Recent Linux on the D-Link DIR-685
(Last boot 2017-05-07 with a patched v4.11 kernel)

D-Link DIR-685

D-Link DIR-685

The D-Link DIR-685 is some kind of high-profile product from D-Link, it is labelled a Xtreme N Storage Router whatever that means. It is based solely around the Gemini platform, and ARMv4 Faraday silicon design, and has the following features:

Getting into it

You need to remove four screws on the bottom and then there are plastic snap locks around the edges, I open these with a credit card or a letter knife.

Circuit board photos

Identified electronics:

Connecting a UART

J3 on the top is obviously the serial port. Helpfully there is even a header. There is some documentation I found online on the layout of the serial port:

  PINS:

  o o o _ o
  | | |   |
  | | |   RX
  | | VCC
  | GND
  TX

The serial port configuration should be: 19200 baud, 8 bits, no parity, no flow control. After soldering a RS232 interface accordingly, the console works like a charm!

Booting a kernel

Compiling the kernel

TBD

Analyzing the vendor code

This bootlog from the unmodified firmware shows some kernel init and flash partitioning etc. A modified busybox binary was needed to get the dmesg out. It shows us that the kernel shipping in my router was compiled on march 25, 2010.

The vendor tree has a custom GPIO userspace access driver in boards/wrgns01/apps/nas_gpio_access/nas_gpio_access.c exposing GPIO in /proc/nas_gpio/gpio looking like this:

  # cd nas_gpio/
  # ls
  gpio
  # cd gpio/
  # ls
  outen_pa_7   outen_pa_14  outen_pb_7   outen_pb_14  data_pa_13   data_pa_11
  outen_pa_8   outen_pa_16  outen_pb_8   outen_pb_16  data_pb_6    data_pa_12
  outen_pa_11  outen_pa_18  outen_pb_11  outen_pb_18  data_pa_7
  outen_pa_12  outen_pa_6   outen_pb_12  outen_pb_6   data_pa_8

Inspecting the driver we see that for ports A and B it creates all the same output enable and data input/output files. So this means GPIO lines 6, 7, 8, 11, 12, 13, 14, 16, 18 are used on either port A or port B, and line 13 is only used as input.

There is further a userspace program for GPIO and LED control in boards/wrgns01/apps/fresetd.c where the use of different lines can be deduced. This illustrates that the blue and orange HD LEDs cannot be on at the same time.

After reverse-engineering the following is deducted:

14 and 18 are still unknown, we don't know which port they are used on or for what.

The vendor code also contains boards/wrgns01/apps/rtl8366/rtl8366rb a kernel module for controlling a RealTek RTL8366RB switch using GPIO. A compiled kernel module named switch.ko is in the directory and disassebling it hints that it is doing control of the switch over GPIO in response to custom ioctl() calls from userspace. It includes some kind of interrupt handler named linkInterruptHandle, setting link status, gpio_set_dir_bit, gpio_read_bit, gpio_write_bit, rtl8366rb_setEthernetPHY etc. 0x16 is passed to gpio_read_bit and 0x15 and 0x16 is passed to gpio_write_bit, so it is reasonable to assume that GPIOs 0x15 (21) and 0x16 (22) are used for controlling MDC and MDIO for the RTL8366RB SMI interface.

Kernel TODO

Getting RT2880 wireless going

This needs kernel config CONFIG_RT2800_PCI to begin with.

Links