SSC333 Compatibility (Tapo C110)

[cjdell]

Hello. I notice there is no guide for SSC333 however there are references to it in the source code. Does this mean that it could still work (unofficially) if I build the firmware myself? Is there any way I can help with the testing so support for this chip can be added?

Thank you

[viktorxda]

Hello, theoretically it should work due to the general compatibility of the SDK.
So far it hasn't been tested, if you feel adventurous you can try the SSC335 version and report back if it's working.

Edit:
This looks like an interesting device, can you provide some teardown photos?

[cjdell]

Thanks for the quick reply. Also noticed this file added 2 weeks ago:

https://github.com/OpenIPC/firmware/blob/master/br-ext-chip-sigmastar/configs/ssc333_lite_defconfig

Does this mean someone has tried already to make this work?

Here are the photos:

[viktorxda]

Thanks for the photos. Yes, Sigmastar gained a lot of attention recently and we are trying to expand the device list.
I have ordered the device to check it as well, this could potentially become a promising device for openipc.

[cjdell]

Here's the first boot log. The pad near "TP501" is the TX pin:
https://gist.github.com/cjdell/c48f95d9910f2e23fb0ee7dfa6a41d34

[flyrouter]

Please give information what version your C110 device is, v1.0, v2.0 or other.
Thank you.

[cjdell]

I think 2.0 according to the sticker on the PCB.

I tried to see if I could get the boot console today. Holding down Enter whilst plugging in the power cable didn't work as some have suggest for other SigmaStar products.

[viktorxda]

Do you have a programmer and soic clip available for direct write access?

[cjdell]

@viktorxda No but I will buy one. Can you recommend a good SOIC clip / programmer? I am willing to get my hands dirty with these devices.

[viktorxda]

The CH341A, it is not particularly good or powerful, but it is decent enough and easy to obtain.

[viktorxda]

I forgot to mention, for Sigmastar you can also use mstar-snander to read and write directly to the flash chip over the uart connection.

Replace bootloader:

snander -l 0x50000 -r C110_boot.bin -s
snander -l 0x50000 -e
snander -l 0x50000 -w u-boot-ssc333-nor.bin -s

Backup to sdcard:

mw.b ${baseaddr} 0xFF 0x800000; sf probe 0; sf read ${baseaddr} 0x0 0x800000; fatwrite mmc 0 ${baseaddr} tapo_c110.bin 0x800000

[cjdell]

@viktorxda I got the stock firmware extracted with the SOIC clip. The binwalk yielded a lot of interesting secrets within the binary. It's built on OpenWRT and most of the startup and initial config is written as plain text shell scripts. I'm willing to share the binary with you if you're interested.

I found the SSC333 build of OpenIPC and decided to try writing it directly with the SOIC clip but it bricked the device. Appears it doesn't like being programmed this way. Fortunately snander worked perfectly with the CH341A so thank you for telling me this otherwise I would have been stuck.

So, end result is OpenIPC is working on the C110! I had to extract ssw101b_wifi_usb.ko from the original firmware which was within the squashfs. Copied to the camera via SD card so it's now on the overlay filesystem. Manually loaded the module and configured wpa_supplicant and the RTSP stream came to life.

Very impressed with the project. To round this off as a success I still need to get the IR/night vision configured which means trial and error searching for the GPIO pins. Also need to make the kernel module for WiFi auto load. Tomorrow's job...

Thanks for all your help so far. Going to buy more C110's as the price/performance for these cameras is now extremely appealing.

[viktorxda]

Thank you for the feedback, I'm glad that it worked out in the end.

An initial wiki entry for the C110 with the gpios has been created here: https://github.com/OpenIPC/wiki/blob/master/en/device-tapo-c110.md
Btw, feel free to add any information to the wiki that you feel is helpful.

For the wlan driver we have a profile system to set the driver: https://github.com/OpenIPC/firmware/blob/master/general/overlay/etc/wireless/usb#L94

Please try the following:

fw_setenv wlandev ssw101b-ssc333-tapo-c110
fw_setenv wlanssid SSID
fw_setenv wlanpass Password

[cjdell]

@viktorxda Thanks for that. All working now. Just one more thing. I noticed that only 32MB of RAM is available to Linux and memory is a bit tight. I know this is a 64MB SoC. Is this normal?

[viktorxda]

Yes, some of the ram is assigned to the vendor kernel driver and encoder.

[nikdoof]

I can also report another successful device. Direct flashing via a SOP clip didn't work, but using snander worked perfectly. Connected to the UART and configured the wlandev and the SSID, reboot and everything came up fine.

