TP-Link T1600G-52PS v4

The TP-Link T1600G-52PS v4 48 + 4-port Gigabit L2 switch with PoE+.

Note: the v4 (and possibly v3) boards in this series are RTL83xx-based. However v1 is based on the Broadcom BCM53344/BCM53346 chipset.

ATTENTION: Currently, no development is being made for this device

  • Winbond 25Q256JVFQ (32MB flash)
  • SEC K4B2G1646 BYMA (256MB RAM)
  • PoE daughter board:
    • TI 9BAJJ6T ISO7741 digital isolator
    • 12× TI TPS23861PW PSE controller

4 Uplink ports are SFP cages which support 1000 Base-X mini GBIC modules.

Power is supplied via a 230 volt mains connector, with an internal power supply for 12 Volt and PoE+.

The board does not have a console connector, but there is an unpopulated header at the left side (front-facing). The Pinout is either TX-RX-GND-VCC or RX-TX-GND-VCC, this needs to be checked again. The connection parameters are 38400 8N1.

There is 1 main PCB and a small PCB with 13 shift register logic chips to control the LEDs (74HC164).

Board Pictures
Overview; the main CPU is beneath the biggest heat sink, the ribbon cable connects to the LED panel. There are three fans, the speed of the two near the power supply can be controlled.
CPU area; the chip markings are SEC 010 K4B2G16 46F (RAM), WINBOND 25Q256JVFQ (Flash) and LVC245A XH38702 TXD947F (Octal Bus Transceiver)
Fan area; there is one FET marked P3056LS 1951
External PHY area; there is a RTL8214QF PHY for the SFP slots
PoE daughter board detail t1600-52p-poe-detail.jpg

There are no ICs on the bottom side of the PCB.

It ships with a bootloader based on Realtek's SDK for RTL83xx SoCs and Linux 2.6.32 based on Realtek's second generation SDK. It has a web interface for all management functions.

OpenWrt support is currently WiP. There is serial access to the bootloader and the stock firmware image has been successfully decrypted. However, a new U-Boot is required for development.

It might be possible to have upgrades from the stock web interface, but this depends on whether the RSA signature is actually verified or not - the relevant code is commented in the bootloader source code.

In order to be able to boot an OpenWrt build, a new U-Boot with network support is required. This can be built from the GPL drop with the following commands:

  • Patch package/zlib/ and remove line export LD_LIBRARY_PATH=/lib:$$LD_LIBRARY_PATH; $(MAKE1) -C $(@D)
  • make O=t1600g-52ps-v4 tplink-t1600g-52ps-v4_defconfig
  • make O=t1600g-52ps-v4
  • u-boot.bin is at tplink-t1600g-52ps-v4/images/u-boot.bin

There is no need to change anything in the source code, as debug is enabled by default. To flash it, a SOIC-16 clip and flashing tool is required - a cheap WCH340-based SPI flasher works sufficiently.

So far, a rather complete GPIO mapping has been found, but some GPIOs cannot be toggled from within OpenWrt. Since the cause is yet unknown, it is not possible to control the fan or LEDs.

GPIO Direction Purpose
15 Out PoE Reset (500ms Low)
31 In Probably Fan RPM Input
20 Out System Fan RPM Input
22 In Power Supply Fan 1 RPM Input
23 Out Fan Green LED
8 Out Fan Orange LED
11 In Button PoE/Speed
12 In Button Reset
16 Out Speed Green LED
17 Out PoE Green LED
10 Out PoE Max Green LED
28 Out Fan Speed Out
19 Out Fan Speed Out
18 Out Fan Speed Out

25 and 26 are probably SDA/SCL for PoE, but this is not yet confirmed.

The fan control was measured, but can't be replicated since toggling these GPIOs does not work from within OpenWrt:

  • Low - Low - Low = Full Speed
  • Low - High - High = Medium
  • High - High - High = Low Speed
  • t1600g-52ps.txt
  • Last modified: 2021/03/03 15:00
  • by andyboeh