Cortex-A9 ARMv7 Processor
STM8S207CB MCU
U-Boot 2014.04
Linux 3.4.5
Firmware 1.02.06.00
2? USB ports
5 UARTS
Partitions:
nand_header | blockrom0: | 128 | KiB |
xboot1 | blockrom1 | 128 | KiB |
uboot1 | blockrom2: | 1792 | KiB |
uboot2 | blockrom3: | 2816 | KiB |
env | blockrom4: | 512 | KiB |
env_redund | blockrom5: | 512 | KiB |
ecos | blockrom6: | 8192 | KiB |
kernel | blockrom7: | 6144 | KiB |
rootfs | blockrom8: | 5760 | KiB |
spsdk | blockrom9: | 54144 | KiB |
spapp | blockrom10: | 53248 | KiB |
nvm | blockrom11: | 51200 | KiB |
pq | blockrom12: | 2048 | KiB |
logo | blockrom13: | 2048 | KiB |
tcon | blockrom14: | 384 | KiB |
iop_car | blockrom15: | 2048 | KiB |
runtime_cfg | blockrom16: | 1024 | KiB |
vi | blockrom17: | 384 | KiB |
isp_logo | blockrom18: | 5120 | KiB |
vendordata | blockrom19: | 256 | KiB |
pat_logo | blockrom20: | 13312 | KiB |
version_info | blockrom21: | 512 | KiB |
vd_restore | blockrom22: | 256 | KiB |
userdata | blockrom23: | 50176 | KiB |
The firmware from Sony is encrypted, but, the firmware loader allows non encrypted images. The decryption keys are stored in enviroment variables during the update so they can be retreieved and sonys firmware can be decrypted. The serial console UART 0 and USB 0 are on second board behind the LCD. The board is clearly labled and easy to solder. At startup U-Boot loads runtime_cfg and the variable gpio_LECD_en controls whether the console is enabled after the intial post message.
The built in firmware updater requires the mcu update binary (st16mcu.bin) be present and it's versions the same as the update in order to load the update. There is a checksum on both files, though the overall checksum in the pack file (CUST_PACK.BIN) is not checked. ISP update can also be entered by settings the first byte of mtdblock19 to 0x70. The data images are standard script images.
Sony open source code is avilable at http://oss.sony.net/Products/Linux/Audio/XAV-AX100.html