Naked hardware #15: PCTV tripleStick (292e)

PCTV tripleStick (292e) teardown

PCTV tripleStick (292e)

tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.

That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.

PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.

PCTV 292e (291e)

Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.


Key components:
Empia EM28178
Silicon Labs Si2168
Silicon Labs Si2157

Hardware internals

That device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).

USB bridge / main PCB

Main PCB

That is top side of main PCB. Biggest chip clearly visible is EM28178.

PCB printings:
291e Main
2030000-02 LF
pctv systems

Empia  EM28178

Empia EM28178

EM28178 is USB-bridge, maybe the latest version from Empia EM28xx family. Clock source is crystal (it should be 12 MHz) which is located on same PCB, but bottom side, between the "sandwich".

Regulator?

regulator?

There is another 10 pin chip too, located right side of EM28178. Unfortunately that chip printings are too unclear and I cannot guess what it is. It cannot be LNA as RF parts are located on another PCB. Maybe some regulator? 

Serial eeprom

eeprom I2C bus wires

I2C serial eeprom is located on main PCB, but it is bottom side - between the PCBs. I2C bus wires from EM28178 to eeprom are clearly visible. It is those two long wires going from chip to right on picture and ending right side of "PCTV" text. I2C bus itself goes through PCB directly to eeprom located just other side of PCB. Copper pads are debug pins, attach your sniffer there :) It is not possible sniff demodulator and tuner from that point because only eeprom is connected to this bus. EM28178 has 2 I2C bus. First bus is for eeprom and all the rest are on second bus. However, attaching sniffer to second I2C bus is even more easier as that bus is routed to another PCB via those soldered pin headers.

serial eeprom

Demodulator and tuner / tuner PCB

Tuner PCB

That PCB is practically dedicated for RF parts "tuner". Demodulator, RF tuner and LNA are all here.


PCB printings:
291e Tuner
20300001-02 LF
pctv systems

Silicon Labs Si2157 & Silicon Labs Si2168

Silicon Labs Si2157 & Silicon Labs Si2168

Chip "215730" seen on picture is Silicon Labs Si2157 RF tuner. Metal box, just upper-side of chip, is crystal which offers 24 MHz reference clock. I2C bus is coming through the Si2168 demodulator, chip on the right side. Si2157 is very modern RF tuner which runs firmware and has has a DSP for digital filtering (and more?). Both of those are very uncommon choices for current silicon RF tuners. I can remember only Xceive tuners having firmware before that. DSP is even more uncommon...

Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.

There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...

Metal box right side of  Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.

Low-noise amplifier

602

That chip must be LNA as it is clearly middle of the RF signal path, between antenna connector and RF tuner. Specifications unknown, labeled as 602. LNAs are usually controlled over GPIO line. Wired to EM28178 GPIO?

Linux driver

There was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.

Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.

Driver can be found from that development tree:
http://git.linuxtv.org/cgit.cgi/anttip/media_tree.git/log/?h=pctv_292e


Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version 6.4.8.984.

file:
/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys

extract:
dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw

verify checksum:
md5sum dvb-demod-si2168-01.fw
87c317e0b75ad49c2f2cbf35572a8093  dvb-demod-si2168-01.fw

Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.

USB interface

IDLE current drain without a driver: 68 mA

lsusb -vvd 2013:025f Bus 001 Device 003: ID 2013:025f PCTV Systems Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x2013 PCTV Systems idProduct 0x025f bcdDevice 1.00 iManufacturer 3 PCTV iProduct 1 PCTV 292e iSerial 2 0011370547 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 41 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 1 bNumEndpoints 1 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x03ac 1x 940 bytes bInterval 1 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures