Keeplink kp-9000-9xhml-x

a budget Multi-Gigabit Layer 3 switch, based on linux

mcu:
Realtek RL6818C? can't find anything online

io:
-8x 2.5G rj45
-1x 10G sfp+

(T8) Uart, pinout: Tx | Gnd | Rx | Vcc
Baud: 57600

Boot log:

==========Loader start V0.2===========
Press any key to start the normal procedure.
To run SPI flash viewer, press [v]
To enforce the download of the runtime kernel, press [ESC] .....
  cmd -1
    Check Runtime Image.....
    Chksum Correct!
    RunTime Kernel Starting....  
===============  Try to detect the PSE   ===============
===============  PSE IC Existed Result:0  ===============
===============  PSE IC ChipSet Result:C  ===============
Ver8372N=2
Ver8373N=2
LINE 1472, RL6818C_pwr_on_patch_phy_v007 , patch 0xf finished!
LINE 1472, RL6818C_pwr_on_patch_phy_v007 , patch 0xf0 finished!
=============== @@@@@ Not found PSE, No need to init @@@@@@ ===============



===========================Config Area pre-check Starts.=====================.
Pre-Check the config size structure is equal or not.
It seems no risk!..................
==============================Config Area pre-check ends.===================.



SalFlshCopyFlshToCache()
sal_sys_config_restore()
Restore dhcp state is: 0

Restore ip is: 192.168.1.168

...OK
sal_mirror_config_restore()...OK
sal_qos_config_restore()...OK
sal_vlan_config_restore()...OK
sal_rate_config_restore()...OK
sal_trunk_config_restore()...OK
sal_l2_config_restore()...OK
sal_loop_config_restore()...OK
sal_eee_config_restore()...OK
sal_stp_config_restore()...OK
sal_igmp_config_restore()...OK
sal_port_config_restore()...OK
sal_poe_config_restore()...OK

################################################################

############Login Menu ############
### Please input uboot password below: ###

i have not been able to find a working password, but the root drive seems to just be a simple winbond spi chip, gonna update with information as soon as i get it

EDIT 1763511264:
i pressed v, when prompted, but some commands seem to be disabled

==========Loader start V0.2===========
Press any key to start the normal procedure.
To run SPI flash viewer, press [v]
To enforce the download of the runtime kernel, press [ESC] ...
=========================SPI FLASH VIEWER=============================
    b: reboot
    e <addr>: Erase flash with the address of <addr>
    ev <addr>: Erase flash with the address of <addr> and then Verify
    r <addr> <len>: read flash from the address of <addr> and then dump
    c: check runtime kernel without boot
    cb: check runtime kernel and boot if checksum is pass
    h: print header
    l: load runtime kernel
    v: show verobose information
    m: print this menu
    q: quit from spi flash view
>r
unknown command: r
>r 0x00
unknown command: r 0x00
>c
unknown command: c
>cb
    Chksum Correct!
    RunTime Kernel Starting....  
...regular boot here...

If I recall, these are Realtek 837x based, firmware runs directly on the switch chips and they're very memory constrained in comparison to what you generally think of.

Firmware on these only really exists to setup the switch registers and serve a basic web interface.

It'll never run OpenWrt, but there is a project that was slowly building out their own firmware for these 8051-based rtl83xx switches.