Hi folks,
Related to my thread on porting OpenWrt to the Wink Hub v1, I have managed to root the Wink Hub v2. Up until now, the hardware has been locked down behind a High Assurance Boot wall, but the Hub v2 is based on old hardware that has a known bootrom vulnerability, allowing burning of the FIELD_RETURN fuse, and consequent liberation of the hardware. I finally managed to figure out all of the details.
The Hub v2 is a nice i.MX6UL-based board with a bunch of IoT radios, implemented as vendor reference designs dropped onto a PCB. Most are connected via UART, but I think one is connected via SPI, based on a quick view of a decompiled device tree.
Currently it seems that there is only an i.mx7 target, but I guess it should be fairly straightforward to create a new mx6ul one.
The Hub v2 hardware is derived from the mx6ul_14x14_evk (according to the u-boot sources provided by the vendor), so hopefully a small number of tweaks should get us up and running. Similar to the Wink 1, there is a footprint for a Molex USB connector which can be used to get new firmware onto the device via Serial Download Protocol, making the board essentially unbrickable. The connector can simply be pressed into place while doing file transfers, avoiding soldering. Alternatively, there are fairly accessible test points for the D+/D- pins, so direct soldering of a cable should also be possible. Vcc and Gnd can be taken from elsewhere, of course.
For the moment, the vendor u-boot doesn't appear to have ethernet support (I see no packets on the network when trying to bootp/dhcp), but that is something I am looking to rectify in the name of a pleasant development environment.
So, this is a) notice that the hardware is accessible, and b) looking for folks interested in working with me to get a decent base running on it.