I didn't try and read out the flash directly after the snander flash to see if it had any differences from the bin, but that might be for the next camera.

On a side note I did direct flash a Tapo C310 with the SSC335 version and it worked out the box with ethernet without any other changes, but I'll commit to the wiki and such for that device.

[fabianmuehlberger]

Hi, first time openIPC user here,

I found this project, since I noticed, after buying the tapo c 110 for my 3D printer, that the app mandatory. Fortunately, I am not the only one not accepting this.

I already opened the case and checked the board, are there some things to consider before attempting to flash or other recommendations?

For those who are also interested in doing this, the case hase 4 latches, one on each side. Sliding a thin card in between two of them, was enough to pry it open with a spatula.

If someone is willing to give me some guidance, I am happy to write a short HowTo

[nikdoof]

From my and Chris' experimentation with these devices, we've found that they don't like direct flashing (for some reason we still can't get to the bottom of) so its a little bit of a pain to get running.

1. De-case the camera, and remove the board from the case
2. Either make a clamp or solder on wires onto the 4 pads on the back of the board starting with 'TP501'
3. Hook up a CHA341A to the wires using this guide, you'll have TX/RX pins, and a 5v/GND pins, hook up the ground but not the 5v.
4. Grab mstar-snander and the latest C110 firmware from the OpenIPC website.
5. Use mstar-snander to flash the firmware image
6. Reboot the device, hookup a USB TTL/Serial on the TX/RX/GND, login via the console (root/12345) and set the WiFi config
7. Reboot again, and hopefully it'll be on your WiFi and you can tweak it from there on.

Like I said, it'd be great if a direct flash of the firmware worked using a clamp as it saves quite a bit of hassle, but for some reason we just never got it to work. Flashing the exact firmware via mstar-snander works perfectly every time.

[fabianmuehlberger]

Hey @nikdoof Thank you for the guide, I appreciate it!

Luckily, I have invested in some PCBite gooseneck probes, so no soldering needed ;) (cant praise them enough, they are so handy) . But the pogo pin clamp block looks pretty handy too.

Hopefully I will be able to report a success tomorrow

Best

[viktorxda]

Theoretically it should be possible to create a complete binary, the flash layout should be:

- 0x000000: u-boot-ssc333-nor.bin
- 0x050000: uImage.ssc333
- 0x250000: rootfs.squashfs.ssc333

Current firmware for the C110: OpenIPC/builder
And the bootloader from here: OpenIPC/distributor

[nikdoof]

We're going to have another C110v2 to setup soon, so we'll experiment more with direct flashing the NOR. Our internal build has that layout, and the same bin works when wrote via mstar-snander.

[fabianmuehlberger]

Just bought a crappy CH341a device from amazon, got a chip labeled with CH341B. RX,TX are on 5V. Is this expected? I usually don't trust those dodgy devices...
I got a Lattice, ATMEL ICE and other smaller programmers on hand, or do I need the snander for this flash?

Connecting the device, with lsusb

...
Bus 001 Device 013: ID 1a86:5523 QinHeng Electronics CH341 in serial mode, usb to serial port converter
...

running snander with ./snander -i -q

SNANDer - Spi Nor/nAND programmER 1.8.0 by McMCC

Error opening usb device [1A86:5512]
Programmer device not found!

[themactep]

Ch341a is a decent versatile device that needs some TLC. Fix the voltage bug and switch jumper from serial mode to programmer mode to use it as a programmer not as a serial adapter.

[D4rk4]

From my and Chris' experimentation with these devices, we've found that they don't like direct flashing (for some reason we still can't get to the bottom of) so its a little bit of a pain to get running.

1. De-case the camera, and remove the board from the case

2. Either make a [clamp](https://www.printables.com/model/139112-pogo-pin-clamp-block-for-use-with-flash-adapter-wi) or solder on wires onto the 4 pads on the back of the board starting with 'TP501'

3. Hook up a CHA341A to the wires [using this guide](https://github.com/OpenIPC/wiki/blob/master/en/sigmastar-unbrick.md), you'll have TX/RX pins, and a 5v/GND pins, hook up the ground but not the 5v.

4. Grab mstar-snander and the latest C110 firmware from the OpenIPC website.

5. Use mstar-snander to [flash the firmware image](https://github.com/OpenIPC/wiki/blob/master/en/sigmastar-unbrick.md)

6. Reboot the device, hookup a USB TTL/Serial on the TX/RX/GND, login via the console (root/12345) and set the [WiFi config](https://github.com/OpenIPC/builder/issues/2)

7. Reboot again, and hopefully it'll be on your WiFi and you can tweak it from there on.

Like I said, it'd be great if a direct flash of the firmware worked using a clamp as it saves quite a bit of hassle, but for some reason we just never got it to work. Flashing the exact firmware via mstar-snander works perfectly every time.

