Hacker News Reader

Comment by squarefoot | Hacker News Reader

> CEC, which is used mainly to power TV on/off or switch sources

CEC is much more than that as it allows the use of a single remote instead of two or more, which is super handy; the TV remote sends its commands through the HDMI cable to the active device, so if you switch from TV to an external source like PVR or media center on the TV remote, if that device supports CEC (Kodi on a Raspberry PI does that) you can control it seamlessly through the TV remote. I recently switched my media center from a Raspberry PI 4 to an older (but much faster) unlocked Chromebox whose video chipset doesn't support CEC, so I had to connect an external interface that does USB to CEC conversion. Unfortunately there is only one manufacturer of such interface, which means it's not that cheap. https://www.pulse-eight.com/p/104/usb-hdmi-cec-adapter

View on HN

Some surprising companies have not completely figured out the correct way to use CEC either.

- Apple: When you start an Airplay stream on your phone directed at an Apple TV, the Apple TV doesn't send a switch input command.

- Nintendo: The Nintendo Switch switch input command when waking from sleep is unreliable at best.

- Microsoft: Surprisingly the worst offender. The only switch input command it ever sends is when it wakes from user-induced sleep. If you let the console go to sleep on its own, and wake up the controller and press the big Xbox button, it never sends a CEC command.

People reading this, make sure to enable it in settings. Thought my TV didn't have HDMI-CEC, but it was deep in the settings and unchecked by default.

Some years ago I set to be able to control my smart TV via my laptop. Unfortunately, the graphics card (integrated or discrete) must also support the CEC spec in order to be able to send commands to the TV. Having a HDMI cable is not enough. My laptop did not ship with that requirement.

Also, I don’t know if it changed since I no more have a TV but on my last TV, HDMI CEC was both disabled by default but also renamed with some stupid marketing feature name TV manufacturers are capable of like SmartLink or some shit like this. BTW, it was a LG TV before WebOS.

Yes, some manufacturers give CEC a different name for added confusion; on LG sets it is called SimpLink. The Wikipedia page reports them.

https://en.wikipedia.org/wiki/Consumer_Electronics_Control

Yes ! Thank you ! It was SimpLink.

On the same topic, I once bought a vacuum cleaner on which they wrote on the box « ExtraRangePlus (R) TM: Up to 12m power cable length ». Just why !?

Apple: When you start an Airplay stream on your phone directed at an Apple TV, the Apple TV doesn't send a switch input command.

I think it depends on the equipment combination, and its state.

I'm able to send an Airplay stream to my AppleTV and it both turns on my LG television, and switches the input to the AppleTV.

However, if the TV is already on, and I send an Airplay stream to the TV it will not switch the input. Which I think is an OK measure if you have kids or roommates or the TV is in a public setting so that someone might hijack your viewing as a joke or to be annoying. My memory is that this used to be possible with an earlier model AppleTV, or an earlier version of iOS.

That said, ever since I attached a $23 no-name Chinese DVR to another HDMI input on the same LG TV, the AppleTV no longer has the ability to wake or change inputs. Very strange.

At least for my TV, which is some cheap Element Amazon TV from 2017, my Apple TV has full CEC. It will change input to Apple TV whenever I interact with it, and can turn the TV on directly. So it has to be how the TVs implement things. I've wiped my TV firmware back to 2017, so it's possible newer TVs intentionally break their CEC features to encourage you use their own (bad) smart features?

it's possible newer TVs intentionally break their CEC features to encourage you use their own (bad) smart features?

In my case, the TV is from 2015.

I know because my wife and I just happened to be in an electronics store when the Pope was visiting the United States in 2015, and it was on all of the televisions.

At the time, we had a 32-inch TV from 2003ish, and when my wife saw the Pope on the 65-inch screen in the store, she immediately grabbed a salesperson and said, "I want to see the Pope like that."

So, in case you've ever wondered if the programming on a TV in a store matters, the answer is "sometimes."

> When you start an Airplay stream on your phone directed at an Apple TV, the Apple TV doesn't send a switch input command.

Oh? My Apple TV 4K (2021) turns on the TV and receiver when I start AirPlay, and the receiver switches the input to the AppleTV if it wasn't already on it. This works whether the TV+receiver were on or off. My TV is a Sharp from ~2013, and the receiver is a Yamaha also from around the same time.

I haven’t tested this enough to know if it’s a real hidden feature, or just me placebo-effecting myself, but I swear it takes way less time to wake up my TV (Samsung) if I press the little TV button on the ATV remote 5x really fast.

Like if I press it once, the ATV wakes up and usually the TV does, but often showing the wrong source. 5x fast consistently wakes the TV to the right input.

What is the purpose anyway? Why would a device send a signal to turn on the tv through an HDMI connection, without tuning to that HDMI channel?

That seems to be the main use case, but instead the design forces every source to be a universal remote control.

