search

tomstorey / c1600re

Documentation of an effort to reverse engineer a Cisco 1603R router, with the end goal to run my own code on it (in particular FreeRTOS)
14 stars 2 forks source link

QUICC startup code #1

Closed mikra01 closed 3 years ago

mikra01 commented 3 years ago

Hi, I wrote a little kernel for this kind of chip - long time ago. the chip-startup could be useful for you (unfortunately the assembler is not compatible with the gcc) https://github.com/mikra01/quicc_kernel/blob/master/src/kernel.src have fun^^

tomstorey commented 3 years ago

Hi, thanks for this, I will take a look through and see if there is anything I can use.

Most of the startup code is based on what I observed in the disassembly of the factory boot ROM. It was enough to get my own serial bootloader and FreeRTOS running. :-)

My biggest issue at the moment seems to be accessing some external peripherals - I must need to set some value in an external register somewhere to enable some memory ranges, but I havent been able to figure it out yet, so that prevents me from accessing the PCMCIA slot and also the parallel bus to the WIC slot of the router.

mikra01 commented 3 years ago

I found a old (incomplete schematic) - hope you can evaluate further with this information...

the pins TDI (Pin No. 229),TMS(Pin No.228),TCK (Pin No. 227) ,TDO (Pin No.230), /TRST(Pin No. 226) and /TRIS (7 signals with GND) are the JTAG interface^^ - SCC1 and SCC2 are the ethernet ports. don't know but it's possible I still have the complete datasheet (500? pages book) from motorola in my cellar... but in the beginning the chip was buggy (at least two errata-sheets per year). think it's still in production (NXP).

the bdm-port (10 pins) form the signals /DS (Pin No.189),/BERR (Pin No. 239),GND,/BKPT (Pin No. 224),GND,FREEZE (Pin No. 188),/RESETH (Pin. No. 225),/IFETCH (Pin. N0. 213),VCC,/IPIPE0(Pin No. 204) (pins 1 to 10 , 2*5 Berg Connector). GND for instance is Pin (186,190,195,197,200,211,217,223,232,238) VCC is Pin (184,193,201,208,216,220,235). Signal /IRQ1 is Pin No. 240 (the last one) As far as I can remember we just used the BDM for debugging and programming the flash.

The signals CLSN,PENA,TENA,RX,TX,RCLK,TCLK form SCC1 (ethernet). don't know much about the second ethernet port (if you have ISDN the SCC2 is occupied by it (no 2nd ethernet port possible - unless there is a second QUICC which operates in Slave-Mode).

tomstorey commented 3 years ago

This router has a dedicated ISDN controller on-board, with a parallel interface hooked up to the data/address busses. SCC1 is used for an ethernet port, and one or more of the other SCCs look like they might be useable on the WAN interface slot.

Other models have a serial WAN interface instead of ISDN, which very likely maps to one of the remaining SCCs.

SMC1 is being used for the serial console port, and the SPI peripheral also routes to the WAN interface slot to read a small inventory EEPROM.

So worst case scenario I can still interface with SPI devices via the WAN slot, but I really want to get the parallel bus going as well.

Ive got a digital copy of the user manual, its a monster at around 1000 pages. :-)