technicolor TC8305C

bgn (N450)
wireless router, cable modem, analog phone gateway
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Status Unknown
Platform
Brand • Model • Rev	technicolor TC8305C Comcast 1.0
FCC ID	H8N-PKE1331BP
Type	wireless router, cable modem, analog phone gateway
CPU1	Broadcom BCM3383Z
CPU1 Speed	not specified
Flash1 Chip	STMicro NAND512W3A2ZN6
Flash1 Size	64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
Flash2 Chip	Macronix MX25L8008E
Flash2 Size	1 MiB1,048,576 B <br />8,192 Kib <br />1,024 KiB <br />8 Mib <br />9.765625e-4 GiB <br />
RAM1 Size	128 MiB134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip	Micron MT41J64M16JT-15E:G
ETH chip1	Broadcom BCM3383Z
Switch	Broadcom BCM53124S
Cable Modem Spec	DOCSIS 3.0: (8 x 4)
Ethernet Port Count	4-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Expansion IF types	USB 2.0
USB ports	1
USB Hub Compatible	Untested
Power	120 VAC ~ 60 Hz, 1.2 A
Connector type	C7P
Flags: DOCSIS 3.0, battery
Other
Default SSID: HOME-XXXX (3 addl. devices) Default IP address: 10.0.0.1 the IP 10.0.0.1 is used by 20 additional devices of which 2 are technicolor devices Default login user: admin Default login password: password admin:password credentials used by 425 additional devices of which 2 are technicolor devices
Manuf/OEM/ODM	Askey PKE1331BP-D49
Retail
Availability	common
FCC approval date	26 July 2012
Country of manuf	China
Radio 1
Chip1	Broadcom BCM4331
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	3x3:3
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 450 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio cor_rev	29
FCC ID Technicolor TC7200 (Thomson) H8N-PKE1331BP H8N-TC7300

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.

For a list of all currently documented technicolor device with specifications, see technicolor.

• 450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.) = N450 class

Overview

8x4 DOCSIS 3.0

Per the FCC internal photos...

• the SoC used is a BCM3383ZKFEBG (BCM3383 / BCM3383Z)
• the GbE Switch is a BCM53124SKMMLG (BCM53124 / BCM53124S)
• the RAM appears to be a Micron 2DGI2 D9MNJ (B887).

• The battery shown in the FCC external photos is a Getac

BP-B210N-21/2600 S (Li-ion, 7.4V 2600mAh, 19.24Wh).

1.2A rated, ~8 Watts or 14 VA at the wall synced with WiFi on, no traffic.

• According to Comcast Help and Support:

A new battery may be purchased for $35.00 plus taxes and a $5.95 shipping fee.

Existing customers are eligible to purchase a new battery, which will be sent

to your Comcast service address and will arrive in about 7-10 business days.

If you would like to order a battery, please call us at 1-888-972-1261.

If you are a Comcast Business Voice customer, please call 1-800-391-3000

for details about the Comcast Business Voice battery replacement program.

The FCC label shows the default SSID pattern is HOME-XXXX, which should be the usual Comcast modem-router default SSID.

Default settings are from Comcast's customer support page.

Interesting features:

• This device has a built-in Mongoose HTTP web server running on port 8080 (http://10.0.0.1:8080), that presents

a graph and a UI allowing you to interact with the chips spectrum analyzer. Only Safari and Chrome are supported.

• The setup Wizard seems to have a problem with <space> characters in a WPA2 PSK AES wi-fi password.

Links of Interest

The FCC external photos indicate that this cable modem is used with Comcast's Xfinity service.

Comcast Wireless Gateway User Guide

Setup and User Guide MediaAccess TC8305C

JTAG-Serial Info

JTAG

JTAG Pinouts

(JP1201)

Pin	Function	Pin	Function
1	tRST	2	GND
3	TDI	4	GND
5	TDO	6	GND
7	TMS	8	GND
9	TCK	10	GND

