SMC WSKP100G
From GPLdevWiki
Contents |
[edit]
Overview
The WSKP100G is a WLAN VoIP phone for the proprietary skype protocol.
It is believed to be manufactured by Accton in Taiwan, presumably the mother company of SMC. The original Product name is Accton VM1185T.
It is similar to the NETGEAR SPH101. By the looks of it it is also similar to the Belkin F1PP000GN-SK which also has the connector mentioned below and whose console messages look similar.
108963401521154535366634
[edit]
Hardware
[edit]
What's on the PCB
The hardware is based on a
- TI OMAP1710
- TI TSC2101
- 4-Wire Touch Screen Controller, St. DAC / Mono ADC with HP/Speaker Amplifier
- http://focus.ti.com/docs/prod/folders/print/tsc2101.html
- Samsung K4S56163PF
- 4M x 16bit x 4 banks (256Mbit) SDRAM
- http://www.samsung.com/products/semiconductor/Sync_AsyncDRAM/SDRSDRAM/Component/256Mbit/K4S561632E/K4S561632E.htm
- Intel 28F128L18B
- 16MB NOR Flash
- TI TPS65013
- 1-cell Li-Ion Power Mgmt IC: USB/AC Charger, 2DC/DC, 2 LDOs, I2C interface
- http://focus.ti.com/docs/prod/folders/print/tps65013.html
- http://www.ti.com/lit/gpn/tps65013
- Marvell 88W8385-BDK1
- WiFi
[edit]
Serial Console
The serial console seems to be available on the unpopulated CONN1 header at 1.8V level. You can find the CONN1 header on the LCD-Display-side of the main PCB, just beneath the keyboard PCB. If all you've got is a 3.3V or 5V serial cable, you can try wiring it up to the port using 2 resistors of e.g. 1K each. This worked for me, no guarantees though!
If the pins are starting with 1 on the top, then the pinout is as follows:
01 GND? 02 ? 03 ? 04 ? 05 TxD 06 RxD 07 ? 08 ? 09 ? 10 ? 11 ? 12 ? 13 ? 14 ? 15 ? 16 ? 17 ?
please complete this list with your own findings.
[edit]
Log of serial console while booting
In this log, we can see very clearly how u-boot and linux-2.6.9 are used in the device.
U-Boot 1.1.1 (Sep 11 2006 - 11:49:11)
U-Boot code: 11080000 -> 1109A030 BSS: -> 1109BEC4
RAM Configuration:
Bank #0: 10000000 32 MB
Initialize ADC average output mechanism
bat 3559 mv (bat=8ef)
v=0xffffffff
bat_vol BATTERY_CRITICAL (shutdown level)
bat 3606 mv (bat=90d)
v=0xffffffff
bat 3651 mv (bat=92a)
v=0xffffffff
bat 3697 mv (bat=948)
v=0xffffffff
bat 3743 mv (bat=965)
v=0xffffffff
bat 3789 mv (bat=983)
v=0xffffffff
bat 3834 mv (bat=9a0)
v=0xffffffff
bat 3881 mv (bat=9be)
v=0xffffffff
bat 3926 mv (bat=9db)
v=0xffffffff
bat 3973 mv (bat=9f9)
v=0xffffffff
bat 4020 mv (bat=a17)
v=0xffffffff
bat 4066 mv (bat=a35)
v=0xffffffff
bat 4115 mv (bat=a54)
v=0xffffffff
bat 4161 mv (bat=a72)
v=0xffffffff
bat 4211 mv (bat=a92)
v=0xffffffff
bat 4259 mv (bat=ab1)
v=0xffffffff
bat 4309 mv (bat=ad1)
v=0xffffffff
bat 4359 mv (bat=af1)
v=0xffffffff
bat 4409 mv (bat=b11)
v=0xffffffff
bat 4460 mv (bat=b32)
v=0xffffffff
original TPS_REGS1 :88
modified TPS_REGS1 :a8
CMS GPIO9 = 1
set LCM brightness to 0%
Flash: 16 MB
In: serial
Out: serial
Err: serial
Hit Backspace key to enter UESM mode............
3.6v ADC=0x915 4.2v ADC=0xa90
bat 4129 mv (bat=a5d)
v=0xffffffff
power key confirmed at 2045 ms
bat 3824 mv (bat=999)
v=0xffffffff
## Booting image at 00040000 ...
displaying start up screen...
Image Name: linux-2.6.9-20060911-1155
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 901580 Bytes = 880.4 kB
Load Address: 10c08000
Entry Point: 10c08000
Verifying Checksum ... OK
Uncompressing Kernel Image ... OK
Starting kernel ...
Uncompressing Linux................................................................ done, booting the kernel.
Linux version 2.6.9-omap1VM1185T (skype@ccskype) (gcc version 3.4.2) #1 Mon Sep 11 11:55:31 CST 2006
CPU: ARM926EJ-Sid(wb) [41069263] revision 3 (ARMv5TEJ)
CPU: D VIPT write-back cache
CPU: I cache: 32768 bytes, associativity 4, 32 byte lines, 256 sets
CPU: D cache: 16384 bytes, associativity 4, 32 byte lines, 128 sets
Machine: TI OMAP1710 H3 board
Memory policy: ECC disabled, Data cache writeback
OMAP_DIE_ID_0: 0x03330200
OMAP_DIE_ID_1: 0x8b5f702f DIE_REV: 15
OMAP_PRODUCTION_ID_0: 0x0000000c
OMAP_PRODUCTION_ID_1: 0xcafeb5f7 JTAG_ID: 0xb5f7
OMAP32_ID_0: 0x03330200
OMAP32_ID_1: 0x8b5f702f
JTAG_ID: 0xb5f7 DIE_REV: 8
OMAP1710 revision 8 handled as 16xx id: 8b5f702f03330200
Built 1 zonelists
Kernel command line: mem=32M console=ttyS0,115200n8 noinitrd root=/dev/mtdblock8 rw devfs=mount rootfstype=jffs2
Total of 128 interrupts in 4 interrupt banks
PID hash table entries: 256 (order: 8, 4096 bytes)
Console: colour dummy device 80x30
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 32MB = 32MB total
Memory: 30280KB available (1517K code, 477K data, 84K init)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
NET: Registered protocol family 16
OMAP NOR FLASH: MTD Self-Contained Driver ver. 1.0 size=0x33554432lx
OMAP NOR FLASH: Intel 28F128L18B found at 0xc2800000
Creating 11 MTD partitions on "OMAP NOR FLASH":
0x00000000-0x00008000 : "long jump"
0x00008000-0x00010000 : "params"
0x00010000-0x00018000 : "reserve1"
0x00018000-0x00020000 : "reserve2"
0x00020000-0x00040000 : "bootloader"
0x00040000-0x00140000 : "kernel"
0x00140000-0x00160000 : "system config A"
0x00160000-0x00180000 : "system config B"
0x00180000-0x00780000 : "file system"
0x00780000-0x00e00000 : "opt file system"
0x00e00000-0x01000000 : "contact file system"
OMAP DMA hardware version 1
DMA capabilities: 000c0000:00000000:01ff:003f:007f
Initializing OMAP McBSP system
OMAP GPIO hardware version 1.1
Initializing OMAP McBSP system for OMAP 1710
MUX: initialized USB1_TXD
MUX: initialized USB1_TXEN
MUX: initialized R13_1710_USB1_SEO
MUX: initialized USB1_RCV
MUX: initialized USB1_VP
MUX: initialized USB1_VM
MUX: initialized USB1_SUSP
USB: hmc 19, usb1 6 wires
OMAP I2C: Driver ver. 1.3
tps65010: version Sep 11 200611:53:40
MUX: initialized W8_1610_GPIO9
OMAP OCPI interconnect driver loaded
Power Management for TI OMAP.
NetWinder Floating Point Emulator V0.97 (double precision)
devfs: 2004-01-31 Richard Gooch (rgooch@atnf.csiro.au)
devfs: boot_options: 0x1
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
Console: switching to colour frame buffer device 16x20
omap-rtc: RTC power up reset detected.
Real Time Clock Driver v1.0
omap_wdt: TI OMAP Watchdog Timer: timer margin 0 sec
Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled
ttyS0 at MMIO 0xfefb0000 (irq = 46) is a OMAP UART
OMAP serial: activated 1 ports
Enter register_netdev
Leave register_netdev
i2c /dev entries driver
OMAP Timer32K is initialized
Using anticipatory io scheduler
VM1185T_R01 and VD1185T_R01:keypad
VM1185T_R0B:keypad
OMAP16XX TSC2101 Audio support initialized
MUX: initialized V9_1710_GPIO7
OMAP GPIO 7: trying to enable GPIO IRQ while no edge is set
NET: Registered protocol family 2
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 2048 bind 4096)
NET: Registered protocol family 1
NET: Registered protocol family 17
VFS: Mounted root (jffs2 filesystem).
Mounted devfs on /dev
Freeing init memory: 84K
/etc/rc.d/rcS.d/S33modutils
/etc/rc.d/rcS.d/S34mountall.sh
Success: mount /dev/mtdblock/10 on /opt/home/.Skype
e2fsck 1.37 (21-Mar-2005)
Pass 1: Checking inodes, blocks, and sizes
Pass 2: Checking directory structure
Pass 3: Checking directory connectivity
Pass 4: Checking reference counts
Pass 5: Checking group summary information
/dev/mtdblock/6: 13/64 files (0.0% non-contiguous), 30/128 blocks
Mounted /dev/mtdblock/6 on /opt/home/settings
Using /lib/modules/dcl_omap.ko
/etc/rc.d/rcS.d/S39ifupdown
/etc/rc.d/rcS.d/S40networking
USB ESM detection: it will takes at most 15 (2) seconds to detect...
MFG already completed
mfg already done
Normal Mode: Insert Normal Wifi Module...
Using /lib/modules/gspi_io.ko
gspi8835_io: module license 'Proprietary' taints kernel.
gspi8835_io: falsely claims to have parameter clkdiv
MUX: initialized D17_1710_GPIO29
MUX: initialized MCBSP2_DR
MUX: initialized MCBSP2_DX
MUX: initialized W7_1710_GPIO21
MUX: initialized V7_1710_GPIO11
Using /lib/modules/wlan.ko
VM1185T_R01:New wlan (5.0.17)
Enter register_netdev
Enter dev_alloc_name
Leave register_netdev
Configuring network interfaces: **Get SYSTEM BLOCK, use system_block mac!
Calibration before calling the cal_data command:
------------------------------------------------
Action : 0
PAOption : 4
ExtPA : 0
Ant : 5
IntPA : 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 aa 0b 0c 00 00 00 00 00 00
PAConfig : 02 32 cc 00
Domain : 00 00
ECO : 0
LCT_cal : 0
MAC Addr : 00 00 00 00 00 00
Calibration after calling the cal_data command:
------------------------------------------------
Action : 0
PAOption : 4
ExtPA : 0
Ant : 5
IntPA : 00 06 00 07 00 08 00 09 00 0a 00 0b 00 0c 00 0d 00 0e 00 aa 0b 0c 00 00 00 00 00 00
PAConfig : 02 32 cc 00
Domain : 00 00
ECO : 0
LCT_cal : 0
MAC Addr : 00 00 00 00 00 00
Enter process_cal_data_ext()
Exit process_cal_data_ext()
done.
/etc/rc.d/rcS.d/S80mknod.sh
/etc/rc.d/rcS.d/S81link.sh
/etc/rc.d/rcS.d/S82apmd.sh
BusyBox v1.01 (2006.09.11-03:22+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
processing /etc/profile
(Accton) Skype Phone Application to be started.. (c)Accton 2006.
Skyware Validation Checking...
Skyware Running ...
I2C Function : 0x8eff0001
Old value: 0x00, New Value: 0x80 will write to Subaddress: 0x0a
Value 0x80 written, readback matched
root@H:/# prepare to set DMA size=9, Block num=8
Waiting signal channel connection...
SkyHost Copyright (C) 2003-2006 Skype Technologies S.A.
Proprietary and confidential, do not share this application.
^[[9;0]^[[?33l^[[?25l^@^[[9;0]^[[?33l^[[?25l^@
-----Fonts contain: uh
Languages contain: English
/opt/skype-ware/lib/fonts/skype_EN.qm
/opt/skype-ware/lib/fonts/skype_EN.qm
killall: sntpmain: no process killed
eth0 (WE) : Buffer for request SIOCGIWPRIV too small (16<84)
eth0 (WE) : Buffer for request SIOCGIWPRIV too small (32<84)
eth0 (WE) : Buffer for request SIOCGIWPRIV too small (64<84)
off
deepsleep off!!!deepsleep: off
setting to on
killall: sntpmain: no process killed
reget_times=720
0-th server first!
[./src/interface-dsc.cpp] Init:100
[./src/main-dss.c] InitSignalChannel:328
Connect signal channel successful : 4
[./src/main-dss.c] InitDataChannel:386
Waiting data channel connection...
Voice Engine Start: [./src/interface-stable.cpp] Init:195
0.0107 - Write: "#0 X-CALL SKYPE Start2 uiVersion="10003/1.0.0.10/SMC" block="1" apiVersion="1.2""
[./src/main-dss.c] InitDataChannel:400
Connect data channel successful : 8
1.0992 - Read: "X-EVENT SKYPE OnLibStatusChange libStatus="RUNNING""
1.1168 - Read: "#0 X-REPLY 0="SUCCESS""
1.1386 - Write: "#1 X-CALL VOICEENGINE VoiceCommand command="KEYTONE_ENABLE\,1""
1.1479 - Read: "#1 X-REPLY 0="1""
1.1579 - Write: "#2 X-CALL VOICEENGINE VoiceCommand command="RINGVOL_SET\,80""
1.1661 - Read: "#2 X-REPLY 0="0""
1.2365 - Write: "#3 X-CALL VOICEENGINE VoiceCommand command="VOL_SET\,49""
1.2381 - Read: "#3 X-REPLY 0="0""
ctrl_interface=/var/run/wpa_supplicant
ap_scan=1
update_config=1
network={
ssid="ACCTONAPSKYPE"
key_mgmt=NONE
priority=1
}
ioctl[SIOCSIWPMKSA]: Device or resource busy
ioctl[SIOCSIWMODE]: Device or resource busy
Could not configure driver to use managed mode
marvell ioctl: Device or resource busy
marvell ioctl: Device or resource busy
marvell ioctl: Device or resource busy
marvell ioctl: Device or resource busy
on
deepsleep on!!!deepsleep: on
setting to off
eth0 Scan completed :
ctrl_interface=/var/run/wpa_supplicant
ap_scan=1
update_config=1
network={
ssid="gnumonks_pub"
mode=0
scan_ssid=1
key_mgmt=NONE
priority=1
}
[edit]
Root access
The serial port drops you in a root shell after booting:
root@H:/# ls
bin etc linuxrc opt sbin usr
dev lib mnt proc tmp var
root@H:/# uname -a
Linux (none) 2.6.9-omap1VM1185T #1 Mon Sep 11 11:55:31 CST 2006 armv5tejl unknon
root@H:/# cat /proc/cpuinfo
Processor : ARM926EJ-Sid(wb) rev 3 (v5l)
BogoMIPS : 107.00
Features : swp half thumb fastmult edsp java
CPU implementer : 0x41
CPU architecture: 5TEJ
CPU variant : 0x0
CPU part : 0x926
CPU revision : 3
Cache type : VIPT write-back
Cache clean : cp15 c7 ops
Cache lockdown : format C
Cache format : Harvard
I size : 32768
I assoc : 4
I line length : 32
I sets : 256
D size : 16384
D assoc : 4
D line length : 32
D sets : 128
Hardware : TI OMAP1710 H3 board
Revision : 17100016
Serial : 033302008b5f702f
root@H:/#
[edit]
Firmware
[edit]
Original
The Original Firmware is available from
- http://www.smc.com/files/AK%5CFW_WSKP100_EU_V1.0.0.10.zip
- http://www.smc.com/files/AK/WSKP100_FEUFG-V1.0.0.22P1.zip
[edit]
Source
The latest update can be found on http://www.wifiphone24.com/download.aspx, including the sources of the GPL components.
http://www.smc.com/files/AK/FW_WSKP100_SOURCE.zip
[edit]
