Rooting Toon (or boxx)

[ericT]

New 4.4.x update feels/is faster and they changed the screen design, there are no more references to Eneco. New start-up screens simply says "Toon" . because they sell it in other countries as well.)

...

I am not sure how they update the OT table internally, the table is now completely gone when debugging so I will look into that.

I'm running a rooted 4.4.21 too. I get an almost empty page with NULL DEVICE when I query http://x.x.x.x/happ_thermstat?action=printTableInfo instead of the json table. Do you have the same experience?

[klaphekje]

Yep, i have exactly the same issue since the update. Don't yet know why though.
Any idea's?

[martjah]

i'm on the latest version to. This is what i get. Updated last night from 3.6.3 to latest. I've posted a topic (waiting to be approved) with the changes i made and then i got another post with the additional changes to make everything work.

This is what i get.

Code: Select all

info = [ 
{'dataId':'0', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 0: 00 00, SlaveState burn=NoFlame, fault=0]'},
{'dataId':'1', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 1: 00 00]'},
{'dataId':'2', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 2: 00 00]'},
{'dataId':'3', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 3: 00 00]'},
{'dataId':'15', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 15: 00 00]'},
{'dataId':'17', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 17: 00 00, RelModLvl=0.00]'},
{'dataId':'25', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 25: 00 00, TempBoiler=0.00]'},
{'dataId':'5', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 5: 00 00]'},
{'dataId':'6', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 6: 00 00]'},
{'dataId':'9', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 9: 00 00]'},
{'dataId':'16', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 16: 00 00, RoomSetpoint=0.00]'},
{'dataId':'18', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 18: 00 00]'},
{'dataId':'20', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 20: 00 00]'},
{'dataId':'21', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 21: 00 00]'},
{'dataId':'22', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 22: 00 00]'},
{'dataId':'24', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 24: 00 00, RoomTemperature=0.00]'},
{'dataId':'26', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 26: 00 00]'},
{'dataId':'27', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 27: 00 00]'},
{'dataId':'28', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 28: 00 00, TempReturn=0.00]'},
{'dataId':'35', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 35: 00 00]'},
{'dataId':'48', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 48: 00 00]'},
{'dataId':'56', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 56: 00 00, DHW Setpoint=0.00]'},
{'dataId':'57', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 57: 00 00]'},
{'dataId':'70', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 70: 00 00]'},
{'dataId':'71', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 71: 00 00]'},
{'dataId':'72', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 72: 00 00]'},
{'dataId':'73', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 73: 00 00]'},
{'dataId':'74', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 74: 00 00, VentilationHeatRecoveryConfig]'},
{'dataId':'75', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 75: 00 00]'},
{'dataId':'76', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 76: 00 00]'},
{'dataId':'77', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 77: 00 00]'},
{'dataId':'87', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 87: 00 00]'},
{'dataId':'113', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 113: 00 00]'},
{'dataId':'114', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 114: 00 00]'},
{'dataId':'115', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 115: 00 00]'},
{'dataId':'116', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 116: 00 00, BurnerStarts=0]'},
{'dataId':'117', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 117: 00 00]'},
{'dataId':'118', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 118: 00 00]'},
{'dataId':'119', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 119: 00 00]'},
{'dataId':'120', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 120: 00 00, BurnerHours=0]'},
{'dataId':'121', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 121: 00 00]'},
{'dataId':'122', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 122: 00 00]'},
{'dataId':'123', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 123: 00 00]'},
{'dataId':'125', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 125: 00 00]'},
{'dataId':'127', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 127: 00 00]'},
{'dataId':'202', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 202: 00 00]'},
{'dataId':'206', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 206: 00 00]'},
{'dataId':'39', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 39: 00 00]'},
{'dataId':'40', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 40: 00 00]'},
{'dataId':'92', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 92: 00 00]'},
{'dataId':'208', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 208: 00 00, vhrCoefficientOfPerformance=0.00]'},
{'dataId':'93', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 93: 00 00]'},
{'dataId':'94', 'value0':'00', 'value1':'00', 'updated':'0', 'description':'[ID 94: 00 00]'}
]

[bwbboot]

Hi All,

Tried to post before but not sure what happened to my post. Possibly waiting for Admin approval? Anyway..
New here on the forums and all into getting my TOON rooted. Love this project. All setup here with RPI3 as JTAG. However running into a DCC write failed issue here.

Code: Select all

> reset halt                      
JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
> load_image u-boot.bin 0xa1f00000
DCC write failed, expected end address 0xa1f28a68 got 0xa1f00000
memory write caused data abort (address: 0xa1f00000, size: 0x4, count: 0xa29a)

> nand probe 0
memory read caused data abort (address: 0x10027814, size: 0x4, count: 0x1)
memory read caused data abort (address: 0x10027814, size: 0x4, count: 0x1)
memory write caused data abort (address: 0x10027814, size: 0x4, count: 0x1)
memory write caused data abort (address: 0x10027814, size: 0x4, count: 0x1)
NAND flash device 'NAND 128MiB 3.3V 8-bit (Samsung)' found
> 

Anyone able to assist or ideas what could be wrong?

Cheers and thanks for the assist!

Bjorn

Edit: The issue is fixed by adding in both rpi.cfg and ed20.cfg

Code: Select all

adapter_khz 500
adapter_nsrst_delay 400
reset_config none

[Ierlandfan]

They disabled/removed the function that updates the table in all latest versions of happ_thermstat for unknown reasons. Maybe legacy issues or speed related.
It's possible to write some script that queries Toon directly for the values but i have to figure out how a query is constructed. From there it's a piece of cake.

BUT for now you can get it to work again

downgrade to happ_thermstat 1.554:

winscp or scp happ-thermstat_1.554-trunk_qb2.ipk to /tmp
then issue
cd /tmp
opkg install --force-downgrade happ-thermstat_1.554-trunk_qb2.ipk

[Ierlandfan]

After doing some poking around I found a standalone bxt (client) in /qmf/bin. If invoked with no options it gives a nice help info screen!
We can use this client to talk to all the inner parts of Toon and use it to query the OT Id's.

After some more fiddling I am making progress

Example:

Code: Select all

./bxt -q CurrentTemperature -d 7d8ef81a-b3b6-4c0c-a0f9-272973bd7497

where the part after the -d is the UUID of in this case happ_thermstat.
UUID can bed found in the config (E.g: config_happ_thermstat.xml)
<query class="response" uuid="7d8ef81a-b3b6-4c0c-a0f9-272973bd7497" destuuid="bxt.c-29185" serviceid="urn:hcb-hae-com:serviceId:specific1">
<u:QueryStateVariableResponse xmlns:u="urn:hcb-hae-com:service:specific1:1"><CurrentTemperature>25.42</CurrentTemperature>
</u:QueryStateVariableResponse>
</query>

Or:

Code: Select all

./bxt -q CurrentBoilerTemperature -d 7d8ef81a-b3b6-4c0c-a0f9-272973bd7497

<query class="response" uuid="7d8ef81a-b3b6-4c0c-a0f9-272973bd7497" destuuid="bxt.c-30185" serviceid="urn:hcb-hae-com:serviceId:specific1">
<u:QueryStateVariableResponse xmlns:u="urn:hcb-hae-com:service:specific1:1"><CurrentBoilerTemperature>58.00</CurrentBoilerTemperature>
</u:QueryStateVariableResponse>
</query>

[marcelr]

Nice find again, Ierlandfan!

This should enable display of all boiler data on screen, even after the cutback in output of the webhandler, since FW 3.6.3, but naturally, you already noticed that.

[Toonz]

Should be possible as well from within qml probably... Will add to my to do list as well....

[marcelr]

Engie's boxx can be rooted as well. The hardware is the same, apart from a few boxx-specific software things (mainly firmwares for attached devices), it's the exact same device.

[bwbboot]

Hey Marcel,

Great work! Do you mind sharing instructions on howto update the boot/splash logo's?

Thanks!

[marcelr]

I've given some hints in this post, although that's outdated (and wrong) a little:
viewtopic.php?f=87&t=8743&p=82340#p82339

Toon shows 4 splash screens before the gui becomes active:

1: /usr/share/images/image-nl-bootsplash.bmp: during u-boot startup and kernel boot. A copy of this file has been flashed to /dev/mtd1, where it is read from at startup.
2: /usr/share/images/image-nl-bootsplash.fb.gz: during startup of the OS, when all processes in /etc/inittab are being cranked up. The fb format is a raw framebuffer format, can be edited with e.g. GIMP.
3: /HCBv2/qml/themes/loadscreen_0.png: during startup of qt-gui.
4: /HCBv2/qml/themes/loadscreen_1.png: during loading of all apps by qt-gui.

In later FW versions most of the stuff in /HCBv2 has been moved to /qmf. The remainders of the paths have remained the same.

You can just replace any of these files by your own versions. Only the first screen needs to be flashed to /dev/mtd1.
For my own toon, I have replaced the first (filled) dot in the first splash screen by an empty one, so as to be able to distinguish between the kernel booting and OS startup.

[bwbboot]

Ok understood. Are you sure its /dev/mtd1? See below. Just double checking.

Code: Select all

eneco-001-xxxxxx:/usr/share/images# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "u-boot-env"
mtd1: 00180000 00020000 "splash-image"
mtd2: 00300000 00020000 "kernel"
mtd3: 00300000 00020000 "kernel-backup"
mtd4: 07700000 00020000 "rootfs"

I noticed all images in /usr/share/images are compressed. Should i flash the compressed version?
So basicly i would flash an image by using the following command correct (assuming /dev/mtd1 is correct).

Code: Select all

./usr/bin/flashcp -v /usr/share/images/image-nl-bootsplash.bmp.gz /dev/mtd1

[marcelr]

Hi bwbboot,

I edited your post (and mine), just to be sure no one makes the same mistake as I did. The splash image resides in /dev/mtd1, as you rightfully state.

You have to flash an uncompressed image to that partition, neither u-boot nor the kernel know how to unzip a partition.

I'm not sure about the flashcp, What I tend to do is the same as the kernel image package does (and that's where the mistake was, the kernel resides in /dev/mtd2 ...):

Code: Select all

flash_eraseall /dev/mtd1
nandwrite -a -p /dev/mtd1 <whatever_the_filename.bmp>

[bwbboot]

Oh, ok I misread. /dev/mtd1 is the correct one for the splash image. Need new glasses apparently

[marcelr]

You got it absolutely right, the error was mine.

You can always check, by

Code: Select all

dd if=/dev/mtd1 of=test.bmp bs=64k

test.bmp is the splash image, if your partition was the right one.