Linux IT9135 driver firmwares

I extracted some firmwares from ITE Technologies IT9135 Windows driver. There was 3 different firmwares, one for old IT9135AX (ver. 1) and two which seems to be compatible with newer IT9135BX (ver. 2). Windows driver version was 12.10.04. (dated 10/04/2012) - it was the newest driver I was able to find...

dvb-usb-it9135-01.fw - versions: 12.54.14.0 / 2.47.14.0
dvb-usb-it9135-02.fw - versions: 3.42.3.3 / 3.29.3.3
dvb-usb-it9135-02.fw - versions: 3.40.1.0 / 3.17.1.0


dvb-usb-it9135-01.fw firmware seems to be just same old which has been there ages. Each of the dvb-usb-it9135-02.fw were newer, according to version numbers reported by the driver, than the old one around the net (old 3.39.1.0 / 3.9.1.0).

These firmwares are compatible with both Linux AF9035 (dvb_usb_af9035) and IT9135 (dvb_usb_it913x) drivers. AF9035 driver supports IT9135 too.

Feel free to test! Especially I am interested to hear if those new ones behaves differently than older.


Download: http://palosaari.fi/linux/v4l-dvb/firmware/IT9135/

Naked hardware #9: TerraTec Cinergy T Stick Dual RC (rev. 2)

TerraTec Cinergy T Stick Dual RC (rev. 2) teardown

That device is ITE Tech IT9135 reference design. It has two independent tuners, so called dual tuner model.
TerraTec has assigned USB ID 0ccd:0099 for that device. Unfortunately same USB ID is used for original revision 1 model too, which is build upon AF9015 chipset. AF9015 belongs to same chipset family, but it is two generation older and differs notably. Hey TerraTec guys, don't do that in future, it causes quite a lot headache!

Device is supported under Linux starting from the Kernel 3.10. Linux AF9035 driver supports IT9135/IT9137 too.

TerraTec Cinergy T Stick Dual RC (rev. 2)

TerraTec Cinergy T Stick Dual RC (rev. 2)

Key components:

ITE Tech IT9137
ITE Tech IT9133

PCB top side

PCB top side

Only chip attached to that side of PCB is IT9137. That chip is so called 3-in-1 as it contains USB-interface, demodulator and RF-tuner. It is all what is needed for DVB-T USB stick.
Black box with 3 pins, partially top of IT9137, is IR-receiver. It is connected to the IT9137, which handles IR decoding. There is also crystal clearly visible. Crystal markings are missing from the reason or the other, but it is most likely 12.000 MHz.

There is two versions of these (IT9130 series) chips available, version 1 and 2. Chips used on that device seems to be version 1. You could see letters AX (v1) or BX (v2) printed top of the chip.

PCB printings: RD168OC VER1.1.

AF9030 and IT9130 family relations

IT9130 family is successor of AF9030 family. Main difference between these families is integrated RF-tuner. IT9130 has integrated RF-tuner whilst external tuner is needed for AF9030. USB-interface and demodulator seems to be quite same between all these chips.

IT9137 is same as IT9135 but contains physical pins for connecting slave demodulator (for dual tuner configuration and/or diversity).

These chips are sold as following chip names and integrated combinations:
* AF9032 = demodulator ?
* AF9033 = demodulator
* AF9035 = USB-interface + demodulator
* IT9133 = demodulator + RF-tuner
* IT9135 = USB-interface + demodulator + RF-tuner
* IT9137 = IT9135 + MPEG TS input for connecting slave IT9133

PCB bottom side

PCB bottom side

Only chip on that side is IT9133. That chip contains demodulator and RF-tuner. It offers second tuner to that device. IT9133 is connected to the IT9137 (other side) as a slave, using I2C bus for control and serial TS for data stream. Also clock is feed through IT9137 saving one crystal.

PCB printings: 94-V0, 1213, LJ-M E300053

Missing eeprom

I cannot see serial eeprom anywhere. Device has still TerraTec USB ID, so there must be eeprom somewhere. I suspect it is integrated to the IT9137. I am pretty sure all IT9135 devices does not have eeprom at all, which makes me wonder if there is versions with and without. Maybe it will be clear after I teardown few more IT9135 devices.

USB interface

IDLE current drain without a driver: 181mA

lsusb -vvd 0ccd:0099 Bus 002 Device 004: ID 0ccd:0099 TerraTec Electronic GmbH Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x0ccd TerraTec Electronic GmbH idProduct 0x0099 bcdDevice 2.00 iManufacturer 1 ITE Technologies, Inc. iProduct 2 DVB-T TV Stick iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 71 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 0 No Subclass bInterfaceProtocol 1 Keyboard iInterface 0 HID Device Descriptor: bLength 9 bDescriptorType 33 bcdHID 1.01 bCountryCode 0 Not supported bNumDescriptors 1 bDescriptorType 34 Report wDescriptorLength 65 Report Descriptors: ** UNAVAILABLE ** Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 10 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures

Naked hardware #8: Cabletech URZ0185

About the device

That device is Afatech AF9035 reference design. It has two independent tuners aka dual tuner model. Used RF tuners are Fitipower FC0012. Device uses chipset vendor reference design USB ID 15a4:1001.

I would not like to thank device vendor Cabletech as they didn't even answered my queries about sample device. Instead thanks to some anonymous Linux user who donates his device for driver development.

