There is a serial console (easily found) however the linux firmware only outputs to the console it doesn't accept serial input. Serial input works in the bootloader but there are no memory dump or flash commands. The bootloader has the web interface for uploading a firmware same as HG612 but no firmware image is available. Someone could request the GPL source code and make it available for download but there are no guarantees it'll be quickly hackable even with the GPL source code.
Bootloader:
CFE version 1.0.38-114.174 for BCM963268 (32bit,SP,BE)
Build Date: Sat Nov 9 13:59:00 CST 2013 (l00184769@localhost)
Copyright (C) 2000-2011 Broadcom Corporation.
NAND flash device: name , id 0x98d1 block 128KB size 131072KB
External switch id = 53125
Chip ID: BCM63168D0, MIPS: 400MHz, DDR: 400MHz, Bus: 200MHz
Main Thread: TP0
Memory Test Passed
Total Memory: 134217728 bytes (128MB)
Boot Address: 0xb8000000
Boot :e=192.168.1.1:ffffff00 h=192.168.1.100 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0
*** Press any key to stop auto run (3 seconds) ***
Auto run second count down: 333
CFE>
web info: Waiting for connection on socket 0.[J
CFE> help
Available commands:
gccs get hw chk sign mode.
p Print boot line and board parameter info
ccs hw chk sign mode.
c Change booline parameters
b Change board parameters
cg hw boot.
r Run program from flash image or from host depend on [f/h] flag
reset Reset the board
help Obtain help for CFE commands
Firmware (partial):
Boot :e=192.168.1.1:ffffff00 h=192.168.1.100 g= r=f f=vmlinux i=bcm963xx_fs_kernel d=1 p=0
*** Press any key to stop auto run (3 seconds) ***
Auto run second count down: 33210
Power down external PHY port.Boot from main system!
SIGN CHK ALWAYLYS.
get bootflag = 1
check tag at block 1 crc ok
Check Image Crc Success
I have find vmlinux.lz at block 11
I have get vmlinux.lz size at block 25
Decompression OK!
Entry at 0x803bb870
Closing network.
no Disabling Switch ports.
Flushing Receive Buffers...
0 buffers found.
Closing DMA Channels.
Starting program at 0x803bb870
init started: BusyBox vv1.9.1 ()
starting pid 299, tty '': '/etc/init.d/rcS'
RCS DONE
starting pid 301, tty '': '/bin/sh'
BusyBox vv1.9.1 () built-in shell (ash)
Enter 'help' for a list of built-in commands.
rootdir=/
table='/etc/devicetable'
mount config success
mount coredump success
-/bin/sh: cannot create /proc/tty/mode: nonexistent directory
Loading drivers and kernel modules...
Start mic now ...
GlobeMac Init OKload cfm ok.
##sendmsg return 16, errno 0.
ethcmdVportEnable--------SUPPORT_ATP_ETH_BCM_EXT_SWITCH_53125-----
ARL table flush done
Success
MASK- ifconfig [eth0]**********
device eth0 is not a slave of br0
LedcmswpsChgProc :9