Preliminary data ~~~~~~~~~~~~~~~~ Our non-invasive incursion into the GNet BB0060B ADSL device begins with the chip where its FirmWare resides: U8, an Atmel AT45DB161B FLASH chip fully described by the chip manufacturer's 33 pages on-line .PDF manual: http://www.atmel.fi/dyn/resources/prod_documents/doc2224.pdf This document is important in the understanding of the PCB layout around U8, starting with its TSOP-28 pins layout/description (shown at page 1): .................. Ready/*Busy -> Rdy/*Busy (1) ....................... *RESET -> *Reset (2) ... HarWare Page Write Protect -> WP (3) . Voltage (continuous Current) -> Vcc (6) ............... Ground/0 Volts -> Gnd (7) ................. *Chip Select -> *CS (11) ................. Serial Clock -> SCk (12) ................. Serial Input -> SI (13) ................ Serial Output -> SO (14) ................ No Connection -> N.C. (all other pins) * Marked as "Active Low". 01. U8 JP1 (close view).jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ U8's home position (Pin #1 - top view) is marked with an embossed golden dot, pin count follows a classic anti-clockwise "U" shapped progression. Essentially, all of U8's active pins can be seen on the present picture: the power-supply decoupling capacitor (pin 6) is identified quite easily and the data lines from its 3-wire Serial Peripheral Interface (SPI) bus aren't hard to find neither. Provided there's no split path involving a hidden line from under U8, those who are handy with a soldering iron may appreciate that they would be able to modify the circuit ahead of pin #3 so that some mechanical switch can override the Write Protection signal. According to the .PDF documentation, it happens that pin #1 (Rdy/*Busy), pin #7 (Gnd) - and perhaps a few more - have their copper traces covered by U8's package and hence, the electrical paths can't be determined with 100 % certainty unless the signals are measured or that chip is removed. It isn't clear where the copper trace passing along C43, JP1-1 and JP1-2 is actually heading but a knee ends this line near JP1-2/JP1-3. Beneath the FLASH chip, near pin #14, another line emerges that also ends with a knee but this one left some clues on the picture: it's partly masked by the white-ink mark close to JP1-3/JP1-4 but remains visible and seems to point at that on the other side of JP1. The apparent alignment of these knees is such that one might think the lines meet at JP1-3, somewhere in the middle; only, what's coming after the knee (shown here) may as well happen to be a second one ending with a copper trace between JP1-3/JP1-4 which, instead, stays away: U8-7 still has no path to ground, so far... Next to this puzzling track - of which none of the extremities have been defined yet, the outermost one (relatively to pin #14 of the FLASH chip) just has no room to target anything else but JP1-4. The allocated space around JP1-4 is so tight we should conclude the line is connected to it. Now, lets focus on a few not so subtle details that the camera captured, specifically: the Serial Clock (U8-12), Serial Input (U8-13) and Serial Output (U8-14) signals. SCk starts with pin #12 and goes toward the R49 empty landing-pad (the component at this location is optional), then the copper trace reaches the main Conexant chip (U10-40 via R39) but this is beyond our grasp at the moment... As for the serial data lines, a close look at the JP1 connector shows them were JP1-1/U8-13 and JP-2/U8-14 are meeting. Some small bit of dark green, visible between JP1-1's base and the white-ink markings, seems to be part of a straight line which points directly at JP1-1 and hence tends to confirm that U8-13 is linked to it; the green knee near the top of the "4" character (R49 white label) shows that U8-14 is most likely connected to JP1-2. Conclusion: Serial Input corresponds to the JP1 pin labelled as "1" on the Printed Circuit Board, Serial Output is next to it and this simply means it connects to pin #2. 02. U8 JP1 SI-SO Bridge & U8 Ground (x-ray views).jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The present shot provides a global view on the maintenance connector and the FLASH chip located close to it. JP1-5 and JP1-6 are now visible and we get another glimpse at a signal line mentioned above (the one between R52 and C43). Four features must be noticed: the chip's markings (read Atmel's documents for more details), a full row of "N.C." pins (not much to write about, it turns out), a double solder-side bridge that links U8 to the SPI bus (the data part of it, to be exact) and last, a ground PCB feed-through which has been located under the FLASH chip quite precisely (after a careful analysis of the solder-side)... The SPI data lines are both routed between R34 and R35, the outermost track being associated to JP1-1 (SI) while the other connects to JP1-2 (SO). It's just impossible to infer from this photo what might be located between the specific U8-7 0 Volts supply (the PCB via) and the main ground-plane but there's still enough information to postulate that none of the lines in front of JP1-4 carries a ground connection to U8-7. The purposes of these lines remain unknown but the one that aligns with JP1-4 would be a good candidate for the yet unknown Rdy/*Busy signal from U8-1. The line next to it (JP1-3, maybe) also requires measurements before any confirmation can be made... With a simultaneous perspective on the C45/C46 decoupling capacitors and U8, an opportunity is given to bring attention on this significant fact: a power-supply rail (located on the solder-side) passes right under both "0426" & "GSV-VIKING" markings. It's relatively wide and four PCB pass- thrus surround it but none of that is visible because the chip's package hides those details. This power bus comes from C45's positive terminal, it's so close to JP1-6 that there's no ground-plane between them; there is no contact, nonetheless - which is a very good thing because it might happen that JP1-5 is tied to 0 Volts! Measurement is no luxury here!... 03. U8-12 U10-40 via R39.jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This photo contains information about half of what's on the Serial Clock path, from the FLASH chip to the main one, with a series-mounted 68 Ohms resistor in the middle (R39's label says "68X"). A PCB pass-thru on the U10 side of that resistor (between it and the "C41" mark nearby) goes to a solder-side bridge (next shot) and a jumper (a 0 Ohms resistor) making direct contact (electrically speaking) with JP1-3... If we consider the JP1-3 signal from U8's perspective, that's not SCk as it originates from the main chip so, we'll call this other SCk version the Master SCk line. Another feature clearly visible is the SPI bus. On its way to reach the main chip, SI/SO get stacked on top of two other lines and the resulting four copper traces pass between two pairs of PCB vias (these are located between C32 and C34). This particular part of the image is an important element as it helps to recognize the SPI bus in a subsequent photograph. 04. U10-40 JP1-3 (and more).jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ A multitude of pictures didn't make it easier to identify the respective functions for the two lines in front of JP1-4 (near U8-14), the material hardly sufficed for the sole purpose of getting a suitable top view over JP1-3, actually. No graphic enhancement revealed the related parts in a satisfying fashion and Master SCk highlights were finally done manually. The area around JP1-4 won't reveal secrets we don't already know and the impression of some alignement between the knees centered around JP1-3 is more like a mirage now: the assymetry is such that one knee didn't even show up in this photo, making the innermost line near U8-14 look quite a bit closer to JP1-4 than expected. Also, the copper lines starting from JP1-3 had to be hand-coloured with light green and the bright side of it is that a cluster of landing pads between JP1-3 and U10-40 has been made obvious. Three of these are empty, a fourth one belongs to a jumper and the later effectively connects JP1-3 to three more empty landing pads... One conclusion can be drawn, finally: the split path at U10-40 involves a trio of PCB feed-throughs and it becomes clear the Master Serial Clock signal from U10-40 radiates toward R39/U8-12, JP1-3 & U11 (future shot). If no Master SCk path to the JP1 connector had been there, it would have seemed logical to assume that U10 has to remain in partial control of U8 at all times. External control of JP1-3 requires that the U10-40 output can be made to switch to High-Impedance state, we may have to assume the maintenance system can only synchronize with U10 using JP1-3 if no means of controling U10 is found. Can control be gained using U8-1 (or else)? 05. JP1.jpg ~~~~~~~~~~~~~~ The alledged Master SCk line coming from between the C43 & R52 locations is visible here as well, its end just begins past a middle point between JP1-2 & JP1-3 and makes it look like it connects to JP1-3 at an angle... 06. JP1-3.jpg ~~~~~~~~~~~~~~~ Here's a variation on a theme. The line discussed previously also shows up on this photograph but the colour information captured into the green spectrum justifies the additional sample because a second green spot now appears at the base of JP1-3 (near JP1-4)... This one might be a mirage due to reflexion on the shiny connector sides but why should that little bit of copper trace head toward the very middle of JP1-3 & JP1-4 if it's not to bring a 0 Volts connection to U8 using one of the lines which run below, otherwise?... More contradiction gets pourred in, unfortunately! 07. JP1-3.jpg ~~~~~~~~~~~~~~~~ The gound-plane's proximity to JP1-3 is finally revealed without a doubt possible. That's no evidence for anything else but it will make some of us wonder if this is where the ground-plane ends or where a copper trace begins. In one case, it's not clear what was accomplished by getting so close (not to mention that's not very safe); in the other case, there's a potential ground-plane PCB feed-thru located so close to U8-7 the need for a ground/0 Volts line that thin just doesn't make much sense at all. It appears we still have a few scenarios to validate at this early point of our investigation, lets leave hidden layout issues on the back-burner until additional clues are provided as there's more on the menu, anyway! 08. U8 U10 via SPI bus & resistors.jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Lets now expose the rest of the SPI bus. Find R40, then the pair of PCB feed-thrus on the other side of the ground-plane (where a crystal sits); only one pair of the vias previously mentioned is shown but the stack of four copper traces is still there, next to it. Ignore the 1st two inner lines, the SPI lines are both covered with the "C" letters from the C34- C38 white-ink labels. As the SPI bus gets near to U10, two lines coming from the discarded pair of vias (on the third picture) show up again but only a small portion of it; U10 has its pins #90 and #91 terminated via 68 Ohms resistors and that's where the SPI bus goes... We are now ready to describe the full path of the SPI bus (or to the least, the most part of it). The main chip sends data to the FLASH chip through pin #91 then resistor R60, the later being connected thru a solder-side bridge to pin #1 of the maintenance connector and pin #13 of the FLASH chip. The data from the FLASH memory is sent via pin #14 then reaches the SPI bus which has a tap on pin #2 of the maintenance connector, the signal passes thru resistor R58 and enters the main chip at pin #90. Two devices shouldn't try to master an SPI bus simultaneously and hence resistor R60 may serve two purposes: isolate the SPI bus from any parasitic load on pin U10-91 and isolate two masters from each other, eventualy. As for the function of resistor R58, it isn't so clear (U10-90 being an input there wouldn't be much parasitic load found there) so, this matter is opened to debate. In any case, here's a schematic representation of possible signal paths: U10-91 -> R60 -> U8-13 -> SI U10-91 -> R60 -> JP1-1 JP1-1 -> U8-13 -> SI SO -> U8-14 -> R58 -> U10-90 SO -> U8-14 -> JP1-2 JP1-2 -> R58 -> U10-90 09. RS-232 Custom Connector.jpg ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The old timers who are about to unpack the rest of their MoDem/Router in search for everything related to the RS-232 feature are better get ready for a surprise, if not worst... Well, the venerable port which remained pretty standard during the last few decades came thru a severe mutation; whoever has designed this product, they must have thought a regular DB-9 connector visible at the back of their black box kills its sexy look so, euh... a custom cable made of some disparate RJ-45 male and DB-9 female connectors is provided! Just be careful not to plug it anywhere else... Quite frankly, a 1/8" stereo jack wouldn't have been much less suitable. Anyway, the good news is the owner won't need to mess around with TTL to LVTTL signal translation in order to FLASH the device during emergencies because a simple RS-232 interface made of discrete parts is built in (an empty U12 landing pad meant for a specialized Maxim chip appears next to it but someone must have thought the cost was prohibitive, i suppose)... Apparently, a stuffed version exists somewhere and it may have something to share with the TurboCom EA130 series... In any case, provisions were also made for a fuse holder, a filtered phone outlet and a reset switch! `10 - U10 .JPG' ~~~~~~~~~~~~~~ The main chip is part of the Conexant GS8100 ChipSet, a subsequent photo will show that its complement chip is marked: "Conexant GS3780-174-001Z 0434 Singapore E1CNK.1-C0". For now, there isn't much to comment about. Additional comments ~~~~~~~~~~~~~~~~~~~ According to posts from other people, a device somehow related to one of the strings listed here would seem close to GNet's BB0060B MoDem/Router: 200e 7204BRA 7401BRA-alt 8021R AR520 AR1021 DM210DP EM4100 GS8100 HM210DI JetSpeed 520 JetSpeed 520i KE318D NetComm NB3 Prestige 623-41 RTA 100+ SAR 130 TurboComm EA130 UT4110A Voyager 205 ZXDSL831 Referencing to TurboComm's EA130 makes sense, photographs of the bottom- cover do reveal a recessed stamp with "US:RIGDL01BEA130" marked on it... It isn't clear yet what's the difference between them all but the RS-232 interface readily available on the GNet brand should play in its favour. ------------------------------------------------------------------------ [very minor edits by cor]