Rooting Toon (or boxx)

[JacDomotica]

Hello,

I bougth an toon and an jtag interface and i am trying to connect the interface via openocd to my toon.
But i get this error:

Code: Select all

PS C:\Projecten\OpenOCD-20170821\bin> ./openocd -f ./interface/jlink.cfg -f ./ed20.cfg
Open On-Chip Debugger 0.10.0 (2017-08-21) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
dcc downloads are enabled
ed20_init
Info : No device selected, using first device.
Info : J-Link ARM V8 compiled Nov 28 2014 13:44:46
Info : Hardware version: 8.00
Info : VTarget = 0.000 V
Error: JTAG I/O operation failed: 0x5.
Error: jaylink_jtag_io() failed: JAYLINK_ERR_DEV.
Error: An adapter speed is not selected in the init script. Insert a call to adapter_khz or jtag_rclk to proceed.

P.S. toon is not connected in this example but if it is then i get the same error.

I am a beginner but is there some one who can help me?

Looks like you are missing a line like this in jlink.cfg:

Code: Select all

adapter_khz 1000

Thanks i can connect to my toon serial and with the jtag interface. now i try to stop the cpu with soft_reset_halt but it is not working?

Code: Select all

.\openocd -f interface/jlink.cfg -f ed20.cfg
Open On-Chip Debugger 0.10.0 (2017-08-21) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 500 kHz
jtag
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
dcc downloads are enabled
ed20_init
Info : No device selected, using first device.
Info : J-Link ARM V8 compiled Nov 28 2014 13:44:46
Info : Hardware version: 8.00
Info : VTarget = 2.814 V
Info : clock speed 500 kHz
Info : TAP imx27.etb does not have IDCODE
Info : TAP imx27.cpu does not have IDCODE
Info : TAP auto0.tap does not have IDCODE
Info : TAP auto1.tap does not have IDCODE
Info : TAP auto2.tap does not have IDCODE
Info : TAP auto3.tap does not have IDCODE
Info : TAP auto4.tap does not have IDCODE
Info : TAP auto5.tap does not have IDCODE
Info : TAP auto6.tap does not have IDCODE
Error: imx27.etb: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.0
Info : accepting 'telnet' connection on tcp/4444
requesting target halt and executing a soft reset
Error: Failed to halt CPU after 1 sec
Info : Halt timed out, wake up GDB.

Sugestions?

[gijsje]

do you need to connect the serial interface to the pc or to the pi or does it really matter as the jtag is doing the communication?

i have attached the cables a few times from new and am sure the cables are connected the correct way
Is there any difference in the gpio between the different pi versions?

[fkruis]

Hi,

I rooted a toon with version 4.10.6.
it seems that the logon applet also no longer exist in busybox.
With the folowing commands i was able to get a working login.

the used busybox is from viewtopic.php?f=87&t=11230&start=300#p84410

the commands
ln -s /root/busybox /sbin/getty
ln -s /root/busybox /sbin/passwd
ln -s /root/busybox /bin/login

i had no problems with the installation of dropbear after these adjustments

[gijsje]

Could this be an issue?

Code: Select all

adapter_khz 1000

In the instruction it is 500

[marcelr]

500 is on the safe side.
1000 should be possible as well.

I've finished the build of busybox 1.27.2 for toon (busybox_1.27.2-r2), will test it for the next few days, and then upload to the ToonStore or at least the forum download area.
The build includes ( all features of the old busysbox (1.18.3-r42.2) OR all features of the new busybox (1.27.2-r1) ).

With the release number just a bit higher than Quby's version, updating should be straightforward.

Update:
The executable, as installed manually, works.
(remember: busybox also provides the root process, /sbin/init. Without that, your machine is nothing more but a paperweight.)

The system boots as usual, and many (haven't tested all) applets seem to do their job. Looks good

[marcelr]

Phase two of testing completed:

I rebooted a virgin Toon with fw 4.9.23 into the bootloader environment and initiated ascii file transfer over the serial line.
The relevant busybox packages were packaged as a base64-encoded tar.gz file and transferred to this Toon.
Subsequently, this tarball was unpacked and the .ipk's installed, giving error 255 messages, as was the case with dropbear, earlier.
Then I executed the postinstall scripts of the packages manually (thanks, Rudolf, for the tip).
Finally, the machine was rebooted, and now this not-so-virgin toon has getty access, along with the old userinfo, passwords, login access, etc.

There's a small glitch in the touchscreen device manager, need to fix that in the package before it goes public.

Will fix that, and then pack things properly and write a script to do the installation with a single command.

Just a bit more patience.

[Rudolf]

Huh, I don't know what happened, I was perfectly able to login to Toon using my public-key but today the key is refused.
(I was unable to set a password before, due to limitations of 4.9.23 busybox)

The putty-key is still valid for other machines, so maybe Toon has wiped my authorized_keys file....
Looks like I need to connect it to serial again and remind myself to set a proper password this time.

Edit: Fixed it: viewtopic.php?f=87&t=11230&p=84912#p84912

[marcelr]

There you go:

(busybox will be published on the ToonStore shortly, this is for those who can't wait):

1: separate packages: You need these if you want to install on a rooted toon.

http://files.domoticaforum.eu/uploads/T ... r2_qb2.ipk
http://files.domoticaforum.eu/uploads/T ... r2_qb2.ipk
http://files.domoticaforum.eu/uploads/T ... r2_qb2.ipk

Be sure to install them all, in one go.

