s905x5m: BM201 / Amlogic S905X5M (S7D)
s905x5m is a hardware board. Its images are built and verified like every
other board’s, and no step of installing or booting one has been recorded on
a unit: every physical statement on this page is unverified.
The board has two storage layouts. s905x5m.basic and s905x5m.emmc-full put
the system on the eMMC and are installed whole, loader included, as a USB
burning package. s905x5m.sd-full puts the system on an SD card and needs the
matching Mica OS U-Boot in the board’s eMMC boot0, which its release carries
as a second package.
Status is owned by the status table.
At a glance
Section titled “At a glance”| Hardware | X88 Pro X5M / BM201 development units |
| SoC | Amlogic S905X5M (S7D) |
| Architecture | arm64 |
| Boot chain | Mica OS Amlogic firmware in eMMC boot0 → required signed FIT, its public key embedded in the loader’s control DTB → signed kernel and authenticated native init → SYSTEM → signed verity root/support → systemd |
| Firmware form | U-Boot lives in eMMC boot0, never in the disk image |
| Partitions | FIRMWARE / SYSTEM / DATA, on SD or on the eMMC user area |
| Kernel and U-Boot | vendor trees, pinned with their patches in mica-build:boards/s905x5m/bsp.env |
| Tier | bring-up |
| Boot assurance | I1; no hardware-rooted claim |
Opaque Amlogic stages sit in front of U-Boot. Automatic boot arms the 60-second Meson watchdog before it consumes an attempt, and imports no U-Boot environment and no boot script.
Hardware and feature state
Section titled “Hardware and feature state”BOARD_FEATURES="wifi bluetooth display audio containers". Every physical row
is untested.
| Feature | State | Note |
|---|---|---|
| Containers (Podman) | ships in sd-full and emmc-full |
— |
| Wi-Fi | declared, untested on hardware | Seekwave firmware over SDIO |
| Bluetooth | declared, untested on hardware | pairing keys and the derived controller address persist on DATA |
| Factory access point | ships in sd-full and emmc-full, untested on hardware |
on out of the box, with the station off; name and key from the device code and the product secret, printed on the label and valid until the claim (mica-core:docs/factory-ap-key.md) |
| Device code | ships | source emmc-cid, the eMMC chip identifier; survives reflashing |
| BLE provisioning | ships in sd-full and emmc-full, untested on hardware |
a phone sets the WiFi network and claims an unclaimed device (first run section 5) |
| Independent radio selection | verified by fixtures | declining Wi-Fi keeps the shared SDIO transport if Bluetooth still needs it |
| Audio | declared, untested on hardware | ALSA routing set at hardware initialisation |
| HDMI display | declared, untested on hardware | depends on the vendor display initialisation |
| Ethernet, USB | in the kernel and device tree | not qualified |
| BM201 front panel | ships | a clock and link-status service |
| RTC | retention untested | — |
| Status LED | none | the board declares none |
| Physical recovery action | none | credential recovery and full-factory reset are refused |
status: board-dependent — evidence:
mica-build:boards/s905x5m/board.env,mica-build:boards/s905x5m/evidence.json,mica-build:boards/s905x5m/README.md
Partition layout
Section titled “Partition layout”On SD (sd-full):
| Partition | Range | Note |
|---|---|---|
FIRMWARE |
sector 64 to 128 MiB | carries no boot loader: two 64 KiB boot records at 120 and 124 MiB, and padding |
SYSTEM |
128–1152 MiB | ext4 + verity |
DATA |
from 1152 MiB, 256 MiB at the factory | the only partition that grows |
On eMMC (basic, emmc-full), beside the vendor’s own partitions, which are preserved:
| Partition | Range | Note |
|---|---|---|
firmware |
128–136 MiB | the two boot records |
system |
136–1160 MiB | ext4 + verity |
data |
from 1160 MiB, 256 MiB at the factory | the only partition that grows |
The authoritative geometry is mica-build:boards/s905x5m/layout.tsv and
mica-build:boards/s905x5m/layout-emmc.tsv. An ordinary update never writes
the firmware in boot0.
Console
Section titled “Console”Serial ttyS0 at 921600 baud, with earlycon=aml_uart,0xfe07a000.
Confirm the connector and voltage against the specific board’s hardware
record before wiring.