TP501 - TX/SDA
TP502 - RX/SCL
TP503 - GND
TP504 - ? (NC)

Please write pinout.

Also, what are the correct commands to flash?

snander -a 0x000000 -w u-boot-ssc333-nor.bin
snander -a 0x050000 -w uImage.ssc335
snander -a 0x250000 -w rootfs.squashfs.ssc335

[D4rk4]

I successfully flash OpenIPC to Tapo C110 v1, with

snander -a 0x000000 -w u-boot-ssc333-nor.bin

mw.b 0x21000000 0xff 0x200000
fatload mmc 0:1 0x21000000 uImage.ssc335
sf probe 0; sf lock 0;
sf erase 0x50000 0x200000; sf write 0x21000000 0x50000 ${filesize}

mw.b 0x21000000 0xff 0x500000
fatload mmc 0:1 0x21000000 rootfs.squashfs.ssc335
sf probe 0; sf lock 0;
sf erase 0x250000 0x500000; sf write 0x21000000 0x250000 ${filesize}

sf erase 0x750000 0xb0000
reset

But wifi not working:

root@openipc-ssc335:~# fw_printenv | grep wlandev
wlandev=ssw101b-ssc333-tapo-c110
root@openipc-ssc335:~# modprobe ssw101b_wifi_usb
modprobe: module ssw101b_wifi_usb not found in modules.dep
root@openipc-ssc335:~# 

[D4rk4]

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

[D4rk4]

Dear @flyrouter, I wanted to inform you that the Tapo C110 version 1 and version 2 utilize the same WiFi chip, designated ssw101b-ssc333-tapo-c110. If you have reservations about approving my merge request, I kindly ask you to consider making the necessary adjustments yourself.

[shikilee]

I've a piece of Tapo C110 it was marked with version 2.20, I'm assuming it is version 2. Strange that these pads TP501,TP502,TP503 are not responding the serial console, tried snander also not able to detect too.

[D4rk4]

Any chance to fix C110v1 in your firmware? The Wi-Fi chip is SSW101B in this revision...
@viktorxda @nikdoof @flyrouter

[sstepansky]

Hi, I recently bought a Tapo C110 camera, board version 2.20 according to the sticker.
Here are the photos of the board:

At first, I ran into the same problem as @shikilee regarding the UART pads not responding. After a closer look with a magnifying glass, I noticed the tiny pads near the UART pads (marked R504, R505, R506, R507 and C502) are all unpopulated, so the connection to the SoC pins is open.

I put some solder on R504 and R505 (i.e. the one above the 7 and the one above the 4) to close the connection and attached a serial adapter (CH341A with the voltage fix). That solved the problem with communication.
So, I used mstar-snander to make a copy of the original firmware. Then I tried flashing the images from the above comment but after rebooting nothing happens... No serial output, nothing... I reflashed the image of the original firmware, but still nothing... not even the red & green led flashing...
I think my camera is now bricked 😅

[cjdell]

@sstepansky Which OS were you using to flash the camera from? I have only ever successfully used the snander tool from bare metal Linux. Using Windows / MacOS or virtual machines always resulted in corruption. Also you need to erase the flash before attempting to write new firmware (easy to forget to do this).

The most reliably way (and fastest) I have found so far is to write only the U-Boot image using snander, then using the U-Boot CLI via a serial console to flash the rest of the firmware via an SD card. I wrote a simply guide for our custom firmware but it should work for any build:

https://gist.github.com/cjdell/aa05e590e00e566635398d893d0c7616

At the very least, writing just U-Boot to the flash using snander should debrick your camera then you can use the U-Boot CLI to do a recovery or whatever you need to do.

[sstepansky]

@cjdell thanks for the tip!
I use Linux, but did not erase the chip every time before flashing.
I erased the chip and then flashed the bootloader, as you suggested. It worked perfectly!
The link for the firmware in your gist is broken, so I downloaded it from the OpenIPC page, copied it to the SD card and then

mw.b 0x21000000 0xff 0x800000
fatload mmc 0:1 0x21000000 openipc-ssc333-lite-8mb.bin
sf probe 0; sf lock 0;
sf erase 0x0 0x800000; sf write 0x21000000 0x0 0x800000
reset

Everything is OK now.

[fabianmuehlberger]

Hey
I just checked my board (version 2.0) and the mentioned components are indeed populated.