2: base64-encoded tarball: You need this if you want to install on a not-yet-rooted toon with FW 4.9.23 or later.

http://files.domoticaforum.eu/uploads/T ... gz.b64.zip

To install:

1: rooted version: Transfer the .ipk files to your toon and issue:

Code: Select all

opkg install busybox*.ipk

and reboot.

2: not-yet-rooted version:

Download the zipped base64 encoded file and unpack to get the base64-encoded tarball.
Transfer the base64-encoded tarball to your toon after accessing it through the bootloader (see rooting manual, the dropbear installation part, and apply to busybox).
Unpack the tarball:

Code: Select all

tar -zxvf <whatever-name-you-gave-it>

This decompresses into the three ipk packages of busybox.

Install by issueing:

Code: Select all

opkg install busybox*.ipk

This gives three postinstaller error messages, haven't figured out why, yet.
Then run the postinstallers manually:

Code: Select all

/usr/lib/opkg/info/busybox.postinst

Code: Select all

/usr/lib/opkg/info/busybox-mountall.postinst

Code: Select all

/usr/lib/opkg/info/busybox-syslog.postinst

This creates the necessary links to applets and boot scripts. Some links are not created because of existing duplicates. You can safely ignore this.

Edit /etc/inittab according to the rooting manual.
Edit /etc/passwd according to the rooting manual.

Reboot.

With the serial line still connected, you should now get a login prompt.

You may now login as 'root'.

Reinstall all busybox packages by issueing:

Code: Select all

opkg install busybox*.ipk

This time, the full OS is up and running, and installation will finish normally, without errors.
Follow the rooting manual for further steps to take.

Good luck, and report any issues.

[wbmk]

@wbmk try run bootcmd and not run boot_nand

Thanx for your help... sadly this does not work...

I will wait to see what marcelr is working on..

[wbmk]

@marcelr

i am eager to try your solution. it seems the tarball is not yet available for download? is this correct?

thanx for your work

regards, wbmk

[marcelr]

You can recreate the tarball by issueing:

Code: Select all

base64 -d < busybox_1.27.2-r2_qb2.ipk.tar.gz.b64 > busybox_1.27.2-r2_qb2.ipk.tar.gz 

[JacDomotica]

I can stop the processor now but loading the boot image is not working. I get the next error:

Code: Select all

C:\Projecten\OpenOCD-20170821\bin>openocd -f interface/jlink.cfg -f ed20.cfg
Open On-Chip Debugger 0.10.0 (2017-08-21) [https://github.com/sysprogs/openocd]
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.org/doc/doxygen/bugs.html
adapter speed: 1000 kHz
jtag
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
dcc downloads are enabled
ed20_init
Info : No device selected, using first device.
Info : J-Link ARM V8 compiled Nov 28 2014 13:44:46
Info : Hardware version: 8.00
Info : VTarget = 3.319 V
Info : clock speed 1000 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Info : accepting 'telnet' connection on tcp/4444
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Error: timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: 245
Info : no working area available, falling back to memory writes
Error: timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: 245

When i give afterwards an: reset halt ( i am not using a raspberry pi but windows) then i get the next error:

Code: Select all

Error: JTAG scan chain interrogation failed: all ones
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Warn : Bypassing JTAG setup events due to errors
Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Warn : NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
Error: DCC write failed, expected end address 0xa1f28a68 got 0xd5f6d3c2
Warn : memory write caused data abort (address: 0xa1f00000, size: 0x4, count: 0xa29a)

somebody knows whats going wrong?

[wbmk]

You can recreate the tarball by issueing:

Code: Select all

base64 -d < busybox_1.27.2-r2_qb2.ipk.tar.gz.b64 > busybox_1.27.2-r2_qb2.ipk.tar.gz 

Thanx, but i ment that the downloadlink in your post does not work (403 - forbidden)

Or am i doing something wrong?

Regards, wbmk

[marcelr]

Hmmm... didn't test this one. There's a strong possibility that the server doesn''t allow the b64 extension. Will zip the file and post it again. Thanks for spotting.

EDIT: zipped and posted again: It's a bit of a christmas tree with all these extensions, but hey, that fits the season.

Oh, by the way, I made a new version of busybox, missed a few features from the official one by Quby (nothing serious, I doubt if more than half of the applets in busybox is actually used, but I like to be precise).
Apparently the applet conspy is now part of busybox (I missed that one in the published build, r2), so you can get hold of the console remotely. Not sure if I want to have it on board .

Will post it later this week. There's no reason to wait for it, the one that's available now is equally good.

[marcelr]

Code: Select all

...
Info : J-Link ARM V8 compiled Nov 28 2014 13:44:46
Info : Hardware version: 8.00
Info : VTarget = 3.319 V
Info : clock speed 1000 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Info : accepting 'telnet' connection on tcp/4444
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Error: timeout waiting for SYSCOMP & DBGACK, last DBG_STATUS: 245
...

somebody knows whats going wrong?

The soft_reset_halt is not a very strong command for the processor. I had severe issues with it. By repeatedly trying (in excess of 10 times sometimes), I got to the point where the line

Code: Select all

cpsr: 0x000000d3 pc: 0x00000000

read slightly different:

Code: Select all

cpsr: 0x000000d3 pc: 0x324f874

(or any other non-zero hexadecimal number).
When this is the case, you can proceed to the next step, initialize memory and upload the patched bootloader.