Rooting Toon (or boxx)

[makkie2002]

Hi

When I opened my toon I disconnected the antennas and now I am not sure which antenna goes to which connector.
I have wifi, but I can not connect to the meter modules any more ...
Can anybody post some pictures of the atenna/connector configuration please

[marcelr]

Like this:

It's a early toon (serial < 3000). Later versions have the antenna pads glued to the grey casing. Anyway, you can't go wrong, really, since the wire lengths are such that you can only connect them to the right connectors. A wifi antenna cannot be connected to the z-wave interface, simply because the wires are to short for that.

Good luck.

[makkie2002]

Thanks marclr!

I saw that on my motherboard on the opposite side there was another atenna connector. So there are 4 connectors in total and only 3 antennas to connect.
Anyhow, I now got my meteradapter connected again (repeating several times the connection process).

Thanks

[marcelr]

In newer toons the z-wave interface has two connections as well.One on each side of the MB.

[makkie2002]

I have installed an ESP8266-wifi module inside my Toon and connected it to Toon's serial port.
On the ESP8266 module I installed ESP-link and now I have always access to Toons terminal!
I think I will need to reopen the thermostat one more time to make pictures

[Toonz]

Brilliant! I ordered a few myself

[TerrorSource]

With sudo i managed to set up the telnet-connection.
The soft_reset_halt and reset halt are not capable of stopping the processor.
Could you help me again?

pi@raspberrypi:~ $ sudo openocd -f rpi.cfg -f ed20.cfg
Open On-Chip Debugger 0.10.0+dev-00166-g0e4fbfb (2017-07-01-14:41)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
adapter speed: 3000 kHz
BCM2835 GPIO config: tck = 23, tms = 22, tdi = 19, tdo = 21
BCM2835 GPIO config: trst = 24
BCM2835 GPIO config: srst = 18
trst_and_srst separate srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_push_pull connect_deassert_srst
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
dcc downloads are enabled
ed20_init
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG only mode enabled (specify swclk and swdio gpio to add SWD mode)
Info : clock speed 3073 kHz
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: imx27.etb: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Info : Embedded ICE version 0
Error: unknown EmbeddedICE version (comms ctrl: 0x00000000)
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.0
Info : accepting 'telnet' connection on tcp/4444
requesting target halt and executing a soft reset
Error: Failed to halt CPU after 1 sec
Error: JTAG scan chain interrogation failed: all zeroes
Error: Check JTAG interface, timings, target power, etc.
Error: Trying to use configured scan chain anyway...
Error: imx27.etb: IR capture error; saw 0x00 not 0x01
Warn : Bypassing JTAG setup events due to errors
Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
Error: timed out while waiting for target halted
TARGET: imx27.cpu - Not halted
in procedure 'reset'
in procedure 'ocd_bouncer'


Error: Target not halted
Info : no working area available, falling back to memory writes
Warn : target not halted

Warn : target not halted

Info : Halt timed out, wake up GDB.

pi@raspberrypi:~ $ sudo telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> soft_reset_halt
requesting target halt and executing a soft reset
Failed to halt CPU after 1 sec
> reset halt
JTAG scan chain interrogation failed: all zeroes
Check JTAG interface, timings, target power, etc.
Trying to use configured scan chain anyway...
imx27.etb: IR capture error; saw 0x00 not 0x01
Bypassing JTAG setup events due to errors
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
timed out while waiting for target halted
TARGET: imx27.cpu - Not halted
in procedure 'reset'
in procedure 'ocd_bouncer'


> load_image u-boot.bin 0xa1f00000
Target not halted
no working area available, falling back to memory writes
target not halted

> resume 0xa1f00000
target not halted

Halt timed out, wake up GDB.

how did you manage to solve this?
Got the same issue.

> soft_reset_halt
requesting target halt and executing a soft reset
Failed to halt CPU after 1 sec
Halt timed out, wake up GDB.

[hayman]

I just updated my Toon from 2.10.15 by adding these files:
base-feed.conf:src/gz base http://feed.hae.int/feeds/qb2/ene/4.4.21
oebase-feed.conf:src/gz oebase http://feed.hae.int/feeds/qb2/oe/2.6.36-base-r10-qmf0
oekern-feed.conf:src/gz oekern http://feed.hae.int/feeds/qb2/oe/2.6.36-R10-h27-no6

And running:
opkg update
opkg list-upgradable
opkg upgrade

It seems to have worked.

Is this will update to the latest version?? Thanks

[Ronald]

how did you manage to solve this?
Got the same issue.

> soft_reset_halt
requesting target halt and executing a soft reset
Failed to halt CPU after 1 sec
Halt timed out, wake up GDB.

I haven't solved this.
Have ordered a usb to jtag convertor cable.
Still have to figure out how to use this.

[michel30]

Hello,

Is it possible to create an full backup off the Toon system?
My Toon it rooted and everything works great, but before I go playing with the Toon setting etc I like to backup everything.

An other question, what happens when I say in the menu factory defaults, will this erase the root settings?

Thanks.

[marcelr]

Hello,

Is it possible to create an full backup off the Toon system?

Depends on what you mean by backup. It's possible to dump the root filesystem as disk image, or you can copy the rootfs as a bunch of files. The first method will give you a disc image that fits your toon only, the second can be transferred to another machine.

An other question, what happens when I say in the menu factory defaults, will this erase the root settings?

Rooting remains intact, but you will have to reactivate your toon, and all data in the energy databases are wiped. Tile configuration is wiped as well, as are week program and other thermostat settings.
I'm probably forgetting some minor things ...

[DaLass]

My Toon has arrived last week, brand-new, completely sealed and is not registered at all, and I want to root the device. The Toon I have received is one starting with 16, so the JTAG way has to be used. Letting Quby root the Toon will make things alot easier, but is the result the same?

When I asked Quby which functionality the Toon will loose when rooting it, they replied the following:

After Rooting the Toon, the device cannot connect to our service center anymore and the following services of Eneco will not work on your device:

- Toon Mobile app will not connect to the Toon anymore
- The Toon will not receive any updates
- The functionality will not work as intended
- Usage insight will not be applicable
- Estimated year usage will not be received on the Toon
- Comparison data will not work anymore
- There will not be any technical support on the device.

When you don’t root your Toon, you will be able to use some of the functionalities (without monthly fee). For example; the Toon device will be connected to the Toon service center and you will receive our newest updates.

Please be aware of the fact that if you want to root your Toon device, you will have to be registered at Eneco under your own name and address.

I am not sure which way to go.
- If I let them root the device, the process will be easy, since I don't have to hack into the system.
- If I root the device myself, it will be more difficult (especially since it is a 16-series Toon), but Quby does not cut the cords for updates.

I am wondering if someone already used the service of Quby to root their Toon?

[Ierlandfan]

My Toon has arrived last week, brand-new, completely sealed and is not registered at all

If you do it yourself then it's a Toon with subscription (If signed up ofcourse) but the question is if you really want that.
If you let Quby root Toon then it's just a Toon without subscription
Basically we can recreate all or almost all the functionality of Toon without subscription (and sometimes even better) so only thing you really loose is the Toon app. (And there's a workaround for that)

Edit: I hate typo's, fixed.

[QuasaR]

I have installed an ESP8266-wifi module inside my Toon and connected it to Toon's serial port.
On the ESP8266 module I installed ESP-link and now I have always access to Toons terminal!
I think I will need to reopen the thermostat one more time to make pictures

Please do
I would love to see how you got it hooked up and where you got the power from ?

[TheHogNL]

I would love to see how you got it hooked up and where you got the power from ?

From the 3.3v pwr on the TTL connector i guess?