Unbricking Aztech DSL305E ADSL Modem (Conexant CX82310 Class I Router)

Intro
I'm kind of obsessed with dead stuffs, especially bricked electronic gadgets, they always seems to be silently begging me for help to revive it back to their "normal life" whenever I got chance to meet one, well here is one of them, lying on the storage shelf for years fully dead and bricked, introducing the Aztech DSL305E ADSL Modem:

History
It was bricked 2 years ago due to unknown reason, the dead symptoms was a typical case of corrupted firmware in flash memory:
a) After power on, only Power & LAN lights are lit.
b) Dead DSL light & no blinking.
c) No response to http/ftp/telnet/ping to 10.0.0.2.
d) Reset button not working.

Solutions From The Net
Immediately after that I started searching the internet hoping to find an "off the shelf" solution to unbrick this modem, although I have managed to find quite a number of resources for unbricking modems that are base on Conexant CX82310 chip with an USB socket, non so far offer any direct solution for our old friend here the Aztech DSL305E which is also base on Conexant CX82310 chip but with no USB B receptacle!!
Anyway I found this adsltech forum discussion (a dead link now!) that offer some clues on the function of J7 10 pins header inside the modem but not much.
Next I found dslreports forum discussion that offer simple solutions on unbricking DSL305EU by using the available USB B receptacle to re-flash the flash memory. As for DSL305E without the USB B receptacle, the forum members assume the J7 10 pins header inside the modem is the serial port for flash memory writing, with suggestion on using an old mobo's COM port 10 to 9 pins connector to connect J7 to PC's COM port, well nobody have any success on this and the discussion die off eventually on the DSL305E without any solution.

The Hardware
I'm a bit skeptical about the COM port thing, just to play safe before I do any experiment with the COM port method, I did a little back engineering research on the DSL305E's internal circuit board with main emphasis on the J7's circuit connection tracks, these are what I found out so far:

a) J2 is the unmounted USB B receptacle for DSL305EU.
b) J7's pin 2, 3 & 5 are linked to J2's pin of 5V, D- & D+ by a few unmounted components.
c) J7's pin 2, 3 & 5 are not physically connected to J2 on DSL305E.
d) J7's pin 3 & 5 are physically directly connected to Conexant CX82310 chip.
e) J7's pin 4 & 10 are physically directly connected to J4.

The Software
Next thing I did was to dummy run the flashing software I downloaded from dslreports forum on two old & slow PCs (a strict system requirement for the flashing software) without any connection to J7, here are the results:

Pentium 133MHz System Without On Board USB Host

Pentium 233MHz System With On Board USB Host

The Hypothesis
Base on my findings, my conclusion are:
a) J7 is not the COM port, it must be the USB port as it is linked to unmounted J2 (USB B receptacle for DSL305EU) and the flashing software requires it to connect to an USB host to functions.
b) There is no USB line biasing for J7 as all components around J2 area for USB line biasing are not mounted and J7's USB lines are directly connected to Conexant CX82310 chip only.
c) J7 should be the USB port used in manufacturing process for flash memory writing, normally factory side will have some sort of jig to connect J7 to host PC, this jig might include all the necessary components for USB line biasing if they are not mounted on board in DSL305E to save manufacturing cost.

The Experiment
At that time, with a vague knowledge on the USB specification, a busy company job on hand and no way to get any info from Aztech on the specifications for USB line biasing, I simply rush to rig a simple connection jig as follow, hoping at least to get the USB link between host PC & J7 up and running to test the flashing software, with the expectation that USB comm might fail without the line biasing circuit:

Next I followed these steps for the flashing process:
a) make sure both modem & PC are power off.
b) short J4 with a jumper block.
c) connect J7 to USB host of a Pentium 233MHz system using the jig.
d) make sure no other USB device is connected to the USB host.
e) power on the modem.
f) power on the PC & boot to DOS mode.
g) at DOS prompt, change directory to flash software folder & type rm [Enter].
The following message appeared after that:

As I expected, comm link between modem & USB host failed, the USB host can't detect any device attached to it, guess it must be that missing USB line biasing circuit or something else.
Just when things started to get more interesting, duty called for my full attention on other projects, therefore the modem was put back to storage shelf for gods know how long until I'm free to tinker with it again.

Back To The Net
Time passed by pretty fast, now after 2 years at present, I'm free again to do some tinkering works, 1st on my list is the Aztech DSL305E, once again I find myself searching the internet looking for easy solutions, thinking may be someone out there might already have one for unbricking this modem after so long.
Well this time I didn't find any direct solutions but found more clues that proves J7 is the USB port and not a COM port, these clues are mostly for other non Aztech router modems which are Class I routers that uses the same Conexant CX82310 chip.
In this RouterTech forum discussion some member managed to re-flash a bricked Class I router using direct USB host connection to an internal 5 pins USB header, this method is somewhat similar to my previous failed attempt, I think they got lucky because their router has USB line biasing components mounted on board.
Well if you are one of those lucky owners of this non Aztech Class I router modem, you will find this repair guide & repair CD extremely useful if you bricked one in future.

USB Rules
My next step now is to target on figuring out the proper USB line biasing by dwelling deeply into the nuts and bolts of the USB comm.
First I found this info on page 36 of Conexant CX82310 DataSheet:

It is a requirement to connect CX82310's USB port data lines each through a 24 ohm resistor to USB host.
Next I found out the possible key reason why USB host can't detect any connected USB device at this Website:

So there you have it, the USB host can't detect anything if there is no 3.3V pull up on either D+ or D- line on the device side, I just need confirm this possibility by doing some electrical measurements on J7's pins especially CX_D+ & CX_D-:

With both pin 3 & 5 measured around 0.3V for voltage to GND and more than 9 mega ohm for resistance to +3.3V, it is obvious that there is no 3.3V pull up on either D+ or D- line, with this strong lead immediately I rig out another version of my connection jig as follow:

There are just three components added, two 24 ohm series resistors for data lines & one 1.5K ohm resistor for 3.3V pull up to D+ line, this time I'm confidence this added basic USB line biasing circuit should do the trick.

The Resurrection
Now the final moment has come for my 2nd experiment with the new connection jig using the same flashing software and flashing methods as before:
a) make sure both modem & PC are power off.
b) short J4 with a jumper block.
c) connect J7 to USB host of a Pentium 233MHz system using the jig.
d) make sure no other USB device is connected to the USB host.
e) power on the modem.
f) power on the PC & boot to DOS mode.
g) at DOS prompt, change directory to flash software folder & type rm [Enter].
h) at "Start Ethernet Global Mac" prompt, type the same MAC address as printed on a sticker at the bottom side of modem's circuit board [Enter].
i) at "End Ethernet Global Mac" prompt, type the same MAC address as h) but change the last byte to FF [Enter].
Here is the long & mesmerizing screen dump during flash memory writing:

Yes, the USB host and modem are "talking" to each other now, what a great sight!!
One small thing to take note is the message at the end of screen dump about "Please see status of Ready LED to determine success", this is actually the USB status LED which is not mounted on board in DSL305E, without it one can still judge the success of flash memory writing by:
a) seeing the final screen dump message with DOS prompt.
b) wait about 1 minute.
c) power off modem & PC.
d) remove jumper block from J4 & USB connector from J7.
e) reconnect LAN & TEL lines.
f) power on modem & check power LED is on.
g) wait about 1 minute.
h) see that DSL LED starts blinking, will change to solid if connected to active DSL line.
i) power on PC, wait until finish booting & check LAN LED is on.
j) use I.E. to connect http://10.0.0.2 and get the following Web Manager's Login page:

k) type admin & password [Enter] and the following home page appeared:

When seeing the above web page appeared for the 1st time, I'm fully convinced now that the Aztech DSL305E has finally come alive and kicking again.

The Firmware
The flashing software that I used above will upload Conexant base firmware to the modem, upon completion of the flash writing process, an updated firmware has to be uploaded using the modem's Web Manager:

Here is the updated firmware's home page:

This Conexant firmware work faster & has more features than the updated Aztech firmware.
Anyway I tried to upload the Aztech firmware using the Conexant Web Manager and the result as follow:

Well, I guess Conexant Web Manager won't accept Aztech firmware image file, as a result I bricked the modem and have to redo the USB flashing all over again. I will stick to Conexant firmware as it work faster and has many features that are not available in Aztech firmware.

The Others
The above methods used for unbricking Aztech DSL305E ADSL router modem are applicable for all other Class I router modems which are using Conexant CX82310 with conditions:
a) no USB B receptacle on circuit board (a non USB model).
b) internal USB header connector is provided without USB biasing circuit.

Notes
Uploading Aztech firmware image file using Conexant Web Manager will cause error and brick the DSL305E again, the only sure way to upload Aztech firmware is to direct flash write it through USB, but Aztech never provide any USB flashing utilities & firmware source files, another possibility is to disassemble the Aztech firmware image file and use Conexant's USB flashing utility to flash write it, I will KIV this problem for my next project.

...stay tuned. :)