Spent some time with this device and figured some stuff out.
brain dump:
PL7223 chips for energy metering and relay control.
Two 74 series TTL type 138 active low mux chip connect to the prolific chip selects and reset pins. (I guess they needed 16 GPIOs plus two for LEDs, and one for reset button, and AR9331 doesn't have enough?)
GPIO 18: A0 on both 74l138
GPIO 21: A1 on both 74l138
GPIO 11: A2 on both 74l138
GPIO 19: enable output on 74l138 that go to PL7223 SPI CS
GPIO 20: enable output on 74l138 that go PL7223 reset
A2 A1 A0
0 0 0 outlet #4
0 0 1 outlet #2
0 1 0 outlet #3
0 1 1 outlet #1
1 0 0 outlet #8
1 0 1 outlet #6
1 1 0 outlet #7
1 1 1 outlet #5
This mapping holds true for both the reset and CS muxes (in other words, A=3 on CS mux addresses outlet 1's CS, and A=3 on reset mux addresses outlet 1's RESET pin)
This is probably different from the 6-port (euro) and 3 port versions, but probably a similar idea. I don't have either, sorry.
Device SPI bus appears to be running at an insultingly low 100KHz. No idea if it can go faster than that.
Sniffed turn relay on command:
SPI write: { 0xb8, 0x0f, 0x20 }
no read
Sniffed turn relay off command
SPI write: { 0xb8, 0x0f, 0x00 }
Meter function and is faster SPI clock possible/reliable?