Sony-XAV-AX100

Cortex-A9 ARMv7 Processor
STM8S207CB MCU
U-Boot 2014.04
Linux 3.4.5
Firmware 1.02.06.00
2? USB ports
5 UARTS

Partitions:

nand_header	blockrom0:	128	KiB
xboot1	blockrom1	128	KiB
uboot1	blockrom2:	1792	KiB
uboot2	blockrom3:	2816	KiB
env	blockrom4:	512	KiB
env_redund	blockrom5:	512	KiB
ecos	blockrom6:	8192	KiB
kernel	blockrom7:	6144	KiB
rootfs	blockrom8:	5760	KiB
spsdk	blockrom9:	54144	KiB
spapp	blockrom10:	53248	KiB
nvm	blockrom11:	51200	KiB
pq	blockrom12:	2048	KiB
logo	blockrom13:	2048	KiB
tcon	blockrom14:	384	KiB
iop_car	blockrom15:	2048	KiB
runtime_cfg	blockrom16:	1024	KiB
vi	blockrom17:	384	KiB
isp_logo	blockrom18:	5120	KiB
vendordata	blockrom19:	256	KiB
pat_logo	blockrom20:	13312	KiB
version_info	blockrom21:	512	KiB
vd_restore	blockrom22:	256	KiB
userdata	blockrom23:	50176	KiB

The firmware from Sony is encrypted, but, the firmware loader allows non encrypted images. The decryption keys are stored in enviroment variables during the update so they can be retreieved and sonys firmware can be decrypted. The serial console UART 0 and USB 0 are on second board behind the LCD. The board is clearly labled and easy to solder. At startup U-Boot loads runtime_cfg and the variable gpio_LECD_en controls whether the console is enabled after the intial post message.

The built in firmware updater requires the mcu update binary (st16mcu.bin) be present and it's versions the same as the update in order to load the update. There is a checksum on both files, though the overall checksum in the pack file (CUST_PACK.BIN) is not checked. ISP update can also be entered by settings the first byte of mtdblock19 to 0x70. The data images are standard script images.

Sony open source code is avilable at http://oss.sony.net/Products/Linux/Audio/XAV-AX100.html