Topic: Smart watch with an MT6260

While searching the 'net for data on the MT6260 I came across your excellent video on the Fernvale project. I have an interest in hacking the Uwatch U8 which uses the same processor.

It has no MicroSD slot, just USB so should be an interesting challenge to modify without "bricking" the thing. I plan to use it for monitoring data via bluetooth, none of the extant functions are of any interest to me except maybe the watch part.

Here's the actual gadget, for reference:

http://www.aliexpress.com/item/Bluetoot … 61796.html

Rob

Re: Smart watch with an MT6260

Fernly will run on those, but Bluetooth isn't working yet.  Maybe someday!

The nice thing about Fernly is that it runs entirely on the OCRAM.  Installing it doesn't brick anything, to get the stock OS back you just have to reboot.

A word of warning: They may say MT6260, but at least one person received an MT6261-based watch.

Re: Smart watch with an MT6260

If I can install a small implementation of Forth with it that may be enough.

BTW I found this today:

http://piranhabox.net/

:-)

Re: Smart watch with an MT6260

Well, I have a quick port of Micropython, but it could use more hardware drivers: https://github.com/xobs/micropython

5 (edited by haiqu 2015-05-02 10:44:13)

Re: Smart watch with an MT6260

Nice. I've found enough docs online to get me started although there's one Chinese site that would be really useful if they didn't insist on 5 uploads before you can get files from them (haven't seen that since the Fidonet BBS days!).

MicroPython will be very handy, many thanks. If I write any drivers with it I'll send you a copy.

Haven't found a spec on the MT6261, what are the main differences?

Re: Smart watch with an MT6260

I actually don't know what's different with the 6261, aside from the fact that it seems to have a captouch driver.  At least the MT6261 watch I have uses captouch.

I also don't have fernly working on the 6261 yet, due to the lack of docs.

Re: Smart watch with an MT6260

haiqu wrote:

It has no MicroSD slot, just USB so should be an interesting challenge to modify without "bricking" the thing.

It should be noted that MT6260 (and most of other modern devices with Mediatek SoCs) can't be bricked at all, because they have USB bootloader. So, as long as you backed up your flash as described here: http://www.kosagi.com/forums/viewtopic.php?id=159 , you should be able to flash it back later, even if you pushed incompatible firmware or just garbage into flash.

haiqu, it would be nice if you posted bootlog for your watch as given by fernly and any information output from its commands (some may require enabling before compiling). Then, it will be easier to find folks with same/compatible device.

8 (edited by haiqu 2015-05-22 16:40:55)

Re: Smart watch with an MT6260

xobs wrote:

A word of warning: They may say MT6260, but at least one person received an MT6261-based watch.

Got the watch a few weeks ago, but I've been busy hacking at Haiku OS and forgot to follow up here. Seems the one I got has an MT6227 chip, same family but even less info available. Can't actually remember how I found that out. Edit: I do recall now (had a senior moment there ...). I enumerated the USB devices in Haiku and dumped their specs, then looked up the ID in public chip lists for Linux/BSD.

Anyhow, if I attach the USB mini to my computer for charging I can see a serial port. It also displays the correct Bluetooth ID for my PC and tries to connect.

It's a good start. :-)

Re: Smart watch with an MT6260

pfalcon wrote:
haiqu wrote:

It has no MicroSD slot, just USB so should be an interesting challenge to modify without "bricking" the thing.

It should be noted that MT6260 (and most of other modern devices with Mediatek SoCs) can't be bricked at all, because they have USB bootloader. So, as long as you backed up your flash as described here: [...] , you should be able to flash it back later, even if you pushed incompatible firmware or just garbage into flash.

That's not what they're saying over at xdadevelopers:

http://forum.xda-developers.com/showthr … ?t=2657970

Apparently a lot of buyers thought they had a 'genuine' U8 and flashed the wrong firmware. Oops.

haiqu, it would be nice if you posted bootlog for your watch as given by fernly and any information output from its commands (some may require enabling before compiling). Then, it will be easier to find folks with same/compatible device.

Good idea. I'll read the above topic and get back to you.

10 (edited by haiqu 2015-05-22 18:23:24)

Re: Smart watch with an MT6260

Yeah. Naah, can't do that right now. Flashrom hasn't been ported to Haiku OS yet and it relies on libusb and libftdi which aren't available either (although we're aware of them).

Bugger. More work. B^p

Definitely worth doing though, especially since we've almost finished the main target platforms and are starting to look at embedded-style devices like the RasPi2 and Mips Creator CI20.

Re: Smart watch with an MT6260

BTW I find this kind-of inspiring, if misguided:

https://www.youtube.com/watch?v=GZx-LJH5J_I

Re: Smart watch with an MT6260

haiqu wrote:

Got the watch a few weeks ago, but I've been busy hacking at Haiku OS and forgot to follow up here. Seems the one I got has an MT6227 chip, same family but even less info available. Can't actually remember how I found that out. Edit: I do recall now (had a senior moment there ...). I enumerated the USB devices in Haiku and dumped their specs, then looked up the ID in public chip lists for Linux/BSD.

A company which churns out SoC models like ..., doesn't bother to provide individual vid/pid combo for each SoC model and each mode SoC can be in. That means that same vid/pid id reused for bunch of different models, and "MT6227" in "public chip lists for Linux/BSD" means only that some dude at some moment of time spotted that combo on a MT6227 device, not that any device with that combo is MT6227.

Re: Smart watch with an MT6260

Correct.  They all show up as the same VID/PID.  If you run fernly-usb-loader on it it will actually query the registers on the device that identify which part number it is.  These registers are always at address 0x80000008, so it should work regardless of the chip inside.

Incidentally, I have a 6261 here that was branded as "MT6260".

Re: Smart watch with an MT6260

Just following up on the suggestion to use FlashROM on this device:

Libftdi and libusb have a chain of dependencies about 200MB deep, and that's just the source code. I managed to build most of them on Haiku but then the whole system crashed in a heap. Honestly, why an FTDI chip needs the libicu_dev libraries is truly beyond me. Welcome to Linux dependency hell.

I spent about 48 hours on it, that's more than enough. It's crap.

Re: Smart watch with an MT6260

pfalcon wrote:

A company which churns out SoC models like ..., doesn't bother to provide individual vid/pid combo for each SoC model and each mode SoC can be in. That means that same vid/pid id reused for bunch of different models, and "MT6227" in "public chip lists for Linux/BSD" means only that some dude at some moment of time spotted that combo on a MT6227 device, not that any device with that combo is MT6227.

It's a reliable method to determine which chip you have from a reputable manufacturer. Of course, that rules out most of Asia. The only other exception is that some companies sell IDs to smaller manufacturers (e.g. the Funcube dongle has a Microchip ID, 0x04d8:fb56) but even that is known and on record publicly.

Re: Smart watch with an MT6260

Here's what the USB interface looks like anyhow. Might be useful to someone:

