Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSC333 Compatibility (Tapo C110) #2

Open
cjdell opened this issue Nov 4, 2023 · 44 comments
Open

SSC333 Compatibility (Tapo C110) #2

cjdell opened this issue Nov 4, 2023 · 44 comments

Comments

@cjdell
Copy link

cjdell commented Nov 4, 2023

Hello. I notice there is no guide for SSC333 however there are references to it in the source code. Does this mean that it could still work (unofficially) if I build the firmware myself? Is there any way I can help with the testing so support for this chip can be added?

Thank you

@viktorxda
Copy link
Collaborator

viktorxda commented Nov 4, 2023

Hello, theoretically it should work due to the general compatibility of the SDK.
So far it hasn't been tested, if you feel adventurous you can try the SSC335 version and report back if it's working.

Edit:
This looks like an interesting device, can you provide some teardown photos?

@cjdell
Copy link
Author

cjdell commented Nov 4, 2023

Thanks for the quick reply. Also noticed this file added 2 weeks ago:

https://github.com/OpenIPC/firmware/blob/master/br-ext-chip-sigmastar/configs/ssc333_lite_defconfig

Does this mean someone has tried already to make this work?

Here are the photos:

C110 Back
C110 Front

@viktorxda
Copy link
Collaborator

Thanks for the photos. Yes, Sigmastar gained a lot of attention recently and we are trying to expand the device list.
I have ordered the device to check it as well, this could potentially become a promising device for openipc.

@cjdell
Copy link
Author

cjdell commented Nov 4, 2023

Here's the first boot log. The pad near "TP501" is the TX pin:
https://gist.github.com/cjdell/c48f95d9910f2e23fb0ee7dfa6a41d34

@flyrouter
Copy link
Member

Please give information what version your C110 device is, v1.0, v2.0 or other.
Thank you.

@cjdell
Copy link
Author

cjdell commented Nov 4, 2023

I think 2.0 according to the sticker on the PCB.

I tried to see if I could get the boot console today. Holding down Enter whilst plugging in the power cable didn't work as some have suggest for other SigmaStar products.

@viktorxda
Copy link
Collaborator

Do you have a programmer and soic clip available for direct write access?

@cjdell
Copy link
Author

cjdell commented Nov 6, 2023

@viktorxda No but I will buy one. Can you recommend a good SOIC clip / programmer? I am willing to get my hands dirty with these devices.

@viktorxda
Copy link
Collaborator

The CH341A, it is not particularly good or powerful, but it is decent enough and easy to obtain.

@viktorxda
Copy link
Collaborator

viktorxda commented Nov 7, 2023

I forgot to mention, for Sigmastar you can also use mstar-snander to read and write directly to the flash chip over the uart connection.

Replace bootloader:

snander -l 0x50000 -r C110_boot.bin -s
snander -l 0x50000 -e
snander -l 0x50000 -w u-boot-ssc333-nor.bin -s

Backup to sdcard:

mw.b ${baseaddr} 0xFF 0x800000; sf probe 0; sf read ${baseaddr} 0x0 0x800000; fatwrite mmc 0 ${baseaddr} tapo_c110.bin 0x800000

@cjdell
Copy link
Author

cjdell commented Nov 9, 2023

@viktorxda I got the stock firmware extracted with the SOIC clip. The binwalk yielded a lot of interesting secrets within the binary. It's built on OpenWRT and most of the startup and initial config is written as plain text shell scripts. I'm willing to share the binary with you if you're interested.

I found the SSC333 build of OpenIPC and decided to try writing it directly with the SOIC clip but it bricked the device. Appears it doesn't like being programmed this way. Fortunately snander worked perfectly with the CH341A so thank you for telling me this otherwise I would have been stuck.

So, end result is OpenIPC is working on the C110! I had to extract ssw101b_wifi_usb.ko from the original firmware which was within the squashfs. Copied to the camera via SD card so it's now on the overlay filesystem. Manually loaded the module and configured wpa_supplicant and the RTSP stream came to life.

