PCTV tripleStick (292e) teardown
|PCTV tripleStick (292e)|
tripleStick is the latest DVB-T/T2/C stick from PCTV Systems, successor of the old good PCTV nanoStick T2 (290e). It has a little bit better features compared to old nanoStick T2 as nanoStick T2 didn't support officially DVB-C at all, only DVB-T and DVB-T2. Case is just similar and it is hard to distinguish visually between nanoStick T2 and tripleStick. Only differences seems to be colored logo on upper-side and model number (290e vs. 292e) on backside.
That device appeared to market beginning of this year, during January 2014 or so. It replaced rather quickly old nanoStick T2. If you now order nanoStick T2 you will likely get tripleStick as a replacement. nanoStick T2 has been very popular stick among the Linux users as it have been basically the only one DVB-T2 capable stick which works out of the box (I made its driver for Kernel 3.0). My initial plan was not write driver for tripleStick, but I changed my mind after large amount of feedback from users who has ordered old well supported nanoStick T2, but got non-working tripleStick instead. So, I decided to give a try for reverse-engineering that Silicon Labs DTV chipset open.
PCTV Systems has assigned USB ID 2013:025f for that device. Windows driver knows also USB ID 2013:025b for 291e. According to Windows driver tripleStick, 292e, seems to be just renamed 291e for the reason or the other. Stick PCB also has model number 291e printed.
|PCTV 292e (291e)|
Initial Linux support will go the Kernel 3.16 if nothing unexpected happens.
Silicon Labs Si2168
Silicon Labs Si2157
Hardware internalsThat device is build to two PCBs, which are attached together like a sandwitch. It is somehow popular construction only for PCTV Systems and Hauppauge devices. Earlier, Pinnacle also used that kind of sandwich construction, maybe its backgrounds are from there, dunno (PCTV Systems was Pinnacle).
USB bridge / main PCB
That is top side of main PCB. Biggest chip clearly visible is EM28178.
|eeprom I2C bus wires|
Demodulator and tuner / tuner PCB
Silicon Labs Si2157 & Silicon Labs Si2168
|Silicon Labs Si2157 & Silicon Labs Si2168|
Biggest chip, Si2168, is DVB-T/T2/C demodulator from Silicon Labs. It is the most popular DVB-T2 capable demodulator used for PC TV receivers currently. Demodulator supports also T2-Lite profile (DVB-T2 extension) which is aimed mainly for mobile transmissions, mobile TV and radio.
There is no own crystal for Si2168 (or it is hiding another side of PCB), which means clock is feed via Si2157, saving few components. Demodulator offers gated I2C bus for Si2157 RF tuner, as norm is nowadays. TS interface pins are located mostly left side of the chip. Surprisingly it looks like TS is connected using parallel connection...
Metal box right side of Si2168 is remote controller receiver (IR RX). Weird looking IR component, though. It is connected to EM28178 which decodes IR key codes.
Linux driverThere was existing driver for EM28178 USB-bridge, but no driver for Si2168 nor Si2157. Fortunately both Si2168 and Si2157 provided very high level firmware API for device control. That makes protocol reverse-engineering pretty easy.
Current driver supports only minimal set of features in order to receive DVB-T/T2/C. There is no signal statistics implemented at all. Power management is also broken, it leaves device full active when device is closed, as it should set tuner and demod sleep. Broken PM is actually Windows driver bug - it is hard reverse-engineer it bug free when sniffs from Windows are already broken. All-in-all, it eats ("only") 210mA from USB when idle and Windows does not behave any better.
Driver can be found from that development tree:
Si2168 needs firmware, which I named as dvb-demod-si2168-01.fw. Firmware size is only 2720 bytes, meaning it cannot be whole firmware, but a kind of the partial patch.
Firmware can be extracted from the bundled driver CD version 188.8.131.524.
/TVC 6.4.8/Driver/PCTV Empia/emOEM.sys
dd if=emOEM.sys ibs=1 skip=1089416 count=2720 of=dvb-demod-si2168-01.fw
Reverse-engineering scripts I used to parse I2C demod and tuner I2C traffic are available here. There is also few already parsed sniffs to look example and compare things. These are surely very helpful if you are adding new features or support for new chip revisions / versions.