Posts Tagged ‘amlogic’
Orange Pi Development Boards

Hacking ARM TrustZone / Secure Boot on Amlogic S905 SoC

October 6th, 2016 4 comments

Amlogic S905 processor used in many Android TV boxes and ODROID-C2 development board implements ARM TrustZone security extensions to run a Trusted Execution Environment (TEE) used for DRM & other security features.


He explains the steps they went through and how they managed to exploit vulnerability to bypass secure boot in a detailed technical blog post.

They first started by looking for info in Amlogic S905 datasheet, but most info about TrustZone had been removed from the public version. So not that much help here except a potential address for BOM Root (ROMBOOT_START   0xD9040000). The next step was to connect the UART pins in order to access the serial console, but he could not read the BootROM from there most probably because you can’t access secure code from an non-secure memory.

However, a closer look at the boot log lead them to find the bootloaders were based on the ARM Trusted Firmware (ATF) reference implementation, which include BL1x (BootROM in SoC), BL2, and BL3x bootloaders as shown in the diagram below.


At this point everything becomes much more technical, as he explains various attempts using U-Boot bootloader, SMC (Secure Monitor Call) interface, and bypassing the Secure Boot chain. The first attempt was a non-stater, the second could have been exploitable but might have required some expert skills and time, but the third one was successful after an analysis of  the mechanism used by BL2 to parse and authenticate the BL31 image, and finding out the cryptographic code came from OSS PolarSSL/mbed TLS project.

Further reverse-engineering of the “authentication” header revealed that BL2 is only using SHA-256 hash to verify the integrity of the firmware, and that there’s no actually authentication. To confirm their findings, they customized a BL31 firmware, updated the SHA-256 hash (using aml-bootloader-tool script), and it would boot, and eventually they managed to dump the BootROM from Amlogic S905 SoC.

That’s the conclusion:

The S905 SoC provides hardware features to support Secure Boot, however OEMs can still choose to enable it or not. But even when Secure Boot is enforced, a flaw in the current version of Amlogic’s BL2 allows to bypass it. So Trusted Execution Environment cannot be trusted. The good news is BL2 can be patched, unlike BootROM.

Amlogic S905L Processor Drops VP9 Codec, TS Inputs for Tuners, and the Camera Interface

September 20th, 2016 8 comments

[Update: I’ve received updated documentation for Amlogic S905X too, and the main differences are only the lack of VP9 codec, and HDMI 2.0b interface]

Amlogic has apparently decided to launch yet another quad core Cortex A53 processor with Amlogic S905L, which appears to be based on  Amlogic S905X with built-in stereo audio codec and 10/100M Ethernet PHY & MAC, HDR support, but without VP9 codec, camera interface, nor TS inputs, so it looks like a cost-down version purely designed for OTT/IP TV boxes.

Click to Enlarge

Click to Enlarge

The document I have is dated June 2016, before the 1.5 GHz “limit” was discovered on Amlogic processors, and the maximum frequency is rated @ 2.0 GHz in the document. Amlogic S905L specifications (based on S905L Quick Referent Manual):

