GNet BB0060B ADSL Modem/Router issue in Canadian Broadband

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 29 Jul 2007 18:43:23 EDT

Bicephale : Hummm...

No news good news, i hope! Lets add an inside view in the meantime.

:)

Addendum

How do i know it's a TurboCom EA130 clone? Well, because of this:

http://www.turbocomm.com.tw/download/EA130/EA130_Manual_V1_0.pdf

Opened Box
EA130_Manual···V1_0.pdf 1,769,447 bytes TurboCom EA130 Manual v1.0
GNet BB0060B PC Board - Solder Side
GNet BB0060B - SW2 & J2 Optional Features

Re: GNet BB0060B ADSL Modem/Router issue

Tue, 10 Jul 2007 01:21:08 EDT

Bicephale : Hi MarkusWarren,

I'm sorry, «Loader Checksum ... Passed» sounded so
promissing but i should have recalled the details:

*WARNING* TFCfg.bin + firmware upgrades, Jay, 2003-Oct-13

After this message, your BootLoader is supposed to
self-extract then 'UMon' would get activated, then
the FLASH chip would be verified and, finally, the
display would say something like "TFTP/UMON Server
Started ..." once the checksum test fails but that
never happens.  I was about to recommend 'TFTPD32'
to see what its "Log viewer" tab looks like but it
seems you get no TFTP support so lets forget it!!!

Anyway, in case you need it later, i've found on a
Portuguese page that the MoDem may also be reached
at 10.1.1.1 (in addition to 192.168.1.1)...  Maybe
other GNet owners in a better position can try it.

Since you need to build the maintenance cable, i'm
going to finish commenting about it...  The cached
text contains information i completely forgot that
could be useful in clearing some of the confusion.

First, i'll just quote the passages to begin with:

2005-Sep-18 8h23, Bicéphale

So far, pin #1=SI, pin #2=SO and pin #5=+3V3 if
pin #6 is Ground.

I get about 70 mV A.C. on pin #3 while there's no
A.C. signal on pin #4 and the later pin drops all
the way down (to below 50 mV) during boot time...

Usually, pins #3 and #4 both remain close to +3V3.

2005-Sep-20 16h49, Bicéphale

`LoadFi' launched from a command-line
describes the v1 cable ("-c1" flag by default) as:

D5 (Data-5) -> CS (Chip Select) D4 (Data-4) -> Clk (Master Serial Clock) D3 (Data-3) -> SI (Serial Input) D2 (Data-2) -> Rst (Reset) ~S7 (?) <- 100Ω <- SO (Serial Output) Gnd25 (Gnd) -> Gnd (Ground)

Then i got this while reading the Atmel #2224 .PDF
documentation (see "Pin Descriptions", page 8/33):
1) Write Protect can be tied high if unused, 2) an
internal power-on reset circuit is present and the
Reset line can be tied high if unused... Page 24:
i also read that SPI mode is 3 by default and i've
also found that the Ready/Busy* output pin must be
terminated with an external pull-up resistor since
that's an open-drain stage and it's low when busy.

Oh, and somewhere it says that "Serial Mode" is 4.

I can't garantee this will help in the near future
but knowing there are half-output stages with some
load resistors finally put me at ease, somewhat...

2006-Feb-16 19h42, Franc Zabkar

For anyone wanting to try the "parallel port"
technique for recovering from a failed flash, here
are the pinouts of the header (JP2) adjacent to
the Atmel EEPROM in a D-Link DSL-302G modem/
router.

JP2-1 -> Atmel EEPROM pin 13 & GS8120 (CPU) pin 91 via 680 ohm resistor JP2-2 -> Atmel EEPROM pin 14 & GS8120 (CPU) pin 90 via 680 ohm resistor JP2-3 -> GS8120 pin 53 & VIA VT6103 pin 48 JP2-4 -> Atmel EEPROM pin 11 JP2-5 -> Atmel EEPROM pin 12 JP2-6 -> ground

I'm guessing that JP2-3 is some kind of reset pin
for the CPU and VT6103. It probably prevents the
CPU from talking on the SPI bus. This would ensure
that the external device (eg PC parallel port)
would have total control of the EEPROM.

According to this, it appears LPT-4 (Data 2) might
be connected as planned to "Reset", after all:  it
seems like JP1-3 isn't fixed at +3.3 Volts but can
vary over time (it would be coherent with the fact
that the master Reset line might also happen to be
active low just like the U8-2 slave Reset line)...