Very impressed with the project. To round this off as a success I still need to get the IR/night vision configured which means trial and error searching for the GPIO pins. Also need to make the kernel module for WiFi auto load. Tomorrow's job...

Thanks for all your help so far. Going to buy more C110's as the price/performance for these cameras is now extremely appealing.

@viktorxda
Copy link
Collaborator

Thank you for the feedback, I'm glad that it worked out in the end.

An initial wiki entry for the C110 with the gpios has been created here: https://github.com/OpenIPC/wiki/blob/master/en/device-tapo-c110.md
Btw, feel free to add any information to the wiki that you feel is helpful.

For the wlan driver we have a profile system to set the driver: https://github.com/OpenIPC/firmware/blob/master/general/overlay/etc/wireless/usb#L94

Please try the following:

fw_setenv wlandev ssw101b-ssc333-tapo-c110
fw_setenv wlanssid SSID
fw_setenv wlanpass Password

@cjdell
Copy link
Author

cjdell commented Nov 9, 2023

@viktorxda Thanks for that. All working now. Just one more thing. I noticed that only 32MB of RAM is available to Linux and memory is a bit tight. I know this is a 64MB SoC. Is this normal?

@viktorxda
Copy link
Collaborator

Yes, some of the ram is assigned to the vendor kernel driver and encoder.

@nikdoof
Copy link

nikdoof commented Nov 12, 2023

I can also report another successful device. Direct flashing via a SOP clip didn't work, but using snander worked perfectly. Connected to the UART and configured the wlandev and the SSID, reboot and everything came up fine.

I didn't try and read out the flash directly after the snander flash to see if it had any differences from the bin, but that might be for the next camera.

On a side note I did direct flash a Tapo C310 with the SSC335 version and it worked out the box with ethernet without any other changes, but I'll commit to the wiki and such for that device.

@fabianmuehlberger
Copy link

Hi, first time openIPC user here,

I found this project, since I noticed, after buying the tapo c 110 for my 3D printer, that the app mandatory. Fortunately, I am not the only one not accepting this.

I already opened the case and checked the board, are there some things to consider before attempting to flash or other recommendations?

For those who are also interested in doing this, the case hase 4 latches, one on each side. Sliding a thin card in between two of them, was enough to pry it open with a spatula.

PXL_20231211_065913190

If someone is willing to give me some guidance, I am happy to write a short HowTo

@nikdoof
Copy link

nikdoof commented Dec 11, 2023

From my and Chris' experimentation with these devices, we've found that they don't like direct flashing (for some reason we still can't get to the bottom of) so its a little bit of a pain to get running.

  1. De-case the camera, and remove the board from the case
  2. Either make a clamp or solder on wires onto the 4 pads on the back of the board starting with 'TP501'
  3. Hook up a CHA341A to the wires using this guide, you'll have TX/RX pins, and a 5v/GND pins, hook up the ground but not the 5v.
  4. Grab mstar-snander and the latest C110 firmware from the OpenIPC website.
  5. Use mstar-snander to flash the firmware image
  6. Reboot the device, hookup a USB TTL/Serial on the TX/RX/GND, login via the console (root/12345) and set the WiFi config
  7. Reboot again, and hopefully it'll be on your WiFi and you can tweak it from there on.

Like I said, it'd be great if a direct flash of the firmware worked using a clamp as it saves quite a bit of hassle, but for some reason we just never got it to work. Flashing the exact firmware via mstar-snander works perfectly every time.

@fabianmuehlberger
Copy link

Hey @nikdoof Thank you for the guide, I appreciate it!

Luckily, I have invested in some PCBite gooseneck probes, so no soldering needed ;) (cant praise them enough, they are so handy) . But the pogo pin clamp block looks pretty handy too.

Hopefully I will be able to report a success tomorrow

Best

@viktorxda
Copy link
Collaborator

Theoretically it should be possible to create a complete binary, the flash layout should be:

- 0x000000: u-boot-ssc333-nor.bin
- 0x050000: uImage.ssc333
- 0x250000: rootfs.squashfs.ssc333

Current firmware for the C110: OpenIPC/builder
And the bootloader from here: OpenIPC/distributor

@nikdoof
Copy link

nikdoof commented Dec 12, 2023

We're going to have another C110v2 to setup soon, so we'll experiment more with direct flashing the NOR. Our internal build has that layout, and the same bin works when wrote via mstar-snander.

@fabianmuehlberger
Copy link

fabianmuehlberger commented Dec 13, 2023

Just bought a crappy CH341a device from amazon, got a chip labeled with CH341B. RX,TX are on 5V. Is this expected? I usually don't trust those dodgy devices...
I got a Lattice, ATMEL ICE and other smaller programmers on hand, or do I need the snander for this flash?

Connecting the device, with lsusb

...
Bus 001 Device 013: ID 1a86:5523 QinHeng Electronics CH341 in serial mode, usb to serial port converter
...

running snander with ./snander -i -q

SNANDer - Spi Nor/nAND programmER 1.8.0 by McMCC

Error opening usb device [1A86:5512]
Programmer device not found!

@themactep
Copy link

Ch341a is a decent versatile device that needs some TLC. Fix the voltage bug and switch jumper from serial mode to programmer mode to use it as a programmer not as a serial adapter.

@viktorxda viktorxda transferred this issue from OpenIPC/firmware Dec 18, 2023
@D4rk4
Copy link

D4rk4 commented Mar 2, 2024

From my and Chris' experimentation with these devices, we've found that they don't like direct flashing (for some reason we still can't get to the bottom of) so its a little bit of a pain to get running.

1. De-case the camera, and remove the board from the case

2. Either make a [clamp](https://www.printables.com/model/139112-pogo-pin-clamp-block-for-use-with-flash-adapter-wi) or solder on wires onto the 4 pads on the back of the board starting with 'TP501'

3. Hook up a CHA341A to the wires [using this guide](https://github.com/OpenIPC/wiki/blob/master/en/sigmastar-unbrick.md), you'll have TX/RX pins, and a 5v/GND pins, hook up the ground but not the 5v.

4. Grab mstar-snander and the latest C110 firmware from the OpenIPC website.

5. Use mstar-snander to [flash the firmware image](https://github.com/OpenIPC/wiki/blob/master/en/sigmastar-unbrick.md)

6. Reboot the device, hookup a USB TTL/Serial on the TX/RX/GND, login via the console (root/12345) and set the [WiFi config](https://github.com/OpenIPC/builder/issues/2)

7. Reboot again, and hopefully it'll be on your WiFi and you can tweak it from there on.

Like I said, it'd be great if a direct flash of the firmware worked using a clamp as it saves quite a bit of hassle, but for some reason we just never got it to work. Flashing the exact firmware via mstar-snander works perfectly every time.

TP501 - TX/SDA
TP502 - RX/SCL
TP503 - GND
TP504 - ? (NC)

Please write pinout.

Also, what are the correct commands to flash?

snander -a 0x000000 -w u-boot-ssc333-nor.bin
snander -a 0x050000 -w uImage.ssc335
snander -a 0x250000 -w rootfs.squashfs.ssc335

@D4rk4
Copy link

D4rk4 commented Mar 2, 2024

I successfully flash OpenIPC to Tapo C110 v1, with

snander -a 0x000000 -w u-boot-ssc333-nor.bin
mw.b 0x21000000 0xff 0x200000
fatload mmc 0:1 0x21000000 uImage.ssc335
sf probe 0; sf lock 0;
sf erase 0x50000 0x200000; sf write 0x21000000 0x50000 ${filesize}

mw.b 0x21000000 0xff 0x500000
fatload mmc 0:1 0x21000000 rootfs.squashfs.ssc335
sf probe 0; sf lock 0;
sf erase 0x250000 0x500000; sf write 0x21000000 0x250000 ${filesize}

sf erase 0x750000 0xb0000
reset

But wifi not working:

root@openipc-ssc335:~# fw_printenv | grep wlandev
wlandev=ssw101b-ssc333-tapo-c110
root@openipc-ssc335:~# modprobe ssw101b_wifi_usb
modprobe: module ssw101b_wifi_usb not found in modules.dep
root@openipc-ssc335:~# 

