TP-Link HS110

A smart plug with energy monitoring

Danger to life!
Never connect the device to mains power. Use a safe separate 3.3V supply for the wifi board.

Contains a MAX71020A, connected over SPI for power monitoring

Datasheet / application sheet: https://datasheets.maximintegrated.com/en/ds/MAX71020A.pdf
Note that there is not yet a Linux driver for this SPI device

DANGER: HIGH VOLTAGE inside!
Opening this device exposes
parts under high voltage (110/230 VAC)!

Risk of deadly electrical shock
Risk of irreversable damage to other components attached, e.g. your PC connected via serial

Make sure to keep your fingers, conductive tools and serial cables away from the high voltage at all times!

Capacitors can still retain dangerous voltages
after disconnection from mains!

Continue at your own risk!

Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...

To remove the cover and open the device, do a/b/c

U-Boot 1.1.4-dirty (Apr 17 2017 - 14:50:27)

AP121 (ar9331) U-boot

DRAM:  32 MB
Top of RAM usable for U-Boot at: 82000000
Reserving 139k for U-Boot at: 81fdc000
Reserving 192k for malloc() at: 81fac000
Reserving 44 Bytes for Board Info at: 81fabfd4
Reserving 36 Bytes for Global Data at: 81fabfb0
Reserving 128k for boot params() at: 81f8bfb0
Stack Pointer at: 81f8bf98
Now running in RAM - U-Boot at: 81fdc000
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x16
flash size 4194304, sector count = 64
Flash:  4 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7240_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
: cfg1 0x5 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
eth0 up
: cfg1 0xf cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs26_reg_init_lan
ATHRS26: resetting s26
ATHRS26: s26 reset done
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0 
## Booting image at 9f010000 ...
   Image Name:   Linux Kernel Image
   Created:      2017-04-17   6:50:48 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    772626 Bytes = 754.5 kB
   Load Address: 80002000
   Entry Point:  8019bfb0
   Verifying Checksum at 0x9f010040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 8019bfb0) ...
## Giving linux memsize in bytes, 33554432

Starting kernel ...

