NOR
NOR flash contents[edit | edit source]
Head unit's NOR flash memory (8 MB) is located on daughter board near main SOC and mapped to three different devices in Android:
/dev/mtd/mtd0[edit | edit source]
mtd0 flash region map:
Address Size 0x000000, 0x0FFE00 // bootloader code 0x0FFE00, 0x000200 // looks like bootloader 512-byte header from fimrware PRG file 0x100000, 0x010000 // model info side A 0x110000, 0x010000 // model info side B 0x120000, 0x010000 // part of opening data PRG file header 0x130000, 0x120000 // opening data 0x250000, 0x010000 // bsp side a 0x260000, 0x010000 // bsp side b
/dev/mtd/mtd1[edit | edit source]
mtd1 contains filesystem mounted to /mnt/backup_flash/
with back.cfg
file inside. This file contains device-specific configuration (touchscreen calibration for example)
/dev/mtd/mtd2[edit | edit source]
mtd2 contains EasyRecovery image (linux kernel + additional files + EasyRecovery executable + android toolbox). This image is loading then u-boot bootloader is unable to start kernel from internal sd card.
Writing data to NOR flash[edit | edit source]
To write data to NOR memory you can use simple dd
command, for example:
dd if=/mnt/udisk/new.img of=/dev/block/mtdblock0 seek=2424832 count=84 bs=1
but before you can write you must erase NOR flash region using ioctl
command:
/system/bin/ioctl -l 8 -a 4 /dev/mtd/mtd0 1074285826 2424832 65536
Where 2424832 is start address, 65536 is memory erase block size. Looks like both this values must be multiple of 0x10000 (Address is aligned to 0x10000 boundary, size is multiple of 0x10000), at least original firmware uses this alignment.