TP-Link HS110
A smart plug with energy monitoring
Danger to life!
Never connect the device to mains power. Use a safe separate 3.3V supply for the wifi board.
Hardware
Contains a MAX71020A, connected over SPI for power monitoring
- Datasheet / application sheet: https://datasheets.maximintegrated.com/en/ds/MAX71020A.pdf
- Note that there is not yet a Linux driver for this SPI device
Opening the case
Describe what needs to be done to open the device, e.g. remove rubber feet, adhesive labels, screws, ...
- To remove the cover and open the device, do a/b/c
bootlog
U-Boot 1.1.4-dirty (Apr 17 2017 - 14:50:27) AP121 (ar9331) U-boot DRAM: 32 MB Top of RAM usable for U-Boot at: 82000000 Reserving 139k for U-Boot at: 81fdc000 Reserving 192k for malloc() at: 81fac000 Reserving 44 Bytes for Board Info at: 81fabfd4 Reserving 36 Bytes for Global Data at: 81fabfb0 Reserving 128k for boot params() at: 81f8bfb0 Stack Pointer at: 81f8bf98 Now running in RAM - U-Boot at: 81fdc000 Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x16 flash size 4194304, sector count = 64 Flash: 4 MB Using default environment In: serial Out: serial Err: serial Net: ag7240_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address : cfg1 0x5 cfg2 0x7114 eth0: 00:03:7f:09:0b:ad eth0 up : cfg1 0xf cfg2 0x7214 eth1: 00:03:7f:09:0b:ad athrs26_reg_init_lan ATHRS26: resetting s26 ATHRS26: s26 reset done eth1 up eth0, eth1 Hit any key to stop autoboot: 0 ## Booting image at 9f010000 ... Image Name: Linux Kernel Image Created: 2017-04-17 6:50:48 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 772626 Bytes = 754.5 kB Load Address: 80002000 Entry Point: 8019bfb0 Verifying Checksum at 0x9f010040 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 8019bfb0) ... ## Giving linux memsize in bytes, 33554432 Starting kernel ... Booting AR9330(Hornet)... Linux version 2.6.31--LSDK-9.2.0_U11.14 (yt@ubuntu) (gcc version 4.3.3 (GCC) ) #4 Thu Apr 13 19:59:48 HKT 2017 flash_size passed from bootloader = 4 arg 1: console=ttyS0,115200 arg 2: root=31:02 arg 3: rootfstype=squashfs arg 4: init=/sbin/init arg 5: mtdparts=ar7240-nor0:64k(u-boot),1024k(uImage),2752k(rootfs),64k(TPHead),64k(config),64k(log),64k(ART),3904k@0x0(firmware) arg 6: mem=32M CPU revision is: 00019374 (MIPS 24Kc) Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 02000000 @ 00000000 (usable) Zone PFN ranges: Normal 0x00000000 -> 0x00002000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00002000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8128 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs init=/sbin/init mtdparts=ar7240-nor0:64k(u-boot),1024k(uImage),2752k(rootfs),64k(TPHead),64k(config),64k(log),64k(ART),3904k@0x0(firmware) mem=32M PID hash table entries: 128 (order: 7, 512 bytes) Dentry cache hash table entries: 4096 (order: 2, 16384 bytes) Inode-cache hash table entries: 2048 (order: 1, 8192 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 30216k/32768k available (1653k kernel code, 2552k reserved, 420k data, 112k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 266.24 BogoMIPS (lpj=532480) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ===== ar7240_platform_init: 0 bio: create slab <bio-0> at 0 SCSI subsystem initialized usbcore: registered new interface driver usbfs usbcore: registered new interface driver hub usbcore: registered new device driver usb NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 1024 (order: 1, 8192 bytes) TCP bind hash table entries: 1024 (order: 0, 4096 bytes) TCP: Hash tables configured (established 1024 bind 1024) TCP reno registered NET: Registered protocol family 1 AR7240 GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher msgmni has been set to 59 io scheduler noop registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled ttyS0: detected caps 00000000 should be 00000100 serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled brd: module loaded 8 cmdlinepart partitions found on MTD device ar7240-nor0 Creating 8 MTD partitions on "ar7240-nor0": 0x000000000000-0x000000010000 : "u-boot" 0x000000010000-0x000000110000 : "uImage" 0x000000110000-0x0000003c0000 : "rootfs" 0x0000003c0000-0x0000003d0000 : "TPHead" 0x0000003d0000-0x0000003e0000 : "config" 0x0000003e0000-0x0000003f0000 : "log" 0x0000003f0000-0x000000400000 : "ART" 0x000000000000-0x0000003d0000 : "firmware" usbmon: debugfs is not available TCP cubic registered NET: Registered protocol family 17 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> ar7240wdt_init: Registering WDT success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 112k freed init started: BusyBox v1.01 (2017.04.17-06:50+0000) multi-call binary init started: BusyBox v1.01 (2017.04.17-06:50+0000) multi-call binary Starting pid 20, console /dev/ttyS0: '/etc/rc.d/rcS' ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: Mac address for unit 0:bf3f0000 ATHR_GMAC: ff:ff:ff:ff:ff:ff ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 252 ATHR_GMAC: Mac capability flags : 4403 ATHR_GMAC: Mac address for unit 1:bf3f0006 ATHR_GMAC: ff:ff:ff:ff:ff:ff ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 96 ATHR_GMAC: Mac capability flags : 4D83 **** drop_caches_sysctl_handler: all done timer added ...**** Starting pid 29, (none) login: gpio_spi_master: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint device eth0 entered promiscuous mode athr_gmac_ring_alloc Allocated 640 at 0x81cc6000 athr_gmac_ring_alloc Allocated 4032 at 0x81ca7000 Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... ath_hal: 0.9.17.1 (AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.2.0_U11.14 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Bootstrap clock 25MHz ar9300RadioAttach: Need analog access recipe!! Restoring Cal data from Flash Using Cal data from Flash 0xbf3f0000 ath_get_caps[5199] rx chainmask mismatch actual 1 sc_chainmak 0 ath_get_caps[5174] tx chainmask mismatch actual 1 sc_chainmak 0 SC Callback Registration for wifi0 wifi0: Atheros 9380: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device ath3 entered promiscuous mode br0: port 2(ath3) entering learning state wlan_vap_create : enter. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x81f082c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. ieee80211_ioctl_siwmode: imr.ifm_active=131712, new mode=3, valid=1 br0: port 2(ath3) entering forwarding state br0: port 2(ath3) entering disabled state br0: port 2(ath3) entering learning state ath_paprd_cal[131] send pkt, thermal_not_sent reset 0 br0: port 2(ath3) entering forwarding state