Booting AR9330(Hornet)...
Linux version 2.6.31--LSDK-9.2.0_U11.14 (yt@ubuntu) (gcc version 4.3.3 (GCC) ) #4 Thu Apr 13 19:59:48 HKT 2017
flash_size passed from bootloader = 4                                                                         
arg 1: console=ttyS0,115200          
arg 2: root=31:02          
arg 3: rootfstype=squashfs
arg 4: init=/sbin/init    
arg 5: mtdparts=ar7240-nor0:64k(u-boot),1024k(uImage),2752k(rootfs),64k(TPHead),64k(config),64k(log),64k(ART),3904k@0x0(firmware)
arg 6: mem=32M                                                                                                                   
CPU revision is: 00019374 (MIPS 24Kc)
Determined physical RAM map:         
 memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:       
 memory: 02000000 @ 00000000 (usable)
Zone PFN ranges:                     
  Normal   0x00000000 -> 0x00002000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges 
    0: 0x00000000 -> 0x00002000    
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8128
Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),1024k(uImage),2752k(rootfs),64k(TPHead),64k(config),64k(log),64k(ART),3904k@0x0(firmware) mem=32M 
PID hash table entries: 128 (order: 7, 512 bytes)                                                                                                                                                                           
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)  
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000                                      
Readback ErrCtl register=00000000
Memory: 30216k/32768k available (1653k kernel code, 2552k reserved, 420k data, 112k init, 0k highmem)
NR_IRQS:128                                                                                          
plat_time_init: plat time init done
Calibrating delay loop... 266.24 BogoMIPS (lpj=532480)
Mount-cache hash table entries: 512                   
NET: Registered protocol family 16 
===== ar7240_platform_init: 0     
bio: create slab <bio-0> at 0
SCSI subsystem initialized   
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub  
usbcore: registered new device driver usb   
NET: Registered protocol family 2        
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)       
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered                                     
NET: Registered protocol family 1
AR7240 GPIOC major 0             
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 59                         
io scheduler noop registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
ttyS0: detected caps 00000000 should be 00000100        
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled                                      
brd: module loaded     
8 cmdlinepart partitions found on MTD device ar7240-nor0
Creating 8 MTD partitions on "ar7240-nor0":             
0x000000000000-0x000000010000 : "u-boot"   
0x000000010000-0x000000110000 : "uImage"
0x000000110000-0x0000003c0000 : "rootfs"
0x0000003c0000-0x0000003d0000 : "TPHead"
0x0000003d0000-0x0000003e0000 : "config"
0x0000003e0000-0x0000003f0000 : "log"   
0x0000003f0000-0x000000400000 : "ART"
0x000000000000-0x0000003d0000 : "firmware"
usbmon: debugfs is not available          
TCP cubic registered            
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>         
ar7240wdt_init: Registering WDT success             
VFS: Mounted root (squashfs filesystem) readonly on device 31:2.
Freeing unused kernel memory: 112k freed                        
init started:  BusyBox v1.01 (2017.04.17-06:50+0000) multi-call binary
init started:  BusyBox v1.01 (2017.04.17-06:50+0000) multi-call binary
Starting pid 20, console /dev/ttyS0: '/etc/rc.d/rcS'
ATHR_GMAC: Length per segment 1536
ATHR_GMAC: fifo cfg 3 01f00140    
ATHR_GMAC: Mac address for unit 0:bf3f0000
ATHR_GMAC: ff:ff:ff:ff:ff:ff              
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   252
ATHR_GMAC: Mac capability flags    :   4403
ATHR_GMAC: Mac address for unit 1:bf3f0006 
ATHR_GMAC: ff:ff:ff:ff:ff:ff              
ATHR_GMAC: Max segments per packet :   1
ATHR_GMAC: Max tx descriptor count :   40
ATHR_GMAC: Max rx descriptor count :   96
ATHR_GMAC: Mac capability flags    :   4D83
**** drop_caches_sysctl_handler: all done timer added ...**** 
Starting pid 29,                                              
(none) login: gpio_spi_master: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint                              
device eth0 entered promiscuous mode        
athr_gmac_ring_alloc Allocated 640 at 0x81cc6000
athr_gmac_ring_alloc Allocated 4032 at 0x81ca7000
Setting Drop CRC Errors, Pause Frames and Length Error frames 
Setting PHY...                                                
ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved         
ath_ahb: 9.2.0_U11.14 (Atheros/multi-bss)                                        
__ath_attach: Set global_scn[0]          
ACBKMinfree = 48               
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0 
CABMinfree = 48
UAPSDMinfree = 0
Bootstrap clock 25MHz
ar9300RadioAttach: Need analog access recipe!!
Restoring Cal data from Flash                 
Using Cal data from Flash 0xbf3f0000
ath_get_caps[5199] rx chainmask mismatch actual 1 sc_chainmak 0
ath_get_caps[5174] tx chainmask mismatch actual 1 sc_chainmak 0
SC Callback Registration for wifi0                             
wifi0: Atheros 9380: mem=0xb8100000, irq=2
wlan_vap_create : enter. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
device ath3 entered promiscuous mode                                               
br0: port 2(ath3) entering learning state
wlan_vap_create : enter. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
 ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1               
br0: port 2(ath3) entering forwarding state                          
br0: port 2(ath3) entering disabled state  
br0: port 2(ath3) entering learning state
ath_paprd_cal[131] send pkt, thermal_not_sent reset 0
br0: port 2(ath3) entering forwarding state

How to add tags

AR9331, 4Flash, 32RAM, Mains powered, Wall plug, Unsupported devices

ar9331 4Flash 32RAM Mains powered Wall plug Unsupported devices

TP-Link HS110

Hardware

Opening the case

bootlog

Tags