Just noticed that I bridged some components, soldering wires to the UART.

[viktorxda]

It seems that the newer revisions of tapo devices are trying to complicate the uart access.

For this we have added a script to create a full firmware binary with included wifi credentials:

sh repack.sh ssc333 ssc333_lite_tp-link-tapo-c110-v2-nor SSID PASS

This can be flashed with snander-mstar that also supports the CH341A:

snander -p ch341a -e
snander -p ch341a -w openipc-ssc333-nor.bin

[shikilee]

@sstepansky Thank you for sharing and discovery the missing resistor which I didn't realising it.
Mine also v2.20 after magnify, mine have missing R504 and R506. It seem tapo intentionally removed those pull down and bridge resistors.
Attached my v2.20 photo of missing R504 and 506.

[shikilee]

My v2.20 Tapo c110 IRLED not responding GPIO14, scanned whole range gpio also not able to trigger the IRled.
@sstepansky is your v2.20 tapo c110 irled working on gpio14 in openipc firmware ?

[sstepansky]

Yes, my camera works fine. The GPIO pins are the ones listed in the wiki page.
Have you tried the firmware from here? That's the one I'm using, with slight adjustments to the stock configuration.

[shikilee]

@sstepansky Thanks for getting back, after trying all firmware it seems it is my hardware issue.
Looking at the back of the mainboard, I found a cracked inductor marking 470 (47uH) :(
Not sure it is the only component that is faulty, need to try some luck get some scrap boards of similar value to replace it.

[trashmaster9000]

just stumbled uppon this project and wanted to try to flash my tapo c110 v1.

worked flawlessly and i have access to the console but wifi isnt working:
root@openipc-ssc335:~# modprobe ssw101b_wifi_usb modprobe: module ssw101b_wifi_usb not found in modules.dep

how do i get working wifi or a working firmware?
i have the ssw110b chip on the board.

[cronyx]

just stumbled uppon this project and wanted to try to flash my tapo c110 v1.

worked flawlessly and i have access to the console but wifi isnt working: root@openipc-ssc335:~# modprobe ssw101b_wifi_usb modprobe: module ssw101b_wifi_usb not found in modules.dep

how do i get working wifi or a working firmware? i have the ssw110b chip on the board.

SC3335 sensor on you board ?

[trashmaster9000]

yes.

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

using this config from an earlier reply i could compile it myself and get wifi working.
would be nice if the precompiled firmware had this fix implemented

[flyrouter]

Please note that there are several types of firmware for the device
Now we support all standards, and the ssc333/335/337 processors are compatible with each other and it is impossible to predict which one the manufacturer will install.
Please focus solely on the type of Wifi chip and sensor.

[zilogZ80]

apologies for the thread-jack but I thought one of you guys might know... any idea if it's possible to add an external WiFi antennae to the board for these cameras? It looks like it's also possible to wire in an ethernet connection so that's plan B... thanks

[mrmazakblu]

yes.

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

using this config from an earlier reply i could compile it myself and get wifi working. would be nice if the precompiled firmware had this fix implemented

I don't know for sure if the fix you refer to is in the current build or not, but I just installed the current precompiled build and wifi works out of the box on my C110. used a combination of multiple comments to get all the steps needed but it worked.

[gungstarbeiter]

I successfully updated the c110 v1 camera to the latest version of OpenIPC. Everything works except ircut. When I turn on the ircut it turns on for a split second and immediately turns off again.
I clearly hear a double click instead of a single click and for a split second a black and white image appears. When I turn off ircut in the web interface, nothing happens and I hear no click. Here is my night mode configuration:

  colorToGray: true
  irCutSingleInvert: false
  lightMonitor: false
  lightSensorInvert: false
  irCutPin1: 79
  irCutPin2: 78
  backlightPin: 14
  monitorDelay: 0
  overrideDrc: 0

[BRFud]

Hello. I have the v2.20 board missing R504 and R506 same as @shikilee showed above. Does anyone know what value resistors should I bridge these with to get the UART working, or do I just bridge them with solder?

edit: nevermind! I have the UART working after simply bridging R504 only (with solder).

[BRFud]

I picked up 2 of these cameras (both Tapo C110 with SSC333) and flashed the prebuilt firmware to them using snander.

Camera 1: Seems mostly working. However, it isn't automatically entering night mode. Does it have an onboard light sensor and is any configuration required to get the C110 night mode to automatically switch on/off?

Here's a pic of its front board. I'm not sure but it looks like it only had LEDs and a mic, or is there a light sensor there?

Camera 2: I have not managed to get on the Wifi because it has a AltoBeam 6012B WIFI chip instead of the SSW101B. I have opened an issue to request this variant be supported.

OpenIPC is amazing, I'm so glad I made the effort

[sstepansky]

AFAIK this camera doesn't have light sensors. It has two IR LEDs and one white LED.
You can adapt a script like this to automate the night mode switching.

[trashmaster9000]

@sstepansky @BRFud you dont need to add a script, works just fine with the right majestic settings out of the box

[sstepansky]

Nice. I guess it's time to update my camera 😅

[geedubess]

Hi! I'm jumping into openipc for the first time, but I thought I'd share my notes.

I just picked up a 4-pack of "TAPO C110" models from amazon.com - the boards say "TAPO C110P4(US) / 2.6".
I opened them up easily enough with one guitar pick and one slim metal pry tool.

Inside, the chips say SSC333 + atbm6012b - but the atbm wifi device appears on the usb bus as 7a:888b, not 7a:8888, and is in fact an atbm6012b-x, despite the chip package only saying 6012b! This chip does not appear to be supported by the atbm60xx package; see #33 for more on that. I found a 6012b-x driver and got all 4 cameras working without any detectable problems (yet). I've collected my local patches to accomplish this and I'll be submitting PRs so others can build ssc333_lite_tp-link-tapo-c110-v26.

For my cameras, I had to bridge R504 with solder to utilize the programming interface. It may be useful to others to hear how I did that: first off, magnifying glasses are helpful. My first attempts with a soldering iron were slow and uncertain. The solder tended to prefer the tip of my iron to the tiny pads on the PCB, but I learned that letting the solder cook on the tip before touching it to the PCB helped a bit.

My subsequent attempts on more cameras were much easier and more reliable: I achieved that with a bit of solder paste, and a short time with a hot air rework station (~15s @ 250C @ low air flow). I discovered that if I let the paste heat for only a little bit it retained its shape and conducted well enough; if I heated it up normally it would ball and not cover both pads. Since it's a very low current temporary bridge I'm okay with the result.

For my programming of the nor flash (u-boot only), I used a ch341a from amazon.com, but it claimed to be v1.7, and has a 4-position switch that lets me set the voltage to 1.8/2.5/3.3/5v. I checked the data pins with a DMM and the voltages appeared accurate! I recommend this device. I was not able to use it correctly in UART mode (linux driver problem?) - no data appeared, so I used a CP2102 instead that was also 3.3v safe, and that worked great.

TP-501 *1   *2   *3   *4       * = test pad
    R506 -  -    -    -        - = DNP
         R504 R507 R505
            ^ this one

bridge the DNP above the "4" on R504

*1 = TX/SDA (to CP2102)
*2 = RX/SCL (from CP2102)
*3 = GND
*4 = do not use

ch341a programmer (NOTE: MUST BE 3.3V safe!!!)


O
O  ------
\-|OO..OO| - 3.3v (DO NOT USE)
  |OO..OO| - to GND *3
  |OO..OO| - to SCL *2
  |OO..OO| - to SDA *1
  |------|
  |OO..OO| (do not use these pins)
  |OO..OO|
  |OO..OO|
  |OO..OO|
   ------
    UUUU
    UUUU
    UUUU

# Connect programmer, then camera 12v power supply.

sudo ./snander -i # verify chip communication

# back up entire flash:
sudo ./snander -r oem-images/tapoc110-v26.bin

# back up u-boot:
sudo ./snander -l 0x50000 -r oem-images/C110_boot.bin

# erase & flash u-boot:

wget https://github.com/OpenIPC/firmware/releases/download/latest/u-boot-ssc333-nor.bin

sudo ./snander -e
sudo ./snander -w u-boot-ssc333-nor.bin

# Insert SD card into camera with uImage.ssc333 and rootfs.squashfs.ssc333.

# Connect CP2102 (or other 3.3V safe serial interface) to camera and USB;

picocom --baud 115200 /dev/ttyUSB0 # or whatever interface is allocated when it's plugged in

# Connect the camera 12v power supply; you should see u-boot starting; hit enter to interrupt.

mw.b 0x21000000 0xff 0x200000; fatload mmc 0:1 0x21000000 uImage.ssc333
sf probe 0; sf erase 0x50000 0x200000; sf write 0x21000000 0x50000 ${filesize}

mw.b 0x21000000 0xff 0x500000; fatload mmc 0:1 0x21000000 rootfs.squashfs.ssc333
sf probe 0; sf erase 0x250000 0x500000; sf write 0x21000000 0x250000 ${filesize}

sf erase 0x750000 0xb0000; reset