I extracted some firmwares from ITE Technologies IT9135 Windows driver. There was 3 different firmwares, one for old IT9135AX (ver. 1) and two which seems to be compatible with newer IT9135BX (ver. 2). Windows driver version was 12.10.04. (dated 10/04/2012) - it was the newest driver I was able to find...
dvb-usb-it9135-01.fw - versions: 12.54.14.0 / 2.47.14.0
dvb-usb-it9135-02.fw - versions: 3.42.3.3 / 3.29.3.3
dvb-usb-it9135-02.fw - versions: 3.40.1.0 / 3.17.1.0
dvb-usb-it9135-01.fw firmware seems to be just same old which has been there ages. Each of the dvb-usb-it9135-02.fw were newer, according to version numbers reported by the driver, than the old one around the net (old 3.39.1.0 / 3.9.1.0).
These firmwares are compatible with both Linux AF9035 (dvb_usb_af9035) and IT9135 (dvb_usb_it913x) drivers. AF9035 driver supports IT9135 too.
Feel free to test! Especially I am interested to hear if those new ones behaves differently than older.
Download: http://palosaari.fi/linux/v4l-dvb/firmware/IT9135/
New firmware with Alink DTU(L) leads to DEV error in Linux Mint (kernel 3.5.0-17), here is dmesg:
ReplyDelete[ 210.816053] usb 1-4: >new high-speed USB device number 4 using ehci_hcd
[ 210.952426] usb 1-4: >New USB device found, idVendor=048d, idProduct=9006
[ 210.952435] usb 1-4: >New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 210.952442] usb 1-4: >Product: USB Deivce
[ 210.952449] usb 1-4: >Manufacturer: ITE Technologies, Inc.
[ 211.244310] it913x: Chip Version=02 Chip Type=9135
[ 211.246049] it913x: Remote HID mode NOT SUPPORTED
[ 211.246420] it913x: Dual mode=0 Tuner Type=0
[ 211.246424] it913x: Unknown tuner ID applying default 0x60
[ 211.247552] dvb-usb: found a 'ITE 9135(9006) Generic' in cold state, will try to load a firmware
[ 211.251618] dvb-usb: downloading firmware from file 'dvb-usb-it9135-02.fw'
[ 211.253398] it913x: FRM Starting Firmware Download
[ 211.481175] it913x: FRM Firmware Download Completed - Resetting Device
[ 211.517938] it913x: Chip Version=02 Chip Type=9135
[ 211.518306] it913x: Firmware Version 53084931
[ 213.588144] it913x: DEV it913x Error
[ 213.590030] usbcore: registered new interface driver usbhid
[ 213.590035] usbhid: USB HID core driver
[ 213.604245] usbcore: registered new interface driver it913x
[ 213.634808] input: ITE Technologies, Inc. USB Deivce as /devices/pci0000:00/0000:00:1d.7/usb1/1-4/1-4:1.1/input/input8
[ 213.635343] hid-generic 0003:048D:9006.0001: >input,hidraw0: USB HID v1.01 Keyboard [ITE Technologies, Inc. USB Deivce] on usb-0000:00:1d.7-4/input1
Old firmware (from get_dvb_firmware) works OK with Mint and old Thinkpad 43p. However, both firmwares fail to load with Thinkpad T61p with Ubuntu kernels 3.8 as well as 3.11, the DVB stick appears to be in warm state (with a random firmware version!).
So summary about firmware and kernel versions:
Deletekernel 3.5.0-17
* new fails, old works
kernel 3.8
* both fails
kernel 3.11
* both fails
Most interesting thing to know is how about kernel 3.15. it9135 driver is replaced with af9035 driver from kernel 3.15... Could you test af9035 driver using media build?
Hi,
ReplyDeleteHow did you extract those firmwares from Windows drivers? Did you use IT9135BDA.sys as starting point? I have IT9135BDA.sys version 12.2.3.1.
Thank you!
Maybe I should write detailed blog post about techniques used... but shortly there is following steps:
Delete1) learn firmware 'finger print'
2) find out firmware location from Windows driver
3) find out firmware length
4) dump firmware to file
I usually first look USB sniffs to see how it downloads firmware and what king of chunks there is. Detect first and last bytes of firmware. firmware downloading is typically very easy to see from USB sniffs - it is multiple long lines of data send to device.
If you look IT9135 firmwares there is always "03 00 00 03 41 00 03 41" bytes at beginning of firmware.
Then find out possible firmware locations. I use hexdump and grep.
$ hexdump -s0 -C IT9135BDA.sys | grep "03 00 00 03 41 00 03 41"
00010f80 03 00 00 03 41 00 03 41 80 06 41 93 13 02 12 bf |....A..A..A.....|
00012c30 ff 00 00 00 00 00 00 00 03 00 00 03 41 00 03 41 |............A..A|
Then detect correct length somehow...