  • CPU – Quad core ARM Cortex-A53 CPU up to 2GHz (DVFS) with Neon and Crypto extensions, unified L2 cache
  • 3D GPU – Penta-core ARM Mali-450 GPU up to 750 MHz+ (DVFS)
  • 2.5D GPU – Fast bitblt engine with dual inputs and single output, programmable raster operations (ROP) and polyphase scaling filter, etc..
  • Crypto Engine – AES/AES-XTS block cipher with 128/192/256 bits keys, DES/TDES block cipher, built-in hardware True Random Number Generator (TRNG), CRC and SHA-1/SHA-2/HMAC SHA engine
  • Video/Picture CODEC
  • Video Post-Processing Engine – HDR10 & HLG HDR processing, motion adaptive 3D noise reduction filter, advanced motion adaptive edge enhancing de-interlacing engine, 3:2 pull-down support, deblocking fliters, etc..
  • Video Output
    • Built-in HDMI 2.0b transmitter including both controller and PHY with CEC, HDR and HDCP 2.2, [email protected] max resolution output
    • CVBS 480i/576i standard definition output
  • Audio Decoder and Input/Output
    • Supports MP3, AAC, WMA, RM, FLAC, Ogg and programmable with 7.1/5.1 down-mixing
    • I2S audio interface supporting 8-channel (7.1) input and output
    • Built-in serial digital audio SPDIF/IEC958 output and PCM input/output
    • Built-in stereo audio DAC
    • Stereo digital microphone PDM input
    • Supports concurrent dual audio stereo channel output with combination of Analog+PCM or I2S+PCM
  • Memory and Storage Interface
    • 16/32-bit SDRAM memory interface running up to DDR2133
    • Supports up to 2GB DDR3/4, DDR3L, LPDDR2, LPDDR3 with dual ranks
    • Supports SLC/MLC/TLC NAND Flash with 60-bit ECC
    • SDSC/SDHC/SDXC card and SDIO interface with 1-bit and 4-bit data bus width supporting up to UHS-I SDR104
    • eMMC and MMC card interface with 1/4/8-bit data bus width fully supporting spec version 5.0 HS400
    • Supports serial 1, 2 or 4-bit NOR Flash via SPI interface
    • Built-in 4k bits One-Time-Programming memory for key storage
  • Network
    • Integrated 10/100M MAC controller with 10/100M PHY interface
    • Supports Energy Efficiency Ethernet (EEE) mode
  • Integrated I/O Controllers and Interfaces
    • Dual USB 2.0 high-speed USB I/O, one USB Host and one USB OTG
    • Multiple UART, I2C and SPI interface with slave select
    • Multiple PWMs
    • Programmable IR remote input/output controllers
    • Built-in 10bit SAR ADC with 2 input channels
    • General Purpose IOs with built-in pull up and pull down
  • System, Peripherals and Misc. Interfaces
    • Integrated general purpose timers, counters, DMA controllers
    • 24 MHz crystal input
    • Embedded debug interface using ICE/JTAG
  • Power Management
    • Multiple external power domains controlled by PMIC, and internal ones controlled by software
    • Multiple sleep modes for CPU, system, DRAM, etc.
    • Multiple internal PLLs for DVFS operation
    • Multi-voltage I/O design for 1.8V and 3.3V
    • Power management auxiliary processor in a dedicated always-on (AO) power domain that can communicate with an external PMIC
  • Security
    • Trustzone based Trusted Execution Environment (TEE)
    • Secured boot, encrypted OTP, encrypted DRAM with memory integrity checker, hardware key ladder and internal control buses and storage
    • Protected memory regions and electric fence data partition
    • Hardware based Trusted Video Path (TVP) , video watermarking and secured contents (needs SecureOS software)
    • Secured IO and secured clock
  • Package – LFBGA,13x13mm, 20×20 ball matrix, 0.65 ball pitch, RoHS compliant

Other notable changes include HDMI 2.0b support, and the Gigabit Ethernet MAC found in Amlogic S905X is now gone, and that’s fine since nobody has used it so far…

Amlogic S905L does not bring new features, but closely matches the requirements of the vast majority of TV boxes on the market, since the camera and tuner interfaces are seldom used, and 4K VP9 videos are still a rarity, except through YouTube app which does not enable 4K on such devices as Android TV operating system is required. All that means is that we should expect more $20 TV boxes soon.

Categories: AMLogic, Android, Hardware Tags: 4k, amlogic, hevc, soc, TV box

Amlogic S905 vs Amlogic S912 Benchmarks Comparison

September 19th, 2016 20 comments

Amlogic has unveiled three new processors this year with Amlogic S905X, S912 and S905D. The latter is not found in devices yet, we’ve seen Amlogic S905X is a bit slower than Amlogic S905, but surely Amlogic S912 with eight Cortex A53 cores and its “multi-core high performance 3D GPU”, namely ARM Mali-T820MP3 must deliver a significant boost in performance. I now have full benchmarks results for two devices: M12N MXQ Plus and Qintaix Q912. M12N is the fastest devices of the two according to benchmarks, and I’ve been told YokaTV KB2 has about the same Antutu score (41K points) as M12N, so I feel confident enough that we have relevant benchmark’s results to compare Amlogic S912 and Amlogic S905 performance using M12N (MXQ Plus) and MINIX NEO U1 TV boxes.


The comparison table below contains scores for Antutu 6.x, Vellamo 3.x, and 3DMark Ice Storm Extreme. MINI NEO U1 runs Android 5.1, while M12N runs Android 6.0, so once/if MINIX NEO U1 gets an Android 6.0 results may differ, likely improve a little bit. It’s also possible Android 6.0 SDK is not that mature, and over time, Amlogic S912 results may improve somewhat too, but nevertheless the results give an overview of the performance that you can expect from devices today (September 2016). Results in green means Amlogic S912 is faster.

Amlogic S905 Amlogic S912 Ratio
CPU* Quad core Cortex A53 @ 1.536 GHz Quad core Cortex A53 @ 1.536 GHz +
Quad core Cortex A53 @ 1.0 GHz
GPU Penta-core ARM Mali-450MP ARM Mali-T820MP3
Antutu 6.x
Overall 38,032 41,303 1.09
3D (1920×1080) 3,979 8,782 2.21
UX 15,690 14,902 0.95
CPU 13,458 13,418 1.00
RAM 4,905 4,201 0.86
Vellamo 3.x
Metal 1,235 1,052 0.85
Multicore 1,589 1,422** 0.89
Browser 2,157 2,758 1.28
3DMark – Ice Storm Extreme v1.2
Total score 4,327 5,752 1.33
Graphics score 3,698 5,304 1.43
Physics score 10,689 8,163 0.76

* CPU-Z and other tools will report 2.02 GHz for both processor, since it’s what’s reported by the kernel, but the actual frequency should be limited to 1.536 GHz, although it might be possible to run up the clock to 1.65 GHz with a firmware change. Amlogic S912 is an octa-core processor using big.LITTLE processing, and the LITTLE cores are clocked at 1.0 GHz according to the values returned by the kernel.

** M12N firmware had a problem to complete one of the Multicore tests, so instead I used the results from Qintaix Q912 since all tests passed, and should be more relevant to the actual performance of Amlogic S912.

So overall, there’s very little performance difference between Amlogic S905 and Amlogic S912, except for 3D graphics where the Mali-T820MP3 GPU used in S912 has a slightly edge over the penta-core Mali-450MP used in S905, with performance improvements up to 1.43x in 3DMark Ice Storm Extreme graphics score. The Antutu 3D score is 2.21 times higher, but it’s because Mali-T820MP3 supports OpenGL ES 3.1, and Mali-450MP does not.

They are however other advantages of Amlogic S912 over Amlogic S905 TV Boxes including Android 6.0 firmware by default, 4K VP9 hardware decoding, and HDR (High Dynamic Range support). Now, if you don’t care about the last three, there are very little incentives to upgrade from Amlogic S905 to Amlogic S912, and if you don’t own a TV box yet, buying an Amlogic S905 TV box would offer a better price to performance ratio, all other specs being equal.

Kodi 17 Setup and Audio/Video Support in Amlogic S912 TV Boxes (as of September 2016)

September 16th, 2016 6 comments

Most people installing Kodi are going to select Kodi 16.1 as of today, since it is the latest stable release. But I’m currently reviewing Qintaix Q912 TV box based on Amlogic S912 octa-core processor, whose Android 6.0 firmware includes Kodi 17 Alpha 3, so since that’s the first time I run Kodi 17 “Krypton”. I’ve decided to report my experience about the interface, and the current status about audio and video support by testing some 4K videos, and audio files. I used the latest available firmware for the test.

Click to Enlarge

Click to Enlarge

Kodi 17 can be found on the main launcher, and for the first launch, we’ll see the default skin has been replaced from Confluence to the new Estuary skin.

Click to Enlarge

Click to Enlarge

It’s a little confusing a first. We can access the setup menu by going to the icon on the bottom left, just on the right on the power button, and then select System Information to confirm Kodi 17 Alpha 3 is installed on the device.


Click to Enlarge

Once of the first thing I normally setup in Kodi Android is automatic frame rate switching option, It can be found in Settings->Player Settings->Videos, after setting options to Advanced. I can then set Adjust display refresh rate to On start / stop as I did in Kodi 16.1.

Click to Enlarge

Click to Enlarge

I also setup HDMI audio pass-through by going to Settings->System settings->Audio, Enable passthrough and the other relevant options including Dolby Digital (AC3), DTS, and DTS-HD. There’s no TrueHD option in Kodi 17, at least in the version loaded in Qintaix Q912.

Click to Enlarge

Click to Enlarge

I also added a SAMBA share to play my test videos. The procedure has slightly changed due to the new skin. Go to Videos, then select the Files icon on the top right, and you’ll be able to click on Add videos and browse Windows network (SMB) shares to add your own.

Click to Enlarge

Click to Enlarge

Now that everything is setup, it’s time to test some 4K videos:

  • 4K Hawaii Sunset _ GoPro Hero 4 Black [email protected] (No Audio) – OK
  • Beauty_3840x2160_120fps_420_8bit_HEVC_MP4.mp4 (H.265 @ 30 fps – No audio) – OK
  • big_buck_bunny_4k_H264_30fps.mp4 (H.264 @ 30 fps – MPEG1/2 and AC3 audio) – OK (when audio pass-through disabled)
  • BT.2020.20140602.ts (H.265 Rec.2020 compliant – AAC audio) – OK
  • Fifa_WorldCup2014_Uruguay-Colombia_4K-x265.mp4 (H.265 @ 60 fps – AC3) – OK
  • Samsung_UHD_Dubai_10-bit_HEVC_51.4Mbps.ts (10-bit HEVC / MPEG-4 AAC) – OK
  • The.Curvature.of.Earth.4K.60FPS-YT-UceRgEyfSsc.VP9.3840×2160.OPUS.160K.webm – Watchable, but not perfectly smooth. Same result as on other S905X / S912 TV boxes
  • Tara-no9-webm (4K / VP9 @ 59.940 fps) – OK

So it’s not too bad as all videos above play smoothly with hardware decoding, except automatic frame rate switching is not working, and there are two black bars on the sides of the video. I tried to change the View mode to Zoom, but then there’s some “frame jumping” – for the lack of a better word – going on, as you’ll see in the video below.

The next step was to try HDMI audio pass-through, and my DD 5.1 sample worked fine, however big_buck_bunny_4k_H264_30fps.mp4 above had frequent audio cuts, and it also slowed down the video. TrueHD is not supported at all, and audio will be downmixed to PCM 2.0, while videos with DTS-HD and DTS-X audio would just show a black screen (3 out of 3 of them), and no audio.

The good news is that hardware decoding of 8-bit and 10-bit H.265 and VP9 is working quite well even in the alpha version of Kodi 17, but there are still bugs to fix, as expected, and audio pass-through is not usable.

Amlogic S905, S905X, and S912 Processors Appear to be Limited to 1.5 GHz, not 2 GHz as Advertised

August 28th, 2016 161 comments

When I compared the performance Amlogic S905 and Rockchip RK3368 processors  last year, I noticed Amlogic S905 single thread performance not being much faster than the one of Rockchip RK3368, despite the former allegedly clocked at 2.0 GHz against the latter 1.2 GHz. But early this month one member (koschi) on ODROID forums started a thread entitled “No performance difference between 1.5, 1.75 & 2GHz” about ODROID-C2 board.


The first post link to Ant-computing website about choosing a processor for a build farm, and one of the tables comparing various ARM and x86 processors with the claim that Amlogic S905 was listed to 1.536 GHz, because “the device claims to run at 2.016 GHz but the kernel silently ignores frequencies above 1.536 GHz!”

ARM_x86_CPU_Comparison_TableSo koschi did his own tests with 7z and sysbench, using cpufreq-set -u $FREQ to set a fixed frequency between test, and could confirm the issue:

So it looks like Amlogic is cheating with the frequencies, and anything above 1.536 GHz does not change the results… There has been many comments in the thread with others confirming the issue. Hardkernel investigated the issue, and the answer while truthful is disappointing:

Please don’t waste your valuable time.
All the Coretex-A53 based Amlogic SoCs have the same issue. S905, S905 Rev-C(S905H), S905X and even S912.
The kernel clock frequency 1.75 and 2Ghz do not exist in the BL3x blobs.
It must be Amlogic’s fault. But we should detect it earlier in our internal development stage. Really sorry about that mistake.

We’ve been modifying/testing the BL3x code to find a maximum feasible/stable clocks like 1.53Ghz, 1.58Ghz, 1.61Ghz, 1.65Ghz, 1.68Ghz, 1.71Ghz, etc for a couple of weeks.
But 1.65Ghz seems to be the maximum one due to some power and heat issues. We will run the burnA53 on Ubuntu and the Stress app on Android with 10 set of C2 boards in this weekend (for 48 hours stability test) to make sure it.
Once we will have a test result, we will report it on this thread with update package for further sampling test in early next week.

If we disable two cores, the SoC can run up to 1.75Ghz probably. But we need further stability test too.
And yes. I fully agree most people don’t like this approach.

Anyway, we know well 1.65Ghz or 1.75Ghz is still very far from the 2Ghz. So we will change the C2 specification in our home page next week as per the test result.
And we must consider some compensation for C2 users. But we need to check what we can do first.

Please accept my sincere apologies for the mistake and kindly understand our situation.

The only good news is that the limit might not be 1.5 GHz, and possibly closer to 1.7 GHz, with the final number pending Hardkernel burn-in test results. That issue will not only affect ODROID boards, but also any other devices based on Amlogic S905, S905X, and S912 processors.

Thanks to Tim for the tip.

Amlogic Releases Linux 3.14 Source Code for S905X, S905D, and S912 Processors, Has Started Working on Linux 4.4 / Android 7.0

August 19th, 2016 26 comments

Amlogic has just released buildroot with Linux 3.14 with support for Amlogic S905X (p212 board), S905D (p230 board), and S912 (Q200 board) processors, and the company appears to have started working on Linux 4.4 likely for future support for Android 7.0.

Amlogic_S912_Linux_BuildrootYou can check the source code as follows:

If you have the wrong toolchain the code won’t build (See comments section). So I installed several toolchains provided by Amlogic (all may not be needed) in /opt:

I also downloaded a shell script to add the toolchains to my path:

Once toolchains are setup, you can select one of three boards config (Q200 / S912 as example) and start building the code:

If you are interested in S905X or S905D instead, use respectively mesongxl_p212_release_defconfig or mesongxl_p230_release_defconfig.

I built both S912:

and S905X images successfully:

Separately, you can also find buildroot for Linux 4.4, but this is very likely very early work, and should be used together with Amlogic Android 7.0 SDK once it is released.

M12N Amlogic S912 TV Box Benchmarks

August 17th, 2016 19 comments

Since Shenzhen Shiningworth MXQ Plus M12N is my first TV box powered by Amlogic S912 octa-core processor, I’ve decided to write a separate post to show system information with CPU-Z, and benchmark results with Antutu 6.x, Vellamo 3.x, and 3Dmark Ice Storm Extreme. Please note that it may not be representative of all Amlogic S912 boards, as mentioned in the teardown post, there are some concerns about the thermal design of M12N TV box.

M12N / Amlogic S912 System Info

I’ve merged CPU-Z’ SOC, DEVICE and SYSTEM data into a single table.

Click to Enlarge

Click to Enlarge

The app correctly detects an 8 core Cortex A53 processor @ 100 MHz to 2.02 GHz with an ARM Mali-T820 GPU. The brand for this particurlar device is MXQ, and Model m12n. Frame buffer resolution is 1920×1080, and memory and storage data are both OK for a box with 2GB and 16GB flash. The device runs Android 6.0.1 on top of Linux 3.14.29.

M12N / Amlogic S912 Benchmarks

With 8 cores and a faster GPU, I was expecting a much higher Antutu 6.x score with Amlogic S912.

The box however only achieved 41,303 points in Antutu 6.2, which compared to 38,032 points on Amlogic S905 based MINIX NEO U1 running Android 5.1 with the same Android 6.x benchmark. The 3D score is naturally higher because of the fast GPU, and also begin the MaliT-820MP3 GPU also supports OpenGL ES 3.1, which was skipped on Amlogic S905. UX, CPU and RAM scores are about the same, or slightly lower in Amlogic S912. So there’s a problem here either because of thermal design, or Android 6.0 Amlogic SDK still needs some work. I launched the benchmark again another day, and got 38,798 points.. 3D was a little higher (9,353), UX and CPU slightly lower (14,088 + 12,414), but RAM test collapse d to 2,943 points.

Vellamo 3.2 offers some more perspective, and one of the Multicore tests failed (see yellow “warning” triangle) because of a “Sysbench issue with Finepar: Invalid CPU mode”.
For reference, MINIX NEO U1, one of the fastest and most stable Amlogic S905 TV boxes, got respectively 1,587, 1,235, and 2,157 points for Multicore, Metal, and Browser scores. Again, that’s not a pretty picture for Amlogic S912 or M12N TV box.

3Dmark Ice Storm Extreme provides a slightly more positive picture.

Click to Enlarge

Click to Enlarge

M12N achieved 5,752 points, against only 4,327 points for MINIX NEO U1. You’ll also note the CPU frequency appears to maxes out at 1.5 or 1.6 GHz instead of the claimed 2.02 GHz. M12N score is quite lower than the 7,512 points achieved in Rockchip RK3288 (ARM Mali-764 GPU) based Tronsmart Orion R28 running Android 4.4, and released in 2014.

Results are quite lower than what I would have expected, so there could be a problem with cooling (despite the rather short Android benchmarks), and/or Android 6.0 Amlogic SDK or M12N firmware might need some more work.

Amlogic S905 vs S905X Benchmarks Comparison

July 31st, 2016 25 comments

We’ve already compared the main features between Amlogic S905, Amlogic S905X and Amlogic S912, with Amlogic S905X being an upgrade of Amlogic S905 with the same quad core Cortex A53 cores and Mali-450MP GPU but adding VP9 hard ware decoding, HDR support,  and integrating 10/100 Ethernet PHY and audio codec to lower the cost. The CPU frequency was also said to be lowered to 1.5 GHz in early document, but TV manufacturers keep promoting Amlogic S905 as a 2.0 GHz processor, and I noticed CPU-Z and Antutu also reported the maximum frequency to be 2.02 GHz.

Amlogic_S905_vs_Amlogic_S905XIn that case the performance should be about the same for both processors. Let’s find out by comparing benchmark results between Amlogic S905 based MINIX NEO U1 (Android 5.1) and Amlogic S905X powered MINI M8S II  (Android 6.0) using Antutu 6.x, Vellamo 3.x, and 3DMark Ice Storm Extreme 1.2. A ratio greater than one means Amlogic S905X is the fastest for a given test.

Amlogic S905 Amlogic S905X Ratio
CPU Quad core Cortex A53 @ 1.5 GHz* Quad core Cortex A53 @ 1.5 GHz*
GPU Penta-core ARM Mali-450MP Penta-core ARM Mali-450MP
Antutu 6.x
Overall 38,032 33,553 0.88
3D (1920×1080) 3,979 3,099 0.78
UX 15,690 12,365 0.79
CPU 13,458 12,438 0.92
RAM 4,905 5,651 1.15
Vellamo 3.x
Metal 1,235 910 0.74
Multicore 1,589 1,491 0.94
Browser 2,157 1,855 0.86
3DMark – Ice Storm Extreme v1.2
Total score 4,327 4,183 0.97
Graphics score 3,698 3,709 1.00
Physics score 10,689 7,561 0.71

[*Update: Amlogic S9xx processors have recently been found to be limited to 1.5 GHz only]

Please note that currently most S905 TV boxes run Android 5.1, while Amlogic S905X devices are already running Android 6.0, so the latter may benefit from some small performance boosts due to more recent firmware. But in any case, that represents a side-by-side comparison of what you can expect from devices sold on July/August 2016, although some Amlogic S905 devices are now getting Android 6.0 Marshmallow firmware updates.

The main takeaway is that you should expect slightly lower performance from Amlogic S905X compared to S905, so the new processor is only interesting if you need 4K VP9 hardware decoding (not usable for YouTube 4K, except in the upcoming Xiaomi Mi Box), and/or High Dynamic Range support, or if the price is cheaper compared to an equivalent S905 TV box.