately, you can also find buildroot for Linux 4.4, but […]

M12N Amlogic S912 TV Box Benchmarks

Since Shenzhen Shiningworth MXQ Plus M12N is my first TV box powered by Amlogic S912 octa-core processor, I’ve decided to write a separate post to show system information with CPU-Z, and benchmark results with Antutu 6.x, Vellamo 3.x, and 3Dmark Ice Storm Extreme. Please note that it may not be representative of all Amlogic S912 boards, as mentioned in the teardown post, there are some concerns about the thermal design of M12N TV box. M12N / Amlogic S912 System Info I’ve merged CPU-Z’ SOC, DEVICE and SYSTEM data into a single table. The app correctly detects an 8 core Cortex A53 processor @ 100 MHz to 2.02 GHz with an ARM Mali-T820 GPU. The brand for this particurlar device is MXQ, and Model m12n. Frame buffer resolution is 1920×1080, and memory and storage data are both OK for a box with 2GB and 16GB flash. The device runs Android 6.0.1 […]

Amlogic S905 vs S905X Benchmarks Comparison

We’ve already compared the main features between Amlogic S905, Amlogic S905X and Amlogic S912, with Amlogic S905X being an upgrade of Amlogic S905 with the same quad core Cortex A53 cores and Mali-450MP GPU but adding VP9 hard ware decoding, HDR support,  and integrating 10/100 Ethernet PHY and audio codec to lower the cost. The CPU frequency was also said to be lowered to 1.5 GHz in early document, but TV manufacturers keep promoting Amlogic S905 as a 2.0 GHz processor, and I noticed CPU-Z and Antutu also reported the maximum frequency to be 2.02 GHz. In that case the performance should be about the same for both processors. Let’s find out by comparing benchmark results between Amlogic S905 based MINIX NEO U1 (Android 5.1) and Amlogic S905X powered MINI M8S II  (Android 6.0) using Antutu 6.x, Vellamo 3.x, and 3DMark Ice Storm Extreme 1.2. A ratio greater than one […]

EmbeddedTS embedded systems design