Wouldn’t that be very cool? Samsung’s crappy software would be gone and we would still benefit from z-wave and zigbee hardware, as well as the battery backup.
I suppose this is next to impossible.
It would be cool. Having said that, I don’t know much about its hardware so my first question would be is there sufficient oomph and storage to adequately serve the needs of Home Assistant (i.e. is it at least as capable as a Raspberry Pi 3).
I imagine you’d have to be able to either root the device, to gain administrative control of it, or find a way to put the hardware into a mode that would allow re-flashing its firmware. Searching for “rooting Smartthings Smart Hub” doesn’t produce anything relevant. Either very few people are interested in exploring this route (perhaps because the platform isn’t powerful enough) or have tried and failed to produce anything worth repeating.
Did a search for “Smartthings Smart Hub teardown” and found this (for version 2 hub):
https://electronics360.globalspec.com/article/9326/teardown-samsung-smartthings-hub
32-bit ARM Cortex-A9 CPU @ 1GHz
4 GB RAM
4 GB eMMC storage
Seems adequate for ‘lift-off’ but you’d probably need to add external storage (via one of its two USB ports) because 4GB of onboard storage is meager.
1 Like
SmatThings V2 hub runs Freescale i.MX6 CPU and has 512MB of RAM.
Serial console is available on the PCB. I have not looked further yet.
Should be possible to root or reinstall from scratch, though it is not powerful enough to run HA. Here is the boot log:
Booting Linux on physical CPU 0x0
Linux version 4.9.229-smartthings (oe-user@oe-host) (gcc version 8.3.0 (GCC) ) #1 Tue Aug 18 16:11:29 UTC 2020
CPU: ARMv7 Processor [412fc09a] revision 10 (ARMv7), cr=10c53c7d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
OF: fdt:Machine model: SmartThings Hub v2
Memory policy: Data cache writeback
CPU: All CPU(s) started in SVC mode.
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 129920
Kernel command line: console=ttymxc0,115200 lvmroot=vg_emmc:lv_root:ext4
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 499584K/524288K available (5120K kernel code, 192K rwdata, 1516K rodata, 1024K init, 336K bss, 24704K reserved, 0K cma-reserved)
Virtual kernel memory layout:
vector : 0xffff0000 - 0xffff1000 ( 4 kB)
fixmap : 0xffc00000 - 0xfff00000 (3072 kB)
vmalloc : 0xa0800000 - 0xff800000 (1520 MB)
lowmem : 0x80000000 - 0xa0000000 ( 512 MB)
modules : 0x7f000000 - 0x80000000 ( 16 MB)
.text : 0x80008000 - 0x80600000 (6112 kB)
.init : 0x80800000 - 0x80900000 (1024 kB)
.data : 0x80900000 - 0x80930120 ( 193 kB)
.bss : 0x80932000 - 0x809863ac ( 337 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
NR_IRQS:16 nr_irqs:16 16
L2C-310 erratum 769419 enabled
L2C-310 enabling early BRESP for Cortex-A9
L2C-310 full line of zeros enabled for Cortex-A9
L2C-310 ID prefetch enabled, offset 16 lines
L2C-310 dynamic clock gating enabled, standby mode enabled
L2C-310 cache controller enabled, 16 ways, 256 kB
L2C-310: CACHE_ID 0x410000c8, AUX_CTRL 0x76430001
Switching to timer-based delay loop, resolution 41ns
sched_clock: 32 bits at 24MHz, resolution 41ns, wraps every 89478484971ns
clocksource: mxc_timer1: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 79635851949 ns
Console: colour dummy device 80x30
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=240000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
CPU0: Spectre v2: using BPIALL workaround
Setting up static identity map for 0x80100000 - 0x80100058
devtmpfs: initialized
VFP support v0.3: implementor 41 architecture 3 part 30 variant 9 rev 4
clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
futex hash table entries: 256 (order: -1, 3072 bytes)
pinctrl core: initialized pinctrl subsystem
NET: Registered protocol family 16
DMA: preallocated 256 KiB pool for atomic coherent allocations
cpuidle: using governor menu
vdd3p0: unsupportable voltage range: 3200000-3150000uV
vdd3p0: unsupportable voltage range: 3200000-3150000uV
hw-breakpoint: Failed to enable monitor mode on CPU 0.
imx6sl-pinctrl 20e0000.iomuxc: initialized IMX pinctrl driver
imx-gpc 20dc000.gpc: Registered imx-gpc
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
2000000.aips-bus:usbphy_nop1 supply vcc not found, using dummy regulator
pps_core: LinuxPPS API ver. 1 registered
pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <[email protected]>
PTP clock support registered
Bluetooth: Core ver 2.22
NET: Registered protocol family 31
Bluetooth: HCI device and connection manager initialized
Bluetooth: HCI socket layer initialized
Bluetooth: L2CAP socket layer initialized
Bluetooth: SCO socket layer initialized
clocksource: Switched to clocksource mxc_timer1
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
UDP hash table entries: 256 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
NET: Registered protocol family 1
Trying to unpack rootfs image as initramfs...
Freeing initrd memory: 10792K
hw perfevents: enabled with armv7_cortex_a9 PMU driver, 7 counters available
Bus freq driver module loaded
workingset: timestamp_bits=14 max_order=17 bucket_order=3
squashfs: version 4.0 (2009/01/31) Phillip Lougher
NET: Registered protocol family 38
io scheduler noop registered
io scheduler deadline registered
io scheduler cfq registered (default)
imx-sdma 20ec000.sdma: loaded firmware 3.3
2020000.serial: ttymxc0 at MMIO 0x2020000 (irq = 19, base_baud = 5000000) is a IMX
console [ttymxc0] enabled
2024000.serial: ttymxc1 at MMIO 0x2024000 (irq = 20, base_baud = 5000000) is a IMX
2034000.serial: ttymxc2 at MMIO 0x2034000 (irq = 21, base_baud = 5000000) is a IMX
2038000.serial: ttymxc3 at MMIO 0x2038000 (irq = 22, base_baud = 5000000) is a IMX
brd: module loaded
loop: module loaded
libphy: Fixed MDIO Bus: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <[email protected]>
2188000.ethernet supply phy not found, using dummy regulator
libphy: fec_enet_mii_bus: probed
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ehci-mxc: Freescale On-Chip EHCI Host driver
usbcore: registered new interface driver cdc_acm
cdc_acm: USB Abstract Control Model driver for USB modems and ISDN adapters
usbcore: registered new interface driver cdc_wdm
usbcore: registered new interface driver usb-storage
ci_hdrc ci_hdrc.0: EHCI Host Controller
ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
ci_hdrc ci_hdrc.1: EHCI Host Controller
ci_hdrc ci_hdrc.1: new USB bus registered, assigned bus number 2
ci_hdrc ci_hdrc.1: USB 2.0 started, EHCI 1.00
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
snvs_rtc 20cc000.snvs:snvs-rtc-lp: rtc core: registered 20cc000.snvs:snvs-r as rtc0
imx2-wdt 20bc000.wdog: timeout 60 sec (nowayout=1)
device-mapper: uevent: version 1.0.3
device-mapper: ioctl: 4.35.0-ioctl (2016-06-23) initialised: [email protected]
usbcore: registered new interface driver btusb
sdhci: Secure Digital Host Controller Interface driver
sdhci: Copyright(c) Pierre Ossman
sdhci-pltfm: SDHCI platform and OF driver helper
mmc0: SDHCI controller on 2194000.usdhc [2194000.usdhc] using DMA
usbcore: registered new interface driver usbhid
usbhid: USB HID core driver
NET: Registered protocol family 10
sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
NET: Registered protocol family 17
Bluetooth: HIDP (Human Interface Emulation) ver 1.2
Bluetooth: HIDP socket layer initialized
vddpu: bypassed regulator has no supply!
vddpu: bypassed regulator has no supply!
cpu cpu0: Registered imx6q-cpufreq
imx_thermal 2000000.aips-bus:tempmon: Commercial CPU temperature grade - max:95C critical:90C passive:85C
mmc0: new DDR MMC card at address 0001
snvs_rtc 20cc000.snvs:snvs-rtc-lp: setting system clock to 1970-01-01 00:00:00 UTC (0)
vddpu: disabling
Freeing unused kernel memory: 1024K
mmcblk0: mmc0:0001 4FPD3R 3.64 GiB
mmcblk0boot0: mmc0:0001 4FPD3R partition 1 4.00 MiB
mmcblk0boot1: mmc0:0001 4FPD3R partition 2 4.00 MiB
mmcblk0rpmb: mmc0:0001 4FPD3R partition 3 512 KiB
mmcblk0: p1 p2 p3
udevd[179]: starting version 3.2.7
random: udevd: uninitialized urandom read (16 bytes read)
random: udevd: uninitialized urandom read (16 bytes read)
random: udevd: uninitialized urandom read (16 bytes read)
udevd[179]: specified group 'tty' unknown
udevd[179]: specified group 'dialout' unknown
udevd[179]: specified group 'kmem' unknown
udevd[179]: specified group 'input' unknown
udevd[179]: specified group 'video' unknown
udevd[179]: specified group 'audio' unknown
udevd[179]: specified group 'lp' unknown
udevd[179]: specified group 'disk' unknown
udevd[179]: specified group 'cdrom' unknown
udevd[180]: starting eudev-3.2.7
random: fast init done
urandom_read: 4 callbacks suppressed
random: lvm: uninitialized urandom read (4 bytes read)
Reading all physical volumes. This may take a while...
Found volume group "vg_emmc" using metadata type lvm2
random: lvm: uninitialized urandom read (4 bytes read)
8 logical volume(s) in volume group "vg_emmc" now active
random: cryptsetup: uninitialized urandom read (2 bytes read)
EXT4-fs (dm-8): recovery complete
EXT4-fs (dm-8): mounted filesystem with ordered data mode. Opts: (null)
EXT4-fs (dm-9): mounted filesystem with ordered data mode. Opts: (null)
EXT4-fs (dm-12): mounted filesystem with ordered data mode. Opts: (null)
udevd: 2 output lines suppressed due to ratelimiting
INIT: version 2.88 booting
Starting udev
udevd[465]: starting version 3.2.7
udevd[465]: specified group 'kvm' unknown
udevd[466]: starting eudev-3.2.7
cryptodev: loading out-of-tree module taints kernel.
cryptodev: driver 1.10 loaded.
hwclock: settimeofday: Invalid argument
Fri Oct 2 06:49:58 UTC 2020
rm: can't remove '/tmp': Read-only file system
Setting time from flash
Mon Oct 19 19:30:01 UTC 2020
INIT: Entering runlevel: 5
Starting system message bus: dbus.
Starting SmartThings LED Daemon
Starting ledd... OK
Starting ConnMan Connection ManagerOK
Starting havegedOK
Exporting GPIOs... done
Starting buttd... DONE
Running initial fstrim: random: crng init done
/hub/data: 470789120 bytes trimmed
OK
Micrel KSZ8081 or KSZ8091 2188000.ethernet-1:00: attached PHY driver [Micrel KSZ8081 or KSZ8091] (mii_bus:phy_addr=2188000.ethernet-1:00, irq=-1)
Starting syslogd/klogd: IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
done
Starting SmartThings HubCore
done
Starting Updater... OK
Starting watchdog daemon...done
Starting crond: OK
Starting SmartThings Video-Core
Starting video-core monitor... OK
INIT: no more processes left in this runlevel
That’s interesting. The teardown in the link indicates there’s 4Gb:
SDRAM, DDR3-1600, 4Gb, 1.5V - MFR: SAMSUNG SEMICONDUCTOR INC - MPN: K4B4G1646D-BCK0
I wonder why there’s such a large discrepancy?
No discrepancy. 4Gbit RAM chip/8bit == 512MB of RAM.
You’re right. The linked teardown of the Smarthome Hub described the part incorrectly. The b in 4 Gb normally means byte but this device is actually 4 Gbit and is correctly described here:
https://octopart.com/k4b4g1646d-bck0-samsung-31072837
Samsung
K4B4G1646D-BCK0
DRAM Chip DDR3 SDRAM 4Gbit 256Mx16 1.5V 90-Pin FBGA
May I ask how you gained enough access to retrieve that boot.log. Other than it talking to the dhcp server to get the ip address and gain a little bit of info to display in the ATT Fiber Router.
Using nmap and script library. I cant even seem to get which ports are open for the product. I am very interested in working this product over as it will give a little access for the usage like a RPi Zero v1.3. They have discontinued the product and the Firmware is free to download and modify. There has to be a way to access it.
To your point I do see the serial console referenced in the boot.log you posted. I will be checking into that as well,.
Any help is appreciated!
I got the same boot log by connecting a usb/ttl device to some test points on the board, but cannot access the u-boot menu. That is probably the end of the road with my very limited skill set. If anyone else knows how to move further, please share.