TP-Link TL-SG2452P

Under Construction!
This page is currently under construction. You can edit the article to help completing it.

The TL-SG2452P, also known as T1600G-52PS, is a 48 (52) port Gigabit switch with PoE on all 48 RJ45 ports and 4 additional SFP ports. Only v4 is supported by OpenWrt, the earlier versions are based on a Broadcom SoC and cannot be supported.

  • SFP ports: No support for the PHY at the moment
  • PoE: Additional workaround necessary to enable the ports (see below)
  • LEDs: Additional workaround necessary to enable the LEDs (see below)
  • Fan control: Only high and medium speed available, manual only

The U-Boot firmware drops to a TP-Link specific “BOOTUTIL” shell at 38400 baud. There is no known way to exit out of this shell, and no way to do anything useful.

Ideally, one would trick the bootloader into flashing the sysupgrade image first. However, if the image exceeds 6MiB in size, it will not work. To install OpenWRT:

Prepare a tftp server with:

  1. server address:
  2. the image as: “uImage.img”

Power on device, and stop boot by pressing any key. Once the shell is active:

  1. Ground out the CLK (pin 16) of the ROM (U6)
  2. Select option “3. Start”
  3. Bootloader notes that “The kernel has been damaged!”
  4. Release CLK as soon as bootloader thinks image is corrupted.
  5. Bootloader enters automatic recovery -- details printed on console
  6. Watch as the bootloader flashes and boots OpenWRT.

This method works when it's not feasible to install a serial header.

Prepare a tftp server with:

  1. server address:
  2. the image as: “uImage.img”
  3. Watch network traffic (tcpdump or wireshark works)
  4. Power on the device.
  5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U6)
  6. When makes tftp requests, release pin 16
  7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT

The PoE modules and the kernel hwmon driver work, but the ICs are not in the correct mode during startup. In order to enable them, the package `i2c-tools` needs to installed and a startup script is required (e.g. /etc/rc.local):

i2cset -y 0 0x30 0x12 0xff
for i in `seq 3 14`; do
  echo 1 > /sys/class/hwmon/hwmon$i/in0_enable
  echo 1 > /sys/class/hwmon/hwmon$i/in1_enable
  echo 1 > /sys/class/hwmon/hwmon$i/in2_enable
  echo 1 > /sys/class/hwmon/hwmon$i/in3_enable

The following commands enable the LEDs on the ports - you can put them into /etc/rc.local:

cd /sys/kernel/debug/rtl838x/led
echo 0x0060f568 > led_glb_ctrl 
echo 0x00007dea > led_set_0_1 
echo 0xffffffff > led_copr_pmask_ctrl_0 
echo 0x000fffff > led_copr_pmask_ctrl_1 
echo 0xffffffff > led_combo_ctrl_0 
echo 0x000fffff > led_combo_ctrl_1
Architecture MIPS
Vendor Realtek
Bootloader (Crippled) U-Boot
System-On-Chip RTL8393M
CPU/Speed 500 MHz
Flash-Chip Winbond
Flash size 32 MiB
RAM 256 MiB
Wireless None
Ethernet 1GBit
Switch 48x GBit, 4x SFP
USB none
Serial Yes
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2024/02/12 08:58
  • by