Collecting Information for RTL8372 based Switches

I have not found much information about RTL8372 based "managed" switches, so I create this thread to collect the information I have found until now.

My current information is sourced from a Horaco HR-SWTGW124AS 6 Port Switch ( 4x 2,5GbE + 2x SFP+ 10Gbit).

The Switch itself seems to be based of the RTL8372 (as the uboot shell states).
UART is available at 57600 baud, though pins need to be soldered.
Boot can be interupted by sending "v".
After boot is successfull, there is a promt that asks for "uboot password".
I have found the password in the store supplied firmware update, it says "Switch321".
The shell then says "RTL8372:" and commands can only be found by searching in the firmware itself.

Memory can be dumped by interrupting boot and issuing the following command:
"r 0x0 0xfff0"

PCB pictures and files will be added later.


I also bought one Hasivo S600WP-4GT-1SX-1XGT-SE (4x 2.5GbE PoE + 1x SFP+ + 1x 10GbE) - managed PoE+ switch. It also based on RTL8372 (prove that by removing radiator on chip) and it has one more chip with a glued radiator most probably it is RTL8261 for 10GbE port (this assumption based on typical application of RTL8372). SFP+ port connected directly to RTL8372. I tried to find serial connection on it - but no luck. There are two 4-pins pinouts on mainboard, however no one of them has serial data. I was able to dump FM25Q16A serial flash memory on the device and stopped further investigation after binwalk-ing this dump, because it looks like that there are no u-boot and linux in this router.

I saw that the uncontrolled switches also use this RTL8372 circuit. For example Hi-K0402WS which would seem the same as Hasivo S600WP. The difference seems to be the unmanage-manage switch. In Hasivo, one of the SFP+ ports is already equipped with the same circuit as the SFP+ modules have inside. Originally, I was wondering where I could get Hasivo firmware to flash-chip for testing. But OpenWRT would be more interesting.

Many of the larger (>8 ports) switches are designed like that, hard-strapped and without flash/ RAM for unmanaged operations but otherwise the same basic SOC.

These operate 8051 MCU providing a web interface (impressive really) to poke registers - it'll never run a full blown OS such as OpenWRT.

Probably the best (only?) source of info on these platforms:

There's been good success in flashing managed firmwares to the unmanaged variants (hardware permitting) after the recent breakthrough on UID generation.

1 Like

@Whiterat thanks a lot for this info, also found this one:

Maybe we'll find a way to flange a second processor onto these boards to just controll the 8051 core.