And finally dump firmware to file:
$ dd if=IT9135BDA.sys ibs=1 skip=START count=LEN of=dvb-usb-it9135-02.fw
Thank you.
DeleteAfter extraction from IT9135BDA.sys ver.12.2.3.1 the firmware was ver.3.25 which didn't work for me. I got tuning issues - found something above the noise level.
Which Kernel version (or media build) you are using? Have you tested those latest ITE Linux firmwares?
Deletedvb-usb-it9135-01.fw reports version: LINK 12.54.14.0 - OFDM 2.47.14.0
dvb-usb-it9135-02.fw reports version: LINK 3.40.1.0 - OFDM 3.40.1.0
http://palosaari.fi/linux/v4l-dvb/firmware/IT9135/ITE_3.25.0.0/
I have IT9135BDA.sys v12.2.3.1 too. Antti, could you instruct us how to correctly extract firmware image?
DeleteMy setup is tl-wdr4900 + usb hub + 4 usb dvb-t dongels + OpenWRT BB
Delete# uname -a
Linux wdr4900 3.10.49 #1 Sun Feb 22 16:50:49 EET 2015 ppc GNU/Linux
# lsusb
Bus 001 Device 002: ID 05e3:0608 Genesys Logic, Inc. USB-2.0 4-Port HUB
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 006: ID 048d:9135 Integrated Technology Express, Inc. Zolid Mini DVB-T Stick
Bus 001 Device 007: ID 048d:9135 Integrated Technology Express, Inc. Zolid Mini DVB-T Stick
Bus 001 Device 008: ID 048d:9135 Integrated Technology Express, Inc. Zolid Mini DVB-T Stick
Bus 001 Device 009: ID 048d:9135 Integrated Technology Express, Inc. Zolid Mini DVB-T Stick
Bus 001 Device 003: ID 0557:2008 ATEN International Co., Ltd UC-232A Serial Port [pl2303]
Bus 001 Device 004: ID 1a40:0101 Terminus Technology Inc. 4-Port HUB
Bus 001 Device 005: ID 1a40:0101 Terminus Technology Inc. 4-Port HUB
# mumudvb -l
MuMuDVB Version 1.7.3_20140822_master
--- Build information ---
Built without CAM support.
Built without SCAM support.
Built with ATSC support.
Built with support for DVB API Version 5.10.
Built with support for DVB-T2.
---------
Originally based on dvbstream 0.6 by (C) Dave Chapman 2001-2004
Released under the GPL.
Latest version available from http://mumudvb.braice.net/
Project from the cr@ns (http://www.crans.org)
by Brice DUBOST (mumudvb@braice.net)
Info: DVB: ==================================
Info: DVB: DVB CARDS LISTING
Info: DVB: ==================================
Info: DVB: =========== Card 0 - Tuner 0 ===========
Info: DVB: Frontend : ITE 9135 Generic_1
Info: DVB: Terrestrial (DVB-T) card
Info: DVB: Frequency: 51000 kHz to 1680000 kHz
Info: DVB:
Info: DVB: =========== Card 1 - Tuner 0 ===========
Info: DVB: Frontend : ITE 9135 Generic_1
Info: DVB: Terrestrial (DVB-T) card
Info: DVB: Frequency: 51000 kHz to 1680000 kHz
Info: DVB:
Info: DVB: =========== Card 2 - Tuner 0 ===========
Info: DVB: Frontend : ITE 9135 Generic_1
Info: DVB: Terrestrial (DVB-T) card
Info: DVB: Frequency: 51000 kHz to 1680000 kHz
Info: DVB:
Info: DVB: =========== Card 3 - Tuner 0 ===========
Info: DVB: Frontend : ITE 9135 Generic_1
Info: DVB: Terrestrial (DVB-T) card
Info: DVB: Frequency: 51000 kHz to 1680000 kHz
Info: DVB:
This comment has been removed by the author.
Delete@Marek Olszewski
DeleteDon't lose your time with this version. The firmware inside is the latest known ver 3.25 which you can download from http://palosaari.fi/linux/v4l-dvb/firmware/IT9135/ITE_3.25.0.0/
I successfully installed drivers, but I'm getting strange error, interestingly it doesn't happen always. The error message is "af9033: unsupported clock=24000000, only 12000000 Hz is supported currently".
ReplyDeleteThe error message comes from http://lxr.free-electrons.com/source/drivers/media/dvb-frontends/af9033.c?v=4.2#L1278
Is there a way to force clock value via config file, etc?
My system: Intel NUC5i5RYK and Ubuntu 15.10 with kernel 4.2 and Zolid Mini DVB-T Stick (048d:9135)
Thanks
Also this is based on ITE 9135. And here are the drivers: http://support.platinet.pl/dvbt-tuners/oudt9/
ReplyDeleteI extraced them from the win10 version and they work in linux.
Inside I have found 3 firmwares.. and extracted them.