Bootlog

boot log

BCM3383A2 TP0 346890 MemSize: 128 M Chip ID: BCM3383Z-B0 Technicolor BootLoader Version: 2.1.8 Broadcom BootLoader Version: 2.4.0alpha18 Release Gnu spiboot dual-flash reduced DDR drive linux Build Date: Sep 12 2012 Build Time: 22:21:37 SPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0 NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B parameter offset is 43832 Signature/PID: a8e6 Reading flash map at ff30, size 192 Successfully restored flash map from SPI flash! NandFlashRead: Reading offset 0x10c0000, length 0x5c Image 1 Program Header: Signature: a8e6 Control: 0005 Major Rev: 0003 Minor Rev: 0000 Build Time: 2013/10/15 06:53:10 Z File Length: 3799926 bytes Load Address: 80004000 Filename: TC8305C-01.E6.10.09-131015-S-FF9-D.img HCS: e136 CRC: 439042b8 Found image 1 at offset 11c0000 NandFlashRead: Reading offset 0x19c0000, length 0x5c NandFlashRead: Reading offset 0x22c0000, length 0x5c Image 3 Program Header: Signature: a8e6 Control: 0005 Major Rev: 0002 Minor Rev: 0017 Build Time: 2013/7/1 22:44:58 Z File Length: 1507236 bytes Load Address: 84010000 Filename: bcm93383LxGNand_kernel HCS: 5b1f CRC: fbd7b9bb Found image 3 at offset 23c0000 Enter '1', '2', or 'p' within 2 seconds or take default... . . NandFlashRead: Reading offset 0x22c0000, length 0x200 NandFlashRead: Reading offset 0x22c0200, length 0x16fe00 Performing CRC on Image 3... CRC time = 37448509 Detected LZMA compressed image... decompressing... Target Address: 0x84010000 decompressSpace is 0x8000000 Elapsed time 1672051630 Decompressed length: 7104722 Done Copying Root File System... NandFlashRead: Reading offset 0x10c0000, length 0x200 NandFlashRead: Reading offset 0x10c0200, length 0x39f9d2 Performing CRC on Image 1... CRC time = 123388597 Detected LZMA compressed image... decompressing... Target Address: 0x80004000 decompressSpace is 0x8000000 Elapsed time 3625215190 Decompressed length: 18259516 Copying partition table to 0x83fffc04 180 Copying partition table to 0x80000904 180 Executing Image 1... eCos - hal_diag_init Init device '/dev/BrcmTelnetIoDriver' Init device '/dev/ttydiag' Init tty channel: 8116d8b0 Init device '/dev/tty0' Init tty channel: 8116d8d0 Init device '/dev/haldiag' HAL/diag SERIAL init Init device '/dev/ser0' BCM 33XX SERIAL init - dev: 0.2 Set output buffer - buf: 0x813790e0 len: 4096 Set input buffer - buf: 0x8137a0e0 len: 4096 BCM 33XX SERIAL config Init device '/dev/ser1' BCM 33XX SERIAL init - dev: 0.3 Set output buffer - buf: 0x8137b0e0 len: 4096 Set input buffer - buf: 0x8137c0e0 len: 4096 BCM 33XX SERIAL config InitBoard: MIPS frequency 637200000 Battery Thread Constructor.... Leaving Battery thread constructor.... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Configuring/Loading Flash driver... [00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash: (SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22014 Waited 12 iterations after device ID read NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B [00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash: (NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0x20762076 Found bootloader flash map at 0x80000904. [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions: (Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading BootloaderStore driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading ProgramStore driver... ProgramStoreDeviceDriver::ProgramStoreDriverInit: INFO - Initializing... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Loading NonVol driver... [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers: (BFC Target) Storage drivers initialized successfully. [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices... Detecting the next image number that we will store to by default... Bootloader indicates we are running image 1 By default, we will dload to image number 2! [00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions: (BFC Target) Device abstraction singletons created successfully. TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! TechnicolorNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! [00:00:00 01/01/1970] [tStartup] TechnicolorNonVolSettings::Constructor: (Technicolor NonVol Settings) ###### Technicolor: NV storage manager initialized ResetParentalControls: Resetting Parental Control NonVols BcmParentalCtrlNonVolSettings::GetSingletonInstance: WARNING - the singleton instance is NULL, and someone is accessing it! ****** [TechnicolorNonVolSettings] Setting up the singleton pointer****** [00:00:00 01/01/1970] [tStartup] BcmContentPolicyList::BcmContentPolicyList: WARNING - Singleton pointer is not NULL! There are multiple BcmContentPolicyList devices! Leaving the singleton pointer alone... [00:00:00 01/01/1970] [tStartup] BcmUserProfileList::BcmUserProfileList: WARNING - Singleton pointer is not NULL! There are multiple BcmUserProfileList devices! Leaving the singleton pointer alone... [00:00:00 01/01/1970] [tStartup] BcmPolicyManager::BcmPolicyManager: WARNING - Singleton pointer is not NULL! There are multiple BcmPolicyManager devices! Leaving the singleton pointer alone... WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values mtaNvCalcChecksum: checksum= 1273036005 Reading Permanent settings from non-vol... Checksum for permanent settings: 0x2447ad3b [00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl: (DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); current version is 2.0, newer settings will be preserved, but will not be used. [00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl: (DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); current version is 2.0, newer settings will be preserved, but will not be used. [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x45445641 'EDVA'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x54484f4d 'THOM'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x52434120 'RCA '); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x45627069 'Ebpi'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom: WARNING - Read an unrecognized settings group from the buffer (magic number 0x54383032 'T802'); storing in raw form for compatibility... [00:00:00 01/01/1970] [tStartup] BcmIpsecNonVolSettings::IsDefault: (IPSEC NonVol Settings) Permanent settings are default! * * One or more of the settings groups was missing, possibly as a result of a code upgrade. * Settings were read and verified. Reading Dynamic settings from non-vol... [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent: (Reset/Standby Switch Thread) Reset switch released; rebooting... VendorResetButtonRebootCM [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmVendorCmApplication::VendorResetButtonRebootCM: (VendorExtension CmApp) Reboot - Setting LEDs ResetButtonRebootCM. [00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent: (Reset/Standby Switch Thread) Cant Reset pfCmDocsisCtlThread==NULL... Checksum for dynamic settings: 0x243efff7 we found one in the table already!!!! Settings were read and verified.