Mailing List Archive

1600R series router internals
Hi all, this is probably a long shot from far out of left field, but I
wonder if anyone is familiar with the deep inner workings of the 1600R
series routers?

Long story short, I got a bit bored recently with all of the coronavirus
related restrictions, and started to reverse engineer some older model
Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
CPUs, with a "no particular reason" goal of making FreeRTOS run on them
(achievement unlocked.)

But the 1600R is throwing me a curve ball, and Im having difficulty
seemingly "unlocking" access to the memory ranges that cover the WIC slot
and the PCMCIA controller registers.

Ive used Ghidra to disassemble and rummage through the factory boot ROM
code to figure out basically "what Cisco did", and re-implemented it
myself, but I still seem to be missing something. Basically, I wondered if
someone here might be familiar enough with these old boxes at a low enough
level and might know if there is something in particular that needs to be
poked to make this work?

Thanks in advance!

Tom
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Tom,

There was a project of porting OpenWRT to 3600 routers, I
believe you could benefit from talking to the author if he’s
somewhere around.

Can’t find the URL now, but I bet somebody will do.

We can’t really share confidential information about the
architecture - if it’s not on CCO, it would require NDA,
and as 1600 is so old... you can imagine finding person
willing to do that and take responsibility of sharing that
info would be kind of a challenge.

--
./

> On 25 Mar 2021, at 18:23, Tom Storey <tom@snnap.net> wrote:
>
> Hi all, this is probably a long shot from far out of left field, but I
> wonder if anyone is familiar with the deep inner workings of the 1600R
> series routers?
>
> Long story short, I got a bit bored recently with all of the coronavirus
> related restrictions, and started to reverse engineer some older model
> Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> (achievement unlocked.)
>
> But the 1600R is throwing me a curve ball, and Im having difficulty
> seemingly "unlocking" access to the memory ranges that cover the WIC slot
> and the PCMCIA controller registers.
>
> Ive used Ghidra to disassemble and rummage through the factory boot ROM
> code to figure out basically "what Cisco did", and re-implemented it
> myself, but I still seem to be missing something. Basically, I wondered if
> someone here might be familiar enough with these old boxes at a low enough
> level and might know if there is something in particular that needs to be
> poked to make this work?
>
> Thanks in advance!
>
> Tom
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/

_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
A long time ago somebody attempted a port of Linux to the Cisco 2500
platform already. Not sure if you stumbled upon this already during
research.
Please share your achievements, this is interesting.

-Alex

[1] http://www.kdvelectronics.eu/uClinux-cisco2500/uClinux-cisco2500.html

On Thu, Mar 25, 2021 at 05:23:31PM +0000, Tom Storey wrote:
> Hi all, this is probably a long shot from far out of left field, but I
> wonder if anyone is familiar with the deep inner workings of the 1600R
> series routers?
>
> Long story short, I got a bit bored recently with all of the coronavirus
> related restrictions, and started to reverse engineer some older model
> Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> (achievement unlocked.)
>
> But the 1600R is throwing me a curve ball, and Im having difficulty
> seemingly "unlocking" access to the memory ranges that cover the WIC slot
> and the PCMCIA controller registers.
>
> Ive used Ghidra to disassemble and rummage through the factory boot ROM
> code to figure out basically "what Cisco did", and re-implemented it
> myself, but I still seem to be missing something. Basically, I wondered if
> someone here might be familiar enough with these old boxes at a low enough
> level and might know if there is something in particular that needs to be
> poked to make this work?
>
> Thanks in advance!
>
> Tom
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Alexander Huemer wrote on 26/03/2021 13:26:
> A long time ago somebody attempted a port of Linux to the Cisco 2500
> platform already

http://www.kdvelectronics.eu/uClinux-cisco2500/uClinux-cisco2500.html

iirc, it was limited in many ways but did forward packets, albeit about
10% slower than native ios. Koen raised quite a lot of eyebrows when he
released this to an unsuspecting world.

Nick
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Hi Lukasz,

Interesting. I might take a little look into this, but not sure how much of
it will translate over, I presume they will be very different platforms
(there are very few similarities between the 2500 and 1600R other than the
family of CPU).