Here they are: https://mega.nz/#!Fx4RxKRC!GC964ZlL4jAZyerkaIzWy-xa4MV7I72KcqxZduxIuxs
I have device with chip marked PT115 which seems to be ITE9135 v2 compatible. TV works fine, but I have trouble with RC - HID registers keypresses, but returns 0 for every key in data stream. Also if I hack the driver to register RC, ignore HID and query the RC through the af9035 code (by CMD_IR_GET) it also registers keypresses but it also returns 0 for every key. Firmware 3.40.1.0, and same with older versions as well. Any idea?
ReplyDeleteIf it is HID remote you likely need to download remote controller key table to device. Table contains mapping of which remote controller button means which keyboard key (HID acts like a keyboard). I think I have never seen HID enabled these devices.
DeleteTake USB sniffs and look how it downloads that table.
Which device it is?
Thanks for reply. It's actually device of my friend, but I am curious :) It's sold here in Czech Republic under Evolveo brand, but it's Chinese made. I think it's this one called Mars: https://www.czc.cz/evolveo-mars/84110/produkt. My dissasembled photos (sorry for low quality - mobile phone/USB cam :) https://jskarvad.fedorapeople.org/evolveo_mars/
DeleteI traced the IR receiver to be very probably connected to the pin 15 of PT115 (PT115 is written on the chip). But I was unable to get datasheet for PT115. The pinout seems to be different from ITE9135, otherwise it seems to be compatible. It also registers as a HID, but the remote uses NEC protocol. Dmesg: https://paste.fedoraproject.org/paste/pSz9bbmjBRvSUfalJAnhsF5M1UNdIGYhyRLivL9gydE=
ir-keytable shows no supported protocol, because there is no .get_rc_config set in the driver, if I add ".get_rc_config = af9035_get_rc_config" EEPROM_IR_MODE register seems to be set to 1 (I guess it's HID, I have no docs :), both CMD_IR_GET or HID queries through libhid/libusb detects remote keypresses, but the resulting stream/data is full of nulls. I am going to do Windows USB sniffs to find out how it is downloading the table.
I made USB sniffs in windows. From them it's clear that after the correct initialization/keymap download the device starts sending unique key codes through the HID. I am now going to sort out the init sequence. The sniffs are huge. I have to prune useless data like firmware download and I don't have much experience with it, so it could take some time. The driver used for the sniffs is from 2017, so I am also going to check the bundled firmware version. I will direct mail you if I progress with it.
DeleteI successfully extracted firmware from the USB sniffs, it's:
DeleteLINK 3.40.1.0 - OFDM 3.48.1.0
The TV is working at least with it, so I probably got it right. Now the more challenging part - extraction of the keytable.
Well, I had some prio stuff on my list, so I got to it after while. I modded the dvb_usb_af9035 driver to upload the sniffed HID table and it works like a charm. Now it sends unique codes for each IR keypress. I can send you the patch or do PR, but be warned that the code needs more love :)
ReplyDeletePatch sent to linux-media@vger.kernel.org
Deletehttp://www.mail-archive.com/linux-media@vger.kernel.org/msg113795.html
DeleteSaw it, but lets try to make some more flexible solution first. I think there must be RLC, NEC or RC-5 decoded remote controller key code somewhere on the USB controller memory. So I will try to find it by dumping memory to find it. If raw code is found then it could be passed to kernel rc-decoder and it gives more flexibility allowing to use different remote controllers.
DeleteOK, found it! Decoded NEC remote controller code could be read from 0x45DE address (IT9135BX). There is still lot of things to do... Test if address is same with different chip revisions, where is RC-5/RC-6 code, toggle, repeat, how to detect new code is received...
DeleteGreat that it's moving. I naively tried to read the 0x45DE reg after CMD_IR_GET command is issued, but it doesn't work for me. My device has NEC remote. Unfortunately the device is not mine, but I will have it borrowed for at least week or so, thus I can test the patch.
DeleteOops, device I used has older IT9135AX chip, not BX. I suspect those addresses could be different, even from firmware version to other... :/ It is NEC code, 4-bytes, so 2 first bytes are remote controller address which is same for every button. So 0x45E0 contains actual code.
ReplyDeleteThere is some default HID table stored, which causes unwanted HID events when you read remote code directly from the memory. But I was also able to kill HID.
One good option is use HID, but configure it dynamically. There is remote controller keytables which are normally used to configure remote. That table contains scan code and button code. So you should read information from that table and configure HID table. Then remote controller could be changed using ir-keytable command.
Casinos Near Me - Mapyro
ReplyDeleteClosest casinos 제천 출장샵 in 군산 출장안마 Washington state to Mohegan Sun · Caesars Palace. 구리 출장샵 Harrah's Lake Tahoe · Caesars Palace. Mohegan Sun 영천 출장샵 Pocono · 부천 출장샵 Montbleu Casino Resort