I can't tell with much certainty if Zabkar's cable
for a D-Link DSL-302G and that of the Chineese are
the same mechanically speaking but his comment has
focussed my attention on something of interest:  i
begin to think that JP-3 effectively operates as a
master Reset signal through U10 via pin U10-53 and
a discrete transistor labelled U9, using U10-40 as
the line which also happens to control U8-12 (SCk)
via a 68 Ω resistor...  The U8-2 (Rst) pin then is
a slave Reset line, i guess.  So, if JP1-3 is OKay
then that leaves JP1-2 and i bet it can be cleared
too, lets see...  JP1-2 connects LPT-11 (*S7/Busy)
to U8-14 (Serial Output) through a resistor so i'm
tempted to conclude that 'LoadFi' is reading FLASH
data via the *S7/Busy printer signal!  This is not
what i'd expect in a perfect world but why not!...

I may still be mistaking but at this stage i'd say
this maintenance connector is going to work with a
GNet BB0060B device as was described previously...

About the 6 pins header, i found one snapshot that
makes me think you probably have enough room above
the FLASH chip (U8) to line up two 2 x 3 IDC blocs
as those used in old Hard-Disk controller cabling,
or pehaps one single 2 x 6 or 2 x 8 IDC bloc which
was used for old Game/MiDi off-board connectors...

In short, i'll say you're booked for a flea market
trip:  you might have to wait for the week-end!...

I bet the RS-232 custom adaptor won't be essential
here:  it's probably for monitoring purposes only.

In any case, good luck while playing guinea pig!!!

N.B.:

When working on the parallel connector be careful:
i've seen mentions about the possibility of errors
relatively to the Chineese picture being reversed!

Addendum

When you're done repairing your spare GNet BB0060B
MoDem/Router i'd like you to try this tweak below:

   DMT - US/DS frequency bands/Tx Bin Adjust:  [ ] TelNet - modify dsl config txbinadj enable    DMT - Upstream (TX) Bins:  6 - 13 TelNet - modify dsl config txstart 6 TelNet - modify dsl config txend 13 --------------------------------------------------    DMT - US/DS frequency bands/Rx Bin Adjust:  [ ] TelNet - modify dsl config rxbinadj enable    DMT - Downstream (RX) Bins:  14 - 248 TelNet - modify dsl config rxstart 14 TelNet - modify dsl config rxend 248 --------------------------------------------------    DMT - ec fdm mode:  FDM TelNet - modify dsl config ecfdmmode fdm --------------------------------------------------    DMT - Tx Power Atten.:  -1 dB TelNet - modify dsl config txatten 1 --------------------------------------------------    DMT - Coding Gain:  7 dB TelNet - modify dsl config gain 7

If you prefer to use my tweaks based on CLI TelNet
commands instead of those for 'DMT' make sure that
you didn't forget to type "commit" and "reboot" at
the end.  This tweak seems to reshape the UpStream
(1-70) and DownStream (10-255) bandwidths, it once
raised my Local SNR Margin by about 2.5 dB while i
got a Line attenuation level which was improved by
3 dB...  One likely explanation is that an Upsream
DSL signal generates noise in any DSL device owned
by the customer and this is injected back into the
DownStream signal locally (reduced bands translate
as less power and hence less interfering noise)...

Re: GNet BB0060B ADSL Modem/Router issue

Mon, 09 Jul 2007 21:49:33 EDT

markuswarren : Me again :D

Ok, the 25 pin D connector, that's easy to find, the cabling is a little harder, but I'm guessing here I could use any six wire (or more) cable. The bit I'm finding hard to source is the 6 pin plastic connector (molex?), where could I source one of these? I've had a look in The Source by Circuit City but they didn't seem to have any.

Re: GNet BB0060B ADSL Modem/Router issue

Mon, 09 Jul 2007 12:18:40 EDT

markuswarren : Ok I've now tried the info on that link and it did not work, I got a timeout error. Not to suprised really as when connecting via the console method in hyperterminal it never gets passed the "Loader Checksum ... Passed" message, so it's not loading TFTP and thus is inaccessible.

It looks like the maintainance cable option is going to be the best/only way to debrick the modem, so I'll try and get the parts tonight to make the cable up.

Re: GNet BB0060B ADSL Modem/Router issue

Mon, 09 Jul 2007 12:04:57 EDT

markuswarren : Funnily enough I found that on a browse yesterday when at a friends place, but forgot to email myself a link! I'll give it a shot in a moment. I doubt it'll work as I don't think the modem is getting to the point where TFTP will be enabled, but it is worth trying, who knows, it might work. I'll report back what I find

Re: GNet BB0060B ADSL Modem/Router issue

Mon, 09 Jul 2007 11:51:42 EDT

Bicephale : Hi again MarkusWarren,

I just found this while exploring the cached data:

SolWise, «Recovering from a failed firmware upgrade»

Can you imagine if it could work for you at all?!!

Re: GNet BB0060B ADSL Modem/Router issue

Mon, 09 Jul 2007 09:00:26 EDT

Bicephale : Hi MarkusWarren,

Lets not forget this is an Atmel Emergency Kit for
the Huawei MT800 Series, that it is written in old
Chineese, that i only bable in Mandarin and i must
confess that mine is so rusted, euh...  i couldn't
resist such a nice opportunity!...  MouHa!  MouHa!

As shown previously in my article, a few pins meet
my expectations but others remain to receive close
attention so the reader's discretion is advised...

Here it goes.  1st of all, ensure that your device
is built around the appropriate FLASH chip:  quite
probably of the 'AT45DB161' type but 'LoadFi' also
supports the 'AT45DB081' or the 'AT45DB321' - this
tool is specific...  Now, remember that i couldn't
fully confirm the 6 pins header layout when i made
my contribution to the Corz.Org site:  pins U8-13/
U8-14 clearly connect to JP1-1/JP1-2 respectively,
JP1-6 has a solid path to the ground plane but the
rest isn't visible unless one desolders this chip.

According to the Chineese illustrated guide, JP1-3
would be tied to the +3.3 Volts power supply while
U8-11/U8-12 go to JP1-4/JP1-5 respectively.  JP1-6
and U8-7 seem to be at Ground (0 Volts) potential,
a statement which pictures from my article support
strongly as well.  If this information is accurate
and applies to the GNet BB0060B unit then it would
be safe to move on and proceed with the PC's side:

DB-25 Male (parallel) Connector + 100 Ohms resistor

DB25-4 (Cyan) <---> JP1-3 DB25-5 (Blue) <---> JP1-1 DB25-6 (Yellow) <-> JP1-5 DB25-7 (Black) <--> JP1-4 DB25-11 (Red) <----> ¼ Watt 100 Ω resistor <-> JP1-2 DB25-18 (Silver) <-> JP1-6

Huawei MT8xx Maintenance Connector

Once it's done copy 'teimage.bin' and 'loadfi.exe'
together in the same directory and most preferably
close to the root on a "Real DOS" FAT-16 or FAT-32
partition, then prepare a Windows 98 Boot Disk and
power off both the MoDem/Router and PC.  The cable
can be used to link the PC's parallel port and the
GNet's Maintenance Connector, at that stage you're
ready to boot using DOS v7.10 (Win98) and to start
the DSL device.  Run the 'LoadFi' utility and type
"1" to restore the FirmWare using 'teimage.bin'...

If everythings goes nicely you won't get a message
saying "Cable1: No Connection"...  Don't forget to
power off before you remove the maintenance cable.

Well, this is what the rescue kit looks like but i
wonder if that's actually sound in a real world...

Let's try to acquire an overall view of this setup
by looking at the standard DB-25 parallel port and
our FLASH chip, i'll show the links in the middle:

DB25-4 (Data 2) <------------------> JP1-3 <->  +3.3 Volts DB25-5 (Data 3) <------------------> JP1-1 <-> U8-13 (SI) DB25-6 (Data 4) <------------------> JP1-5 <-> U8-12 (SCk) DB25-7 (Data 5) <------------------> JP1-4 <-> U8-11 (*CS) DB25-11 (Busy) <-> 100 Ω resistor <-> JP1-2 <-> U8-14 (SO) DB25-18 (Ground) <------------------> JP1-6 <->  U8-7 (Gnd)

* Marked as "Active Low".

That's where this investigation came to a halt:  i
was trying to validate the connections but i get a
strange feeling that tells me pins JP1-2 and JP1-3
may need to have their positions reversed.  I read
no positive confirmation stating that the cable is
actually working with a GNet BB0060B unit, this is
why the user is advised to proceed with caution...

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 22:15:56 EDT

markuswarren : Blimey tha is quite the write up! I don't suppose you have any kind of translation for the chinese guide for creating the connector do you?

It looks fairly straightforward from the article, my only concern is part where it mentioned there should be a resistor somewhere, I don't recall seeing that in the pictures, but I could have missed it. Any info appreciated.

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 15:50:00 EDT

Bicephale : Hi,

I couldn't find the lastest version of the article
project but i reconstituted it using what i found,
thinking it might come handy for future reference.

