VAD Laplace

From LinuxTVWiki
Jump to navigation Jump to search

Webcam VAD (Vicious and Divine) Laplace

Vad5m.jpg

The webcam is called "VAD (Vicious and Divine) Laplace". "Vicious And Devine" is a kind of noble brand of SpeedLink.
The Laplace webcam was sold in two colors (black and white) and has been discontinued somtime between Windows XP SP2 and SP3.
SpeedLink/VAD removed all hints and links concerning this device from their web pages (including the driver and documentation files) around 2012/2013.


The device is not UVC (USB video class) compliant and uses a custom setup for its Empia EM2765 USB-video-bridge chip. Therefore, the generic camera driver from Empiatech doesn't work, too.
The latest available official Windows driver from SpeedLink insists on Windows XP SP2, drivers for MAC were never available.


The device is supported by the em28xx driver (card #91) since kernel 3.14 with a few limitations:
  - max. resolution: 640x480
  - audio/video mute button doesn't work yet
  - picture quality could be improved

Basic Hardware Specs of the Webcam

  • 2 MP Photo, 1.3 MP Video resolution
  • USB 2.0 Interface (USB 1.1 supported)
  • 3x digital zoom (button)
  • Flash (switch on/off via button)
  • Night illumination (switch on/off via button)
  • Noise-suppressing microphone (so there is already a filter ...)
  • Mute button
  • Z-fold positioning
  • 0.6m cable at the Webcam itself
  • 1.4m extra USB extension cable
  • max. video resolution 1600x1200/7fps, 1280x960/15fps, 640x480/30fps
  • max. photo resolution 1600x1200
  • available in white (1ae7:9003) and black (1ae7:9004)

Advanced Hardware Specs of the Webcam

  • Not UVC Compliant
  • Video bridge (main chip, large) - See also Pictures below
EMPIA EM2765
6Z523-500
0711-118G

Chip ID (reg 0x0A) is 0x36

  • Image sensor (from USB-logs)

OV2640 (http://read.pudn.com/downloads128/doc/543891/OV2640_spec.pdf)
Product ID: 0x2642 (reg 0x0A, 0x0B)
Uses i2c/sccb slave address 0x60

  • EEPROM

I2c slave address: 0xA0
Size: 8kb
Content/data format seems to be em25xx-style !
(=> see http://wenku.baidu.com/view/a21a28eab8f67c1cfad6b8f6.html) 

0x00000000: 26 00 01 00 02 0d ea c2 ee 30 fa 02 d2 0a 32 02
0x00000010: 0d c3 c2 04 12 00 33 c2 04 12 00 4b 12 0e 1f d2
0x00000020: 04 12 00 33 12 0e 1f d2 04 12 00 4b 02 0e 1f 80
0x00000030: 00 a2 85 22 02 0b cb a2 04 92 84 22 02 0c 78 00
0x00000040: 02 0d 69 7b 1f 7d 40 7f 32 02 0c 44 02 00 03 a2
0x00000050: 04 92 85 22 00 00 00 00 e7 1a 03 90 00 00 00 00
0x00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000080: 00 00 00 00 00 00 1e 40 1e 72 00 20 01 01 00 01
0x00000090: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x000000f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x00000140: 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00
0x00000150: 00 00 00 00 02 03 ff 00 ff 00 00 00 00 00 00 00
0x00000160: 00 00 00 00 00 00 00 00 00 00 00 00 af fd ef 24
0x00000170: fb 60 1a 24 03 70 2c 75 08 00 75 09 00 75 0a 2f
0x00000180: 75 0b 00 75 0c 00 75 0d 30 7e 0f 80 19 75 08 00
0x00000190: 75 09 00 75 0a 31 75 0b 00 75 0c 00 75 0d 32 7e
0x000001a0: 1f 80 03 c2 c6 22 e4 f5 0e f5 0f c2 04 af f7 ef
0x000001b0: 24 fe 60 2d 04 60 03 02 02 3a af f5 ef 24 7f 60
0x000001c0: 16 24 80 70 19 d2 c6 ad 0a 7f 01 12 0b 66 40 03
0x000001d0: 02 02 80 d2 04 80 6a 12 0d 80 f5 0e 80 63 c2 c6
0x000001e0: 22 af f5 ef 24 7f 60 3b 14 60 42 14 60 44 14 60
0x000001f0: 45 24 83 70 46 d2 c6 7d 0e 7f 02 12 0b 66 40 03
...

- addresses 0x00-0x03 are read first: EEPROM type, boot page address and configuration
- after reading the chip ID of the bridge: addresses 0x68-0x6b (single 4 byte read) and addresses 0x70, 0x6c, 0x71, 0x6d, 0x72, 0x6e, 0x73, 0x6f are read: UNKNOWN MEANING
- after sensor probing: addresses 0x86-0x89 (single 4 byte read), addresses 0x8a-0x91 are read: UNKNOWN MEANING

  • Other chips (small)
IDT
STAC9753AX
MPG
E10745Z
UT10953
  • Buttons and LEDs

The buttons and LEDs are connected over GPIO-lines.
All bits are inverted (0 = on/pressed, 1=off/not pressed) !

capturing LED (red): reg 0x84 (r) / reg 0x80 (w) - bit 0
light/flash LED (white): reg 0x84 (r) / 0x80 (w) - bit 6
mute button: 0x84 (r) / 0x80 (w) - bit 2 (button state must be reset manually)
light button: 0x84 (r) / 0x80 (w) - bit 3 (button state must be reset manually)
snapshot button: 0x85 (r) - bit 7

  • Output from lsusb (and /proc/bus/usb/devices)
Bus 006 Device 008: ID 1ae7:9003  
Device Descriptor:
 bLength                18
 bDescriptorType         1
 bcdUSB               2.00
 bDeviceClass            0 (Defined at Interface level)
 bDeviceSubClass         0 
 bDeviceProtocol         0 
 bMaxPacketSize0        64
 idVendor           0x1ae7 
 idProduct          0x9003 
 bcdDevice            2.03
 iManufacturer           0 
 iProduct                0 
 iSerial                 0 
 bNumConfigurations      1
 Configuration Descriptor:
   bLength                 9
   bDescriptorType         2
   wTotalLength          126
   bNumInterfaces          3
   bConfigurationValue     1
   iConfiguration          0 
   bmAttributes         0x80
     (Bus Powered)
   MaxPower              500mA
   Interface Descriptor:
     bLength                 9
     bDescriptorType         4
     bInterfaceNumber        0
     bAlternateSetting       0
     bNumEndpoints           0
     bInterfaceClass         1 Audio
     bInterfaceSubClass      1 Control Device
     bInterfaceProtocol      0 
     iInterface              0 
     AudioControl Interface Descriptor:
       bLength                 9
       bDescriptorType        36
       bDescriptorSubtype      1 (HEADER)
       bcdADC               1.00
       wTotalLength           40
       bInCollection           1
       baInterfaceNr( 0)       1
     AudioControl Interface Descriptor:
       bLength                12
       bDescriptorType        36
       bDescriptorSubtype      2 (INPUT_TERMINAL)
       bTerminalID             1
       wTerminalType      0x0201 Microphone
       bAssocTerminal          0
       bNrChannels             2
       wChannelConfig     0x0000
       iChannelNames           0 
       iTerminal               0 
     AudioControl Interface Descriptor:
       bLength                10
       bDescriptorType        36
       bDescriptorSubtype      6 (FEATURE_UNIT)
       bUnitID                 2
       bSourceID               1
       bControlSize            1
       bmaControls( 0)      0x03
         Mute
         Volume
       bmaControls( 1)      0x00
       bmaControls( 2)      0x00
       iFeature                0 
     AudioControl Interface Descriptor:
       bLength                 9
       bDescriptorType        36
       bDescriptorSubtype      3 (OUTPUT_TERMINAL)
       bTerminalID             3
       wTerminalType      0x0101 USB Streaming
       bAssocTerminal          0
       bSourceID               2
       iTerminal               0 
   Interface Descriptor:
     bLength                 9
     bDescriptorType         4
     bInterfaceNumber        1
     bAlternateSetting       0
     bNumEndpoints           0
     bInterfaceClass         1 Audio
     bInterfaceSubClass      2 Streaming
     bInterfaceProtocol      0 
     iInterface              0 
   Interface Descriptor:
     bLength                 9
     bDescriptorType         4
     bAlternateSetting       1
     bNumEndpoints           1
     bInterfaceClass         1 Audio
     bInterfaceSubClass      2 Streaming
     bInterfaceProtocol      0 
     iInterface              0 
     AudioStreaming Interface Descriptor:
       bLength                 7
       bDescriptorType        36
       bDescriptorSubtype      1 (AS_GENERAL)
       bTerminalLink           3
       bDelay                  1 frames
       wFormatTag              1 PCM
     AudioStreaming Interface Descriptor:
       bLength                11
       bDescriptorType        36
       bDescriptorSubtype      2 (FORMAT_TYPE)
       bFormatType             1 (FORMAT_TYPE_I)
       bNrChannels             2
       bSubframeSize           2
       bBitResolution         16
       bSamFreqType            1 Discrete
       tSamFreq[ 0]         8000
     Endpoint Descriptor:
       bLength                 9
       bDescriptorType         5
       bEndpointAddress     0x83  EP 3 IN
       bmAttributes            1
         Transfer Type            Isochronous
         Synch Type               None
         Usage Type               Data
       wMaxPacketSize     0x00c8  1x 200 bytes
       bInterval               4
       bRefresh                0
       bSynchAddress           0
       AudioControl Endpoint Descriptor:
         bLength                 7
         bDescriptorType        37
         bDescriptorSubtype      1 (EP_GENERAL)
         bmAttributes         0x00
         bLockDelayUnits         0 Undefined
         wLockDelay              0 Undefined
   Interface Descriptor:
     bLength                 9
     bDescriptorType         4
     bInterfaceNumber        3
     bAlternateSetting       0
     bNumEndpoints           1
     bInterfaceClass       255 Vendor Specific Class
     bInterfaceSubClass    234 
     bInterfaceProtocol      0 
     iInterface              0 
     Endpoint Descriptor:
       bLength                 7
       bDescriptorType         5
       bEndpointAddress     0x82  EP 2 IN
       bmAttributes            2
         Transfer Type            Bulk
         Synch Type               None
         Usage Type               Data
       wMaxPacketSize     0x0200  1x 512 bytes
       bInterval               1
Device Qualifier (for other device speed):
 bLength                10
 bDescriptorType         6
 bcdUSB               2.00
 bDeviceClass            0 (Defined at Interface level)
 bDeviceSubClass         0 
 bDeviceProtocol         0 
 bMaxPacketSize0        64
 bNumConfigurations      1
Device Status:     0x0000
 (Bus Powered)

/proc/usb/devices: 

T:  Bus=01 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 16 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1ae7 ProdID=9003 Rev= 2.03
C:* #Ifs= 3 Cfg#= 1 Atr=80 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=00 Driver=snd-usb-audio
I:* If#= 1 Alt= 0 #EPs= 0 Cls=01(audio) Sub=02 Prot=00 Driver=snd-usb-audio
I:  If#= 1 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=00 Driver=snd-usb-audio
E:  Ad=83(I) Atr=01(Isoc) MxPS= 200 Ivl=1ms
I:* If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ea Prot=00 Driver=(none)
E:  Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

/proc/asound/cards: 

1 [U0x1ae70x9003  ]: USB-Audio - USB Device 0x1ae7:0x9003
                     USB Device 0x1ae7:0x9003 at usb-0000:00:13.5-5, high speed

/proc/asound/devices: 

32: [ 1]   : control
33:        : timer
56: [ 1- 0]: digital audio capture

Pictures

Vad2m.jpg
Vad3m.jpg

All pictures in larger size can be found on this page: http://s42.photobucket.com/albums/e344/suamor/webcam_vad Copyright (C) Reinhard Katzmann 2009. Distributed under Creative Common License ca. by is optional but wished (to make it easier for inclusion in mail (mailing list) and forums).

Tools for testing

Reverse Engineering (evaluation of USB-logs)

The device is controlled with USB-control-messages (watch out for URB_FUNCTION_CONTROL_TRANSFER, if you are using SniffUSB) 

Byte 1:  c0 = read from USB device
         40 = write to USB device
Byte 2:  00 = read/write from/to EM2765 register
         02 = i2c read
         03 = i2c write
         06 = read/write from/to sensor register
         08 = check success of read/write from/to sensor register
Byte 3:  always 00
Byte 4:  always 00
Byte 5:  register low byte
Byte 6:  register high byte
Byte 7:  buffer size
Byte 8:  always 00
  • Reads/writes from/to the EM2765 register:
Setup Data:                    Buffer:
c0 00 00 00 0a 00 01 00        36		=> Read reg 0x000a, value is 0x36
40 00 00 00 08 00 01 00        f7		=> Write value 0xf7 to reg 0x0008


  • Reads from i2c-device with slave address 0xa0:
Setup Data:                    Buffer:
40 03 00 00 a0 00 02 00        00 86		=> Select reg 0x0086 of I2C device 0xa0
c0 00 00 00 05 00 01 00        00		=> Check success of i2c operation: 0x00 = success, 0x10 = no response (device not present)
c0 02 00 00 a0 00 04 00        1e 40 1e 72	=> Read 4 bytes from i2c device 0xa0: 0x1e 0x40 0x1e 0x72
c0 00 00 00 05 00 01 00        00		=> Check success of i2c operation: 0x00 = success


  • Reads/writes from/to the sensor (likely connected via SCCB):
Setup Data:                    Buffer:
40 06 00 00 60 00 01 00        0a              => Select sensor register 0x0a
c0 08 00 00 00 00 01 00        00              => Check success of sensor operation: 0x00 = success, 0x01 = no response (device not present)
c0 06 00 00 60 00 01 00        26              => Read from current sensor register (0x0a): 0x26
c0 08 00 00 00 00 01 00        00              => Check success of sensor operation: 0x00 = success
40 06 00 00 60 00 02 00        ff 01           => Write value 0x01 to sensor register 0xff
c0 08 00 00 00 00 01 00        00              => Check success of sensor operation: 0x00 = success
Retrieved from "https://www.linuxtv.org/wiki/index.php?title=VAD_Laplace&oldid=32752"