OpenWrtとしては何もできないが、パスワードを解除できないか探るためメモ。→ パスワード含めて全て初期化できた。
UART -> J14: 筐体リア側からVcc, GND, RX, TX



RTL838x# # help
?       - alias for 'help'
base    - print or set address offset
boardid - boardid  - Get/Set board model id

boota   - boota  - boot application image from one of dual images partition automatically

bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
env     - environment handling commands
erase   - erase FLASH memory
flinfo  - print FLASH memory information
go      - start application at address 'addr'
help    - print command description/usage
iminfo  - print header information for application image
loadb   - load binary file over serial line (kermit mode)
loady   - load binary file over serial line (ymodem mode)
loop    - infinite loop on address range
md      - memory display
mm      - memory modify (auto-incrementing address)
mtest   - simple RAM read/write test
mw      - memory write (fill)
nm      - memory modify (constant address)
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
printsys- printsys - print system information variables

protect - enable or disable FLASH write protection
reset   - Perform RESET of the CPU
rtk     - rtk     - Realtek commands

run     - run commands in an environment variable
saveenv - save environment variables to persistent storage
savesys - savesys - save system information variables to persistent storage

setenv  - set environment variables
setsys  - setsys  - set system information variables

sf      - SPI flash sub-system
sleep   - delay execution for some time
tftpboot- boot image via network using TFTP protocol
version - print monitor, compiler and linker version


RTL838x# # version

U-Boot 2011.12.46351 (Mar 14 2014 - 16:33:56)
mips-linux-uclibc-gcc (GCC) 3.4.4 mipssde-6.03.00-20051020
GNU ld version 2.15.94 mipssde-6.03.00-20051020


RTL838x# # printenv
nuke_env=sf probe 0; sf erase $(flashoffset_env) +$(ssize_env)
rtkon=rtk network on;ping $(serverip)
up_linux=sf probe 0;sf read $(freemem) $(flashoffset_linux) $(ssize_linux);bootm $(freemem)
update_linux=tftp $(freemem) $(file_linux);sf probe 0;sf erase $(flashoffset_linux) $(ssize_linux);sf write $(fileaddr) $(flashoffset_linux) $(ssize_linux)
update_linux2=tftp $(freemem) $(file_linux2);sf probe 0;sf erase $(flashoffset_linux2) $(ssize_linux2);sf write $(fileaddr) $(flashoffset_linux2) $(ssize_linux2)
update_uboot=tftp $(freemem) $(file_uboot);sf probe 0;sf erase $(flashoffset_uboot) $(ssize_uboot);sf write $(fileaddr) $(flashoffset_uboot) $(ssize_uboot)

Environment size: 1246/65532 bytes





U-Boot 2011.12.46351 (Mar 14 2014 - 16:33:56)

Board: RTL838x CPU:500MHz LXB:200MHz MEM:300MHz
DRAM:  128 MB
SPI-F: 1x32 MB
Loading 65536B env. variables from offset 0x80000
Switch Model: RTL8382M_INTPHY_8218B_8214FC_DEMO (Port Count: 17)
Switch Chip: RTL8382M
0. [0xbb00a000] 0. val = 0x2f39eb3f
0. [0xbb00a000] 1. val = 0x2f396b3f
0. val = 0x00ffff00
### Error chip ID = 0x0000ffff ###
#### RTL8218B config - MAC ID = 8 ####
Now Internal PHY
#### RTL8218B config - MAC ID = 16 ####
Now External 8218B
**** RTL8214FC config - MAC ID = 24 ****
Now External 8214FC
Net:   Net Initialization Skipped
Hit any key to stop autoboot:  0 
## Booting image from partition ... 0
## Booting kernel from Legacy Image at b45a0000 ...
   Image Name:   1.2.1
   Created:      2015-03-06  16:52:41 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    6175426 Bytes = 5.9 MB
   Load Address: 80000000
   Entry Point:  8026d000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Linux version 2.6.19 (root@localhost.localdomain) (gcc version 3.4.4 mipssde-6.03.00-20051020) #33 PREEMPT Fri Mar 6 16:52:39 CST 2015
CPU revision is: 00019070
Determined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
User-defined physical RAM map:
 memory: 04000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 16256
Kernel command line: console=ttyS0,115200 mem=64M
Primary instruction cache 16kB, physically tagged, 4-way, linesize 16 bytes.
Primary data cache 16kB, 2-way, linesize 16 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 57240k/65536k available (2057k kernel code, 8240k reserved, 423k data, 5112k init, 0k highmem)
Mount-cache hash table entries: 512
Checking for 'wait' instruction...  available.
NET: Registered protocol family 16
NET: Registered protocol family 2
IP route cache hash table entries: 512 (order: -1, 2048 bytes)
TCP established hash table entries: 2048 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 2048 bind 1024)
TCP reno registered
squashfs: version 3.3 (2007/10/31) Phillip Lougher
squashfs: LZMA suppport for by jro
JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver $Revision: 1.90 $ 1 ports, IRQ sharing disabled
serial8250: ttyS0 at MMIO 0x0 (irq = 31) is a 16550A
loop: loaded (max 8 devices)
Probe: SPI CS1 Flash Type MX25L25635F
Creating 7 MTD partitions on "Total SPI FLASH":
0x00000000-0x00080000 : "LOADER"
0x00080000-0x00090000 : "BDINFO"
0x00090000-0x000a0000 : "SYSINFO"
0x000a0000-0x004a0000 : "JFFS2 CFG"
0x004a0000-0x005a0000 : "JFFS2 LOG"
0x005a0000-0x012d0000 : "RUNTIME"
0x012d0000-0x02000000 : "RUNTIME2"
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Freeing unused kernel memory: 5112k freed
Mount DEV File System....OK
Mount PROC File System........OK
Mount Main SQFS File System........OK
Mount Module SQFS File System....OK
Mount CFG JFFS2 File System....OK
Mount LOG JFFS2 File System....OK
Init RTCORE Driver Module....OK
Init RTK Driver Module....OK
Init Board Configuration Module....OK
Init SYS NIC Driver Module....OK
Init RTDRV Driver Module....OK
Init KSI Core Driver Module....OK
Init SKI Core Driver Module....OK
Init Board Module....
[board_poe_init] SYS_BM_8380_16GE_1GEC not need Init !!
Init VLAN Aware Module....OK
Init Board Vendor Module....OK
Init Switch GVRP Module....OK
Init Switch STP Module....OK
Init Switch AUTHMGR Module....OK
Init Switch LACP Module....OK
Init Switch Multicast Module....OK
Init Switch IPSG Module....OK
Init Switch DHCP Module....OK
Init Switch DAI Module....OK
Init Switch Voice VLAN Module....OK
Init Switch LLDP Module....OK
Init Switch UDLD Module....OK
Init Switch MAC VLAN Module....OK
Init Switch Surveillance VLAN Module....OK
Init Custom Module....OK
[restore_action] resetdefault = 0 (0)

====== Defaults Initial [Start] ======
Init Switch Factory Default....OK
Init VLAN Factory Default....OK
Init Protocol VLAN Factory Default....OK
Init Vocie VLAN Factory Default....OK
Init Surveillance VLAN Factory Default....OK
Init Mirror Factory Default....OK
Init L2 Factory Default....OK
Init Trunk Factory Default....OK
Init Rate Factory Default....OK
Init QoS Factory Default....OK
Init LACP Factory Default....OK
Init EEE Factory Default....OK
Init DoS Factory Default....OK
Init IGMP Factory Default....OK
Init MVR Factory Default....OK
Init MLD Factory Default....OK
Init STP Factory Default....OK
Press any key to continue