Toon as a domotica controller?

Everything about rooting Toons 1 and 2.

Moderators: marcelr, TheHogNL, Toonz

ewjmulder
Starting Member
Starting Member
Posts: 2
Joined: Tue Feb 17, 2015 5:54 pm

Re: Toon as a domotica controller?

Post by ewjmulder »

Hi Bart,

Cool you like the idea, let me know if it works for you.
Personally, I'm not using any domotica software package, but I'm programming everything myself.
Not because I think I can do a better job then for instance HS, but just because I like the challenge as a nice 'hobby project'. :-)
The system I'm building is called 'Program Your Home', you can find it at https://github.com/ewjmulder/program-your-home
It's still very much under development, so not useful to anyone but myself.
I tried to make the hue-bridge-simulator project separate though, so you can use it and connect it to other software the way you like.

Regards, Erik
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller? EDIT 20150502

Post by marcelr »

Hi Marcelr,

I found a way of doing that.
(I will not yet disclose in public)
Since you' have all that's needed we can try to duplicate.
Then I will disclose it.
can you contact me?
Haven't been very active lately, good to see that others haven't been as idle as I was :-)
Will contact you, ierlandfan.

In the meantime, I bumped into a little program called JTAGenum, loaded that onto a Seeeduino ADK (3.3V version of and arduino ADK), and started searching.

By playing around with connectors and tests, etc, this is what I found so far:
The first ten pins of the connector hold a JTAG interface after all.
This is the pinout (incomplete, but working):
(Please note that this list changes every now and then: I am still trying to get things working properly, and find better pinout descriptions along the way
Will update the edit date in the post title when things change)


Pin 1: ??
Pin 2: ??
Pin 3: GND
Pin 4: TCK
Pin 5: GND
Pin 6: TMS
Pin 7: SRST
Pin 8: TDI
Pin 9: ?? (I use it as Vt right now)
Pin 10: TDO

Haven't found nTRST yet.
I bought an el-cheapo jlink JTAG interface (< EUR 16,-- incl. cabling, adapter board, shipping) and hooked it up.
Using openocd 0.8.0, this is the output that I get:

Code: Select all

[root@doubletrouble openocd-0.8.0]# openocd -f ./jlink.cfg -f ./imx27.cfg 
Open On-Chip Debugger 0.8.0 (2015-03-26-19:26)
Licensed under GNU GPL v2
For bug reports, read
        http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain con
nect_deassert_srst
dcc downloads are enabled
Info : J-Link initialization started / target CPU reset initiated
Info : J-Link ARM V8 compiled Dec  1 2009 11:42:48
Info : J-Link caps 0xb9ff7bbf
Info : J-Link hw version 80000
Info : J-Link hw type J-Link
Info : J-Link max mem block 9576
Info : J-Link configuration
Info : USB-Address: 0xff
Info : Kickstart power on JTAG-pin 19: 0xffffffff
Info : Vref = 2.38 TCK = 1 TDI = 0 TDO = 1 TMS = 0 SRST = 0 TRST = 0
Info : J-Link JTAG Interface ready
Info : clock speed 1000 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787, part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090, part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
... which means that we're in and can talk to the machine.

Will try and setup nand flash dump with this equipment, but I'm not an expert. So, if any of you IS and expert, I'll welcome any suggestions.

grtz,

marcelr
Last edited by marcelr on Sat May 02, 2015 9:13 am, edited 4 times in total.
Ierlandfan
Member
Member
Posts: 151
Joined: Thu Oct 03, 2013 7:53 pm

Re: Toon as a domotica controller?

Post by Ierlandfan »

He Marcel,

nice find! Would you PM me with a emailadres I can reach you. I cannot send any messages.
Root access is a breezz (even without JTAG)
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller?

Post by marcelr »

@ierlandfan
done

grtz,

marcelr
herman
Starting Member
Starting Member
Posts: 1
Joined: Fri Apr 24, 2015 8:14 pm

Re: Toon as a domotica controller?

