See 'WikiDevi' @ the Internet Archive (MW XML, Files, Images)
upgraded MW to 1.30 - maybe things are slightly less broken

technicolor TC8305C

From WikiDevi
Jump to: navigation, search

technicolor TC8305C Comcast 1.0
Availability: common

Manuf/OEM/ODM Askey PKE1331BP-D49

FCC approval date: 26 July 2012
Country of manuf.: China

Type: wireless router, cable modem, analog phone gateway

FCC ID: H8N-PKE1331BP

Power: 120 VAC ~ 60 Hz, 1.2 A
Connector type: C7P

CPU1: Broadcom BCM3383Z
FLA1: 64 MiB
67,108,864 B
524,288 Kib
65,536 KiB
512 Mib
0.0625 GiB
(STMicroelectronics NAND512W3A2ZN6)
FLA2: 1 MiB
1,048,576 B
8,192 Kib
1,024 KiB
8 Mib
9.765625e-4 GiB
(Macronix MX25L8008E)
RAM1: 128 MiB
134,217,728 B
1,048,576 Kib
131,072 KiB
1,024 Mib
0.125 GiB
(Micron MT41J64M16JT-15E:G)

Expansion IFs: USB 2.0
USB ports: 1

WI1 chip1: Broadcom BCM4331
WI1 802dot11 protocols: bgn
WI1 MIMO config: 3x3:3
WI1 antenna connector: none

ETH chip1: Broadcom BCM3383Z
Switch: Broadcom BCM53124S
LAN speed: 10/100/1000
LAN ports: 4

bgn

Flags: DOCSIS 3.0, battery

Default SSID: HOME-XXXX (3 addl. devices)
Default IP address: 10.0.0.1
the IP 10.0.0.1 is used by 19 additional devices
of which 2 are technicolor devices
Default login user: admin
Default login password: password
admin:password credentials used by 377 additional devices
of which 1 are technicolor devices

802dot11 OUI: none specified

 FCC ID
Technicolor TC7200 (Thomson)H8N-PKE1331BP
H8N-TC7300
For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.


The FCC external photos indicate that this cable modem is used with Comcast's Xfinity service.

Comcast Wireless Gateway User Guide

Per the FCC internal photos...

  • the SoC used is a BCM3383ZKFEBG (BCM3383 / BCM3383Z)
  • the GbE Switch is a BCM53124SKMMLG (BCM53124 / BCM53124S)
  • the RAM appears to be a Micron 2DGI2 D9MNJ (B887).
  • The battery shown in the FCC external photos is a Getac
BP-B210N-21/2600 S (Li-ion, 7.4V 2600mAh, 19.24Wh).
1.2A rated, ~8 Watts or 14 VA at the wall synced with WiFi on, no traffic.
A new battery may be purchased for $35.00 plus taxes and a $5.95 shipping fee.
Existing customers are eligible to purchase a new battery, which will be sent
to your Comcast service address and will arrive in about 7-10 business days.
If you would like to order a battery, please call us at 1-888-972-1261.
If you are a Comcast Business Voice customer, please call 1-800-391-3000
for details about the Comcast Business Voice battery replacement program.

The FCC label shows the default SSID pattern is HOME-XXXX, which should be the usual Comcast modem-router default SSID.

Default settings are from Comcast's customer support page.

Interesting features:

  • This device has a built-in Mongoose HTTP web server running on port 8080 (http://10.0.0.1:8080), that presents
a graph and a UI allowing you to interact with the chips spectrum analyzer. Only Safari and Chrome are supported.
  • The setup Wizard seems to have a problem with <space> characters in a WPA2 PSK AES wi-fi password.

Bootlog[edit]

boot log
BCM3383A2 TP0 346890
MemSize:            128 M
Chip ID:     BCM3383Z-B0

Technicolor BootLoader Version: 2.1.8
Broadcom    BootLoader Version: 2.4.0alpha18 Release Gnu spiboot dual-flash reduced DDR drive linux
Build Date: Sep 12 2012
Build Time: 22:21:37
SPI flash ID 0xc22014, size 1MB, block size 64KB, write buffer 256, flags 0x0
NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B
parameter offset is 43832

Signature/PID: a8e6

Reading flash map at ff30, size 192
Successfully restored flash map from SPI flash!
NandFlashRead: Reading offset 0x10c0000, length 0x5c

Image 1 Program Header:
   Signature: a8e6
     Control: 0005
   Major Rev: 0003
   Minor Rev: 0000
  Build Time: 2013/10/15 06:53:10 Z
 File Length: 3799926 bytes
Load Address: 80004000
    Filename: TC8305C-01.E6.10.09-131015-S-FF9-D.img
         HCS: e136
         CRC: 439042b8

Found image 1 at offset 11c0000
NandFlashRead: Reading offset 0x19c0000, length 0x5c
NandFlashRead: Reading offset 0x22c0000, length 0x5c

Image 3 Program Header:
   Signature: a8e6
     Control: 0005
   Major Rev: 0002
   Minor Rev: 0017
  Build Time: 2013/7/1 22:44:58 Z
 File Length: 1507236 bytes
Load Address: 84010000
    Filename: bcm93383LxGNand_kernel
         HCS: 5b1f
         CRC: fbd7b9bb

Found image 3 at offset 23c0000
Enter '1', '2', or 'p' within 2 seconds or take default...
. . 
NandFlashRead: Reading offset 0x22c0000, length 0x200
NandFlashRead: Reading offset 0x22c0200, length 0x16fe00
Performing CRC on Image 3...
CRC time = 37448509
Detected LZMA compressed image... decompressing... 
Target Address: 0x84010000
decompressSpace is 0x8000000
Elapsed time 1672051630

Decompressed length: 7104722
Done Copying Root File System...

NandFlashRead: Reading offset 0x10c0000, length 0x200
NandFlashRead: Reading offset 0x10c0200, length 0x39f9d2
Performing CRC on Image 1...
CRC time = 123388597
Detected LZMA compressed image... decompressing... 
Target Address: 0x80004000
decompressSpace is 0x8000000
Elapsed time 3625215190

Decompressed length: 18259516
Copying partition table to 0x83fffc04 180
Copying partition table to 0x80000904 180

Executing Image 1...

 eCos - hal_diag_init
Init device '/dev/BrcmTelnetIoDriver'
Init device '/dev/ttydiag'
Init tty channel: 8116d8b0
Init device '/dev/tty0'
Init tty channel: 8116d8d0
Init device '/dev/haldiag'
HAL/diag SERIAL init
Init device '/dev/ser0'
BCM 33XX SERIAL init - dev: 0.2
Set output buffer - buf: 0x813790e0 len: 4096
Set input buffer - buf: 0x8137a0e0 len: 4096
BCM 33XX SERIAL config
Init device '/dev/ser1'
BCM 33XX SERIAL init - dev: 0.3
Set output buffer - buf: 0x8137b0e0 len: 4096
Set input buffer - buf: 0x8137c0e0 len: 4096
BCM 33XX SERIAL config

InitBoard: MIPS frequency 637200000
Battery Thread Constructor....
Leaving Battery thread constructor....
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:
(BFC Target) Configuring/Loading Flash driver...
[00:00:00 01/01/1970] [tStartup] BcmSpiFlashDevice::DetectFlash:
(SPI Flash Device Factory) WARNING - Detected SPI flash with JEDEC ID =0xc22014
Waited 12 iterations after device ID read
NAND flash: Device size 64 MB, Block size 16 KB, Page size 512 B
[00:00:00 01/01/1970] [tStartup] BcmNandFlashDevice::DetectNandFlash:
(NAND Flash Device Factory) WARNING - Detected NAND flash with JEDEC ID =0x20762076
Found bootloader flash map at 0x80000904.
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] FlashDeviceDriver::SpiFlashPlaceRegions:
(Flash Driver C API) WARNING - Partition falls out of range of device 0. Placing in device 1...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:
(BFC Target) Loading BootloaderStore driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:
(BFC Target) Loading ProgramStore driver...
ProgramStoreDeviceDriver::ProgramStoreDriverInit:  INFO - Initializing...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:
(BFC Target) Loading NonVol driver...
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitStorageDrivers:
(BFC Target) Storage drivers initialized successfully.
[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:
(BFC Target) Creating singletons for ProgramStore/BootloaderStore/NonVol devices...
Detecting the next image number that we will store to by default...
Bootloader indicates we are running image 1
By default, we will dload to image number 2!

[00:00:00 01/01/1970] [tStartup] BcmBfcStdEmbeddedTarget::InitDeviceAbstractions:
(BFC Target) Device abstraction singletons created successfully.

TechnicolorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
TechnicolorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
TechnicolorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
TechnicolorNonVolSettings::GetSingletonInstance:  WARNING - the singleton instance is NULL, and someone is accessing it!
[00:00:00 01/01/1970] [tStartup] TechnicolorNonVolSettings::Constructor:
(Technicolor NonVol Settings) ###### Technicolor:  NV storage manager initialized
ResetParentalControls: Resetting Parental Control NonVols
BcmParentalCtrlNonVolSettings::GetSingletonInstance: 
WARNING - the singleton instance is NULL, and someone is accessing it!
****** [TechnicolorNonVolSettings] Setting up the singleton pointer******
[00:00:00 01/01/1970] [tStartup] BcmContentPolicyList::BcmContentPolicyList: 
WARNING - Singleton pointer is not NULL!  There are multiple BcmContentPolicyList devices!  
Leaving the singleton pointer alone...
[00:00:00 01/01/1970] [tStartup] BcmUserProfileList::BcmUserProfileList: 
WARNING - Singleton pointer is not NULL!  There are multiple BcmUserProfileList devices!  
Leaving the singleton pointer alone...
[00:00:00 01/01/1970] [tStartup] BcmPolicyManager::BcmPolicyManager:  WARNING - Singleton pointer is not NULL! 
There are multiple BcmPolicyManager devices!  Leaving the singleton pointer alone...
WARNING: ResetDefaultBlindEmtaData() -Resetting EMTA non-vol data section to default values
mtaNvCalcChecksum: checksum= 1273036005
Reading Permanent settings from non-vol...
Checksum for permanent settings:  0x2447ad3b
[00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl:
(DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); 
current version is 2.0, newer settings will be preserved, but will not be used.
[00:00:00 01/01/1970] [tStartup] BcmDocsisCmDownstreamCalibrationNonVolSettings::ReadFromImpl:
(DOCSIS CM Downstream Calibration NonVol Settings) WARNING - Read newer version of the settings (2.1); 
current version is 2.0, newer settings will be preserved, but will not be used.
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  WARNING - Read an unrecognized 
settings group from the buffer (magic number 0x45445641 'EDVA'); storing in raw form for compatibility...
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  WARNING - Read an unrecognized 
settings group from the buffer (magic number 0x54484f4d 'THOM'); storing in raw form for compatibility...
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  WARNING - Read an unrecognized 
settings group from the buffer (magic number 0x52434120 'RCA '); storing in raw form for compatibility...
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  WARNING - Read an unrecognized 
settings group from the buffer (magic number 0x45627069 'Ebpi'); storing in raw form for compatibility...
[00:00:00 01/01/1970] [tStartup] BcmBfcAppCompositeNonVolSettings::ReadFrom:  WARNING - Read an unrecognized 
settings group from the buffer (magic number 0x54383032 'T802'); storing in raw form for compatibility...
[00:00:00 01/01/1970] [tStartup] BcmIpsecNonVolSettings::IsDefault:  (IPSEC NonVol Settings) Permanent settings 
are default!

*
* One or more of the settings groups was missing, possibly as a result of a code upgrade.
*
Settings were read and verified.

Reading Dynamic settings from non-vol...
[00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent:
(Reset/Standby Switch Thread) Reset switch released; rebooting...
VendorResetButtonRebootCM
[00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmVendorCmApplication::VendorResetButtonRebootCM: 
(VendorExtension CmApp) Reboot - Setting LEDs
ResetButtonRebootCM.
[00:00:00 01/01/1970] [Reset/Standby Switch Thread] BcmResetStandbySwitchThread::ProcessResetSwitchEvent:  
(Reset/Standby Switch Thread) Cant Reset pfCmDocsisCtlThread==NULL...
Checksum for dynamic settings:  0x243efff7

 we found one in the table already!!!!
Settings were read and verified.

JTAG (JP1201)[edit]

Pin Function Pin Function
1 tRST 2 GND
3 TDI 4 GND
5 TDO 6 GND
7 TMS 8 GND
9 TCK 10 GND