It definitely is going to be a challenge, but if you dont ask, you dont
get. :-)

On Fri, 26 Mar 2021 at 12:43, Lukasz Bromirski <lukasz@bromirski.net> wrote:

> Tom,
>
> There was a project of porting OpenWRT to 3600 routers, I
> believe you could benefit from talking to the author if he’s
> somewhere around.
>
> Can’t find the URL now, but I bet somebody will do.
>
> We can’t really share confidential information about the
> architecture - if it’s not on CCO, it would require NDA,
> and as 1600 is so old... you can imagine finding person
> willing to do that and take responsibility of sharing that
> info would be kind of a challenge.
>
> --
> ./
>
> > On 25 Mar 2021, at 18:23, Tom Storey <tom@snnap.net> wrote:
> >
> > Hi all, this is probably a long shot from far out of left field, but I
> > wonder if anyone is familiar with the deep inner workings of the 1600R
> > series routers?
> >
> > Long story short, I got a bit bored recently with all of the coronavirus
> > related restrictions, and started to reverse engineer some older model
> > Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> > CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> > (achievement unlocked.)
> >
> > But the 1600R is throwing me a curve ball, and Im having difficulty
> > seemingly "unlocking" access to the memory ranges that cover the WIC slot
> > and the PCMCIA controller registers.
> >
> > Ive used Ghidra to disassemble and rummage through the factory boot ROM
> > code to figure out basically "what Cisco did", and re-implemented it
> > myself, but I still seem to be missing something. Basically, I wondered
> if
> > someone here might be familiar enough with these old boxes at a low
> enough
> > level and might know if there is something in particular that needs to be
> > poked to make this work?
> >
> > Thanks in advance!
> >
> > Tom
> > _______________________________________________
> > cisco-nsp mailing list cisco-nsp@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Hi Alexander,

Yep, had come across uClinux, but Im going to a lower level than they did I
think. And by the time I looked at their documentation I had pretty much
already worked out everything they had.

Im much more of a "bare metal" kind of person I guess (I do a lot of
hobby work with microcontrollers). So for my projects I took out the
factory boot ROMs and flash and started from the ground up - locate and
document internal registers, address map, etc - basically working out how
to bend them to my will.

Theres a pretty big "retro scene" these days around old computer hardware
and processors, and I figure with 680x0 processors on-board and a bunch of
other components (like ethernet controllers!), these old routers could
maybe see some new life. :-)

Ive put everything I know up on github with some example code:

https://github.com/tomstorey/c2500re
https://github.com/tomstorey/c1600re

As projects they are still somewhat "works in progress", but the code
examples do compile and boot with appropriate mods.

On Fri, 26 Mar 2021 at 13:30, Alexander Huemer <alexander.huemer@xx.vu>
wrote:

> A long time ago somebody attempted a port of Linux to the Cisco 2500
> platform already. Not sure if you stumbled upon this already during
> research.
> Please share your achievements, this is interesting.
>
> -Alex
>
> [1] http://www.kdvelectronics.eu/uClinux-cisco2500/uClinux-cisco2500.html
>
> On Thu, Mar 25, 2021 at 05:23:31PM +0000, Tom Storey wrote:
> > Hi all, this is probably a long shot from far out of left field, but I
> > wonder if anyone is familiar with the deep inner workings of the 1600R
> > series routers?
> >
> > Long story short, I got a bit bored recently with all of the coronavirus
> > related restrictions, and started to reverse engineer some older model
> > Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> > CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> > (achievement unlocked.)
> >
> > But the 1600R is throwing me a curve ball, and Im having difficulty
> > seemingly "unlocking" access to the memory ranges that cover the WIC slot
> > and the PCMCIA controller registers.
> >
> > Ive used Ghidra to disassemble and rummage through the factory boot ROM
> > code to figure out basically "what Cisco did", and re-implemented it
> > myself, but I still seem to be missing something. Basically, I wondered
> if
> > someone here might be familiar enough with these old boxes at a low
> enough
> > level and might know if there is something in particular that needs to be
> > poked to make this work?
> >
> > Thanks in advance!
> >
> > Tom
> > _______________________________________________
> > cisco-nsp mailing list cisco-nsp@puck.nether.net
> > https://puck.nether.net/mailman/listinfo/cisco-nsp
> > archive at http://puck.nether.net/pipermail/cisco-nsp/
> _______________________________________________
> cisco-nsp mailing list cisco-nsp@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Hi,

On Fri, Mar 26, 2021 at 03:37:41PM +0000, Tom Storey wrote:
> Interesting. I might take a little look into this, but not sure how much of
> it will translate over, I presume they will be very different platforms
> (there are very few similarities between the 2500 and 1600R other than the
> family of CPU).