I use my chromecast to turn my TV on or off with voice commands, even when I just want to watch FTA channels.

So you use your device as a universal remote control. That is not at all the common use case.

I mostly use it so that a 'goodnight' voice command will turn off the TV, no matter what source is selected or what is playing.

So it doesn’t matter at all if the tv switches to a channel or not.

Sony seem to get this right: My PS4 can turn on my TV and switch the input source when it wakes up, but is also clever enough not to do so if you wake the PS4 via remote play (where you are streaming the output to some other device)

However, I think that the issue is that CEC support has never been 100% reliable and interoperable. My TV is also made by Sony, which likely helps with compatibility. Probably all these devices work well with some TVs and not others, despite everything claiming to support CEC.

My PS5 will randomly steal the input from my LG TV's internal smart apps. My Nintendo Switch does whatever it feels like doing at random.

Frankly I find the technology to be a total mess, and there's no way to debug it.

The PS5<>LG interaction is fucked. The TV will wake up all its devices when one of them does, and the PS5 will grab the input even if it wasn't the initiator.

You can disable this in config, but it's all-or-nothing: now the PS5 can't wake the TV at all.

Attempting to report the misbehavior to LG and Sony is like shouting into the void. They don't care, or it's the other entity's problem, or both.

Exactly the same on PS5 <> Philips TV. Needed to turn it off completely.

Wow, sounds like a dream. I had it happen ONCE that my chromecast-with-googleTV did NOT turn on the TV screen when streaming spotify.

Also my xbox turns on the TV, but that never turns on the speaker bar.

Sony TV as well, I guess.

I hadn't noticed that with my Xbox, but then again I may actually have the sleep timeout turned off...

I'm surprised that they'd get it wrong though given that they've properly supported the HDMI VRR and ALLM features since the Xbox One X. (AFAIK Sony doesn't have either of those, even on the PS5. And with Nintendo it's surprising they have any CEC support at all)

I solved the switch input issue by using an automatic HDMI switch from Aliexpress. This thing is remarkably reliable at switching to any source that starts emitting a signal.

I don’t know if there are switches capables of turning on and off the TV based on the presence or lack or signal but that could be the ultimate solution to this issue.

Having worked on a large product that plugs into TVs and uses CEC, I wouldn't be so quick to blame the devices as I would be to blame your TV...

> - Apple: When you start an Airplay stream on your phone directed at an Apple TV, the Apple TV doesn't send a switch input command.

I have almost the opposite problem. Any time I turn on my TV and receiver to use another device (often my Nintendo Switch), the Apple TV somehow wakes up and then switches my receiver's input to itself. (My receiver is my HDMI switcher and has a single HDMI output to my TV.) This is a very annoying problem, and is the only reason I still need to have the receiver's remote nearby.

Another unrelated but incredibly annoying problem I have with this whole setup is that it's essentially impossible to play music through my receiver with my AppleTV without the TV being on. Turning off the TV will, of course, turn off the receiver too.

I have the same issue with my XBox: It gets turned on by the TV (without me wanting this), but fails to turn on or off the TV (which would actually be useful).

You can get a special HDMI cable with the CEC cables disconnected to stop that.

CEC won't work at all then of course, but it will fix that problem.

I've never seen a device that supported CEC where use of it wasn't toggled inside a menu. Both sides of the wire need to accept it.

I've seen millions of comments on AV forums from Apple TV users having problems with CEC.

I don't have an Apple TV. Does it have a setting to disable CEC?

TVs usually have an option to disable (i.e. ignore) it though, at least every one I've owned/helped someone with has.

I can disable CEC on the TV, but of course I want the TV to turn on when I wake up a device. I just want to be able to turn off the TV and have it not turn off the receiver. Picky, I know, but I gathered that we’re deep in “first world problems” here.

Sounds like there is a market for a CEC firewall box. Something $1 ESP8266 based you could configure with a phone/laptop over the air in visual way (webpage) to pick an d choose what can pass in what direction, maybe even with ability to add simple scripts triggered by particular messages. ~$5 BOM ~$15 retail.

I'd buy one.

When Apple TV sends my Samsung TV to "sleep", the TV doesn't fully turn off the display.

In a dark room, you can still see a dim glow coming from the LCD panel that only goes away if I press the power button on the Samsung remote.

:/ works great on my samsung serif as long as its plugged into the port labeled 'hdmi-cec'

Google got it surprisingly well with the Chromecast with Google TV, it can send a power on and off, switch input and even control the actual TV volume through CEC.

I just wish it supported auto-off. It is nice that I can ask it to turn off the TV but I really don't need the screensaver playing forever.

I really like how starting a cast can wake up my whole A/V system.

Are you sure you didn't get bluffed out by their IR emitter?

Chromecast with Google TV contains an IR emitter to handle that, and IR is the default not CEC.

I can change the volume from another floor (I tried out of curiosity), and it also controls the TV volume through the Android TV Remote. My phone doesn't have an IR emitter.

My Switch's CEC is as flaky as yours, but my Xbox One X does wake up the TV from sleep no worries even if I let it go to sleep, last I checked. Though now I really want to double check this, and see whether it's the Xbox that has messed it up, or the Xbox + TV manufacturer combo?

My Apple TV 4K wakes my TV and to the right input with Airplay though!

The Nintendo switch input command seems to work absolutely fine.

Yes, CEC can do much more, but IMO the basic requirement is to power TV on/off properly and control volume, so that I can use whichever HDMI device's remote alone. Everything should be extra.

But yes it can do much more: You can program records over CEC! You can directly select broadcast service! (i.e. not just through key presses, but indeed say which channel you want) You can display some message on TV's OSD! You can discover another device's language! You can make audio 0.1% or 0.01% slower (or 1% and 0.1%? I don't remember)

I don't think I've crossed any device that supports any of the command I just mentioned however.

Though "Dispay some message on TV's OSD" from CEC bus would be perfectly on point based on TFA.

I even programmed my own overlay (app selector) for rpi that listens to CEC commands, so I can use the remote's arrows. Convenient so that I don't need to reach for mouse/keyboard/ssh/phone to start something on the rpi.

Oh neat, I assumed my PVR remote just had an infrared emitter that controlled the TV at the same time as the PVR.

That USB to CEC passthru box is $44.92 for reference. I do wonder what chipset it's using under the hood to do its thing, but given the combination of HDMI licensing/royalty fees, manufacturing tooling, the little custom enclosure it has (looks like molded/formed plastic, if I'm using the right term), then factoring in the low production volume, and considering that this seems to be a smaller operation... I think it's quite plausible the margin on the thing is quite small. Very plausible.

While on the page I was curious if the firmware was open source. While writing this and properly articulating the bit about HDMI royalty (and also just now realizing it might need to deal with HDCP... ah) I now realize the question is moot, but I didn't think of any of what while looking at the webpage, so I wondered if it would be interesting to have a cursory poke at the firmware download.

7-Zip (also available as a commandline program as p7zip-full on debian et al) is honestly grossly understated it its capabilities. I didn't feel like remembering how to invoke binwalk so tried `7z x firmware-v7.exe` almost as a bit of a challenge and it actually worked :)

  $ 7z l ~/Downloads/firmware-v7.exe 
  Path = /home/i336/Downloads/firmware-v7.exe
  Name = WEXTRACT.EXE            .MUI
  OS Version = 6.1
  Image Version = 6.1
  Subsystem Version = 5.0
  Subsystem = Windows GUI
  DLL Characteristics = Relocated NX-Compatible TerminalServerAware
  Comment = FileVersion: 9.0.8112.16421
  FileVersion: 9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
  CompanyName: Microsoft Corporation
  FileDescription: Win32 Cabinet Self-Extractor                                           
  ----
  Path = .rsrc/RCDATA/CABINET
  Type = Cab
  Physical Size = 1348694
  ID = 7086

    Date      Time    Attr         Size   Compressed  Name
  ------------------- ----- ------------ ------------  ------------------------
  2016-04-13 13:05:12 ....A       184800               flash.exe
  2012-08-29 16:19:56 ....A       619536               driver1.exe
  2012-02-21 04:24:52 ....A       816224               driver2.exe
  2012-07-31 15:35:30 ....A          400               flash.cmd
  2012-03-10 11:27:28 ....A        67008               libusb0.dll
  ...

It output even more lines of metadata than I included. I removed probably 50% of output so as not to spam the subthread.

Awesome.

Hmm... what if I do the same to `flash.exe`?

  $ 7z l flash.exe 
  ...
  Linker Version = 10.0
  OS Version = 5.1
  Image Version = 0.0
  Subsystem Version = 5.1
  Subsystem = Windows CUI
  DLL Characteristics = Relocated NX-Compatible TerminalServerAware

     Date      Time    Attr         Size   Compressed  Name
  ------------------- ----- ------------ ------------  ------------------------
  ...
                      .....        67392        67392  .rsrc/RCDATA/101
                      .....         2496         2496  .rsrc/RCDATA/102
  ...
  ------------------- ----- ------------ ------------  ------------------------
  2016-04-13 22:05:07             183568       183568  9 files

HMMmmmm, RCDATA you say?

Extracting (`7z x ../flash.exe` from an empty subdir) produced newline-less ASCII hex output ("EF19541A19D258B099B877545DE0B65BBBC5602..."), so after a bit of `printf "$(cat 101 | sed 's/../\\x&/g')" > 101.bin` I came up with... nothing.

Binwalk has no idea what it is. Perhaps the start of the files ring bells for some humans?

