Turns out that the AlertMe Hub (at least the Nano that came with my Energy starter kit) runs Linux. There's a TTL serial connector on the board, which is nice and clearly marked. There's a similar port marked 'Modem' as well, presumably for the GSM modem in the Security Hub.
The pinout is fairly standard TTL, Pin 4 is GND, 2 is RX and 3 is TX. The port runs at 115200 baud.
If anyone has a guess at what the root password might be, or where to get the firmware blobs from, that'd be appreciated

Here, for your viewing pleasure, is the system from poweron to login prompt:
Code: Select all
HubBoot v1.01, processor ID 9231C384
Cold reset
HubOS v0.71 Copyright (C) AlertMe.com 2007-09
>
Bad reset count : 0
Loading system from NAND in 5 seconds
[OS] Mains power now on
Loading linux...
MD5 checksum passed
Operator key passed
Loading ramdisk...
MD5 checksum passed
Operator key passed
Starting linux...
Uncompressing Linux.............................................................................. done, booting the kernel.
Linux version 2.6.19 (jacky@jacky-desktop) (gcc version 3.4.6) #1 Wed Jan 19 11:11:14 GMT 2011
CPU: ARM920T [41129200] revision 0 (ARMv4T), cr=c0007177
Machine: AlertMe.com Hub CPU Board
tags address is: c001fee0
mdesc->boot_params is: 00000100
Parsing tags
tag core, flags = 00000000
tag mem32 - start: 00000000 size: 00800000
tag mem32 - start: 01000000 size: 00800000
tag mem32 - start: 04000000 size: 00800000
tag mem32 - start: 05000000 size: 00800000
Tag: initrd2 - start: 01000000 size 00200000
TAG commandline: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
Memory policy: ECC disabled, Data cache writeback
CPU0: D VIVT write-back cache
CPU0: I cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
CPU0: D cache: 16384 bytes, associativity 64, 32 byte lines, 8 sets
Built 4 zonelists. Total pages: 8128
Kernel command line: console=ttyAM1,115200 root=/dev/mtdblock3 rootfstype=yaffs2,ext2
PID hash table entries: 128 (order: 7, 512 bytes)
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 8MB 8MB 8MB 8MB = 32MB total
Memory: 27908KB available (1936K code, 406K data, 104K init)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
checking if image is initramfs...it isn't (no cpio magic); looks like an initrd
Freeing initrd memory: 2048K
NET: Registered protocol family 16
AlertMe hub PCB revision 5
ep93xx: PLL1 running at 400 MHz, PLL2 at 192 MHz
ep93xx: FCLK 200 MHz, HCLK 100 MHz, PCLK 50 MHz
AMEHUB: disabling spiflash enable
********************************************************
ep93xx_led software pwm driver startup
********************************************************
Setting modem fudge...********* REQUEST IRQ ****************
NET: Registered protocol family 2
IP route cache hash table entries: 256 (order: -2, 1024 bytes)
TCP established hash table entries: 1024 (order: 0, 4096 bytes)
TCP bind hash table entries: 512 (order: -1, 2048 bytes)
TCP: Hash tables configured (established 1024 bind 512)
TCP reno registered
EP93xx M2M driver version 0.01
Hub Upgrade driver version 1.0
ADC driver version 0.1
Generic SSP Support version 0.1
EP93xx DMA-SSP driver version 0.01
SPI Flash driver version 0.1
SPI Flash driver: Registered ssp slave interface
Ember EM260 Driver, Copyright (C) 2007 AlertMe.com
Implementation by Mynah-Software Ltd.
EM260 driver startup ... em260 driver installed successfully.
EP93xx CPU frequency driver version 0.01
ep93xx software pwm driver starting
NetWinder Floating Point Emulator V0.97 (extended precision)
audit: initializing netlink socket (disabled)
audit(1.239:1): initialized
yaffs Jan 19 2011 11:10:18 Installing.
io scheduler noop registered
io scheduler anticipatory registered
io scheduler deadline registered
io scheduler cfq registered (default)
ep93xx_wdt: EP93XX watchdog, driver version 0.3
SoftDog: cannot register miscdev on minor=130 (err=-16)
Serial: AMBA driver $Revision: 1.41 $
apb:uart1: ttyAM0 at MMIO 0x808c0000 (irq = 52) is a AMBA
apb:uart2: ttyAM1 at MMIO 0x808d0000 (irq = 54) is a AMBA
apb:uart3: ttyAM2 at MMIO 0x808e0000 (irq = 55) is a AMBA
Serial: AMBA PL011 UART driver
RAMDISK driver initialized: 16 RAM disks of 16384K size 1024 blocksize
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
ep93xx-eth version 0.1 loading
eth0: ep93xx on-chip ethernet, IRQ 39, 00:1c:2b:01:9d:d8.
