2013-05-29

Naked hardware #8: Cabletech URZ0185

About the device

That device is Afatech AF9035 reference design. It has two independent tuners aka dual tuner model. Used RF tuners are Fitipower FC0012. Device uses chipset vendor reference design USB ID 15a4:1001.

I would not like to thank device vendor Cabletech as they didn't even answered my queries about sample device. Instead thanks to some anonymous Linux user who donates his device for driver development.

Device is supported under Linux starting from the Kernel 3.9.

Cabletech URZ0185 teardown

Cabletech URZ0185

Key components:

Afatech AF9035
Afatech AF9033
Fitipower FC0012

PCB top side

AF9035 and AF9033
All relevant chips are composed to that side of the PCB. Two chips, which are partially under piece of tape and located near antenna connector, are FC0012 RF-tuners. There is two RF-tuners as this device supports dual mode - it could receive two television channel at the time even those channels are delivered using different frequency.
Black component, which is partially top of both tuners, is IR-receiver for remote controller. Piece of tape between RF-tuner and IR-receiver is avoiding possible short circuit(?).
Black chip most near USB-connector is AF9035. I am not going to AF9035 details now as I have explained it quite carefully earlier. Lets still mention it is chip that integrates USB-interface and DVB-T demodulator. Demodulator integrated is AF9033. That version of AF9035 has also pins to connect slave demodulator using serial TS.
There is small metal box, crystal, between AF9035 and USB-connector. It offers 12.000 MHz clock source for AF9035. 12.000 MHz is very standard USB reference clock.
The most centre big chip is AF9033 DVB-T demodulator. It is slave demodulator for AF9035 offering 2nd tuner. Note that AF9035 itself integrates one AF9033 - so there is two AF9033 logically on that device. AF9033 gets clock from AF9035, own crystal is not needed for that kind of dual configuration. There is clearly visible 4 + 2 wires between AF9033 and AF9035. That four wire bus, going through resistor network RP1, is most likely serial TS. Two wires going through resistors R23 / R24 is likely I2C bus. TS bus feeds data and I2C is used for control.
IR-receiver is connected to AF9035. First FC0012 is connected to the AF9035 and second one to AF9033, both TS and I2C buses.

RF-tuners

FC0012 tuners
FC0012 tuner is based of direct-conversion architecture. From that picture it could be easily seen 4-wires going from both tuners to AF9033/AF9035. It is baseband (aka Zero-IF) interface to feed signal from tuner to demodulator. There is also I2C bus between each demodulator and tuner pair, but it is not easily visible. 36.000 MHz clock is feed from the crystal that is located another side of PCB. Only one crystal is needed as tuner has clock bypass. RF-input, antenna wire, is also bypassed from tuner to other.

PCB bottom side


Bottom side of PCB
That side of PCB is quite empty and boring. The only and the one 8 pin IC is  2k serial eeprom. Markings are not clearly visible, but looks like letters are "402RP", which I could guess is 24C02RP. Eeprom is used to tell device hardware confguration for AF9035. Content is read by AF9035 on startup.
36.000 MHz crystal is for FC0012 RF-tuners.
PCB has printings "94-V0", "12-13", "DK-5902 V1.0", "iTE Technologies, Inc". Last one reveals it is clearly reference design. Originally AF9035 was made by Afatech and later Afatech was acquired by ITE Technologies.

Block diagram

AF9035 FC0012 dual tuner block diagram
I had very much troubles in order to get that device working! That was due to very complex hardware configuration. Because of dual tuner support it has physically 4 chips and logically even one more (AF9035 integrates AF9033). There was existing drivers for all the used chips, so it was "only" tweaking correct setup. Most problematic things were tuner clock bypassing, tuner RF bypassing and GPIOs. I took quite many USB sniffs, made scripts to generate code and hundreds of trial and error tests. After all that intensive reverse-engineering, I decided to write block to visualize relevant connections. For all the other AF9035 dual mode devices you could expect pretty much same.
It took something like 60 hours of work and result was only about 100 lines of code. Sometimes Kernel coding is very slow at the unit of used hours for lines of code, especially when hacking with complex embedded hardware.


