ea / bosch_headunit_root

Documentation and code for rooting and extending a Bosch car head unit (lcn2kai)
399 stars 57 forks source link

Figure out TK Device access #21

Open ea opened 3 years ago

ea commented 3 years ago

Both linux and rtos side expose each other's file systems through kernel drivers called RFS/RFS2 which stands for Remote FS as far as i can tell. It's a relatively simple virt FS driver that's built ontop of virtio and provides basic FS functionality.

Most interestingly, RTOS devices are exposed through it in /dev/media/rfs/ some of which have quite fun sounding names (such cas candesc which seems to be a CAN device). Now, reversing on the RTOS side reveal a relatively simple IOCTL based interface to these devices. BUT! The RFS implementation doesn't support IOCTLs. Reading/writing to some of the devices is very easy because they work with regular read/write (like errmem for example) , but others don't do anything (like said candesc...).

Wishful thinking: Close this issue when you figure out how to talk to any of the non-cooperative devices!