***** AME NANDFlash driver *****
** Prior to update, dev_cfg is: 08170d00
** Post update, dev_cfg is: 08170d00
Searching for NAND flash...
NAND device: Manufacturer ID: 0xec, Chip ID: 0x76 (Samsung NAND 64MiB 3,3V 8-bit)
Scanning device for bad blocks
Bad eraseblock 23 at 0x0005c000
Bad eraseblock 1216 at 0x01300000
AMEFlash - Found 5 partitions
AMEFlash: Initializing partition 1
Name: zImage
size: 00200000
offset: 00004000
AMEFlash: Initializing partition 2
Name: ramdisk
size: 00200000
offset: 00204000
AMEFlash: Initializing partition 3
Name: root
size: 02000000
offset: 00404000
AMEFlash: Initializing partition 4
Name: download
size: 01afc000
offset: 02404000
AMEFlash: Initializing partition 5
Name: persistent
size: 00100000
offset: 03f00000
Using static partition definition
Creating 6 MTD partitions on "NAND 64MiB 3,3V 8-bit":
0x00000000-0x04000000 : "whole-flash"
0x00004000-0x00204000 : "zImage"
0x00204000-0x00404000 : "ramdisk"
0x00404000-0x02404000 : "root"
0x02404000-0x03f00000 : "download"
0x03f00000-0x04000000 : "persistent"
ep93xx_i2c_probe started
***** EP93xx I2C Init ***** result is: 0
pca9533_attach_adapter, adapter is: c0538050 - result is: 0
Advanced Linux Sound Architecture Driver Version 1.0.13 (Tue Nov 28 14:07:24 2006 UTC).
ASoC version 0.13.3
wm8510: WM8510 Audio Codec 0.6
SETTING UP custom interface
asoc: WM8510 HiFi <-> ep93xx-i2s mapping ok
Codec is: c054b2d0
ALSA device list:
#0: amehub-wm8510 (WM8510)
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 17
NET: Registered protocol family 15
RAMDISK: Compressed image found at block 0
yaffs: dev is 1048576 name is "ram0"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 1.0, "ram0"
VFS: Mounted root (ext2 filesystem).
Simple initrd is active
Attempting to mount /dev/mtdblock3
yaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
block 960 is bad
Filesystem found on /dev/mtdblock3 - passing control...
save exit: isCheckpointed 0
Àyaffs: dev is 32505859 name is "mtdblock3"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.3, "mtdblock3"
yaffs: auto selecting yaffs1
block 960 is bad
VFS: Mounted root (yaffs2 filesystem).
Trying to move old root to /initrd ... okay
Freeing init memory: 104K
yaffs: dev is 32505860 name is "mtdblock4"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.4, "mtdblock4"
yaffs: auto selecting yaffs1
Setting up persistent filesystem
Attempting to mount /persistent
yaffs: dev is 32505861 name is "mtdblock5"
yaffs: passed flags ""
yaffs: Attempting MTD mount on 31.5, "mtdblock5"
yaffs: auto selecting yaffs1
Initializing random number generator... done.
Creating dynamic devices
àStarting network...
udhcpc (v1.4.1) started
ep93xx-eth: PHY is a SMSC LAN8700, rev 4
REG_SELFCTL = 0x00006220 MII_BMCR = 0x00003000
Sending discover...
link down
Sending discover...
Sending discover...
No lease, forking to background
OK
àStarting alertme: In Em2xxUpgradePackage::create
em260_open called
inode minor is zero, assigning to builtin struct em260_user
Down semaphore
In crit section
Device opened, open_count is: 1
em260_open returning zero (success)
Em260 firmware version is 0x3422 - requiem260_release called
red version is 0 em260_release, open count is: 0
x3422.
Em260 fiem260_release, returning 0
rmware is up to date - skipping Em260 bootload procedure.
done
Welcome to AlertMe Linux.
uclibc login: