Preliminary data
~~~~~~~~~~~~~~~~

Our non-invasive incursion into the GNet BB0060B ADSL device begins with
the chip where its FirmWare resides:  U8, an Atmel AT45DB161B FLASH chip
fully described by the chip manufacturer's 33 pages on-line .PDF manual:

http://www.atmel.fi/dyn/resources/prod_documents/doc2224.pdf

This document is important in the understanding of the PCB layout around
U8, starting with its TSOP-28 pins layout/description (shown at page 1):

.................. Ready/*Busy -> Rdy/*Busy (1)
....................... *RESET -> *Reset (2)
... HarWare Page Write Protect -> WP (3)
. Voltage (continuous Current) -> Vcc (6)
............... Ground/0 Volts -> Gnd (7)
................. *Chip Select -> *CS (11)
................. Serial Clock -> SCk (12)
................. Serial Input -> SI (13)
................ Serial Output -> SO (14)
................ No Connection -> N.C. (all other pins)

* Marked as "Active Low".

01. U8 JP1 (close view).jpg 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

U8's home position (Pin #1 - top view) is marked with an embossed golden
dot, pin count follows a classic anti-clockwise "U" shapped progression.

Essentially, all of U8's active pins can be seen on the present picture:
the power-supply decoupling capacitor (pin 6) is identified quite easily
and the data lines from its 3-wire Serial Peripheral Interface (SPI) bus
aren't hard to find neither.  Provided there's no split path involving a
hidden line from under U8, those who are handy with a soldering iron may
appreciate that they would be able to modify the circuit ahead of pin #3
so that some mechanical switch can override the Write Protection signal.

According to the .PDF documentation, it happens that pin #1 (Rdy/*Busy),
pin #7 (Gnd) - and perhaps a few more - have their copper traces covered
by U8's package and hence, the electrical paths can't be determined with
100 % certainty unless the signals are measured or that chip is removed.

It isn't clear where the copper trace passing along C43, JP1-1 and JP1-2
is actually heading but a knee ends this line near JP1-2/JP1-3.  Beneath
the FLASH chip, near pin #14, another line emerges that also ends with a
knee but this one left some clues on the picture:  it's partly masked by
the white-ink mark close to JP1-3/JP1-4 but remains visible and seems to
point at that on the other side of JP1.  The apparent alignment of these
knees is such that one might think the lines meet at JP1-3, somewhere in
the middle;  only, what's coming after the knee (shown here) may as well
happen to be a second one ending with a copper trace between JP1-3/JP1-4
which, instead, stays away:  U8-7 still has no path to ground, so far...

Next to this puzzling track - of which none of the extremities have been
defined yet, the outermost one (relatively to pin #14 of the FLASH chip)
just has no room to target anything else but JP1-4.  The allocated space
around JP1-4 is so tight we should conclude the line is connected to it.

Now, lets focus on a few not so subtle details that the camera captured,
specifically:  the Serial Clock (U8-12), Serial Input (U8-13) and Serial
Output (U8-14) signals.  SCk starts with pin #12 and goes toward the R49
empty landing-pad (the component at this location is optional), then the
copper trace reaches the main Conexant chip (U10-40 via R39) but this is
beyond our grasp at the moment...  As for the serial data lines, a close
look at the JP1 connector shows them were JP1-1/U8-13 and JP-2/U8-14 are
meeting.  Some small bit of dark green, visible between JP1-1's base and
the white-ink markings, seems to be part of a straight line which points
directly at JP1-1 and hence tends to confirm that U8-13 is linked to it;
the green knee near the top of the "4" character (R49 white label) shows
that U8-14 is most likely connected to JP1-2.  Conclusion:  Serial Input
corresponds to the JP1 pin labelled as "1" on the Printed Circuit Board,
Serial Output is next to it and this simply means it connects to pin #2.

02. U8 JP1 SI-SO Bridge & U8 Ground (x-ray views).jpg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The present shot provides a global view on the maintenance connector and
the FLASH chip located close to it.  JP1-5 and JP1-6 are now visible and
we get another glimpse at a signal line mentioned above (the one between
R52 and C43).  Four features must be noticed:  the chip's markings (read
Atmel's documents for more details), a full row of "N.C." pins (not much
