PA168/PA1688

PA1688 page changed to http://www.palmmicro.com.

More information:
Palmmicro products mailing list – http://groups.yahoo.com/group/palmmicro
AR1688

This is low-cost VoIP solution, complete with reference design and software that allows you to make cheap ip phones and ATAs.

The CPU is similar to an MCS8051 and operates at max 50 MHz. That is a 8bit CPU …
to speed it up, it has an on-chip DSP which is ADSP2181 instruction set compatible, operating at 50MHz. The chip has interfaces to RS232, USB, SDRAM, SRAM, AC97 codec and a keypad. An RTL8019 10MBit ethernet chip can easily be connected.

Part of the documentation is gibberish:

Considering about standard MCS8051, there are a 256bits SRAM in core.
The most scope of core can seek is 65536bits of SRAM and 65536 of Program
Flash. There has a 4.5KB SRAM in PA1688, it is an outside SRAM of MCU core
seeked.

Now everything is indeed clear. 🙂

Newsflash – January 30, 200
SecurityFocus is reporting today a security vulnerability in the PA168 chipset that allows a remote attacker to issue administrative commands. The attack seems to be somewhat mitigated by the fact that an attacker can only execute the attack when someone has logged into the phone with the superuser password, but when an attacker is able to do this (and they can automate checking to see if the superuser is logged in) they have control of the phone. No fix is reportedly available but the workarounds are to use router Access Control Lists to restrict access to the phone’s web server and also to not put one of these phones directly on the public Internet.

Newsflash
I’ve just had confirmation from the manufacturers of the PA168 chipset that they are open sourcing their VoIP firmware! It’s being released under the BSD license, and it will be hosted on Source Forge.

Actually, this chipset has a number of nice features. It comes with g711, g723.1, g729, iLBC, and gsm codecs. IAX2, H.323, MGCP, Net2Phone, and SIP are well-supported. The voice prompts are available in a number of languages (English and Mandarin are standard, French or German or other custom language is available by request).

Although the code is closed-source, it’s pretty easy (compared to most closed-source products) to obtain a redacted source for the firmware. Even if you don’t have access to the source, the developers are willing to consider widely useful enhancements – for instance, I asked about uPnP support, provided the developers with a link to libupnp and they said they’d look into it. Ok, so maybe it will be a while before it arrives, but any other group would have given me the answer “order 200K items and we’ll do it” – not very useful for a small-time user.

It supports up to 5 separate SIP registrars, but not simultaneously (you can preset the phone to work with 5 providers, say, FWD and Stanaphone, but only one will register at a time. It’s fairly easy, however, to switch among profiles/proxies). STUN servers are supported, but not uPnP (yet).

Firmware upgrade failure recovery

One nice feature of this chip is its’ disaster recovery mode — if something goes wrong during the firmware upgrade process, you can rather painlessly reflash.

To do this, you’ll need to get the latest version of PalmTool. Be aware that PalmTool does not appear to work with Windows XP (possible firewall issues). {palmtool 1.57 works ok with xp pro service pack 2}

First, turn on the phone while holding down the * key. The normal boot process should be interrupted, and “*” should be displayed. Release the * key, turn off the phone, and repeat the process. The phone will now be reset to the factory default IP address (usually 192.168.1.100).

Next, turn on the phone again, still holding down the * key. Once * is displayed, release the key and plug the phone into your network. The phone is now in recovery mode, waiting to talk to PalmTool.

On your PC, launch PalmTool. Select “List Phones”. Select the phone that you want to reflash from the list. Important safety tip — your PC must be on the same network segment as the phone.

After the target phone is selected, click “Update Program”. Select the correct firmware image. The transfer will begin — the phone will display “Updating…” (without a byte count) during the transfer, and “Updating…” (with a percentage) during the actual flash operation.

After a successful flash, the phone will automatically reboot.

Phones with this chip:

• AT-323 from Atcom
• AT-320 from Atcom
• Vida some phones PA168 based
• Wuchuan HOP-1001/1002/1003
• GIPTEL IP Phones G100, also Siptronic ST-100 and Siptronic ST-150 (PA168S chipset)
• GNET some phones PA168x based
• KE1020 Netphone (Meritline)
• ML210 Meritline
• Integrated Networks IN-1002. Found on eBay.
• Soyo G668
• YUXIN YWH10 IP phone from Yuxin
• YWH100 IP phone from Yuxin
• YWH200 IP phone from Yuxin
• YWH300 IP phone from Yuxin
• YWH500 IP phone from Yuxin

ATA with this chip:

• AG-168V vendor is https://www.atcom.com.cn
• Wuchuan WUC-GW101/102/201/202, with metal case and also available in versions with two Ethernet ports
• YGW20 ATA vendor is YUXIN

See also:

• Chip Manufacturer is Centrality Communications, a.k.a. Palmmicro http://www.palmmicro.com
• Software download – Note: Generic versions of firmware may not work with all PA168 phones due to different button maps and local language requirements. Please download it from your wholesaler’s site.
• Firmware Mirror Site with ancient firmware – Centrality’s site only contains older firmware now, palmmicro.com supplies the most recent firmware but their web server is quite slow. Mirror contains both IAX2 and SIP firmware.

PA1688 Version 1.47 Released

PA1688 VOIP API 1.47 release new binary files and documents are ready for download from www.palmmicro.com now. If you can not find the needed firmware for special language, protocol or hardware type, please send email to [email protected] to ask for it.

Changes and Fixes:
1. Enhanced voice quality and echo cancellation for ATAs and ip phones, especially for PA168V, set handset input volume number between 10-15 to get best performance
2. Enhanced auto-provision feature, support HTTP, FTP and TFTP at the same time, no need to compile differently now. Use the URL to indicate which protocol to use.
3. Added STUN NAT type judgment for better working behind NAT
4. Added T-online.de service provider long name @T-online.de support in SIP service type options.
5. Fixed non-Chinese IVR number play problem.
6. Fixed audio disconnect in a call problem since 1.46
7. Added page12 to restore the function of automatically find public IP address when using port mapping on NAT. Please notice that as program grows, only 1M (like MX28LV008T used in PA168S, PA168Q) and 2M (MT28F016S5 used in PA168T, PA168V) bytes program flashes will have this function.
8. Spanish IVR now available! Juan Carlos Valero ([email protected]) recorded IVR for Spanish, modified Spanish lcd display.
9. Poland version added, Piotr Niemojewski ([email protected] ) provided Polish IVR, display and web support
Piotr Niemojewski ([email protected] ) currently has a hardware type “5111phone” ip phone, he asked me whether we can provide an ATA for him to do the test and development for Poland market. I told him that we do not have it but I will ask among our customers and our mailing list in Yahoo to find some possible device donation 🙂

Compiled Palmtool.exe package also attached for those who do not have M$VC 6
If you do not like to receive this 3M bytes files anymore, please feel free to send email to [email protected], I will remove you from this private mailing list upon request.

You can get a test version of binary files by writing to [email protected], please include the following:
1. Hardware type, like PA168S, PA168T for ip phone, PA168Q, PA168V for 1-port FXS gateway.
2. Software version, we can provide every final release version since 1.00, and the most recent test version.
3. Protocol needed, like H323/SIP/MGCP/IAX2 and other private protocols like Net2phone
4. Language needed, like Chinese, English
5. If it is for an OEM build, please specify OEM type

Software download:

• 1.47 API

PA1688 Version 1.48 Released

1.48.011 attached.

Changes and Fixes:
1. Delayed IVR play time to fix IVR shortened playing problem
2. Improved DTMF detection and continue improvement on voice quality.
3. Added more country and district support for dial-up modem and dial-tone.
4. Fixed problem with Call Hold and Flash functions.
Compiled Palmtool.exe package also attached for those who do not have M$VC 6