Its not like that, this is setup window on samsung for universal remote
Can’t really help you with that, sorry. My LG TV picks up the device without problem.
I don’t know why you’d need a CEC Wizard…
Do you have the Anynet+/HDMI-CEC option active on Samsung Menu (General - External Device Manager)?
A post was split to a new topic: Unsigned code loader for Amlogic bootrom
hey @edragon i really need it can u send me
I want to share my expirience with A95X F3 Air box. And ask some more questions 
I’m running CE 21.2 with no major issues. I’m using ethernet, bluetooth (with slight issues, i had to disable SecureConnections in bluez main.conf, if someone is interested in that i can share more info), VFD, HDMI-CEC, video only in full-hd, audio pass through, wifi seems to work as it finds some APs but i’m not using it.
Generally the box is working as expected, pretty fast.
Now I wanted to tinker with it a little bit and I was trying to install it on emmc.
I used ceemmc -x ant it gave me no errors, but after rebooting without SD card the box goes to android. Booting it with SD card goes to CE and ceemmc -x tells me that CE is not installed on EMMC.
I started to search was might be the casue, and I learned something about the emmc installation process of CE.
So, the amlogic has its proprietary partition table defined in the emmc which is described here and may be decoded with that.
Upon CE boot, all the emmc partitions are installed in /dev (ls -al /dev/block/).
The partition table is defined on partition called “reserved”, and this partitions also contains device tree which is encrypted in case of a95x F3 Air box.
The ceemmc tool is modifying this “reserved” partition by shrinking “data” partition a little bit and squeezing there another partition for all the stuff that goes to /flash partition on SD card CE installation. It seems like it also modifies u-boot environment to change the boot process a little bit. Namely, it adds a step where it searches for fat partition with cfgload file which in turn contains script for booting CE. So, it should find this last partition with /flash content and boot that.
So everything makes sense and looks as it should be but … after reboot the “reserved” partition magically looses its changes made by ceemmc tool 
There is no more CE_STORAGE and CE_FLASH labeled partitions (created by ceemmc tool) and ceemmc reports that CE is not instdalled on emmc … Funny enough that if I make a copy of modified “reserverd” partition after ceemmc changes and restore it after reset, the ceemmc tool says that CE IS installed on emmc 
So my question is, how the heck this “reserved” partition “reverts” to original version after reboot ? One thing I noticed is that the boot screen looks like the u-boot runs twice after ceemmc installation (I have no logs from u-boot, but propably I will need to get them somehow).
Maybe your u-boot fixes itself.
Yeah, that would be an explanation. But, I do not see anything in u-boot env that would do that. And how it would know that it must fix itself if the only thing that is changed is the reserved partition layout ?
I will report back with u-boot logs if I manage to get them. In the mean time here are u-boot envs:
EnableSelinux=permissive
Irq_check_en=0
active_slot=normal
aml_dt=sm1_ac213_4g
baudrate=115200
bcb_cmd=get_avb_mode;get_valid_slot;
boot_part=boot
bootcmd=if test ${bootfromnand} = 1; then setenv bootfromnand 0; saveenv; else run bootfromsd; run bootfromusb; run bootfromemmc; fi; run storeboot
bootdelay=1
bootfromemmc=run cfgloademmc
bootfromnand=0
bootfromsd=if mmcinfo; then run cfgloadsd; if fatload mmc 0 ${loadaddr} kernel.img; then run sddtb; setenv bootargs ${bootargs} bootfromsd; bootm; fi; fi
bootfromusb=usb start 0; run cfgloadusb; if fatload usb 0 ${loadaddr} kernel.img; then run usbdtb; setenv bootargs ${bootargs} bootfromusb; bootm; fi
ce_on_emmc=no
cfgloademmc=for p in 1 2 3 4 5 6 7 8 9 A B C D E F 10 11 12 13 14 15 16 17 18; do if fatload mmc 1:${p} ${loadaddr} cfgload; then setenv device mmc; setenv devnr 1; setenv partnr ${p}; setenv ce_on_emmc "yes"; autoscr ${loadaddr}; fi; done;
cfgloadsd=if fatload mmc 0:1 ${loadaddr} cfgload; then setenv device mmc; setenv devnr 0; setenv partnr 1; autoscr ${loadaddr}; fi
cfgloadusb=if fatload usb 0:1 ${loadaddr} cfgload; then setenv device usb; setenv devnr 0; setenv partnr 1; autoscr ${loadaddr}; fi
cmdline_keys=if keyman init 0x1234; then if keyman read usid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.serialno=${usid};setenv serial ${usid};else setenv bootargs ${bootargs} androidboot.serialno=1234567890;setenv serial 1234567890;fi;if keyman read mac ${loadaddr} str; then setenv bootargs ${bootargs} mac=${mac} androidboot.mac=${mac};fi;if keyman read deviceid ${loadaddr} str; then setenv bootargs ${bootargs} androidboot.deviceid=${deviceid};fi;fi;
colorattribute=444,8bit
cvbs_drv=0
cvbsmode=576cvbs
display_bpp=24
display_color_bg=0
display_color_fg=0xffff
display_color_index=24
display_height=1080
display_layer=osd0
display_width=1920
dtb_mem_addr=0x1000000
ethaddr=00:15:18:01:81:31
factory_reset_poweroff_protect=echo wipe_data=${wipe_data}; echo wipe_cache=${wipe_cache};if test ${wipe_data} = failed; then run init_display; run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi; if test ${wipe_cache} = failed; then run init_display; run storeargs;if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;fi;
fb_addr=0x3d800000
fb_height=1080
fb_width=1920
fdt_high=0x20000000
firstboot=0
frac_rate_policy=1
fs_type=rootfstype=ramfs
gatewayip=10.18.9.1
hdmi_read_edid=1
hdmimode=1080p60hz
hostname=arm_gxbb
init_display=get_rebootmode;echo reboot_mode:::: ${reboot_mode};if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;osd open;osd clear;else setenv reboot_mode_android normal;run storeargs;hdmitx hpd;hdmitx get_preferred_mode;osd open;osd clear;imgread pic logo bootup $loadaddr;bmp display $bootup_offset;bmp scale;vout output ${outputmode};vpp hdrpkt;fi;fi;
initargs=init=/init console=ttyS0,115200 no_console_suspend earlyprintk=aml-uart,0xff803000 ramoops.pstore_en=1 ramoops.record_size=0x8000 ramoops.console_size=0x4000
ipaddr=10.18.9.97
irremote_update=if irkey 2500000 0xe31cdf00 0xb24d4040; then echo read irkey ok!; if itest ${irkey_value} == 0xe31cdf00; then run update;else if itest ${irkey_value} == 0xb24d4040; then run update;
fi;fi;fi;
jtag=disable
lcd_ctrl=0x00000000
loadaddr=1080000
lock=10001000
netmask=255.255.255.0
osd_reverse=0
otg_device=0
outputmode=1080p60hz
panel_type=lcd_1
preboot=run bcb_cmd; run factory_reset_poweroff_protect;run upgrade_check;run init_display;run storeargs;run upgrade_key;bcb uboot-command;run switch_bootmode;
reboot_mode_android=normal
recovery_from_flash=get_valid_slot;echo active_slot: ${active_slot};if test ${active_slot} = normal; then setenv bootargs ${bootargs} ${fs_type} aml_dt=${aml_dt} recovery_part={recovery_part} recovery_offset={recovery_offset};if imgread kernel ${recovery_part} ${loadaddr} ${recovery_offset}; then wipeisb; bootm ${loadaddr}; fi;else setenv bootargs ${bootargs} ${fs_type} aml_dt=${aml_dt} recovery_part=${boot_part} recovery_offset=${recovery_offset};if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;fi;
recovery_from_sdcard=if fatload mmc 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload mmc 0 ${loadaddr} recovery.img; then if fatload mmc 0 ${dtb_mem_addr} dtb.img; then echo sd dtb.img loaded; fi;wipeisb; setenv bootargs ${bootargs} ${fs_type};bootm ${loadaddr};fi;
recovery_from_udisk=if fatload usb 0 ${loadaddr} aml_autoscript; then autoscr ${loadaddr}; fi;if fatload usb 0 ${loadaddr} recovery.img; then if fatload usb 0 ${dtb_mem_addr} dtb.img; then echo udisk dtb.img loaded; fi;wipeisb; setenv bootargs ${bootargs} ${fs_type};bootm ${loadaddr};fi;
recovery_offset=0
recovery_part=recovery
sdc_burning=sdc_burn ${sdcburncfg}
sdcburncfg=aml_sdc_burn.ini
sddtb=if fatload mmc 0 ${dtb_mem_addr} dtb.img; then else store dtb read $dtb_mem_addr; fi
sdr2hdr=2
serverip=10.18.9.113