Device is supported under Linux starting from the Kernel 3.9.

Cabletech URZ0185 teardown

Cabletech URZ0185

Key components:

Afatech AF9035
Afatech AF9033
Fitipower FC0012

PCB top side

AF9035 and AF9033

All relevant chips are composed to that side of the PCB. Two chips, which are partially under piece of tape and located near antenna connector, are FC0012 RF-tuners. There is two RF-tuners as this device supports dual mode - it could receive two television channel at the time even those channels are delivered using different frequency.
Black component, which is partially top of both tuners, is IR-receiver for remote controller. Piece of tape between RF-tuner and IR-receiver is avoiding possible short circuit(?).
Black chip most near USB-connector is AF9035. I am not going to AF9035 details now as I have explained it quite carefully earlier. Lets still mention it is chip that integrates USB-interface and DVB-T demodulator. Demodulator integrated is AF9033. That version of AF9035 has also pins to connect slave demodulator using serial TS.
There is small metal box, crystal, between AF9035 and USB-connector. It offers 12.000 MHz clock source for AF9035. 12.000 MHz is very standard USB reference clock.
The most centre big chip is AF9033 DVB-T demodulator. It is slave demodulator for AF9035 offering 2nd tuner. Note that AF9035 itself integrates one AF9033 - so there is two AF9033 logically on that device. AF9033 gets clock from AF9035, own crystal is not needed for that kind of dual configuration. There is clearly visible 4 + 2 wires between AF9033 and AF9035. That four wire bus, going through resistor network RP1, is most likely serial TS. Two wires going through resistors R23 / R24 is likely I2C bus. TS bus feeds data and I2C is used for control.
IR-receiver is connected to AF9035. First FC0012 is connected to the AF9035 and second one to AF9033, both TS and I2C buses.

RF-tuners

FC0012 tuners

FC0012 tuner is based of direct-conversion architecture. From that picture it could be easily seen 4-wires going from both tuners to AF9033/AF9035. It is baseband (aka Zero-IF) interface to feed signal from tuner to demodulator. There is also I2C bus between each demodulator and tuner pair, but it is not easily visible. 36.000 MHz clock is feed from the crystal that is located another side of PCB. Only one crystal is needed as tuner has clock bypass. RF-input, antenna wire, is also bypassed from tuner to other.

PCB bottom side

Bottom side of PCB

That side of PCB is quite empty and boring. The only and the one 8 pin IC is  2k serial eeprom. Markings are not clearly visible, but looks like letters are "402RP", which I could guess is 24C02RP. Eeprom is used to tell device hardware confguration for AF9035. Content is read by AF9035 on startup.
36.000 MHz crystal is for FC0012 RF-tuners.
PCB has printings "94-V0", "12-13", "DK-5902 V1.0", "iTE Technologies, Inc". Last one reveals it is clearly reference design. Originally AF9035 was made by Afatech and later Afatech was acquired by ITE Technologies.

Block diagram

AF9035 FC0012 dual tuner block diagram

I had very much troubles in order to get that device working! That was due to very complex hardware configuration. Because of dual tuner support it has physically 4 chips and logically even one more (AF9035 integrates AF9033). There was existing drivers for all the used chips, so it was "only" tweaking correct setup. Most problematic things were tuner clock bypassing, tuner RF bypassing and GPIOs. I took quite many USB sniffs, made scripts to generate code and hundreds of trial and error tests. After all that intensive reverse-engineering, I decided to write block to visualize relevant connections. For all the other AF9035 dual mode devices you could expect pretty much same.
It took something like 60 hours of work and result was only about 100 lines of code. Sometimes Kernel coding is very slow at the unit of used hours for lines of code, especially when hacking with complex embedded hardware.

USB interface

IDLE current drain without a driver: 183mA

lsusb -vvd 15a4:1001 Bus 002 Device 018: ID 15a4:1001 Afatech Technologies, Inc. AF9015/AF9035 DVB-T stick Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 idVendor 0x15a4 Afatech Technologies, Inc. idProduct 0x1001 AF9015/AF9035 DVB-T stick bcdDevice 2.00 iManufacturer 1 ITE Technologies, Inc. iProduct 2 DVB-T TV Stick iSerial 3 AF0102020700001 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 122 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 5 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x86 EP 6 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x0000 1x 0 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 1 bNumEndpoints 5 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 0 bInterfaceProtocol 0 iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x85 EP 5 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x86 EP 6 IN bmAttributes 1 Transfer Type Isochronous Synch Type None Usage Type Data wMaxPacketSize 0x1400 3x 1024 bytes bInterval 1 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 1 bInterfaceClass 3 Human Interface Device bInterfaceSubClass 0 No Subclass bInterfaceProtocol 1 Keyboard iInterface 0 HID Device Descriptor: bLength 9 bDescriptorType 33 bcdHID 1.01 bCountryCode 0 Not supported bNumDescriptors 1 bDescriptorType 34 Report wDescriptorLength 65 Report Descriptors: ** UNAVAILABLE ** Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x83 EP 3 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 10 Device Qualifier (for other device speed): bLength 10 bDescriptorType 6 bcdUSB 2.00 bDeviceClass 0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 64 bNumConfigurations 1 Device Status: 0x0000 (Bus Powered)

Pictures