technicolor TC8305C

technicolor TC8305C Comcast 1.0
Availability: common

Manuf (OEM/ODM): Askey PKE1331BP-D49

FCC approval date: 26 July 2012
Country of manuf.: China

Type: wireless router, cable modem, analog phone gateway

FCC ID: H8N-PKE1331BP

Power: 120 VAC ~ 60 Hz, 1.2 A
Connector type: C7P

CPU1: Broadcom BCM3383Z
FLA1: 64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br /> (STMicroelectronics NAND512W3A2ZN6)
FLA2: 1 MiB1,048,576 B <br />8,192 Kib <br />1,024 KiB <br />8 Mib <br />9.765625e-4 GiB <br /> (Macronix MX25L8008E)
RAM1: 128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br /> (Micron MT41J64M16JT-15E:G)

Expansion IFs: USB 2.0
USB ports: 1

WI1 chip1: Broadcom BCM4331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 3x3:3
WI1 antenna connector: none

ETH chip1: Broadcom BCM3383Z
Switch: Broadcom BCM53124S
LAN speed: 1G
LAN ports: 4

bgn

Flags: DOCSIS 3.0, battery

Default SSID: HOME-XXXX (3 addl. devices)
Default IP address: 10.0.0.1
the IP 10.0.0.1 is used by 20 additional devices
of which 2 are technicolor devices
Default login user: admin
Default login password: password
admin:password credentials used by 421 additional devices
of which 2 are technicolor devices

802dot11 OUI: none specified

	FCC ID
Technicolor TC7200 (Thomson)	H8N-PKE1331BP H8N-TC7300

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

---

The FCC external photos indicate that this cable modem is used with Comcast's Xfinity service.

Comcast Wireless Gateway User Guide

Setup and User Guide MediaAccess TC8305C

8x4 DOCSIS 3.0

Per the FCC internal photos...

• the SoC used is a BCM3383ZKFEBG (BCM3383 / BCM3383Z)
• the GbE Switch is a BCM53124SKMMLG (BCM53124 / BCM53124S)
• the RAM appears to be a Micron 2DGI2 D9MNJ (B887).

• The battery shown in the FCC external photos is a Getac

BP-B210N-21/2600 S (Li-ion, 7.4V 2600mAh, 19.24Wh).

1.2A rated, ~8 Watts or 14 VA at the wall synced with WiFi on, no traffic.

• According to Comcast Help and Support:

A new battery may be purchased for $35.00 plus taxes and a $5.95 shipping fee.

Existing customers are eligible to purchase a new battery, which will be sent

to your Comcast service address and will arrive in about 7-10 business days.

If you would like to order a battery, please call us at 1-888-972-1261.

If you are a Comcast Business Voice customer, please call 1-800-391-3000

for details about the Comcast Business Voice battery replacement program.

The FCC label shows the default SSID pattern is HOME-XXXX, which should be the usual Comcast modem-router default SSID.

Default settings are from Comcast's customer support page.

Interesting features:

• This device has a built-in Mongoose HTTP web server running on port 8080 (http://10.0.0.1:8080), that presents

a graph and a UI allowing you to interact with the chips spectrum analyzer. Only Safari and Chrome are supported.

• The setup Wizard seems to have a problem with <space> characters in a WPA2 PSK AES wi-fi password.

Bootlog

• boot log

BCM3383A2 TP0 346890 MemSize: 128 M Chip ID: BCM3383Z-B0 Technicolor BootLoader Version: 2.1.8 Broadcom BootLoader Version: 2.4.0alpha18 Release Gnu spiboot dual-flash reduced DDR drive linux Build Date: Sep 12 2012 Build Time: 22:21:37 SPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0 NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B parameter offset is 43832 Signature/PID: a8e6 Reading flash map at ff30, size 192 Successfully restored flash map from SPI flash! NandFlashRead: Reading offset 0x10c0000, length 0x5c Image 1 Program Header: Signature: a8e6 Control: 0005 Major Rev: 0003 Minor Rev: 0000 Build Time: 2013/10/15 06:53:10 Z File Length: 3799926 bytes Load Address: 80004000 Filename: TC8305C-01.E6.10.09-131015-S-FF9-D.img HCS: e136 CRC: 439042b8 Found image 1 at offset 11c0000 NandFlashRead: Reading offset 0x19c0000, length 0x5c NandFlashRead: Reading offset 0x22c0000, length 0x5c Image 3 Program Header: Signature: a8e6 Control: 0005 Major Rev: 0002 Minor Rev: 0017 Build Time: 2013/7/1 22:44:58 Z File Length: 1507236 bytes Load Address: 84010000 Filename: bcm93383LxGNand_kernel HCS: 5b1f CRC: fbd7b9bb Found image 3 at offset 23c0000 Enter '1', '2', or 'p' within 2 seconds or take default... . . NandFlashRead: Reading offset 0x22c0000, length 0x200 NandFlashRead: Reading offset 0x22c0200, length 0x16fe00 Performing CRC on Image 3... CRC time = 37448509 Detected LZMA compressed image... decompressing... Target Address: 0x84010000 decompressSpace is 0x8000000 Elapsed time 1672051630 Decompressed length: 7104722 Done Copying Root File System... NandFlashRead: Reading offset 0x10c0000, length 0x200 NandFlashRead: Reading offset 0x10c0200, length 0x39f9d2 Performing CRC on Image 1... CRC time = 123388597 Detected LZMA compressed image... decompressing... Target Address: 0x80004000 decompressSpace is 0x8000000 Elapsed time 3625215190 Decompressed length: 18259516 Copying partition table to 0x83fffc04 180 Copying partition table to 0x80000904 180 Executing Image 1... eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 8116d8b0 Init device '/dev/tty0' Init tty channel: 8116d8d0 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.2 Set output buffer - buf: 0x813790e0 len: 4096 Set input buffer - buf: 0x8137a0e0 len: 4096 BCM 33XX SERIAL config Init device '/dev/ser1' BCM 33XX SERIAL init - dev: 0.3 Set output buffer - buf: 0x8137b0e0 len: 4096 Set input buffer - buf: 0x8137c0e0 len: 4096 BCM 33XX SERIAL config InitBoard: MIPS frequency 637200000 Battery Thread Constructor.... Leaving Battery thread constructor.... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22014 Waited 12 iterations after device ID read NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B [00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash: (NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0x20762076 Found bootloader flash map at 0x80000904. [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... Bootloader indicates we are running image 1 By default, we will dload to image number 2! [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! [00:00:00 01/01/1970] [tStartup] TechnicolorNonVolSettings::Constructor: (Technicolor NonVol Settings) ###### Technicolor: NV storage manager initialized ResetParentalControls: Resetting Parental Control NonVols BcmParentalCtrlNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! ****** [TechnicolorNonVolSettings] Setting up the singleton pointer****** [00:00:00 01/01/1970] [tStartup] BcmContentPolicyList::BcmContentPolicyList: WARNING - Singleton pointer is not NULL! There are multiple BcmContentPolicyList devices! Leaving the singleton pointer alone... [00:00:00 01/01/1970] [tStartup] BcmUserProfileList::BcmUserProfileList: WARNING - Singleton pointer is not NULL! There are multiple BcmUserProfileList devices! Leaving the singleton pointer alone... [00:00:00 01/01/1970] [tStartup] BcmPolicyManager::BcmPolicyManager: WARNING - Singleton pointer is not NULL! There are multiple BcmPolicyManager devices! Leaving the singleton pointer alone... WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values mtaNvCalcChecksum: checksum= 1273036005 Reading Permanent settings from non-vol... Checksum for permanent settings: 0x2447ad3b [00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl: (DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); current version is 2.0, newer settings will be preserved, but will not be used. [00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl: (DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); current version is 2.0, newer settings will be preserved, but will not be used. [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x45445641 'EDVA'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x54484f4d 'THOM'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x52434120 'RCA '); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x45627069 'Ebpi'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x54383032 'T802'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmIpsecNonVolSettings::IsDefault: (IPSEC NonVol Settings) Permanent settings are default! * * One or more of the settings groups was missing, possibly as a result of a code upgrade. * Settings were read and verified. Reading Dynamic settings from non-vol... [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent: (Reset/Standby Switch Thread) Reset switch released; rebooting... VendorResetButtonRebootCM [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmVendorCmApplication::VendorResetButtonRebootCM: (VendorExtension CmApp) Reboot - Setting LEDs ResetButtonRebootCM. [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent: (Reset/Standby Switch Thread) Cant Reset pfCmDocsisCtlThread==NULL... Checksum for dynamic settings: 0x243efff7 we found one in the table already!!!! Settings were read and verified.

JTAG (JP1201)

Pin	Function	Pin	Function
1	tRST	2	GND
3	TDI	4	GND
5	TDO	6	GND
7	TMS	8	GND
9	TCK	10	GND