3600 is similar in some aspects, as it has the NM modules with WIC slots
on them.

(I do not have any specifics, but assume that the NM would have a
PCI<->PCMCIA bridge chip on it, connecting the WICs)

gert
--
"If was one thing all people took for granted, was conviction that if you
feed honest figures into a computer, honest figures come out. Never doubted
it myself till I met a computer with a sense of humor."
Robert A. Heinlein, The Moon is a Harsh Mistress

Gert Doering - Munich, Germany gert@greenie.muc.de
Re: 1600R series router internals [ In reply to ]
Oh yeah! Im thinking of the wrong 3600 - for some reason I was thinking
along the lines of a wireless access point - I guess that is what I would
expect from something like OpenWRT. :-)

On Fri, 26 Mar 2021 at 16:10, Gert Doering <gert@greenie.muc.de> wrote:

> Hi,
>
> On Fri, Mar 26, 2021 at 03:37:41PM +0000, Tom Storey wrote:
> > Interesting. I might take a little look into this, but not sure how much
> of
> > it will translate over, I presume they will be very different platforms
> > (there are very few similarities between the 2500 and 1600R other than
> the
> > family of CPU).
>
> 3600 is similar in some aspects, as it has the NM modules with WIC slots
> on them.
>
> (I do not have any specifics, but assume that the NM would have a
> PCI<->PCMCIA bridge chip on it, connecting the WICs)
>
> gert
> --
> "If was one thing all people took for granted, was conviction that if you
> feed honest figures into a computer, honest figures come out. Never
> doubted
> it myself till I met a computer with a sense of humor."
> Robert A. Heinlein, The Moon is a Harsh
> Mistress
>
> Gert Doering - Munich, Germany
> gert@greenie.muc.de
>
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
Re: 1600R series router internals [ In reply to ]
Quick update for anyone that is playing along, but I had a bit of a light
bulb moment and have managed to solve the issue.

It turns out that my mod to take control of pin 31 of the boot ROM sockets
to allow me to use smaller ROM sizes (which involved installing a jumper to
allow me to pull this signal high because it is the WE/ pin of smaller ROMs
as opposed to an address pin on the larger factory ROMs) was also resulting
in an address line (A19) being pulled high on the two CPLDs. It is only by
sheer coincidence that this didnt cause any issues with the registers I was
able to access (e.g. to control LEDs), because those registers were all at
addresses where that address line would have been high anyway!

So I made another very fiddly mod to the board to re-route the two CPLD
pins to the original address signal and hey presto, WIC address space and
registers for the PCMCIA controller are now accessible. :-)

Unfortunately due to the way this particular trace is routed on the board,
it is not possible to break it anywhere else to make easier or fewer mods,
so the difficulty factor in re-using these routers has increased, or a more
creative solution is required.

Anyway, time to spin some WIC blanks with prototyping area I think. :-)

On Thu, 25 Mar 2021 at 17:23, Tom Storey <tom@snnap.net> wrote:

> Hi all, this is probably a long shot from far out of left field, but I
> wonder if anyone is familiar with the deep inner workings of the 1600R
> series routers?
>
> Long story short, I got a bit bored recently with all of the coronavirus
> related restrictions, and started to reverse engineer some older model
> Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> (achievement unlocked.)
>
> But the 1600R is throwing me a curve ball, and Im having difficulty
> seemingly "unlocking" access to the memory ranges that cover the WIC slot
> and the PCMCIA controller registers.
>
> Ive used Ghidra to disassemble and rummage through the factory boot ROM
> code to figure out basically "what Cisco did", and re-implemented it
> myself, but I still seem to be missing something. Basically, I wondered if
> someone here might be familiar enough with these old boxes at a low enough
> level and might know if there is something in particular that needs to be
> poked to make this work?
>
> Thanks in advance!
>
> Tom
>
_______________________________________________
cisco-nsp mailing list cisco-nsp@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/