Cisco 2500 reverse engineering: Motorola 68EC030 "SBC"

[TomS_]

Hi all.

Hope this is the right place to post, its kind of retro/vintage...

Ive been working on reverse engineering a Cisco 2501 router over the last couple of weeks, mostly because its based on a Motorola 68EC030 (MMUless 68030) and this is currently my favourite retro processor family to learn and play around with.

Although they lack any graphics capabilities, I think it still presents an interesting platform to hack around on. And with an ethernet controller on board could provide a reasonable challenge to someone so inclined to turn it into some kind of Internet of Things thing. I plan to have a go getting it talking ethernet/IP to some degree.

I am aware that uClinux was ported to run on the C2500, but I wanted to go deeper and work out how to run my own code from the ground up by replacing the factory boot ROMs entirely. This involved disassembling those boot ROMs and identifying a bunch of registers within two proprietary Cisco chips and their functions/purposes, some of which are critical to getting the board up and running successfully.

Ive documented everything that I have found so far, including all of the necessary bits to get the board operational. A particular goal was to get FreeRTOS running, and I have succeeded in doing this. You can find my fork with m68k port along with my documentation of the router itself on github here:

https://github.com/tomstorey/c2500re

https://github.com/tomstorey/FreeRTOS-Kernel

I'll continue to expand the documentation a bit more as I go along, but I have reached a point where enough is known to get going reliably, and finding anything further will require probably a lot more time than should be spent on it at this stage. 

Enjoy if you so wish! Hopefully someone finds this information useful, or inspires them to go further.

[TomS_]

I took on another project, this time the 1600R series routers. Some similarities between the two, but very different beasts. This time it is using a 68360, which is like a 68k CPU core (CPU32 to be more specific, which I think is similar to a 68020) wrapped in a bunch of peripherals much like a microcontroller.

The biggest drawback of this router model is that there are no jumpers to "fix" the WE/ pin of the ROM sockets, so you have to make a fiddly modification to work around it. On the plus side, it has more LEDs that you can control. 

But, Ive hit a snag with this router which is kind of dragging me down at the moment, and I think I will take a break from it because Ive been going at it pretty intensely over the last several weeks and not making much progress. 

Basically there are some memory ranges that cover the WAN interface slot and a PCMCIA controller (implemented in a CPLD it seems), and I cant seem to work out how to "enable" these, even though I think I am doing everything that Cisco did in the factory boot ROMs.

Its something I might come back to another time when I have some interest again, but for now I think I should really get back to some other projects I was working on before I started all of this.

All of the details I know about the 1600R are up on github as well:

https://github.com/tomstorey/c1600re

Included is a serial bootloader and sample FreeRTOS application if youre feeling adventurous. Enjoy .. again.

[Celliwig]

Hi Tom,

Saw this post while doing some research, turns out we've been working on the same thing!

I think we're pretty much at the same place in regards to the system registers, but you might want to check my repo:

https://github.com/Celliwig/Cisco-2503

I'm afraid documentation is sadly lacking currently, but there is a (really crude) emulator in there, and a U-boot port which might be helpful.
U-boot currently supports the serial interface, system timer, NVRAM (for environment), and Boot Flash. LANCE driver is currently in the works.

Hope that might be helpful, C

[telliz]

Unfortunately, the documentation is missing at the moment, but there may be a (really crude) emulator and submarine port there, which is probably useful.
 Uboot currently supports the serial interface, the machine timer, NVRAM (for the environment) and Boot Flash. The driving force behind Boot is currently in the works.