Obtaining an image
Section titled “Obtaining an image”The products, each released as s905x5m.<variant>.<YYYYMMDD-HHMM>:
| Product | Storage | Containers | Its release carries |
|---|---|---|---|
s905x5m.basic (the default) |
eMMC | no | the USB burning package, .burn.img.gz |
s905x5m.emmc-full |
eMMC | yes | the USB burning package, .burn.img.gz |
s905x5m.sd-full |
SD | yes | the disk image, .img.gz, and the boot loader package, .sd-boot.img.gz |
Every release also carries its update archives. Verification is in download.
Flashing
Section titled “Flashing”Onto eMMC (basic, emmc-full), unverified. The USB burning package is an Amlogic
v2 burning image for the vendor USB Burning Tool. It writes the partition
table, both bootloader targets, the vendor device tree and the three Mica OS
partitions, and leaves the vendor’s other partitions alone. Holding the
recovery key at power-on puts the board into USB burning mode. The build
unpacks every package it makes and proves each payload is its source; nobody
has burned one onto a unit.
Onto SD (sd-full), unverified. Write the decompressed disk image to the
whole card. Writing it installs no boot loader: the image covers
FIRMWARE, SYSTEM and DATA only, and the board starts from it only when its
eMMC boot0 already carries the matching Mica OS U-Boot. That is the boot
loader package beside the image in the same release, a USB burning package
installed over the same USB burning mode
(mica-build:boards/s905x5m/loader/README.md).
Detail is in flashing section 6.
status: unsupported
First boot
Section titled “First boot”A one-second console countdown that consumes no attempt, then the watchdog is armed, a boot record is selected, the attempt is persisted and read back, and the FIT is verified. DATA grows on first boot. None of this has run on hardware.
Updates
Section titled “Updates”full, root and kernel archives are published. An ordinary update never touches the firmware in eMMC boot0, and the
generic firmware maintenance deliberately refuses this board’s boot target.
See updates and rollback.
Nothing in these repositories starts this board’s images, so the update path has no end-to-end record here.
Recovery
Section titled “Recovery”- Available on a device that boots: read-only diagnosis, manual rollback, configuration reset, application-data reset.
- Unavailable: credential recovery and full-factory reset, for want of a declared physical recovery action.
- The floor is Amlogic USB burning mode, entered with the recovery key at power-on. It is open to anyone with physical access, and it is this board’s recorded physical-access boundary. It costs every partition and the device identity.
- There is no secure erase.
See recovery.
Known limitations
Section titled “Known limitations”- SD boot requires the matching Mica OS firmware in eMMC boot0; the original vendor firmware does not implement the signed-file policy.
- Opaque Amlogic stages and radio firmware keep their auditability and distribution-licence limits.
- The loader does not rebuild byte-identically, because the vendor signing step is not deterministic.
- No physical row is recorded, and Bluetooth pairing against a controlled peer is untested.
Qualification results
Section titled “Qualification results”Binding: BM201 development units; no additional PCB, RAM, storage or radio variant is covered.
Owners: the Mica OS project owns the port and its qualification; there is no integrator of record, and no matrix run on a unit is on file.
Rows from off-hardware gates speak for their own surface and are never a hardware pass.
| Row | Result | Date | Evidence / reason |
|---|---|---|---|
| Kernel, required-key firmware and recovery package builds | pass | 2026-09-10 | final configurations, the key checked in the decompressed loader, package round-trip |
| Boot record policy and transaction fault recovery | pass | 2026-09-10 | the board’s C harness and the shared IO-fault gate |
| Independent radio selection | pass | 2026-09-10 | four Wi-Fi/Bluetooth selection fixtures |
| Required FIT signatures and key rotation | pass | 2026-09-10 | modified, missing and unknown-key refusals; overlap and removal |
| Complete SD image and protected DATA growth | pass | 2026-09-10 | offline image checks; DATA-only growth preserving every FIRMWARE and SYSTEM byte |
| Installation and first boot | not tested | — | needs a physical BM201 |
| Cold boot and warm boot | not tested | — | needs a physical BM201 |
| A/B switch and update | not tested | — | needs a physical BM201 |
| Power-cut during update | not tested | — | needs a physical BM201 and a power-cut rig |
| Watchdog/reset cause | not tested | — | needs a physical BM201 |
| Network/radio, audio, display, USB | not tested | — | needs a physical BM201 |
| Recovery | not tested | — | USB burning mode is described, not driven |
status: board-dependent — evidence:
mica-build:boards/s905x5m/evidence.json,mica-build:boards/s905x5m/images.tsv,mica-build:tests/suites/lifecycle-uboot-fit