storeargs=setenv bootargs ${initargs} otg_device=${otg_device} reboot_mode_android=${reboot_mode_android} logo=${display_layer},loaded,${fb_addr} vout=${outputmode},enable panel_type=${panel_type} lcd_ctrl=${lcd_ctrl} hdmitx=${cecconfig},${colorattribute} hdmimode=${hdmimode} frac_rate_policy=${frac_rate_policy} hdmi_read_edid=${hdmi_read_edid} cvbsmode=${cvbsmode} osd_reverse=${osd_reverse} video_reverse=${video_reverse} irq_check_en=${Irq_check_en} androidboot.selinux=${EnableSelinux} androidboot.firstboot=${firstboot} jtag=${jtag}; setenv bootargs ${bootargs} androidboot.hardware=amlogic;run cmdline_keys;
storeboot=boot_cooling;get_system_as_root_mode;echo system_mode: ${system_mode};if test ${system_mode} = 1; then setenv bootargs ${bootargs} ro rootwait skip_initramfs;else setenv bootargs ${bootargs} ${fs_type};fi;get_valid_slot;get_avb_mode;echo active_slot: ${active_slot};if test ${active_slot} != normal; then setenv bootargs ${bootargs} androidboot.slot_suffix=${active_slot};fi;if test ${avb2} = 0; then if test ${active_slot} = _a; then setenv bootargs ${bootargs} root=/dev/mmcblk0p23;else if test ${active_slot} = _b; then setenv bootargs ${bootargs} root=/dev/mmcblk0p24;fi;fi;fi;if imgread kernel ${boot_part} ${loadaddr}; then bootm ${loadaddr}; fi;run storeargs; run update;
switch_bootmode=get_rebootmode;if test ${reboot_mode} = factory_reset; then setenv reboot_mode_android normal;run storeargs;run recovery_from_flash;else if test ${reboot_mode} = update; then setenv reboot_mode_android normal;run storeargs;run update;else if test ${reboot_mode} = quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;else if test ${reboot_mode} = recovery_quiescent; then setenv reboot_mode_android quiescent;run storeargs;setenv bootargs ${bootargs} androidboot.quiescent=1;run recovery_from_flash;else if test ${reboot_mode} = cold_boot; then setenv reboot_mode_android normal;run try_auto_burn; run storeargs;else if test ${reboot_mode} = fastboot; then setenv reboot_mode_android normal;run storeargs;fastboot;fi;fi;fi;fi;fi;fi;
try_auto_burn=update 700 750;
update=run usb_burning; run sdc_burning; if mmcinfo; then run recovery_from_sdcard;fi;if usb start 0; then run recovery_from_udisk;fi;run recovery_from_flash;
upgrade_check=echo upgrade_step=${upgrade_step}; if itest ${upgrade_step} == 3; then run init_display; run storeargs; run update;else fi;
upgrade_key=if gpio input GPIOAO_3; then echo detect upgrade key; run update;fi;
upgrade_step=2
usb_burning=update 1000
usbdtb=if fatload usb 0 ${dtb_mem_addr} dtb.img; then else store dtb read $dtb_mem_addr; fi
video_reverse=0
wipe_cache=successful
wipe_data=successful
I have u-boot logs. The interesting part:
[mmc_init] mmc init success
Amlogic multi-dtb tool
GZIP format, decompress...
Multi dtb detected
Multi dtb tool version: v2 .
Support 4 dtbs.
aml_dt soc: sm1 platform: ac213 variant: 4g
dtb 0 soc: g12a plat: u212 vari: 2g
dtb 1 soc: g12a plat: u212 vari: 4g
dtb 2 soc: sm1 plat: ac213 vari: 2g
dtb 3 soc: sm1 plat: ac213 vari: 4g
Find match dtb: 3
start dts,buffer=00000000d3e42620,dt_addr=00000000d3e42620
get_partition_from_dts() 91: ret 0
Amlogic multi-dtb tool
Single dtb detected
parts: 17
00: logo 0000000000800000 1
01: recovery 0000000001800000 1
02: misc 0000000000800000 1
03: dtbo 0000000000800000 1
04: cri_data 0000000000800000 2
05: param 0000000001000000 2
06: boot 0000000001000000 1
set has_boot_slot = 0
07: rsv 0000000001000000 1
08: metadata 0000000001000000 1
09: vbmeta 0000000000200000 1
10: tee 0000000002000000 1
11: vendor 0000000010000000 1
12: odm 0000000008000000 1
13: system 0000000060000000 1
14: product 0000000008000000 1
15: cache 0000000046000000 2
16: data ffffffffffffffff 4
_cmp_iptbl()-620: partition count is not same 20:22
mmc_device_init()-1288: update rsv with dtb!
init_part() 297: PART_TYPE_AML
eMMC/TSD partition table have been checked OK!
crc32_s:0x1577dad == storage crc_pattern:0x1577dad!!!
crc32_s:0xee152b83 == storage crc_pattern:0xee152b83!!!
crc32_s:0x79f50f07 == storage crc_pattern:0x79f50f07!!!
mmc env offset: 0x4d400000
In: serial
Out: serial
Err: serial
reboot_mode=cold_boot
After reboot, the u-boot log does not contain those lines:
_cmp_iptbl()-620: partition count is not same 20:22
mmc_device_init()-1288: update rsv with dtb!
It seems like u-boot verifies actual partition table with the one stored in the dtb. Will see what can I do about that …
Can you post more on disable SecureConnections in bluez main.conf? Would like to try this on my sk1 
So the problem I had was that when connecting my Android phone to CE I got this error in system logs:
Bluetooth: hci0: Invalid security: Missing AES-CCM usage
setting “SecureConnections = off” in bluez main.conf solved it.
First to check if this solves Your problem just run:
bluetoothctl mgmt.sc off
And try to connect Your device.
To make it permanent is not so easy on CE as main.conf config file is on SYSTEM partition (read-only squashfs).
So I bind-mount my custom main.conf to this location.
I don’t know if this is the best approach but I just added it to autostart.sh:
~/.config/autostart.sh:
mount -o bind /storage/.config/bluetooth/main.conf /etc/bluetooth/main.conf
systemctl restart bluetooth
bluetoothctl mgmt.sc off
First line binds my custom main.conf replacing stock main.conf. Second line restarts bluetooth service as it seems that during boot it is already running (with the stock main.conf). Ahh and the third line … I don’t know why but just using the modified main.conf does not change the SecureConnections setting … So the last line is also setting the SecureConnections to off but with a command. It looks like both are needed to make it happen (main.conf file and command).
To check if it worked run:
bluetoothctl mgmt.info
in the output, the line containing ‘current settings’ should not contain ‘secure-conn’.
1 Like
I managed to install CE on eMMC but with some caveats.
Because u-boot checks actual partition table against device tree I sacrificed system partition to hold CE_FLASH partition (so android is no longer bootable - I suppose, didn’t check).
So the steps I took:
-
perform normal dual boot installation:
ceemmc -x
After that we have data partition splitted into two partitions, CE_STORAGE and CE_FLASH. Those two partitions overlay the whole android data partiotion. After reboot the CE_STORAGE and CE_FLASH partitions disapear but the data is still there, so android data partition constains everything that is needed for CE_STORAGE partition, it just have different label.
The problem is with CE_FLASH which is no longer accessible after reboot. -
So I copied CE_FLASH partition to android system partition with dd. This also set proper label to the system parition. This step allows u-boot to find this partition as fat partition and load cfgload script and boot the CE.
-
last part is to properly mount the data partition during boot, for that I changed config.ini on the CE_FLASH partition (android system partition located in eMMC not the one created by emmc) to override bootargs replacing /dev/CE_STORAGE with /dev/data.
after those three step I shutdown the box, removed SD card and powered it on again. CE booted as expected and averything seems to work as expected.
I do not include detailed instructions since the process may brick the box. If the description is not clear enough then do not risk bricking your box.
I also managed to decrypt the device tree using this method. I was able to modify reserved partition image with it and ampart correctly decoded the whole thing.
So my question is, if I load this decrypted dtb into reserved partition on eMMC, would ceemmc modify it to align with new partition table ? Do the box even boot with the decrypted dtb ?? Or maybe this u-boot behaviour is unique to a95x f3 air box ?
1 Like
I think you will have to provide the answers because who knows who has such device.
Well, if the source code of the ceemmc would be available I could read it and find the answers. If no one on this forum knows how ceemmc work (that would be very wierd) then I will not risk bricking my device.
No, ceemmc is not public.
Yes, there are people who knows what it does
Not everything could be covered specially without physical device.
I would imagine that if someone knows how ceemmc work, he could answer the question wether the ceemmc modifies partition table in dtb on the “reserved” partition or not. because if it is not modifing it then there is no point in loading decrypted dtb into recovery partition.
Another option is to modify it manually (somehow, i don’t know yet how) and then load it after running ceemmc. Assuming that the box even boot with decrypted dtb. Seems like to much hassle, and I don’t event need the android so my current approach is enough.
Sure it modify the table and modify the u-boto dtb as well.
But maybe there is another check for your device implemented and the partition is recovered again.
OK thanks, on this box dtb is encrypted, I’ll try to replace it with decrypted one and try again.
Holy moly !!! replacing encrypted dtb with decrypted one did not brick the box
Nah… with decrypted DTB ceemmc works as expected and I can install CE to emmc and boot it from emmc. But android is not booting … seems like u-boot expects encrypted dtb.
So currently there are two ways to install CE to emmc but not in dual boot with android.