[c-nsp] 1600R series router internals

[Tom Storey]

Quick update for anyone that is playing along, but I had a bit of a light
bulb moment and have managed to solve the issue.

It turns out that my mod to take control of pin 31 of the boot ROM sockets
to allow me to use smaller ROM sizes (which involved installing a jumper to
allow me to pull this signal high because it is the WE/ pin of smaller ROMs
as opposed to an address pin on the larger factory ROMs) was also resulting
in an address line (A19) being pulled high on the two CPLDs. It is only by
sheer coincidence that this didnt cause any issues with the registers I was
able to access (e.g. to control LEDs), because those registers were all at
addresses where that address line would have been high anyway!

So I made another very fiddly mod to the board to re-route the two CPLD
pins to the original address signal and hey presto, WIC address space and
registers for the PCMCIA controller are now accessible. :-)

Unfortunately due to the way this particular trace is routed on the board,
it is not possible to break it anywhere else to make easier or fewer mods,
so the difficulty factor in re-using these routers has increased, or a more
creative solution is required.

Anyway, time to spin some WIC blanks with prototyping area I think. :-)

On Thu, 25 Mar 2021 at 17:23, Tom Storey <tom at snnap.net> wrote:

> Hi all, this is probably a long shot from far out of left field, but I
> wonder if anyone is familiar with the deep inner workings of the 1600R
> series routers?
>
> Long story short, I got a bit bored recently with all of the coronavirus
> related restrictions, and started to reverse engineer some older model
> Cisco routers (2500 and 1600R) that are based on Motorola 68000 family
> CPUs, with a "no particular reason" goal of making FreeRTOS run on them
> (achievement unlocked.)
>
> But the 1600R is throwing me a curve ball, and Im having difficulty
> seemingly "unlocking" access to the memory ranges that cover the WIC slot
> and the PCMCIA controller registers.
>
> Ive used Ghidra to disassemble and rummage through the factory boot ROM
> code to figure out basically "what Cisco did", and re-implemented it
> myself, but I still seem to be missing something. Basically, I wondered if
> someone here might be familiar enough with these old boxes at a low enough
> level and might know if there is something in particular that needs to be
> poked to make this work?
>
> Thanks in advance!
>
> Tom
>