This information was published on Corz.Org because
that site focussed on similar devices including my
Viking-based GNet BB0060B as pictured right below:

This is the article from Google's cache plus a new
section from personal records which was describing
the GNet custom RS-232 adaptor cable (figure #11):

«Bicephale's BB0060B maintenance connector review»

Preliminary data

Our non-invasive incursion into the GNet BB0060B ADSL device begins with
the chip where its FirmWare resides:  U8, an Atmel AT45DB161B FLASH chip
fully described by the chip manufacturer's 33 pages on-line .PDF manual:

http://www.atmel.fi/dyn/resources/prod_documents/doc2224.pdf

This document is important in the understanding of the PCB layout around
U8, starting with its TSOP-28 pins layout/description (shown at page 1):

.................. Ready/*Busy -> Rdy/*Busy (1) ....................... *RESET -> *Reset (2) ... HarWare Page Write Protect -> WP (3) . Voltage (continuous Current) -> Vcc (6) ............... Ground/0 Volts -> Gnd (7) ................. *Chip Select -> *CS (11) ................. Serial Clock -> SCk (12) ................. Serial Input -> SI (13) ................ Serial Output -> SO (14) ................ No Connection -> N.C. (all other pins) * Marked as "Active Low".

01. U8 JP1 (close view).jpg

U8's home position (Pin #1 - top view) is marked with an embossed golden
dot, pin count follows a classic anti-clockwise "U" shapped progression.

Essentially, all of U8's active pins can be seen on the present picture:
the power-supply decoupling capacitor (pin 6) is identified quite easily
and the data lines from its 3-wire Serial Peripheral Interface (SPI) bus
aren't hard to find neither.  Provided there's no split path involving a
hidden line from under U8, those who are handy with a soldering iron may
appreciate that they would be able to modify the circuit ahead of pin #3
so that some mechanical switch can override the Write Protection signal.

According to the .PDF documentation, it happens that pin #1 (Rdy/*Busy),
pin #7 (Gnd) - and perhaps a few more - have their copper traces covered
by U8's package and hence, the electrical paths can't be determined with
100 % certainty unless the signals are measured or that chip is removed.

It isn't clear where the copper trace passing along C43, JP1-1 and JP1-2
is actually heading but a knee ends this line near JP1-2/JP1-3.  Beneath
the FLASH chip, near pin #14, another line emerges that also ends with a
knee but this one left some clues on the picture:  it's partly masked by
the white-ink mark close to JP1-3/JP1-4 but remains visible and seems to
point at that on the other side of JP1.  The apparent alignment of these
knees is such that one might think the lines meet at JP1-3, somewhere in
the middle;  only, what's coming after the knee (shown here) may as well
happen to be a second one ending with a copper trace between JP1-3/JP1-4
which, instead, stays away:  U8-7 still has no path to ground, so far...

Next to this puzzling track - of which none of the extremities have been
defined yet, the outermost one (relatively to pin #14 of the FLASH chip)
just has no room to target anything else but JP1-4.  The allocated space
around JP1-4 is so tight we should conclude the line is connected to it.

Now, lets focus on a few not so subtle details that the camera captured,
specifically:  the Serial Clock (U8-12), Serial Input (U8-13) and Serial
Output (U8-14) signals.  SCk starts with pin #12 and goes toward the R49
empty landing-pad (the component at this location is optional), then the
copper trace reaches the main Conexant chip (U10-40 via R39) but this is
beyond our grasp at the moment...  As for the serial data lines, a close
look at the JP1 connector shows them were JP1-1/U8-13 and JP-2/U8-14 are
meeting.  Some small bit of dark green, visible between JP1-1's base and
the white-ink markings, seems to be part of a straight line which points
directly at JP1-1 and hence tends to confirm that U8-13 is linked to it;
the green knee near the top of the "4" character (R49 white label) shows
that U8-14 is most likely connected to JP1-2.  Conclusion:  Serial Input
corresponds to the JP1 pin labelled as "1" on the Printed Circuit Board,
Serial Output is next to it and this simply means it connects to pin #2.

02. U8 JP1 SI-SO Bridge & U8 Ground (x-ray views).jpg

The present shot provides a global view on the maintenance connector and
the FLASH chip located close to it.  JP1-5 and JP1-6 are now visible and
we get another glimpse at a signal line mentioned above (the one between
R52 and C43).  Four features must be noticed:  the chip's markings (read
Atmel's documents for more details), a full row of "N.C." pins (not much
to write about, it turns out), a double solder-side bridge that links U8
to the SPI bus (the data part of it, to be exact) and last, a ground PCB
feed-through which has been located under the FLASH chip quite precisely
(after a careful analysis of the solder-side)...  The SPI data lines are
both routed between R34 and R35, the outermost track being associated to
JP1-1 (SI) while the other connects to JP1-2 (SO).  It's just impossible
to infer from this photo what might be located between the specific U8-7
0 Volts supply (the PCB via) and the main ground-plane but there's still
enough information to postulate that none of the lines in front of JP1-4
carries a ground connection to U8-7.  The purposes of these lines remain
unknown but the one that aligns with JP1-4 would be a good candidate for
the yet unknown Rdy/*Busy signal from U8-1.  The line next to it (JP1-3,
maybe) also requires measurements before any confirmation can be made...

With a simultaneous perspective on the C45/C46 decoupling capacitors and
U8, an opportunity is given to bring attention on this significant fact:
a power-supply rail (located on the solder-side) passes right under both
"0426" & "GSV-VIKING" markings.  It's relatively wide and four PCB pass-
thrus surround it but none of that is visible because the chip's package
hides those details.  This power bus comes from C45's positive terminal,
it's so close to JP1-6 that there's no ground-plane between them;  there
is no contact, nonetheless - which is a very good thing because it might
happen that JP1-5 is tied to 0 Volts!  Measurement is no luxury here!...

03. U8-12 U10-40 via R39.jpg

This photo contains information about half of what's on the Serial Clock
path, from the FLASH chip to the main one, with a series-mounted 68 Ohms
resistor in the middle (R39's label says "68X").  A PCB pass-thru on the
U10 side of that resistor (between it and the "C41" mark nearby) goes to
a solder-side bridge (next shot) and a jumper (a 0 Ohms resistor) making
direct contact (electrically speaking) with JP1-3...  If we consider the
JP1-3 signal from U8's perspective, that's not SCk as it originates from
the main chip so, we'll call this other SCk version the Master SCk line.

Another feature clearly visible is the SPI bus.  On its way to reach the
main chip, SI/SO get stacked on top of two other lines and the resulting
four copper traces pass between two pairs of PCB vias (these are located
between C32 and C34).  This particular part of the image is an important
element as it helps to recognize the SPI bus in a subsequent photograph.

04. U10-40 JP1-3 (and more).jpg

A multitude of pictures didn't make it easier to identify the respective
functions for the two lines in front of JP1-4 (near U8-14), the material
hardly sufficed for the sole purpose of getting a suitable top view over
JP1-3, actually.  No graphic enhancement revealed the related parts in a
satisfying fashion and Master SCk highlights were finally done manually.

The area around JP1-4 won't reveal secrets we don't already know and the
impression of some alignement between the knees centered around JP1-3 is
more like a mirage now:  the assymetry is such that one knee didn't even
show up in this photo, making the innermost line near U8-14 look quite a
bit closer to JP1-4 than expected.  Also, the copper lines starting from
JP1-3 had to be hand-coloured with light green and the bright side of it
is that a cluster of landing pads between JP1-3 and U10-40 has been made
obvious.  Three of these are empty, a fourth one belongs to a jumper and
the later effectively connects JP1-3 to three more empty landing pads...

One conclusion can be drawn, finally:  the split path at U10-40 involves
a trio of PCB feed-throughs and it becomes clear the Master Serial Clock
signal from U10-40 radiates toward R39/U8-12, JP1-3 & U11 (future shot).

If no Master SCk path to the JP1 connector had been there, it would have
seemed logical to assume that U10 has to remain in partial control of U8
at all times.  External control of JP1-3 requires that the U10-40 output
can be made to switch to High-Impedance state, we may have to assume the
maintenance system can only synchronize with U10 using JP1-3 if no means
of controling U10 is found.  Can control be gained using U8-1 (or else)?

05. JP1.jpg

The alledged Master SCk line coming from between the C43 & R52 locations
is visible here as well, its end just begins past a middle point between
JP1-2 & JP1-3 and makes it look like it connects to JP1-3 at an angle...

06. JP1-3.jpg

Here's a variation on a theme.  The line discussed previously also shows
up on this photograph but the colour information captured into the green
spectrum justifies the additional sample because a second green spot now
appears at the base of JP1-3 (near JP1-4)...  This one might be a mirage
due to reflexion on the shiny connector sides but why should that little
bit of copper trace head toward the very middle of JP1-3 & JP1-4 if it's
not to bring a 0 Volts connection to U8 using one of the lines which run
below, otherwise?...  More contradiction gets pourred in, unfortunately!

07. JP1-3.jpg

The gound-plane's proximity to JP1-3 is finally revealed without a doubt
possible.  That's no evidence for anything else but it will make some of
us wonder if this is where the ground-plane ends or where a copper trace
begins.  In one case, it's not clear what was accomplished by getting so
close (not to mention that's not very safe);  in the other case, there's
a potential ground-plane PCB feed-thru located so close to U8-7 the need
for a ground/0 Volts line that thin just doesn't make much sense at all.

It appears we still have a few scenarios to validate at this early point
of our investigation, lets leave hidden layout issues on the back-burner
until additional clues are provided as there's more on the menu, anyway!

08. U8 U10 via SPI bus & resistors.jpg

Lets now expose the rest of the SPI bus.  Find R40, then the pair of PCB
feed-thrus on the other side of the ground-plane (where a crystal sits);
only one pair of the vias previously mentioned is shown but the stack of
four copper traces is still there, next to it.  Ignore the 1st two inner
lines, the SPI lines are both covered with the "C" letters from the C34-
C38 white-ink labels.  As the SPI bus gets near to U10, two lines coming
from the discarded pair of vias (on the third picture) show up again but
only a small portion of it;  U10 has its pins #90 and #91 terminated via
68 Ohms resistors and that's where the SPI bus goes...  We are now ready
to describe the full path of the SPI bus (or to the least, the most part
of it).  The main chip sends data to the FLASH chip through pin #91 then
resistor R60, the later being connected thru a solder-side bridge to pin
#1 of the maintenance connector and pin #13 of the FLASH chip.  The data
from the FLASH memory is sent via pin #14 then reaches the SPI bus which
has a tap on pin #2 of the maintenance connector, the signal passes thru
resistor R58 and enters the main chip at pin #90.  Two devices shouldn't
try to master an SPI bus simultaneously and hence resistor R60 may serve
two purposes:  isolate the SPI bus from any parasitic load on pin U10-91
and isolate two masters from each other, eventualy.  As for the function
of resistor R58, it isn't so clear (U10-90 being an input there wouldn't
be much parasitic load found there) so, this matter is opened to debate.

In any case, here's a schematic representation of possible signal paths:

U10-91 -> R60   -> U8-13 -> SI U10-91 -> R60   -> JP1-1 JP1-1  -> U8-13 -> SI SO    -> U8-14 -> R58 -> U10-90 SO    -> U8-14 -> JP1-2 JP1-2 -> R58   -> U10-90

09. RS-232 Custom Connector.jpg

The old timers who are about to unpack the rest of their MoDem/Router in
search for everything related to the RS-232 feature are better get ready
for a surprise, if not worst...  Well, the venerable port which remained
pretty standard during the last few decades came thru a severe mutation;
whoever has designed this product, they must have thought a regular DB-9
connector visible at the back of their black box kills its sexy look so,
euh...  a custom cable made of some disparate RJ-45 male and DB-9 female
connectors is provided!  Just be careful not to plug it anywhere else...

Quite frankly, a 1/8" stereo jack wouldn't have been much less suitable.

Anyway, the good news is the owner won't need to mess around with TTL to
LVTTL signal translation in order to FLASH the device during emergencies
because a simple RS-232 interface made of discrete parts is built in (an
empty U12 landing pad meant for a specialized Maxim chip appears next to
it but someone must have thought the cost was prohibitive, i suppose)...

Apparently, a stuffed version exists somewhere and it may have something
to share with the TurboCom EA130 series...  In any case, provisions were
also made for a fuse holder, a filtered phone outlet and a reset switch!

10 - U10 .JPG

The main chip is part of the Conexant GS8100 ChipSet, a subsequent photo
will show that its complement chip is marked:  "Conexant GS3780-174-001Z
0434 Singapore E1CNK.1-C0".  For now, there isn't much to comment about.

11. RS-232 Console Cable (RJ-45M DB-9F).png

The colours present in this drawing don't meet any standards, their sole
purpose is assist us with the differenciation of three electrical wires.

Only two of the lines actually carry the serial console signal: RJ-45-3
gets data from DB-9-3 (TxD) and RJ-45-6 sends data to DB-9-2 (RxD), with
RJ-45-5/DB-9-5 as the common 0 Volts reference. A multimeter on the TxD
line confirms that RJ-45-3 is an input (the signal level remains flat at
0 Volts if the DB-9 end of the cable is unterminated), the other line is
an output (voltage transitions will appear at RJ-45-6, on the contrary).

The three-wires RS-232 cabling is compatible with that used for Siemens/
Efficient NetWorks SpeedStream 5260 or 5660 MoDems and this is radically
different from any of Cisco's RJ-45/DB-9 Patch Cable variations found in
Business-Class bundles such as the 5861 ADSL Router... The GNet BB0060B
came with a TIA/EIA-568-8.2 Cat.5 UTP Patch Cable marked EverNew E138922
in this case, it should work with the PonyProg Serial Device Programmer.