  $ ls -l
  -rw-r--r-- 1 i336 i336 67392 Apr 13  2016 101
  -rw-r--r-- 1 i336 i336 33696 Apr  1 05:46 101.bin
  -rw-r--r-- 1 i336 i336  2496 Apr 13  2016 102
  -rw-r--r-- 1 i336 i336  1248 Apr  1 05:48 102.bin

  $ xxd 101.bin | head -n 5
  00000000: ef19 541a 19d2 58b0 99b8 7754 5de0 b65b  ..T...X...wT]..[
  00000010: bbc5 6020 54e7 ca9a 1fb7 beca 0a39 95c4  ..` T........9..
  00000020: c876 de8a 4705 19a5 9f03 4c56 5d83 9550  .v..G.....LV]..P
  00000030: f5ad 2930 5f07 9b46 21b1 91a0 d091 4685  ..)0_..F!.....F.
  00000040: 3ada 0ce3 305b 49e1 939e 7384 3c5a 5794  :...0[I...s.<ZW.

  $ xxd 102.bin | head -n 5
  00000000: f3f1 7b55 3f33 cbed 426e 1ab7 5792 4425  ..{U?3..Bn..W.D%
  00000010: 8e75 1566 5597 8183 c1ce 9265 6acf 3b73  .u.fU......ej.;s
  00000020: 1370 47b4 5431 399b f73f 0f6a 6323 3329  .pG.T19..?.jc#3)
  00000030: 0e52 25ad 0530 5d03 9393 bc8c 40c8 f0fb  .R%..0].....@...
  00000040: c63c 7ddb 4d3a cd89 ab4a e6c7 cb2f ab4f  .<}.M:...J.../.O

For what it's worth, having realized this might be touching HDCP or for all I know might be an FPGA bitstream, I emphasize my interest is purely coming from a decidedly non-exhaustive sense of "ooh that's a cute product, I wonder what firmware it runs and how it broadly works internally" entirely made up of idle curiosity :)

The intel NUC exposes the CEC pins to the motherboard, and the same company makes an internal USB/CEC adapter for $15 less[1]. That PCB is almost entirely an MCU and a crystal, so the plastic box and HDMI passthrough adds $15.

1: https://www.pulse-eight.com/p/154/intel-nuc-hdmi-cec-adapter

Ah, I see.

The listed photos are just at the wrong angle to be able to read the chip markings (grr)... but I had a bit of a further poke around, and found a listing for a discontinued internal board for HTPC (!) setups: https://www.pulse-eight.com/p/117/internal-hdmi-cec-adapter

A reasonable bit of eye-strain later I at last identified that I was staring at an AT90USB162-15AU. Here's a reference for the -16AU: https://www.mouser.com/ProductDetail/Microchip-Technology-At...

Huh. 16MHz. That answers that then.

(Now I'm a tad more idly curious why the firmware was unreadable.)

If you end buying the product wireshark can capture USB data and then you'll be able to see exactly what data is sent to it when you use their flash util. On windows you'll need to also install USBPcap to capture USB traffic, but if I remember correctly it is bundled with wireshark and just unchecked by default.

Otherwise you might try binwalk with the --disasm option (you'll need capstone installed for it to work) then it will attempt to search files for assembly for any of wide range of processors (obviously would fail if the firmware is encrypted, but I doubt a cheap product like this would bother). I'll also just briefly say that even though RCDATA is microsoft's recommended way to embed a file into an executable I've seen plenty of software that embeds files in other creative ways, so I wouldn't rule out the possibility that the firmware is somewhere else in the executable, binwalks entropy analysis mode can sometimes work firmware that is otherwise hard to locate.

HDCP is unrelated to the CEC bus. CEC is completely separate and unencrypted. The pulse-eight adapter, AFAIK, should just be a female-female connector with two pins plugged into a microcontroller.

I've toyed with the idea of replicating its functionality on an Arduino, but ended up just buying the adapter :)

In the end, I'm not sure how doable it is, but it shouldn't be too complex. Licensing is another matter. I'm at a loss as to why GPU makers don't wire it up though.

I see (TIL a lot about CEC, added some info to a sibling comment).

I incidentally found https://hackaday.io/project/168696-cec2usb while poking around, last updated a couple years ago so probably not available for sale anymore, but open source at least.

Unpacking the files also produces a certificate, and the strings command on the flash.exe executable reveals also references to various related links, so it is possible that the firmware is also encrypted and signed.

  ---
  http://s2.symcb.com0
  http://www.symauth.com/cps0(
  http://www.symauth.com/rpa00
  http://s1.symcb.com/pca3-g5.crl0
  SymantecPKI-1-5670
  Symantec Corporation1
  Symantec Trust Network100.
  Symantec Class 3 SHA256 Code Signing CA
  ---

... etc.

Reply on news.ycombinator.com