TP-Link T1600G-52PS v4

The TP-Link T1600G-52PS v4 48 + 4-port Gigabit L2 switch with PoE+.

Note: the v4 (and possibly v3) boards in this series are RTL83xx-based. However v1 is based on the Broadcom BCM53344/BCM53346 chipset.

ATTENTION: Currently, no development is being made for this device

• RTL8393M SoC
• Winbond 25Q256JVFQ (32MB flash)
• SEC K4B2G1646 BYMA (256MB RAM)
• PoE daughter board:
  • TI 9BAJJ6T ISO7741 digital isolator
  • 12× TI TPS23861PW PSE controller

4 Uplink ports are SFP cages which support 1000 Base-X mini GBIC modules.

Power is supplied via a 230 volt mains connector, with an internal power supply for 12 Volt and PoE+.

The board does not have a console connector, but there is an unpopulated header at the left side (front-facing). The Pinout is either TX-RX-GND-VCC or RX-TX-GND-VCC, this needs to be checked again. The connection parameters are 38400 8N1.

There is 1 main PCB and a small PCB with 13 shift register logic chips to control the LEDs (74HC164).

Board	Pictures
Overview; the main CPU is beneath the biggest heat sink, the ribbon cable connects to the LED panel. There are three fans, the speed of the two near the power supply can be controlled.
CPU area; the chip markings are SEC 010 K4B2G16 46F (RAM), WINBOND 25Q256JVFQ (Flash) and LVC245A XH38702 TXD947F (Octal Bus Transceiver)
Fan area; there is one FET marked P3056LS 1951
External PHY area; there is a RTL8214QF PHY for the SFP slots
PoE daughter board detail

There are no ICs on the bottom side of the PCB.

It ships with a bootloader based on Realtek's SDK for RTL83xx SoCs and Linux 2.6.32 based on Realtek's second generation SDK. It has a web interface for all management functions.

OpenWrt support is currently WiP. There is serial access to the bootloader and the stock firmware image has been successfully decrypted. However, a new U-Boot is required for development.

It might be possible to have upgrades from the stock web interface, but this depends on whether the RSA signature is actually verified or not - the relevant code is commented in the bootloader source code.

In order to be able to boot an OpenWrt build, a new U-Boot with network support is required. This can be built from the GPL drop with the following commands:

• Patch package/zlib/zlib.mk and remove line export LD_LIBRARY_PATH=/lib:$$LD_LIBRARY_PATH; $(MAKE1) -C $(@D)
• make O=t1600g-52ps-v4 tplink-t1600g-52ps-v4_defconfig
• make O=t1600g-52ps-v4
• u-boot.bin is at `tplink-t1600g-52ps-v4/images/u-boot.bin`

There is no need to change anything in the source code, as debug is enabled by default. To flash it, a SOIC-16 clip and flashing tool is required - a cheap WCH340-based SPI flasher works sufficiently.

So far, a rather complete GPIO mapping has been found, but some GPIOs cannot be toggled from within OpenWrt. Since the cause is yet unknown, it is not possible to control the fan or LEDs.

25 and 26 are probably SDA/SCL for PoE, but this is not yet confirmed.

The fan control was measured, but can't be replicated since toggling these GPIOs does not work from within OpenWrt:

• Low - Low - Low = Full Speed
• Low - High - High = Medium
• High - High - High = Low Speed

• Product page