USB interface

IDLE current drain without a driver: 183mA




Pictures


























21 comments:

  1. it doesn't work. Please help

    $ uname -a
    Linux ceiwyz 3.9.0-030900-generic #201304291257 SMP Mon Apr 29 16:58:15 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

    $ lsusb
    Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
    Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
    Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
    Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
    Bus 001 Device 003: ID 064e:a219 Suyin Corp. 1.3M WebCam (notebook emachines E730, Acer sub-brand)
    Bus 002 Device 003: ID 15a4:1001 Afatech Technologies, Inc. AF9015/AF9035 DVB-T stick
    Bus 002 Device 004: ID 093a:2510 Pixart Imaging, Inc. Optical Mouse

    $ dmesg | grep -i dvb
    [ 5.653620] usb 2-1.1: Product: DVB-T TV Stick
    [ 17.318464] usbcore: registered new interface driver dvb_usb_af9035
    [ 17.318804] usb 2-1.1: dvb_usb_v2: found a 'Afatech AF9035 reference design' in warm state
    [ 17.322288] usb 2-1.1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
    [ 17.322319] DVB: registering new adapter (Afatech AF9035 reference design)
    [ 17.664380] usb 2-1.1: DVB: registering adapter 0 frontend 0 (Afatech AF9033 (DVB-T))...
    [ 17.801128] usb 2-1.1: dvb_usb_v2: 'Afatech AF9035 reference design' error while loading driver (-19)
    [ 17.801359] usb 2-1.1: dvb_usb_v2: 'Afatech AF9035 reference design' successfully deinitialized and disconnected

    ReplyDelete
    Replies
    1. Is your device just similar Cabletech URZ0185?
      Did you try to replug it? (plug out from USB and then in to USB)

      Delete
  2. $ cd /lib/firmware/

    $ ls | grep dvb
    dvb-fe-xc5000-1.6.114.fw
    dvb-usb-af9015.fw
    dvb-usb-af9035-02.fw
    dvb-usb-dib0700-1.20.fw
    dvb-usb-terratec-h5-drxk.fw
    plug Cabletech URZ0185 in to USB
    $ dmesg | grep -i dvb
    [ 3106.272112] usb 2-1.1: Product: DVB-T TV Stick
    [ 3106.384195] usbcore: registered new interface driver dvb_usb_af9035
    [ 3106.384583] usb 2-1.1: dvb_usb_v2: found a 'Afatech AF9035 reference design' in cold state
    [ 3106.401959] usb 2-1.1: dvb_usb_v2: downloading firmware from file 'dvb-usb-af9035-02.fw'
    [ 3109.047187] usb 2-1.1: dvb_usb_af9035: firmware version=12.13.15.0
    [ 3109.047214] usb 2-1.1: dvb_usb_v2: found a 'Afatech AF9035 reference design' in warm state
    [ 3109.051789] usb 2-1.1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
    [ 3109.051831] DVB: registering new adapter (Afatech AF9035 reference design)
    [ 3109.112214] usb 2-1.1: DVB: registering adapter 0 frontend 0 (Afatech AF9033 (DVB-T))...
    [ 3109.183731] usb 2-1.1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
    [ 3109.183773] DVB: registering new adapter (Afatech AF9035 reference design)
    [ 3109.209607] usb 2-1.1: DVB: registering adapter 1 frontend 0 (Afatech AF9033 (DVB-T))...
    [ 3109.251265] usb 2-1.1: dvb_usb_v2: 'Afatech AF9035 reference design' successfully initialized and connected

    :) thx

    ReplyDelete
  3. i have this dvb-t dongle but it doesn't work
    the error i get is:
    [53603.416388] usb 1-1.3.3.4: new full-speed USB device number 8 using dwc_otg
    [53603.553022] usb 1-1.3.3.4: new high-speed USB device number 9 using dwc_otg
    [53603.640490] usb 1-1.3.3.4: New USB device found, idVendor=15a4, idProduct=1001
    [53603.640534] usb 1-1.3.3.4: New USB device strings: Mfr=1, Product=2, SerialNumber=3
    [53603.640553] usb 1-1.3.3.4: Product: DVB-T TV Stick
    [53603.640568] usb 1-1.3.3.4: Manufacturer: ITE Technologies, Inc.
    [53603.640583] usb 1-1.3.3.4: SerialNumber: AF0102020700001
    [53603.684076] input: ITE Technologies, Inc. DVB-T TV Stick as /devices/platform/bcm2708_usb/usb1/1-1/1-1.3/1-1.3.3/1-1.3.3.4/1-1.3.3.4:1.1/input/input5
    [53603.686675] hid-generic 0003:15A4:1001.0004: input,hidraw3: USB HID v1.01 Keyboard [ITE Technologies, Inc. DVB-T TV Stick] on usb-bcm2708_usb-1.3.3.4/input1
    [53603.817001] usb 1-1.3.3.4: dvb_usb_af9035: prechip_version=00 chip_version=03 chip_type=3802
    [53603.818029] usb 1-1.3.3.4: dvb_usb_v2: found a 'Afatech AF9035 reference design' in cold state
    [53603.852816] usb 1-1.3.3.4: dvb_usb_v2: downloading firmware from file 'dvb-usb-af9035-02.fw'
    [53604.121831] dvb_usb_af9035: probe of 1-1.3.3.4:1.0 failed with error -5

    ReplyDelete
    Replies
    1. What is kernel version? uname -a command tells it.

      Delete
    2. Linux OpenELEC 3.12.6 #1 PREEMPT Thu Jan 9 04:58:17 GMT 2014 armv6l GNU/Linux

      Delete
    3. 3.12.5 contains some important fixes as there was regression made on 3.12.3. So it is not issue then. I see it is ARM and I suspect that is the reason. I have never tested it any other than x86_64. I am not going to look the issue as I haven't even ARM hardware, not much interest or time to start debug (possible) ARM issues. But patches are welcome ;)

      Delete
    4. i'll try a live cd with linux and see if the usb dongle works (any suggestions for a distribution?)
      meanwhile here's the lastest driver from cabletech http://www.cabletech.pl/lp/urz0185//drivers_urz0185_driver_windows.rar maybe you can extract the firmware from them.
      what does error -5 mean? i've googled around and i see only error -2, error -19 and error -110 but never -5.

      Delete
    5. It is error code EIO. It is set by AF9035 driver (file af9035.c) when control command to device fails. Just to be sure, did you use firmware from there: http://palosaari.fi/linux/v4l-dvb/firmware/af9035/

      Delete
    6. yes i tried all of them, one by one
      download, unplug usb, replug usb, dmesg, download...
      same effect

      Delete
    7. Yeah. 99% it is bug in AF9035. It could be endianess issue or some timing issue. I am not sure abour ARM endianess, but if it differs from the x86 it is thing I would check at the very first.

      Delete
  4. tried it on siduction 3.12-6.towo-siduction-686 live
    same -5 error
    maybe it has some different hardware. could you tell by the windows driver if it has a different hardware?

    ReplyDelete
    Replies
    1. It is AF9035 as it surely bails out with some error code earlier than firmware download. You could compile kernel with dynamic debug support and enable af9035 debugs:
      # modprobe dvb_usb_af9035; echo -n 'module dvb_usb_af9035 +p' > /sys/kernel/debug/dynamic_debug/control
      Are you still using ARM? Please test with x86.
      Looking files from windows driver usually reveals used chipset. There is some files named as af9035 and also installer .inf file contains typically some general info.

      Delete
    2. http://pastebin.com/hRePLsii

      here's from cat /sys/kernel/debug/dynamic_debug/control | grep af9035

      Delete
    3. That is not debug log output, but debug format strings. Logging is done by syslog or some other mechanism. I am running Fedora 20 and I usually read logs using journalctl command.

      Delete
    4. i don't know how to do that
      i am running debian
      what should i search for on google?

      Delete
  5. http://pastebin.com/2E92z0rV

    here is an extract from cat /var/log/syslog

    ReplyDelete
  6. if i load windows driver and the connect stick to linux (warm state) i can see the fc0012 module load (it still gives error but at least it loads the module).
    if i connect the stick to linux cold state and use any of the firmwares it doesn't go to loading the fc0012 module
    here's the link for the windows sys file, maybe you can extract firmware from it
    http://www.sendspace.com/file/df4dc5

    ReplyDelete
  7. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. Sorry, I removed accidentally your comment.

      Delete
  8. I still wonder why Afatech AF9033 can't be used as an SDR...

    ReplyDelete