| Aviosys 9100A Plus Video Server. |
|
I was looking for IP video cameras when I came across one of Steve Ciarcia's editorials
in Circuit Cellar magazine in which
he mentioned an inexpensive 4 port IP video server that he had been playing with.
After a little googling, I discovered that it appears to be available under several
different brand names at wildly varying prices, ranging from $80.00 for the Aviosys
9100A Plus from www.geeks.com to over $300 at a custom security outfit. Since then,
I have found it on sale for even less than $70.00.
|
| Last update: June 2006 |
The 9100A provides a lot of bang for the buck, hardware-wise, but the software
leaves something to be desired. It works reasonably well under Internet Explorer, but if
you use any other browsers, you get only a very primitive display with far fewer options.
I noticed also that even when I was viewing a static image using Firefox, the 9100A was
using the network constantly. I didn't bother to find out what the little box was sending,
but I could see the lights on my network switch flashing continuously. Installing the 9100A
is simple, just plug it in and it works. As long as you're running a DHCP server somewhere
on your network, it will acquire an IP address and away you go. For some reason, though,
it has the curious habit of checking with the DHCP server every 30 seconds, which I find
annoying because it tends to fill my logs unnecessarily. While the 9100A might be quite
useful on a Windows system, I wanted to use it with Linux, and I wasn't happy with it's
quirks and minimal Linux support -- although it is always gratifying to see products that
acknowledge Linux's existence at all; far too many companies seem to think that Windows is
the only game in town.
Anyway, I rapidly lost interest in using the 9100A as is, and decided it would be more
interesting to see what makes it tick. Is there any way to customize it? What software
does it run? Is there any way to port Linux to it, or perhaps it already runs Linux -- more
and more of these little embedded products do. The box and documentation don't mention
it, but you never know.
The top and bottom of the case pop off quite easily, revealing two stacked circuit boards.
Removing three screws releases the boards, but they don't come out easily while they're
still joined together. You have to separate them before
you can remove them from the case. They're connected by two sets of header pins, one group
of four on one of the short sides of the boards and one double row of 26 on one of the long sides.
You can reach through from the bottom and push up on the top board while pushing down on
the bottom board with a small screw driver to separate them.
Once they're separated, they come out easily. The top board is the video interface board,
the bottom one is the CPU board. The chips are standard surface mount devices and
datasheets for all of them are readily available on the web.
The CPU board contains
- 32-bit ARM7TDMI-based CPU (Winbond W90N740DG).
- 8MB (2Mx32bit) DRAM (EtronTech EM638325TS-6G).
- 2MB flash memory (Spansion S27AL016M).
- ethernet transceiver (Davicon DM9161EP).
- 8bit microcontroller with 64KB main flash EPROM, 4KB aux flash EPROM and 512 bytes RAM (Winbond W78L516A24LL).
- 9bit video input processor (Philips SAA7113H).
- camera image processor (Winbond W99682BCDB).
- 8MB (4Mx16bit) low power DRAM (Etronics EM638165TS-7G).
- stereo audio ADC/DAC (Philips UDA1345TS).
Pulling the CPU board out of the case revealed a 4-pin header I traced the pins back to the main CPU and found that they are connected to the chip's built-in serial port. That seemed promising.
Unfortunately, the signals on those pins are not RS232, so I had to build a little interface circuit.
Any RS232 driver chip should work, I used a Maxim MAX232 dual port chip I had on hand. I didn't
need both ports, but it was cheap and uses only 5v to generate the -10/+10 voltage swing required
by RS232. With that circuit attached to the header pins, I connected a serial port, fired up
minicom (a terminal emulator), tried a few baud rates and when I hit 115200,8,n,1 ... presto!
This little thing is already running linux. 2.4.20 uClinux, in fact (see the boot messages
here).
As you'd expect for a device like this, there's nothing in the
filesystem other that what's absolutely necessary for it to do its job. If you're lucky, the
manufacturer will have left a few utilities in there to simplify maintenance and debugging,
but in this case, the only program of any use is a shell, sash, with a handful
of standard linux utilities (ls, ps, df, etc.) built in. Other than sash and its built-in
commands, the only executables are dhcpc, ifconfig, iwconfig, mount, pppd, and route.
There are also two custom programs which do all the useful work: camera.flat and mctest.
There is one system configuration script, inittab, which mounts various filesystems (/proc, /usr, /swap,
/var/run, and /etc/Html/Reboot), runs ifconfig to bring up the network, then starts camera.flat, mctest,
and sh. There's also a bunch of html files in /etc/Html that form the web interface to the
video functions.
A ps command shows the following processes:
PID PORT STAT SIZE SHARED %CPU COMMAND
1 S 150K 0K 0.0 /bin/sh -t /bin/inittab
2 S 0K 0K 0.0 keventd
3 R 0K 0K 0.0 ksoftirqd_CPU0
4 S 0K 0K 0.0 kswapd
5 S 0K 0K 0.0 bdflush
6 S 0K 0K 0.0 kupdated
7 S 0K 0K 0.0 khubd
15 S 1622K 0K 0.0 camera.flat
16 S 86K 0K 0.0 mctest
17 R 137K 0K 0.0 sh
18 S 137K 0K 0.0 /bin/dhcpc eth1
19 S 1622K 0K 0.0 camera.flat
20 S 1622K 0K 0.0 camera.flat
21 S 1622K 0K 0.0 camera.flat
22 S 1622K 0K 0.0 camera.flat
23 S 1622K 0K 0.0 camera.flat
24 R 1622K 0K 92.0 camera.flat
25 S 1622K 0K 1.2 camera.flat
26 S 1622K 0K 0.0 camera.flat
27 S 1622K 0K 0.0 camera.flat
> od -Ad -tx2z 9100A_IE_V237.bin | grep rom 0492320 0000 82ba 0007 0000 722d 6d6f 6631 2d73 >........-rom1fs-< 0492336 0f00 a046 3a78 f23f 6f72 206d 3234 3465 >..F.x:?.rom 42e4< 0686848 6e61 6920 6574 206d 7266 6d6f 6120 6f62 >an item from abo< 0740192 7265 6576 2072 6974 656d 6620 6f72 206d >erver time from < 0753408 5774 6469 6874 2d20 6f20 7250 6d6f 7470 >tWidth - oPrompt< 0754272 7073 6e61 6920 3d64 506f 6f72 706d 5474 >span id=oPromptT< 1035488 0000 0000 698d fa48 6f72 316d 0000 0000 >.....iH.rom1....< >The "-rom1fs-" token on the first line marks the start of the filesystem and, in this case, is at offset 492328. I extracted and mounted the filesystem by typing --
> dd if=9100A_IE_V237.bin bs=1 skip=492328 of=romfs_image.bin
> file romfs_image.bin
romfs_image.bin: romfs filesystem, version 1 1001120 bytes, named rom 42e44511.
> mkdir /mnt/t
> mount -o loop ./romfs_image.bin /mnt/t
> ls -sF /mnt/t
total 0
0 bin/ 0 dev/ 0 etc/ 0 proc/ 0 swap/ 0 usr/ 0 var/
>
A ROMFS filesystem is read-only; after all, it is intended to be installed in a ROM. So I copied the contents of the file system to a R/W directory, made a trivial change to it and generated a new ROMFS image --
> cp -a /tmp/t romfs_master > touch romfs_master/etc/test > genromfs -d romfs_master -f romfs_new.bin >
All that remained was to screw up my courage and install my modified filesystem, hoping I didn't trash the 9100A in the process. The CPU has a JTAG interface that lets you gain control of the machine even if it can't boot, but that interface is not brought out to the CPU board in the 9100A, and my clumsy soldering skills preclude any possibility of being able to attach the necessary wires directly to those tiny pins on the chip itself, so if my experiment caused the machine to fail to boot, there was a chance I would end up with an $80.00 paperweight. But the boot monitor is fairly powerful and I was reasonably sure I would be able to reinstall the original system, if necessary.
You enter the 9100A boot monitor by rebooting and hitting the Escape key when it prompts you. Once in the monitor, you can type "ls" to see a list of flash partitions --
Press ESC to enter debug mode . [hit the Escape key here] bootloader > ls Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000038 exec:0x7F010000 -af Image: 7 name:linux base:0x7F020000 size:0x00078314 exec:0x00008000 -acxz Image: 6 name:romfs base:0x7F0C0000 size:0x000F4800 exec:0x7F0C0000 -aYou need to delete the romfs partition, in this case, partition 6, and then use the ft command to load a file into flash via TFTP. The arguments to the ft command come from the output of the ls command, above. It doesn't hurt if you skip the del command; ft will do it for you, if necessary --
bootloader > del 6 Deleting Image 6 ... ................ bootloader > ft 6 romfs 0x7f0c0000 0x7f0c0000 -a Wait for auto-negotiation complete...OK 100MB - Full Duplex DHCP DISCOVER... DHCP REQUEST... DHCP ACKed... IP Address. . . . . . . . . . . . : 192.168.1.133 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 Waiting for download ...Now the 9100A is running as a TFTP server and you have to go to another machine and send the ROMFS file you want to install --
> tftp 192.168.1.133 tftp> binary tftp> put romfs_new.bin Sent 1001472 bytes in 1.5 seconds tftp> quit >The 9100A responds with --
TFTP client: 192.168.1.10 Download OK, file size:1001472 Flash programming ... ................ bootloader >And that's it. If you type "boot", the monitor will boot the system and you'll be running with your new filesystem. I found no problems with my modified filesystem. The 9100A came up cleanly and the file I created was right there where I put it.
That's where things stand at the moment. What I want to do next is to install some way to log in to the 9100A over the network, either a telnet server or, preferably, an ssh server; I'd also like to try to build my own kernel for it. To that end, I'm assembling a cross-compiler development system to be able to compile ARM executables on my Intel linux box. I'll update this page as the project progresses.