@D4rk4
Copy link

D4rk4 commented Mar 2, 2024

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

@D4rk4
Copy link

D4rk4 commented Mar 4, 2024

Dear @flyrouter, I wanted to inform you that the Tapo C110 version 1 and version 2 utilize the same WiFi chip, designated ssw101b-ssc333-tapo-c110. If you have reservations about approving my merge request, I kindly ask you to consider making the necessary adjustments yourself.

@shikilee
Copy link

shikilee commented Mar 6, 2024

I've a piece of Tapo C110 it was marked with version 2.20, I'm assuming it is version 2. Strange that these pads TP501,TP502,TP503 are not responding the serial console, tried snander also not able to detect too.

@D4rk4
Copy link

D4rk4 commented Mar 20, 2024

Any chance to fix C110v1 in your firmware? The Wi-Fi chip is SSW101B in this revision...
@viktorxda @nikdoof @flyrouter

@sstepansky
Copy link

Hi, I recently bought a Tapo C110 camera, board version 2.20 according to the sticker.
Here are the photos of the board:
TOP-1
BOT-1

At first, I ran into the same problem as @shikilee regarding the UART pads not responding. After a closer look with a magnifying glass, I noticed the tiny pads near the UART pads (marked R504, R505, R506, R507 and C502) are all unpopulated, so the connection to the SoC pins is open.
UART_pads

I put some solder on R504 and R505 (i.e. the one above the 7 and the one above the 4) to close the connection and attached a serial adapter (CH341A with the voltage fix). That solved the problem with communication.
So, I used mstar-snander to make a copy of the original firmware. Then I tried flashing the images from the above comment but after rebooting nothing happens... No serial output, nothing... I reflashed the image of the original firmware, but still nothing... not even the red & green led flashing...
I think my camera is now bricked 😅

@cjdell
Copy link
Author

cjdell commented Mar 24, 2024

@sstepansky Which OS were you using to flash the camera from? I have only ever successfully used the snander tool from bare metal Linux. Using Windows / MacOS or virtual machines always resulted in corruption. Also you need to erase the flash before attempting to write new firmware (easy to forget to do this).

The most reliably way (and fastest) I have found so far is to write only the U-Boot image using snander, then using the U-Boot CLI via a serial console to flash the rest of the firmware via an SD card. I wrote a simply guide for our custom firmware but it should work for any build:

https://gist.github.com/cjdell/aa05e590e00e566635398d893d0c7616

At the very least, writing just U-Boot to the flash using snander should debrick your camera then you can use the U-Boot CLI to do a recovery or whatever you need to do.

@sstepansky
Copy link

@cjdell thanks for the tip!
I use Linux, but did not erase the chip every time before flashing.
I erased the chip and then flashed the bootloader, as you suggested. It worked perfectly!
The link for the firmware in your gist is broken, so I downloaded it from the OpenIPC page, copied it to the SD card and then

mw.b 0x21000000 0xff 0x800000
fatload mmc 0:1 0x21000000 openipc-ssc333-lite-8mb.bin
sf probe 0; sf lock 0;
sf erase 0x0 0x800000; sf write 0x21000000 0x0 0x800000
reset

Everything is OK now.

@fabianmuehlberger
Copy link

Hey
I just checked my board (version 2.0) and the mentioned components are indeed populated.
PXL_20240324_192713580

Just noticed that I bridged some components, soldering wires to the UART.

@viktorxda
Copy link
Collaborator

It seems that the newer revisions of tapo devices are trying to complicate the uart access.

For this we have added a script to create a full firmware binary with included wifi credentials:

sh repack.sh ssc333 ssc333_lite_tp-link-tapo-c110-v2-nor SSID PASS

This can be flashed with snander-mstar that also supports the CH341A:

snander -p ch341a -e
snander -p ch341a -w openipc-ssc333-nor.bin

@shikilee
Copy link

@sstepansky Thank you for sharing and discovery the missing resistor which I didn't realising it.
Mine also v2.20 after magnify, mine have missing R504 and R506. It seem tapo intentionally removed those pull down and bridge resistors.
Attached my v2.20 photo of missing R504 and 506.
IMG_3354

@shikilee
Copy link

My v2.20 Tapo c110 IRLED not responding GPIO14, scanned whole range gpio also not able to trigger the IRled.
@sstepansky is your v2.20 tapo c110 irled working on gpio14 in openipc firmware ?

@sstepansky
Copy link

Yes, my camera works fine. The GPIO pins are the ones listed in the wiki page.
Have you tried the firmware from here? That's the one I'm using, with slight adjustments to the stock configuration.

@shikilee
Copy link

shikilee commented Apr 5, 2024

@sstepansky Thanks for getting back, after trying all firmware it seems it is my hardware issue.
Looking at the back of the mainboard, I found a cracked inductor marking 470 (47uH) :(
Not sure it is the only component that is faulty, need to try some luck get some scrap boards of similar value to replace it.
IMG_3389 Medium

@trashmaster9000
Copy link

just stumbled uppon this project and wanted to try to flash my tapo c110 v1.

worked flawlessly and i have access to the console but wifi isnt working:
root@openipc-ssc335:~# modprobe ssw101b_wifi_usb modprobe: module ssw101b_wifi_usb not found in modules.dep

how do i get working wifi or a working firmware?
i have the ssw110b chip on the board.

@cronyx
Copy link
Member

cronyx commented Jun 2, 2024

just stumbled uppon this project and wanted to try to flash my tapo c110 v1.

worked flawlessly and i have access to the console but wifi isnt working: root@openipc-ssc335:~# modprobe ssw101b_wifi_usb modprobe: module ssw101b_wifi_usb not found in modules.dep

how do i get working wifi or a working firmware? i have the ssw110b chip on the board.

SC3335 sensor on you board ?

@trashmaster9000
Copy link

yes.

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

using this config from an earlier reply i could compile it myself and get wifi working.
would be nice if the precompiled firmware had this fix implemented

@flyrouter
Copy link
Member

Please note that there are several types of firmware for the device
Now we support all standards, and the ssc333/335/337 processors are compatible with each other and it is impossible to predict which one the manufacturer will install.
Please focus solely on the type of Wifi chip and sensor.

@zilogZ80
Copy link

apologies for the thread-jack but I thought one of you guys might know... any idea if it's possible to add an external WiFi antennae to the board for these cameras? It looks like it's also possible to wire in an ethernet connection so that's plan B... thanks

@mrmazakblu
Copy link

yes.

Missed ko fix - https://github.com/OpenIPC/builder/pull/16/files

using this config from an earlier reply i could compile it myself and get wifi working. would be nice if the precompiled firmware had this fix implemented

I don't know for sure if the fix you refer to is in the current build or not, but I just installed the current precompiled build and wifi works out of the box on my C110. used a combination of multiple comments to get all the steps needed but it worked.

@gungstarbeiter
Copy link

I successfully updated the c110 v1 camera to the latest version of OpenIPC. Everything works except ircut. When I turn on the ircut it turns on for a split second and immediately turns off again.
I clearly hear a double click instead of a single click and for a split second a black and white image appears. When I turn off ircut in the web interface, nothing happens and I hear no click. Here is my night mode configuration:

  colorToGray: true
  irCutSingleInvert: false
  lightMonitor: false
  lightSensorInvert: false
  irCutPin1: 79
  irCutPin2: 78
  backlightPin: 14
  monitorDelay: 0
  overrideDrc: 0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests