Skip to content
/ wiki Public

Add TP-Link Tapo C120 device page - #549

Merged
openipc-ai merged 3 commits into
OpenIPC:masterfrom
nzzane:tapo-c120
Sep 19, 2026
Merged

openipc-ai merged 3 commits into
OpenIPC:masterfrom
nzzane:tapo-c120

Conversation

@nzzane

@nzzane nzzane commented Sep 18, 2026

Copy link
Copy Markdown
Contributor

Device page for the TP-Link Tapo C120 (SSC377 + SC430AI + RTL8188FTV), in the style of the C110 page: UART pads, full-chip backup warning, mtdparts for the 3 MB kernel, GPIO table with the majestic config block, how to check sensor detection and where the IQ file goes, and the Wi-Fi bring-up (/etc/wireless/usb entry, wlandev).

One photo of the bottom side of the board. Adds the TOC line, fills the sensor column in en/tp-link.md, and lists Infinity6C in the sensor index.

Related: OpenIPC/sensors#7 (SC430AI driver), OpenIPC/firmware#2445 (load_sigmastar).

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

PR Summary by Qodo

Document OpenIPC setup for TP-Link Tapo C120

📝 Documentation 🕐 10-20 Minutes

Grey Divider

AI Description

• Adds a C120 guide covering safe flashing, UART access, and hardware mappings.
• Documents SC430AI calibration and RTL8188FTV bring-up requirements for OpenIPC.
• Links the guide from navigation and completes the TP-Link sensor catalog.
Diagram

graph TD
  A["Wiki TOC"] --> B["C120 guide"] --> C["UART access"] --> D["Flash backup"]
  B --> E["Sensor setup"] --> F["GPIO mapping"]
  B --> G["Wi-Fi setup"]
  H["Device catalog"] --> B
Loading
High-Level Assessment

A dedicated device page is the best fit because the C120 has model-specific flash preservation, sensor calibration, GPIO, and wireless requirements. Extending the C110 page or limiting the change to the catalog would obscure critical hardware differences and safety warnings.

Files changed (3) +81 / -1

Documentation (3) +81 / -1
README.mdAdd the Tapo C120 guide to wiki navigation +1/-0

Add the Tapo C120 guide to wiki navigation

• Adds the new device page alongside the existing Tapo C110 entry in the camera table of contents.

README.md

device-tapo-c120.mdAdd the complete Tapo C120 hardware and setup guide +79/-0

Add the complete Tapo C120 hardware and setup guide

• Documents the SSC377 and SC430AI hardware, UART access, stock flash layout, factory data warning, OpenIPC partitions, and GPIO assignments. It also covers sensor IQ extraction, Majestic configuration, RTL8188FTV initialization, WPA3 requirements, and the exposed Ethernet pads.

en/device-tapo-c120.md

tp-link.mdIdentify the Tapo C120 image sensor +1/-1

Identify the Tapo C120 image sensor

• Populates the Tapo C120 catalog entry with its SC430AI image sensor.

en/tp-link.md

@qodo-free-for-open-source-projects

qodo-free-for-open-source-projects Bot commented Sep 18, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Action required

1. Closed firmware path becomes public ✓ Resolved 🐞 Bug ⛨ Security
Description
The sensor instructions publish the exact stock-rootfs path and filename for TP-Link's IQ asset.
Because the stock firmware is closed, lines 34–35 cross the disclosure gate's explicit prohibition
on paths or filenames from a closed component's tree.
Code

en/device-tapo-c120.md[R34-35]

+`config/auto_detect_sensor/default_isp/sc430ai_MIPI/isp_default_day.bin` from the stock rootfs
+(squashfs at flash offset `0x400000` in your dump) and copy it to `/etc/sensors/sc430ai.bin`.
Evidence
The new page identifies the asset as originating in the stock rootfs and publishes its complete path
and filename, while the compliance checklist expressly forbids paths or filenames from a closed
component's tree.

en/device-tapo-c120.md[33-35]
pr_compliance_checklist.yaml[37-42]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The page discloses an exact path and filename from TP-Link's closed stock firmware, which the repository's disclosure gate forbids publishing.
## Fix Focus Areas
- en/device-tapo-c120.md[33-35]
## Recommended Fix
Remove the stock-rootfs path and filename. Link to a legally publishable public sensor asset or describe an extraction method that does not reveal names or paths from the closed component, and ensure the commit message and pull-request metadata do not retain the removed detail.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Stock credential layout becomes public ✓ Resolved 🐞 Bug ⛨ Security
Description
The flash section names an internal stock partition, identifies its certificate-and-key contents,
and maps those credentials to an exact flash range. This violates the disclosure gate's prohibition
on internal classifications from closed components, and the same identifier is also present in the
pull-request description and commit message.
Code

en/device-tapo-c120.md[R24-25]

+Stock layout: U-Boot `0x14000`, `factory_info` (device certificate and key) `0x22000-0x4E000`, second U-Boot `0x60000`, kernel `0x70200`, rootfs `0x400000`.
+Dump the whole chip before writing anything: the OpenIPC bootloader overwrites `factory_info`, which the stock firmware needs.
Evidence
The added text publishes the stock partition's internal name, contents, and offsets; the checklist
permits externally observable behavior but rejects internal classification names belonging to closed
components.

en/device-tapo-c120.md[24-25]
pr_compliance_checklist.yaml[26-42]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The page and pull-request metadata expose an internal stock-firmware classification and the exact location and type of credential material stored there.
## Fix Focus Areas
- en/device-tapo-c120.md[24-25]
## Recommended Fix
Replace the partition name, credential description, and location with an externally observable warning that installing the OpenIPC bootloader prevents restoration of stock firmware unless the complete original flash is backed up. Before merge, edit the pull-request description and rewrite the branch commit message to remove the internal partition identifier there as well.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

3. Readers cannot verify sensor support ✓ Resolved 🐞 Bug ≡ Correctness
Description
The firmware declaration and sensor section assert that ssc377_lite supports and automatically
detects SC430AI without linking a supported package or providing a verification procedure. The
repository's sensor index contains neither SSC377 nor SC430AI and warns that even a listed driver
may be absent or nonfunctional in the final binary, so operators cannot establish whether their
selected image has working support.
Code

en/device-tapo-c120.md[R7-8]

+SoC SSC377, sensor SC430AI (4 MP), 16 MB NOR (XM25QH128C), Wi-Fi RTL8188FTV on USB.
+Firmware: `ssc377_lite`, sensor `sc430ai`.
Evidence
The new page makes an unconditional support claim, whereas the repository's designated support guide
neither lists this SoC/sensor combination nor treats driver presence as sufficient proof that a
final firmware binary supports it.

en/device-tapo-c120.md[7-8]
en/device-tapo-c120.md[32-35]
en/firmware-sensors.md[6-10]
en/firmware-sensors.md[14-37]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The page confidently declares firmware and automatic sensor support, but the repository's support index does not cover this combination and the page gives operators no way to confirm it.
## Fix Focus Areas
- en/device-tapo-c120.md[7-8]
- en/device-tapo-c120.md[32-35]
- en/firmware-sensors.md[14-37]
## Recommended Fix
Add SSC377/SC430AI to the supported-sensor index with a public package reference, and document an operator-visible command or interface result that confirms detection and a working image. If support depends on a particular build or manually supplied driver, state that prerequisite before the installation instructions.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Tip of the day
💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread en/device-tapo-c120.md Outdated
Comment thread en/device-tapo-c120.md Outdated
Comment thread en/device-tapo-c120.md Outdated
UART pads, full-chip backup warning, partition sizes for the 3 MB kernel,
GPIO map (IR cut, IR/white/status LEDs, Wi-Fi power), sensor IQ file
location, RTL8188FTV bring-up. Fills the sensor column for the C120 in
the TP-Link table and lists Infinity6C in the sensor index.
@nzzane

nzzane commented Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Reworked per the review: no stock firmware paths or partition names any more (backup warning kept, in external terms), sensor support now points at the driver/loader PRs with a way to verify detection, and Infinity6C is in the sensor index. Commit message and description updated too.

@openipc-ai openipc-ai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The rework reads well and the C110-style structure is the right shape for this. One factual inconsistency and one pointer.

The mtdparts does not match the firmware the page tells you to flash. The layout given is 3072k(kernel),9216k(rootfs) — a 16 MB split — while the page says to use ssc377_lite, which is BR2_OPENIPC_FLASH_SIZE="8" and builds to caps of 2048 KB kernel and 5120 KB squashfs. Add the CONFIG_CFG80211=y kernel the Wireless section calls for (the tree ships =m for infinity6c) and the IQ file copied by hand, and the page is describing a custom build from top to bottom without saying so. Either say plainly that this needs a self-built 16 MB image, or — better — point at a builder device once one exists; I've suggested that to you on OpenIPC/firmware#2445.

Small one: the Wireless section sends readers to build 8188fu from openipc/realtek-wlan branch rtl8188fu. That is accurate, but it is also exactly what BR2_PACKAGE_RTL8188FU_OPENIPC=y already builds — same repo, same branch. Naming the symbol saves people a manual kernel-module build.

The page described a hand-built image without saying so: a 3 MB kernel
with cfg80211 built in, a hand-copied IQ file, a 9216k rootfs. The builder
device ssc377_lite_tp-link-tapo-c120 holds all of that, on the stock
infinity6c kernel (cfg80211 as a module works with 8188fu) and the standard
16 MB layout. Name the rtl8188fu Buildroot symbol instead of the manual
module build, and say that WPA3-only networks still need a hand-written
SAE config until the firmware follow-up lands.
@nzzane

nzzane commented Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

Both fixed. The page now points at the OpenIPC/builder device ssc377_lite_tp-link-tapo-c120 (OpenIPC/builder#162) and describes what that image is: the standard 16 MB layout (3072k(kernel),10240k(rootfs)) and the stock infinity6c kernel — the "3 MB kernel with cfg80211 built in" line was wrong, cfg80211 as a module works with 8188fu and the built uImage is under the 2 MB cap — plus the IQ file shipped by the device. The Wireless section names BR2_PACKAGE_RTL8188FU_OPENIPC=y instead of the manual module build, and says plainly that WPA3-only networks still need a hand-written key_mgmt=SAE config until the firmware follow-up lands.

@openipc-ai openipc-ai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Both findings are fixed: the layout is the standard 16 MB map and matches the device, and the Wireless section names BR2_PACKAGE_RTL8188FU_OPENIPC=y instead of a manual module build. Approving — the wiki has no CI, so nothing else gates this.

One thing has gone stale underneath you in the last hour, though: all four are merged now.

So the opening paragraph's "until those and the builder device are merged, build the device yourself" no longer applies, and the builder link points at a closed PR rather than the device. Worth a last pass before this goes in: point at devices/ssc377_lite_tp-link-tapo-c120 on master, and say the image comes from the builder release. Everything below that paragraph reads correctly as it stands.

For the record, the builder CI build of the device reproduced your hardware numbers exactly — uImage 1991KB/2048KB, rootfs.squashfs 5384KB/8192KB, 2808KB of headroom.

@openipc-ai
openipc-ai merged commit cb8e333 into OpenIPC:master Sep 19, 2026
johnchia added a commit to johnchia/firmware that referenced this pull request Sep 21, 2026
ssc377_raptor is ssc377d_raptor on the suffixless 64 MB part: 16 MB NOR,
8192k rootfs, no radio. ssc377_tapo_c120 derives from it and adds what
that camera has -- an RTL8188FTV on USB, the supplicant, and a baked
U-Boot environment whose one non-default line is wlandev.

The radio needs two pins driven before it exists, and both are board
knowledge, which is why this is a target and not a symbol:

  GPIO 42 (PAD_FUART_RX) gates the radio's supply. This tree's kernel
  holds it low -- the infinity6c padmux table muxes the pad to PWM0 at
  boot and an idle PWM output is a low -- while the vendor's device
  tree leaves it alone. A gpio export claims the pad back, so the arm
  in /etc/wireless/usb needs no kernel change. OpenIPC/builder#57 and
  the C120 page in OpenIPC/wiki#549 drive the same pin.

  GPIO 8 (PAD_UART1_TX) is the chip enable, pulsed the way the stock
  firmware's tmpd_insmod_driver does it: low a second, high, two more,
  insmod. The vendor's kernel carries the same pad table as ours, so
  the number means the same thing here.

Detection cannot find a radio whose power is off, so wlandev has to be
set before S40network runs; on a camera with no login yet the only
place for that is the environment, hence the mkenvimage blob written
through make_full_image.sh's ENV_BIN.

Board status, from one C120: the full image boots, the baked
environment is read, the arm runs, and the enable net rises on its own
once it does -- GPIO 42 gating the supply is confirmed on that unit.
Enumeration and association are not verified: the unit's RTL8188FTV
had been damaged before the arm was corrected and never came up.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants