!!!!!!! Rooting your Toon is at your own risk! !!!!!!!
!!!!!!! This guide is for education purposes only. If you use this information and damage your Toon, Raspberry Pi or anything else I’m not responsible. !!!!!!!
EDIT: we recommend to use the ToonRooter script:
https://github.com/ToonSoftwareCollective/ToonRooter but if you still want to now how we used to do this by hand,.. read below:
=========================================================================================================================
Yesterday I tried to hack a Toon with U-Boot 2010.09-R10 (Dec 14 2015 - 19:28:18).
I found that some of the information was incomplete or I could not compare the output of the commands because the output of the commands was not in the articles I found.
This guide describes how you can use the JTAG interface to root your Toon R10 bootloader.
If you have R6 or R8 u-boot image in your Toon you don’t need to use the JTAG method and skip directly to marcelr’s guide on domoticaforum.eu.
viewtopic.php?f=87&t=11235#p82533
I cloud not do it without all the work that was put into it from the authors of several forum posts and websites. Thanks guys!!
These are the pages I used:
https://github.com/synthetos/PiOCD/wiki ... TAG-Dongle
https://learn.adafruit.com/programming- ... spberry-pi
viewtopic.php?f=87&t=11235#p82533
Here is how I did it. Maybe it can help someone to root their Toon using JTAG.
I had a Raspberry Pi 3 lying around which I turned into a JTAG debugger.
What you need:
- Toon thermostat
- Raspberry Pi 3 (version 2 should also work) with power adapter.
- 11 Dupont wires (2.54mm female-female, 20cm)
- USB to TTL Serial adapter (3.3v)
Step 1: Prepare your Raspberry Pi
First of all you have to install Raspbian on the Pi3.
I used Raspbian Stretch (9.1).
See for instructions:
https://www.raspberrypi.org/documentati ... ng-images/
To configure Wi-Fi for your Pi3 see instructions at:
https://www.raspberrypi.org/documentati ... ess-cli.md
If you want to login to your Pi3 from another PC you have to enable SSH:
https://www.raspberrypi.org/documentati ... ccess/ssh/
Update your Raspbian to the latest version.
Check out:
https://www.raspberrypi.org/documentati ... pdating.md
Step 2: Install OpenOCD
Login to your Raspberry Pi.
We will install OpenOCD using the latest version from git repository.
All commands in this guide are executed as user root.
Code: Select all
root@raspberrypi:apt-get install git autoconf libtool make pkg-config libusb-1.0-0-dev libftdi-dev build-essential cmake minicom pkg-config
root@raspberrypi:mkdir ~/rootToon
root@raspberrypi:git clone --recursive git://git.code.sf.net/p/openocd/code openocd
root@raspberrypi:cd openocd
root@raspberrypi:{
./bootstrap &&\
./configure --enable-sysfsgpio\
--enable-bcm2835gpio \
--enable-maintainer-mode \
--disable-werror \
--enable-ft2232_libftdi \
--enable-ep93xx \
--enable-at91rm9200 \
--enable-usbprog \
--enable-presto_libftdi \
--enable-jlink \
--enable-vsllink \
--enable-rlink \
--enable-arm-jtag-ew \
--enable-dummy \
--enable-buspirate \
--enable-ulink \
--enable-presto_libftdi \
--enable-usb_blaster_libftdi \
--enable-ft2232_libftdi\
--prefix=/usr\
&&\
make -j4
} 2>&1 | tee openocd_build.log
Open the Toon thermostat and connect the Pi3 JTAG pins and the USB-Serial pins to the Toon JTAG connector.
I used 20cm female-female 2.54mm Dupont wires.
Plug the USB-Serial adapter into a USB-port on your Pi or your computer.
Code: Select all
Connect the JTAG wires
Toon wire color Pi header pin
2 -white-> 24 (TRST)
3 -gray-> 20 (GND)
4 -darkred-> 23 (TCK)
5 -blue-> 25 (GND)
6 -green-> 22 (TMS)
7 -yellow-> 18 (SRST)
8 -orange-> 19 (TDI)
10 -red-> 21 (TDO)
Code: Select all
Connect the serial console
Toon wire color USB-Serial
11 (TxD) -white-> RxD (receive)
13 (RxD) -gray-> TxD (transmit)
14 (GND) -green-> GND (ground)
You can download the zipfile with pictures from this URL:
https://1drv.ms/u/s!AqSP1w9Vx6O1htsKtWXctSN2_aBnBg .
Open a serial console application (I used Minicom) and select the USB port where your USB-Serial converter is connected (in my case /dev/ttyUSB0).
The Toon thermostat uses 115200 baud, 8 data-bits, no parity, 1 stop-bit for communication.
Now you have to connect your boiler module (ketel module) to the Toon thermostat and plug-in the poweradapter of the boiler module.
You should now see the bootlog of your Toon in your serial console application.
Step 5: Changing the bootloader
Download the config.zip file which is attached to this post and extract it into ~/rootToon/.
The zip file contains 2 files: raspberrypi.cfg and ed20.cfg.
Start OpenOCD:
Code: Select all
root@raspberrypi:cd ~/rootToon/
root@raspberrypi:openocd -s /usr/share/openocd -f ~/rootToon/raspberrypi.cfg -f ~/rootToon/ed20.cfg
Open On-Chip Debugger 0.10.0+dev-00200-g16625089 (2017-10-21-08:59)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.org/doc/doxygen/bugs.html
BCM2835 GPIO config: tck = 11, tms = 25, tdi = 10, tdo = 9
BCM2835 GPIO config: trst = 8
BCM2835 GPIO config: srst = 24
adapter speed: 500 kHz
adapter_nsrst_delay: 400
none separate
trst_and_srst srst_pulls_trst srst_gates_jtag trst_push_pull srst_open_drain connect_deassert_srst
Info : auto-selecting first available session transport "jtag". To override use 'transport select <transport>'.
dcc downloads are enabled
ed20_init
Info : BCM2835 GPIO JTAG/SWD bitbang driver
Info : JTAG only mode enabled (specify swclk and swdio gpio to add SWD mode)
Info : clock speed 500 kHz
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Info : Embedded ICE version 6
Info : imx27.cpu: hardware has 2 breakpoint/watchpoint units
Info : ETM v1.3
Info : accepting 'telnet' connection on tcp/4444
Open another terminal on the Pi3 and start a telnet session to OpenOCD:
Code: Select all
root@raspberrypi:cd ~/rootToon
root@raspberrypi:telnet localhost 4444
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
>
Execute the following commands in the telnet session:
Code: Select all
> soft_reset_halt
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
> reset halt
JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
> load_image u-boot.bin 0xa1f00000
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)
> resume 0xa1f00000
>
The logging on the OpenOCD screen should be like this:
Code: Select all
requesting target halt and executing a soft reset
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x000000d3 pc: 0x00000000
MMU: disabled, D-Cache: disabled, I-Cache: disabled
Info : JTAG tap: imx27.etb tap/device found: 0x1b900f0f (mfg: 0x787 (<unknown>), part: 0xb900, ver: 0x1)
Info : JTAG tap: imx27.cpu tap/device found: 0x07926121 (mfg: 0x090 (Chip Express), part: 0x7926, ver: 0x0)
Warn : srst pulls trst - can not reset into halted mode. Issuing halt after reset.
target halted in ARM state due to debug-request, current mode: Supervisor
cpsr: 0x200000d3 pc: 0xa1f20580
MMU: disabled, D-Cache: disabled, I-Cache: enabled
Warn : NOTE! Severe performance degradation without fast memory access enabled. Type 'help fast'.
166504 bytes written at address 0xa1f00000
downloaded 166504 bytes in 1.903381s (85.428 KiB/s)
Now the Toon loads the “hacked” u-boot loader which has the password “toon”.
Right after the bootloader starts you get the password prompt in your serial console:
Code: Select all
Autoboot in 2 sec...
Enter the password to interrupt.
The password is: toon
Type in the word toon and press <enter>.
You can now root your Toon with the same procedure as the R6 or R8 U-Boot bootloaders as described in the next section.
If you made it this far, please continue reading on:
viewtopic.php?f=87&t=11235#p82533
Start at the “
##### Entering (and editing) the boot loader: #####” section.
.
via the ESP8266 card. I'm happy!