Post by herman »

Hey i'd like also to know how to get to the root without JTAG I tried getting in through USB because the freescale i.MX27 docs say it's possible through ATK (advanced toolkit 1.67) but they also write it's more complicated and to use ethernet instead and once leased an adress ethernet does respond but not what i need it seemed to me the only way of getting in was to open it up and hit the board pins directly but then iread irelandfan's message so can you please update me on the current status the freescale arm i.MX27 proc can run Windows Embedded CE6.0 ->visual studio 2005 and there is also a Linux Source Code package available i was hoping to get android running but this seems to be only supported from i.MX5X and higher however i am confident it is still possible to make some magic out of it once i get in :)
Ierlandfan
Member
Member
Posts: 151
Joined: Thu Oct 03, 2013 7:53 pm

Re: Toon as a domotica controller?

Post by Ierlandfan »

Yeay, the advanced toolkit 1.67. Been there!
Short version: My original idea was that when the IMX boot and it can't find the default bootdevice it attempts to boot from other media (USB/network/other)
If you want to put Windows CE on it you need to mess with the bootloader. Best way to do that is JTAG.
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller? JTAG unraveled, edit #2

Post by marcelr »

BIG FAT WARNING: If you screw up your thermostat by applying the stuff that I wrote, don't blame me. Just because this works for me, does not mean it works for everybody. It depends on JTAG interface, openocd version, probably OS, most likely the wiring, etc.

(still not scared? let's move on, then ;-)).

Took a shot at the JTAG connector again, after playing around with lots of configurations, I found one that actually works, and enables dumping the NAND flash:

This is the pinout (not necessary completely correct, but works for me):

JTAG:

pin 1: RTCK
pin 2: TRST
pin 3: GND
pin 4: TCK
pin 5: GND
pin 6: TMS
pin 7: SRST
pin 8: TDI
pin 9: Vt
pin 10: TDO

serial port (3.3V logic levels, ttymxc0, 115200 baud, 8N1):

pin 11: RxD
pin 12: ??
pin 13: TxD
pin 14: GND

Then, with the J-Link JTAG interface attached, openocd and proper NAND configuration:

Code: Select all

[root@doubletrouble openocd-0.8.0]# openocd -f ./jlink.cfg -f ./toon.cfg
Open On-Chip Debugger 0.8.0 (2015-03-26-19:26)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
dcc downloads are enabled
fast memory access is enabled
trst_and_srst separate srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
trst_and_srst separate srst_gates_jtag trst_open_drain srst_open_drain connect_deassert_srst
jtag_ntrst_assert_width: 50
toon_init
Info : J-Link initialization started / target CPU reset initiated
Info : J-Link ARM V8 compiled Dec  1 2009 11:42:48
Info : J-Link caps 0xb9ff7bbf
Info : J-Link hw version 80000
Info : J-Link hw type J-Link
Info : J-Link max mem block 9576
Info : J-Link configuration
Info : USB-Address: 0xff
Info : Kickstart power on JTAG-pin 19: 0xffffffff
Info : Vref = 2.536 TCK = 1 TDI = 0 TDO = 1 TMS = 0 SRST = 0 TRST = 0
Info : J-Link JTAG Interface ready
Info : clock speed 1000 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787, part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090, part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Get access to the openocd server and halt the processor:

Code: Select all

[marcelr@doubletrouble openocd-0.8.0]$ telnet localhost 4444
Trying ::1...
telnet: connect to address ::1: Connection refused
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> soft_reset_halt
requesting target halt and executing a soft reset
target state: halted
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> 
Before I could probe the flash, I had to resume the processor first, then issue a second soft_reset_halt and then it worked. Probably still some wiring issues, or a configuration script that's flawed.

probe flash:

Code: Select all

> nand probe 0   
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
check type:

Code: Select all

> nand list
#0: NAND 128MiB 3.3V 8-bit (Samsung) pagesize: 2048, buswidth: 8,
	blocksize: 131072, blocks: 1024
.. and dump (see serial output at boot for nand addresses):

Code: Select all

> nand dump 0 u-boot-env.img 0x100000 0x80000
dumped 524288 bytes in 95.674171s (5.351 KiB/s)
> 
This gives a file of 512kB size, holding the u-boot environment, as stored in nand flash. The same goes for the other partitions. Especially the root filesystem may take some time :-).

Just a quick edit:

1: The thing I'm least sure about is the Vt-pin. A Freescale i.MX27 also has a JTAG_CTRL signal, which is normally pulled up to 3.3V. Pulling this signal low disables the JTAG TAP device. The pin I used for Vt could be that signal. I had to have the serial port attached to get decent signal levels. (2.8V or thereabouts). Without the serial port it was a bit over 1.8 V. So my Vt-pin is probably not what I think it is. There's a strong possibility that Vt should be supplied by the JTAG interface (not standard, but then again, almost nothing about toon's JTAG interface is standard :-) ).

2: The JTAG interface was connected to the processor through a series of 1k resistors, one for each pin. This way, the current never exceeds 3mA, which should be tolerable for normal digital devices. See picture (link, images don't seem to work for me):

dropbox.com/s/ouip4soi35qi1x4/toon_atta ... 00x600.png
Toon attached to my boiler, with JTAG interface, resistors bridge and serial connector.

That's all for now. I'm in, so I can finally reassemble my toon :-).
If you have improvements, better solutions, whatever, I'll be happy to hear them (and other people too, most likely).
Please note that I am not an expert in embedded systems or hardware to probe them. So if you have any questions regarding this access route, with other JTAG hardware, software, there's a strong possibility that I cannot really help you.

grtz,

marcelr
al_n
Member
Member
Posts: 52
Joined: Tue Jun 02, 2015 7:51 pm

Re: Toon as a domotica controller?

Post by al_n »

Hello,

I got one of this "toon"s from a friend.
Did you ever manage to get root access? Is there a cfw available?
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller?

Post by marcelr »

Like I said, I'm in:

Code: Select all

eneco-xxx-yyyyyyy:/# ls
HCBv2       configured  lib         mnt         sbin        usr
bin         dev         linuxrc     proc        sys         var
boot        etc         media       root        tmp
eneco-xxx-yyyyyy:/# whoami
root
eneco-xxx-yyyyyy:/# 
(eneco-xxx-yyyyyy represents the number at the back of the box).
What's a cfw?

grtz,

marcelr
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller?

Post by marcelr »

OK, looked it up, and no, there's no cfw (custom firmware) available (yet). The only thing available is the openembedded source code for toon. It builds a rootfs, a kernel and a sheer infinite number of packages, so in theory you could make a Custom FirmWare out of it. But then again, once you're in, you have access to a full-fledged linux system, and with the openembedded kit, you could make whatever you like, within the limits of a 2.6.36 linux kernel, and 128MB of RAM and 128MB of nand flash.

Just go ahead and do it.

grtz,

marcelr
Ierlandfan
Member
Member
Posts: 151
Joined: Thu Oct 03, 2013 7:53 pm

Re: Toon as a domotica controller?

Post by Ierlandfan »

What can you do once you're in?

Well, I dind't like the idea of having a cold shower,or a cold house in the morning so I searched for opentherm info for waterpressure inside Toon. Yeay, Toon has it *...and more info from your CV . But it's not visible in the GUI.
(*If the data is supported by your opentherm CV)
No I query Toon directly (Not via Eneco's server) to monitor the waterpressure and when it passes a certain threshold it (Domoticz) sends me a message! Or whatever software you prefer! It's just a http command!
Want to know whether your CV generate some fault? Script!

You want your energy history backup up? You can!
You want...let's say..geofencing? You can!
You have a privacvy issue with sending info to Eneco's server? Well, Don't. Disable it.
You loose toonopafstand... Who cares! Find yourself some domotica software!

You have outside temperature control on your CV? Toon is prepared...
It's all there.
al_n
Member
Member
Posts: 52
Joined: Tue Jun 02, 2015 7:51 pm

Re: Toon as a domotica controller?

Post by al_n »

It sounds promising guys.
What will be the best way to get toon to do all the stuff it can but then without talking to eneco?
Is all of the information available through internal http server ( @Ierlandfan )? If that the case then we could build our own backend server or control app.

It will be great if we could get a cfw with ssh or even telnet added. Did anyone already recompile and reinstalled the original firmware to start with? If so can you please share the procedure ?

Thanks
marcelr
Global Moderator
Global Moderator
Posts: 1153
Joined: Thu May 10, 2012 10:58 pm
Location: Ehv

Re: Toon as a domotica controller?

Post by marcelr »

Recompile: yes. Reinstall: no.

Why? because there's no point in reinstalling the full set of packages (yet). The quby openembedded code tree builds separate packages (and you can add whatever you like), so you can install on a package-by-package basis. dropbear is one of the packages that's routinely built in the quby openembedded tree :-). Install and you have ssh access.

The first thing to do is shut down all connections with eneco, and then you have a standalone machine that can do what you want. That's also the tricky bit, because some of the connections are hard-coded into binaries, and therefore a bit cumbersome to shut down.

grtz,

marcelr
al_n
Member
Member
Posts: 52
Joined: Tue Jun 02, 2015 7:51 pm

Re: Toon as a domotica controller?

Post by al_n »

marcelr wrote:Recompile: yes. Reinstall: no.

Why? because there's no point in reinstalling the full set of packages (yet). The quby openembedded code tree builds separate packages (and you can add whatever you like), so you can install on a package-by-package basis. dropbear is one of the packages that's routinely built in the quby openembedded tree :-). Install and you have ssh access.

The first thing to do is shut down all connections with eneco, and then you have a standalone machine that can do what you want. That's also the tricky bit, because some of the connections are hard-coded into binaries, and therefore a bit cumbersome to shut down.

grtz,

marcelr
If I understand correctly the only way to get access for now is with jtag. But if a cfw with telnet enabled could be installed then more people will be able to start working on the platform.


P.S does a moderator has to re-look every post? this really disturbs communication.
Ierlandfan
Member
Member
Posts: 151
Joined: Thu Oct 03, 2013 7:53 pm

Re: Toon as a domotica controller?

Post by Ierlandfan »

The harcoded part is not a real issue. We can edit them out with a elf editor.
We don't need the webui. It's crap but we have handlers. One example I am working on right now is this:
(http://toon_ip:(some port I choose)/happ_thermstat?action=printTableInfo)

Code: Select all

{'dataId':'0', 'value0':'02', 'value1':'00', 'updated':'1433526549', 'description':'[ID 0: 02 00, SlaveState burn=NoFlame, fault=0]'},
{'dataId':'25', 'value0':'31', 'value1':'00', 'updated':'1433526550', 'description':'[ID 25: 31 00, TempBoiler=49.00]'},
{'dataId':'9', 'value0':'00', 'value1':'00', 'updated':'1433526550', 'description':'[ID 9: 00 00]'},
{'dataId':'18', 'value0':'01', 'value1':'66', 'updated':'1433526550', 'description':'[ID 18: 01 66]'}
(Not the complete output , i have truncated it for visibility)

These are Opentherm codes straight from my CV. I will feed them into Domoticz and I can see what my CV does.
For example: {ID 18} is water pressure. 01 66 is the value. We have to convert it (Hex to decimal) devide by 256
Now you canfigure out my waterpressure (Thanks Marcel!)

Full Opentherm table domoticaforum.eu/uploaded/Ard%20M/Opent ... 20v2-2.pdf
Note that every HVAC has it's own sets of ID's. There are about 5 mandatory ID's.
Post Reply

Return to “Toon Rooting”