This is video server provided by D-Link. Known hardware revision: B1. It's VS-2405HBE, OEM device developed by APPRO.

TODO

Flash layout:

root@ /root#cat /proc/mtd
dev:    size   erasesize  name
mtd0: 02000000 00004000 "nand_image"
mtd1: 000fc000 00004000 "bootloader"
mtd2: 00100000 00004000 "backup kernel"
mtd3: 00200000 00004000 "kernel"
mtd4: 00700000 00004000 "rootfs"
mtd5: 00100000 00004000 "config data"
mtd6: 00400000 00004000 "web page"
mtd7: 00a00000 00004000 "firmware"
mtd8: 00600000 00004000 "sensor data"

Dmesg info: here

Disk fillness:

root@ /root# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 7.0M      6.7M    268.0K  96% /
tmpfs                    61.5M         0     61.5M   0% /tmp
/dev/root                 7.0M      6.7M    268.0K  96% /dev/.static/dev
tmpfs                    10.0M     28.0K     10.0M   0% /dev
/dev/mtdblock7           10.0M      5.3M      4.7M  53% /opt/ipnc
/dev/mtdblock6            4.0M      3.1M    932.0K  77% /opt/www
/dev/mtdblock5            1.0M     80.0K    944.0K   8% /mnt/data
/dev/sbulla             494.0K      2.0K    492.0K   0% /mnt/ramdisk

Mount Points:

root@ /root# mount
rootfs on / type rootfs (rw)
/dev/root on / type jffs2 (ro)
ramfs on /etc type ramfs (rw)
ramfs on /var type ramfs (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
tmpfs on /tmp type tmpfs (rw)
/dev/root on /dev/.static/dev type jffs2 (ro)
tmpfs on /dev type tmpfs (rw)
devpts on /dev/pts type devpts (rw)
/dev/mtdblock7 on /opt/ipnc type jffs2 (ro)
/dev/mtdblock6 on /opt/www type jffs2 (ro)
/dev/mtdblock5 on /mnt/data type jffs2 (rw,sync)
/dev/sbulla on /mnt/ramdisk type vfat (rw,sync,fmask=0022,dmask=0022,codepage=cp437,iocharset=iso8859-1)

The alarm inputs are electrically-isolated by LTV-357T optocouples. The alarm output is electrically-isolated by EPR411A064000 relay.

Front:

Back:

Note: This will void your warranty!

• Unscrew the 2 screws on one of sides (no need to unscrew both front and back sides)
• Get the pcb and pull it

The PCB have processor module and main board module.

Photo of bottom side PCBs

Photo of top side PCBs

Photo of top side of main board PCB (CPU-module removed)

Photo of CPU-module PCB (top-side)

Photo of CPU-module PCB (bottob-side)

How to connect to the Serial Port of this specific device:

The board contains 2 serial ports. To connect console-port, look at the CPU-module PCB photo, and find JP1 (unsoldered 16-pin connector). This connector contains serial port pins:

Look at "Photo of top side of CPU-module PCB" for soldering. At photos, the cords already soldered to needed pins. The speed is 115200 8N1.

The second serial port is connected to voltage level converter, and used for RS-485 connection to the camera.

NOTE, the root password of the original firmware is unknown, but You have access to U-Boot.

Before booting kernel, the board boots 3 Bootloaders:

1. RBL (rom bootloader), it selects from what device to boot. The board try to boot from nand, but if it fails, it will try to boot from SD/MMC.
2. UBL (user bootloader), it's first 16 KiB at the nand memory, this bootloader needed to met RBL requirements.
3. U-Boot. Almost 1 MiB allocated for this bootloader (include nvram).

You have full access to U-Boot. To enter into U-Boot menu, just press any key when board started, here is output and "help" cmd:

Booting Catalog Boot Loader
BootMode = NAND

sensor_test: 0x00000000
update_mode: 0x00000000
load_default: 0x00000000
Starting NAND Copy...
Valid MagicNum found.

 ENTRY POINT = 0x81080000
 NUM PAGES = 0x00000130
 BLOCK = 0x00000010
 PAGE = 0x00000001
 LOAD ADDRESS = 0x81080000   DONE
Jumping to entry point at 0x81080000.


U-Boot 1.3.4 (May 25 2010 - 19:52:11) DM365-IPNC

I2C:   ready
DRAM:  128 MB
NAND:  NAND device: Manufacturer ID: 0xec, Chip ID: 0x75 (Samsung NAND 32MiB 3,3V 8-bit)
Bad block table found at page 65504, version 0x00
Bad block table found at page 65472, version 0x00
32 MiB
In:    serial
Out:   serial
Err:   serial
ARM Clock :- 297MHz
DDR Clock :- 270MHz
Ethernet PHY: GENERIC @ 0x01
Hit any key to stop autoboot:  0 
DM365 IPNC :>help
?       - alias for 'help'
askenv  - get environment variables from stdin
autoscr - run script from memory
base     - print or set address offset
boot    - boot default, i.e., run 'bootcmd'
bootd   - boot default, i.e., run 'bootcmd'
bootm   - boot application image from memory
bootp   - boot image via network using BootP/TFTP protocol
cmp      - memory compare
coninfo - print console devices and information
cp       - memory copy
crc32    - checksum calculation
dhcp    - invoke DHCP client to obtain IP/boot params
echo    - echo args to console
fsinfo  - print information about filesystems
fsload  - load binary file from a filesystem image
go      - start application at address 'addr'
help    - print online help
icrc32  - checksum calculation
iloop   - infinite loop on address range
imd     - i2c memory display
iminfo  - print header information for application image
imm     - i2c memory modify (auto-incrementing)
imw     - memory write (fill)
imxtract- extract a part of a multi-image
inm     - memory modify (constant address)
iprobe  - probe to discover valid I2C chip addresses
itest   - return true/false on integer compare
loadb   - load binary file over serial line (kermit mode)
loads   - load S-Record file over serial line
loady   - load binary file over serial line (ymodem mode)
loop     - infinite loop on address range
ls      - list files in a directory (default /)
md       - memory display
mii     - MII utility commands
mm       - memory modify (auto-incrementing)
mtest    - simple RAM test
mw       - memory write (fill)
nand - NAND sub-system
nboot   - boot from NAND device
nfs     - boot image via network using NFS protocol
nm       - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
rarpboot- boot image via network using RARP/TFTP protocol
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
saves   - save S-Record file over serial line
setenv  - set environment variables
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor version
DM365 IPNC :>

As a beginner, you really should inform yourself about soldering in general and then obtain some practical experience!

TODO The LED may be soldered to PCB to inform users, that SD/MMC card is busy. Just connect resistor 300 Ohm … 1 KOhm into R66 place, and LED into LED1 place.

TODO Both USB-modes are supported (OTG and HOST), but need to add resistors/jumpers to CPU-board, due USB mode must be selected by pin-configuration. Parts needed in main board: USB1, T3, R79, R76, R71, R78, R70, R68.

Find JP2 connector (white) at the top side of main board. It's composite-video output. It works fine as-is, but it would be a good idea to solder operational amplifier, to protect dm365 chip from static electricity.

1. D-Link GPL code for DVS-310-1 B1. Total: 1.6 GiB (contains DVSDK 2.0 components, no sources for AVServer application and TI-modules). It's very old, but usable to determine what gpio pins connected to i/o lines:
   • DVS-310-1_FW_v1.00_GPL.tar.gz (various tools)
   • lzo-2.03.tar.gz (compression library)
   • mv_pro_5.0.tar.gz (montavista tree)
   • readme.txt
2. Gateworks Rincon developed Openwrt patches for DM6446 (very similar CPU):
   • trac with svn
   • They also creates Luci-web module for H264 streaming to multicast.
   • ti-modules package contains sources for proprietary part for using H264 and MJPEG hardware encoders.
   • They creates patches to kernel to support TVP5150 chip, that used in DVS-310-1
3. LeopardBoard SDK (RidgeRun SDK): registration needed
   • Using the same kernel as backfire (2.6.32)
   • integrated with DVSDK to produce hardware-accelerated H264/MJPEG, MP3/AAC codec's for gstreamer (same as gateworks rincon).
4. TI DVSDK: wiki page, for download, you need to register at TI and accept license agreement. This step always needed, if You need hardware-accelerated codecs.
   • Contains source code for kernel modules, that utilize DSP functionality (codecs, scalers, face detection, etc.)
   • Latest version (DVSDK_4.0) also using linux-2.6.32 as kernel.

This device selling at various markets (especially at security survillance), the price for this device: ~250$ (June 2011)

2.6.33 kernel patches

ToDo:

1. Use TI-tools to compile DSP-related code
2. Make gstreamer works at target platform.
3. Test luci video streaming application (decoding/encoding).

Development Notes:

The eth0 mac given by U-Boot at commandline argument eth=F0:7D:xx:xx:xx:xx