Flow-Control just isn't supported by GNet's BB0060B MoDem and hence, the
purpose of a console interface seems questionable because there could be
lost characters (though TelNet sessions are less severely affected). We
must also consider that access to the Reset mechanism can be effectively
restricted and, if this happens, it's reached thru the Patch Cable only.

A graphical representation of the Siemens/Efficient NetWorks SpeedStream
5260/5660 Serial Interface should be available at the following address:

http://www.dslreports.com/r0/download/240762~6b708beda7b718ae94b2ecc949df84fd/5260_serial.jpg

Additional comments

According to posts from other people, a device somehow related to one of
the strings listed here would seem close to GNet's BB0060B MoDem/Router:

200e
7204BRA
7401BRA-alt
8021R
AR520
AR1021
DM210DP
EM4100
GS8100
HM210DI
JetSpeed 520
JetSpeed 520i
KE318D
NetComm NB3
Prestige 623-41
RTA 100+
SAR 130
TurboComm EA130
UT4110A
Voyager 205
ZXDSL831

Referencing to TurboComm's EA130 makes sense, photographs of the bottom-
cover do reveal a recessed stamp with "US:RIGDL01BEA130" marked on it...

It isn't clear yet what's the difference between them all but the RS-232
interface readily available on the GNet brand should play in its favour.
------------------------------------------------------------------------
[very minor edits by cor]

:)

"Must Have" files:

'loadfi.rar' - GlobeSpan/Virata's 'Flash Image Loader v2.05', 52 Kilo-Bytes
CLI Reference Manual (DO-300171-TC-7) for Viking & Viking II Chip Sets, 5M3

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 13:53:15 EDT

Bicephale : :D

1 - U8 JP1 (close view) .JPG
2 - U8 JP1 SI-SO Bridge & U8 Ground (x-ray views) .JPG
3 - U8-12 U10-40 via R39 .JPG
4 - U10-40 JP1-3 (and more) .JPG
5 - JP1 .JPG
6 - JP1-3 .JPG
7 - JP1-3 .JPG
8 - U8 U10 via SPI bus & resistors .JPG
9 - RS-232 Custom Connector .JPG
10 - U10 .JPG
11. RS-232 Console Cable (RJ-45M DB-9F).png
12. JP1 & Solder-Side Bridge.jpg
13. Casing (BB0060A).jpg
loadfi.rar 52,446 bytes 'LoadFi.RAR' (52 Kilo-Bytes)
Viking CLI R···ual .PDF 5,424,542 bytes Viking CLI Reference Manual
DB-25 Connector with 100 Ohms resistor
DB-25 Connector and Shield
DB-25 Connector Layout (front view)
Huawei MT800 Series Maintenance ("De-Brick") Connector
Huawei MT800 Series - Global Components Side view
Huawei MT800 Series - Global Casing view
GlobeSpan/Virata's 'Flash Image Loader v2.05' (LoadFi.EXE: Menu)
GlobeSpan/Virata's 'Flash Image Loader v2.05' (LoadFi.EXE: BackUp)
GlobeSpan/Virata's 'Flash Image Loader v2.05' (LoadFi.EXE: Restore)
Atmel AT45DB161B FLASH Chip
DB-25 Parallel Layout

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 13:43:27 EDT

Bicephale : Hi again MarkusWarren,

Sorry about the broken image, DSL Reports seems to
have a bug since it displayed OK here!  Appologies
as well about forgetting your mention that you did
connect using the RS-232 custom cable, i think you
were completely connected but your CLI session was
probably cut short:  this booting got interrupted.

I'm afraid i can't tell for sure if 'LoadFi' would
require both cables but you only need to build the
maintenance cable using a 6 pins header and a male
DB-25 connector (as per the Chineese guide);  it's
supposed to match the wiring instructions provided
by the DOS application...  By the way, do you know
which FirmWare you used and if it was a DownGrade?

I'm searching my records for additional files, the
maintenance connector may take a few read hours...

:p

Well, i can publish more pictures in the meantime!

;)

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 12:10:01 EDT

markuswarren : Hmm, seems the picture is not displaying :(

I did get the console cable with the unit and I've tried connecting to the modem with this cable connected and via hyperterminal but as mentioned in my first post it did not seem to completely connect, so I'm guessing that this won't help much when trying to get that DOS program to run.
Basically when the modem comes up, it doesn't give me a $ prompt from hyperterminal.

From what I understood I would need to make up a new cable, open up the modem box and plug it into the "spike" connectors sticking up from the PCB. Am I correct, or should I be making up a new DB-9 to RJ-45 connector as per the specs you mention, rather than a DB-9 to a well, some other type of connector.

Sorry for my lack of understanding here. Thanks again for all the info.

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 12:00:16 EDT

Bicephale : Hi MarkusWarren,

Oh, i'm quite pleased to read that you plan to put
it to good use!  In case you didn't get the custom
RS-232 adaptor when you bought this product here's
a description, the "Console" RJ-45 connector isn't
an EtherNet outlet and has nothing to do with some
Cisco standard...  You'll need to use a cable made
of an RJ-45 Male plug and a DB-9 Female connector:

A PC running terminal emulation SoftWare would act
as an RS-232 "DTE" with the MoDem being the "DCE",
it's a "Straight-Thru" cable if i'm not mistaking:

RxD: DB-9(2) <-> RJ-45(6) - Blue TxD: DB-9(3) <-> RJ-45(3) - Purple Gnd: DB-9(5) <-> RJ-45(5) - Brown

What's nice about the console port is that it does
not require credentials when we access the BB0060B
CLI at all;  according to the Viking CLI Reference
Manual, "reboot default" clears the password, etc.

:D

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 09:05:26 EDT

markuswarren : So, looks like I need to make up a cable then, from the pictures on the link you gave (saved to a webarchive file so I have a local copy) it doesn't look too difficult a thing to build, so I'll pop off to TigerDirect at some point and source the parts to build one. I've given the exe file a quick run, to check it works and it does, obviously with no cable connected it's not going to do much :D

Is there anything special about this cable? just a D-pin to a block connector with some cable between it. Anything else need soldering on? Any additional hints/info greatly appreciated.

Thanks once again :)

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 08:47:55 EDT

markuswarren : Words cannot express how grateful I am to you for providing that above excellent information and associated files! I shall have a thorough read and see if I can debrick the modem, always handy to have a spare lurking around.

I will report back with what I am able to achieve.

Once again, thank you very much indeed! :)

Re: GNet BB0060B ADSL Modem/Router issue

Sun, 08 Jul 2007 01:36:05 EDT

Bicephale : Hi MarkusWarren,

I once expressed a concern that no MoDem/Router is
100 % dependable when it comes to the FLASH UpLoad
procedure, only a few business-grade units use two
separate FLASH chips to make sure there's always a
valid FirmWare installed.  Unfortunately, the GNet
BB0060B FirmWare has a flaw that makes DownGrading
particularily dangerous as i found out.  Like many
others before me i fell for it and returned my 1st
GNet to get a replacement after an incident...  My
GNet's FirmWare is v2.1.050224a1 (2005-Mar-10), it
works as expected so i never touched that again!!!

Few persons would think of reviving a MoDem/Router
when it fails and manufacturers don't want them to
but i found a "De-Brick" tool for the GNet BB0060B
some months ago and there still are copies around:

'loadfi.rar' - GlobeSpanVirata's 'Flash Image Loader v2.05', 52 Kilo-Bytes
Source #1, Source #2

Luckily, those who need it can also find a graphic
description of the maintenance adaptor right here:

Foreign Atmel Serial DataFlash Rescue Guide with Pictures

And related discussions to which i contributed can
also be found on this site (plain English helps!):

Some Corz.Org Viking Threads

Then here's a relic of a cached project i started:

Google Cache of Corz.Org, "Bicephale's BB0060B maintenance connecter review"

GNet BB0060B ADSL Modem/Router issue

Sat, 07 Jul 2007 22:24:07 EDT

markuswarren : Good evening all.
I've got a GNet (gentek) BB0060B ADSL Modem/Router and have a problem with it. I went to flash the firmware and it stated it was going to reboot, which it did (I watched the LED's blink out then come back on). I went for a coffee, came back 30 mins later and could not access the internet. I checked the modem and the LAN lights (10/100M and Link) lights were lit but the DSL lights (ACT and Link) were not lit. Most odd.

I tried accessing the modem via web browser but it would not see it. I tried the normal address it would have (it has a static IP) and I also tried the default value as in the manual as I guessed it might have reverted to factory defaults, neither worked.

I read the manual and connected the device to a PC via the console cable and tried gaining access via Hyperterminal. It gave me the first few lines:

Starting POST - V1.9
SDRAM ... Passed
Loader Checksum ... Passed

But that was all. I was expecting it to display more, specifically a login prompt.

Anyway, long story short, I think the "image" that should be on there is screwed up somehow and I'm wondering if there is some backup image or something that can somehow be accessed, perhaps certain keys need to be held down when starting the session via hyperterminal or perhaps I need to open up the device and bridge something to force a reset. I'm guessing the factory would encounter situations like this so there has to be a way to refresh things.

Any suggestions or advice greatly appreciated.

btw: This is not the modem I was using as per my other post about DSL speed issues, it's an older modem I had previously been using.