to write about, it turns out), a double solder-side bridge that links U8
to the SPI bus (the data part of it, to be exact) and last, a ground PCB
feed-through which has been located under the FLASH chip quite precisely
(after a careful analysis of the solder-side)...  The SPI data lines are
both routed between R34 and R35, the outermost track being associated to
JP1-1 (SI) while the other connects to JP1-2 (SO).  It's just impossible
to infer from this photo what might be located between the specific U8-7
0 Volts supply (the PCB via) and the main ground-plane but there's still
enough information to postulate that none of the lines in front of JP1-4
carries a ground connection to U8-7.  The purposes of these lines remain
unknown but the one that aligns with JP1-4 would be a good candidate for
the yet unknown Rdy/*Busy signal from U8-1.  The line next to it (JP1-3,
maybe) also requires measurements before any confirmation can be made...

With a simultaneous perspective on the C45/C46 decoupling capacitors and
U8, an opportunity is given to bring attention on this significant fact:
a power-supply rail (located on the solder-side) passes right under both
"0426" & "GSV-VIKING" markings.  It's relatively wide and four PCB pass-
thrus surround it but none of that is visible because the chip's package
hides those details.  This power bus comes from C45's positive terminal,
it's so close to JP1-6 that there's no ground-plane between them;  there
is no contact, nonetheless - which is a very good thing because it might
happen that JP1-5 is tied to 0 Volts!  Measurement is no luxury here!...

03. U8-12 U10-40 via R39.jpg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This photo contains information about half of what's on the Serial Clock
path, from the FLASH chip to the main one, with a series-mounted 68 Ohms
resistor in the middle (R39's label says "68X").  A PCB pass-thru on the
U10 side of that resistor (between it and the "C41" mark nearby) goes to
a solder-side bridge (next shot) and a jumper (a 0 Ohms resistor) making
direct contact (electrically speaking) with JP1-3...  If we consider the
JP1-3 signal from U8's perspective, that's not SCk as it originates from
the main chip so, we'll call this other SCk version the Master SCk line.

Another feature clearly visible is the SPI bus.  On its way to reach the
main chip, SI/SO get stacked on top of two other lines and the resulting
four copper traces pass between two pairs of PCB vias (these are located
between C32 and C34).  This particular part of the image is an important
element as it helps to recognize the SPI bus in a subsequent photograph.

04. U10-40 JP1-3 (and more).jpg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A multitude of pictures didn't make it easier to identify the respective
functions for the two lines in front of JP1-4 (near U8-14), the material
hardly sufficed for the sole purpose of getting a suitable top view over
JP1-3, actually.  No graphic enhancement revealed the related parts in a
satisfying fashion and Master SCk highlights were finally done manually.

The area around JP1-4 won't reveal secrets we don't already know and the
impression of some alignement between the knees centered around JP1-3 is
more like a mirage now:  the assymetry is such that one knee didn't even
show up in this photo, making the innermost line near U8-14 look quite a
bit closer to JP1-4 than expected.  Also, the copper lines starting from
JP1-3 had to be hand-coloured with light green and the bright side of it
is that a cluster of landing pads between JP1-3 and U10-40 has been made
obvious.  Three of these are empty, a fourth one belongs to a jumper and
the later effectively connects JP1-3 to three more empty landing pads...

One conclusion can be drawn, finally:  the split path at U10-40 involves
a trio of PCB feed-throughs and it becomes clear the Master Serial Clock
signal from U10-40 radiates toward R39/U8-12, JP1-3 & U11 (future shot).

If no Master SCk path to the JP1 connector had been there, it would have
seemed logical to assume that U10 has to remain in partial control of U8
at all times.  External control of JP1-3 requires that the U10-40 output
can be made to switch to High-Impedance state, we may have to assume the
maintenance system can only synchronize with U10 using JP1-3 if no means
of controling U10 is found.  Can control be gained using U8-1 (or else)?

05. JP1.jpg
~~~~~~~~~~~~~~

The alledged Master SCk line coming from between the C43 & R52 locations
is visible here as well, its end just begins past a middle point between
JP1-2 & JP1-3 and makes it look like it connects to JP1-3 at an angle...

` 06. JP1-3.jpg
~~~~~~~~~~~~~~~

Here's a variation on a theme.  The line discussed previously also shows
up on this photograph but the colour information captured into the green
spectrum justifies the additional sample because a second green spot now
appears at the base of JP1-3 (near JP1-4)...  This one might be a mirage
due to reflexion on the shiny connector sides but why should that little
bit of copper trace head toward the very middle of JP1-3 & JP1-4 if it's
not to bring a 0 Volts connection to U8 using one of the lines which run
below, otherwise?...  More contradiction gets pourred in, unfortunately!

07. JP1-3.jpg
~~~~~~~~~~~~~~~~

The gound-plane's proximity to JP1-3 is finally revealed without a doubt
possible.  That's no evidence for anything else but it will make some of
us wonder if this is where the ground-plane ends or where a copper trace
begins.  In one case, it's not clear what was accomplished by getting so
close (not to mention that's not very safe);  in the other case, there's
a potential ground-plane PCB feed-thru located so close to U8-7 the need
for a ground/0 Volts line that thin just doesn't make much sense at all.

It appears we still have a few scenarios to validate at this early point
of our investigation, lets leave hidden layout issues on the back-burner
until additional clues are provided as there's more on the menu, anyway!

08. U8 U10 via SPI bus & resistors.jpg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Lets now expose the rest of the SPI bus.  Find R40, then the pair of PCB
feed-thrus on the other side of the ground-plane (where a crystal sits);
only one pair of the vias previously mentioned is shown but the stack of
four copper traces is still there, next to it.  Ignore the 1st two inner
lines, the SPI lines are both covered with the "C" letters from the C34-
C38 white-ink labels.  As the SPI bus gets near to U10, two lines coming
from the discarded pair of vias (on the third picture) show up again but
only a small portion of it;  U10 has its pins #90 and #91 terminated via
68 Ohms resistors and that's where the SPI bus goes...  We are now ready
to describe the full path of the SPI bus (or to the least, the most part
of it).  The main chip sends data to the FLASH chip through pin #91 then
resistor R60, the later being connected thru a solder-side bridge to pin
#1 of the maintenance connector and pin #13 of the FLASH chip.  The data
from the FLASH memory is sent via pin #14 then reaches the SPI bus which
has a tap on pin #2 of the maintenance connector, the signal passes thru
resistor R58 and enters the main chip at pin #90.  Two devices shouldn't
try to master an SPI bus simultaneously and hence resistor R60 may serve
two purposes:  isolate the SPI bus from any parasitic load on pin U10-91
and isolate two masters from each other, eventualy.  As for the function
of resistor R58, it isn't so clear (U10-90 being an input there wouldn't
be much parasitic load found there) so, this matter is opened to debate.

In any case, here's a schematic representation of possible signal paths:

U10-91 -> R60   -> U8-13 -> SI
U10-91 -> R60   -> JP1-1
JP1-1  -> U8-13 -> SI

SO    -> U8-14 -> R58 -> U10-90
SO    -> U8-14 -> JP1-2
JP1-2 -> R58   -> U10-90

09. RS-232 Custom Connector.jpg
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The old timers who are about to unpack the rest of their MoDem/Router in
search for everything related to the RS-232 feature are better get ready
for a surprise, if not worst...  Well, the venerable port which remained
pretty standard during the last few decades came thru a severe mutation;
whoever has designed this product, they must have thought a regular DB-9
connector visible at the back of their black box kills its sexy look so,
euh...  a custom cable made of some disparate RJ-45 male and DB-9 female
connectors is provided!  Just be careful not to plug it anywhere else...

Quite frankly, a 1/8" stereo jack wouldn't have been much less suitable.

Anyway, the good news is the owner won't need to mess around with TTL to
LVTTL signal translation in order to FLASH the device during emergencies
because a simple RS-232 interface made of discrete parts is built in (an
empty U12 landing pad meant for a specialized Maxim chip appears next to
it but someone must have thought the cost was prohibitive, i suppose)...

Apparently, a stuffed version exists somewhere and it may have something
to share with the TurboCom EA130 series...  In any case, provisions were
also made for a fuse holder, a filtered phone outlet and a reset switch!

10. U10.jpg
~~~~~~~~~~~~~~

The main chip is part of the Conexant GS8100 ChipSet, a subsequent photo
will show that its complement chip is marked:  "Conexant GS3780-174-001Z
0434 Singapore E1CNK.1-C0".  For now, there isn't much to comment about.

Additional comments
~~~~~~~~~~~~~~~~~~~

According to posts from other people, a device somehow related to one of
the strings listed here would seem close to GNet's BB0060B MoDem/Router:

200e
7204BRA
7401BRA-alt
8021R
AR520
AR1021
DM210DP
EM4100
GS8100
HM210DI
JetSpeed 520
JetSpeed 520i
KE318D
NetComm NB3
Prestige 623-41
RTA 100+
SAR 130
TurboComm EA130
UT4110A
Voyager 205
ZXDSL831

Referencing to TurboComm's EA130 makes sense, photographs of the bottom-
cover do reveal a recessed stamp with "US:RIGDL01BEA130" marked on it...

It isn't clear yet what's the difference between them all but the RS-232
interface readily available on the GNet brand should play in its favour.
------------------------------------------------------------------------

[very minor edits by cor]