U8 Smart Watch

[Device]
    Class .................. 0x02 (Communication)
    Subclass ............... 0x00
    Protocol ............... 0x00
    Max Endpoint 0 Packet .. 8
    USB Version ............ 0x0200
    Vendor ID .............. 0x0e8d (MediaTek Inc.)
    Product ID ............. 0x0003 (MT6227 phone)
    Product Version ........ 0x0100
    Manufacturer String .... "U8"
    Product String ......... "U8 "
    Serial Number .......... ""
    [Configuration 0]
        Configuration String . ""
        [Interface 0]
            [Alternate 0 active]
                Class .............. 0x0a (CDC-Data)
                Subclass ........... 0x00
                Protocol ........... 0x00
                Interface String ... "COM(data_if)"
                [Endpoint 0]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Input
                [Endpoint 1]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Output
        [Interface 1]
            [Alternate 0 active]
                Class .............. 0x02 (Communication)
                Subclass ........... 0x02
                Protocol ........... 0x01
                Interface String ... "COM(comm_if)"
                [Endpoint 0]
                    MaxPacketSize .... 16
                    Interval ......... 3
                    Type ............. Interrupt
                    Direction ........ Input
                [Descriptor 0]
                    Type ............. 0x24
                    Data ............. 00 10 01
                [Descriptor 1]
                    Type ............. 0x24
                    Data ............. 02 0f
                [Descriptor 2]
                    Type ............. 0x24
                    Data ............. 06 01 00
                [Descriptor 3]
                    Type ............. 0x24
                    Data ............. 01 03 00
    [Configuration 1]
        Configuration String . ""
        [Interface 0]
            [Alternate 0 active]
                Class .............. 0x0a (CDC-Data)
                Subclass ........... 0x00
                Protocol ........... 0x00
                Interface String ... "COM(data_if)"
                [Endpoint 0]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Input
                [Endpoint 1]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Output
        [Interface 1]
            [Alternate 0 active]
                Class .............. 0x02 (Communication)
                Subclass ........... 0x02
                Protocol ........... 0x01
                Interface String ... "COM(comm_if)"
                [Endpoint 0]
                    MaxPacketSize .... 16
                    Interval ......... 3
                    Type ............. Interrupt
                    Direction ........ Input
                [Descriptor 0]
                    Type ............. 0x24
                    Data ............. 00 10 01
                [Descriptor 1]
                    Type ............. 0x24
                    Data ............. 02 0f
                [Descriptor 2]
                    Type ............. 0x24
                    Data ............. 06 01 00
                [Descriptor 3]
                    Type ............. 0x24
                    Data ............. 01 03 00
    [Configuration 2]
        Configuration String . ""
        [Interface 0]
            [Alternate 0 active]
                Class .............. 0x0a (CDC-Data)
                Subclass ........... 0x00
                Protocol ........... 0x00
                Interface String ... "COM(data_if)"
                [Endpoint 0]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Input
                [Endpoint 1]
                    MaxPacketSize .... 64
                    Interval ......... 0
                    Type ............. Bulk
                    Direction ........ Output
        [Interface 1]
            [Alternate 0 active]
                Class .............. 0x02 (Communication)
                Subclass ........... 0x02
                Protocol ........... 0x01
                Interface String ... "COM(comm_if)"
                [Endpoint 0]
                    MaxPacketSize .... 16
                    Interval ......... 3
                    Type ............. Interrupt
                    Direction ........ Input
                [Descriptor 0]
                    Type ............. 0x24
                    Data ............. 00 10 01
                [Descriptor 1]
                    Type ............. 0x24
                    Data ............. 02 0f
                [Descriptor 2]
                    Type ............. 0x24
                    Data ............. 06 01 00
                [Descriptor 3]
                    Type ............. 0x24
                    Data ............. 01 03 00

Re: Smart watch with an MT6260

You shouldn't need libftdi.  Isn't there an option to disable it?

Re: Smart watch with an MT6260

Actually the OS has an FTDI driver already but I think it's looking for the ftdi_devel package for headers and with our build system you need to build the whole package to get those in a system-recognizable format. I'll have a look at the options again since this is the library that pulls in most of the dependencies.

19 (edited by haiqu 2015-06-11 14:41:05)

Re: Smart watch with an MT6260

Rewrote the Makefile (again) and managed to get it to build, which wasn't easy when the Haiku packaging system refuses to install packages built locally. The joys of using an alpha-quality OS. :-/

This thing has an impressive list of supported hardware! I'm sure the Haiku community will be pleased with it once I pack it up in a format that's easily used.

All-righty then, now to re-read the previous stuff about how to use this to hack my U8 watch.

Re: Smart watch with an MT6260

Hmmm, got it. I now have to build a cross-compiler capable of outputting gnueabi then build Fernly. What fun.

Back soon.

Re: Smart watch with an MT6260

I now have to build a cross-compiler capable of outputting gnueabi then build Fernly.

Actually no, you just need to boot Linux, build fernly, boot it, and then either be back to Haiku hacking, or stay with fernly hacking for a while ;-).

Re: Smart watch with an MT6260

I don't run Linux here. At all.

OK, now have an Arm cross-compiler, a copy of Fernly built and Qemu for fernly/arm.

Silly question: Can I do this via the serial port or do I have to attach wires to my watch's PCB and run flashrom at the SPI device? Instructions weren't very clear on this point. And I'm not really keen to physically hack my new watch if it can be avoided.

Re: Smart watch with an MT6260

If you have a serial port and you get the Bootloader screen, then you should be able to use the fernly-usb-loader to load fernly into the watch, and afterwards you can use the flashrom to flash the rom through fernly:

The loads fernly:
build/fernly-usb-loader -s /dev/YourSerialInterfaceToFernvale build/usb-loader.bin build/firmware.bin
And then you can use flashrom (romdumper 0.9.8):
./flashrom --programmer fernvale_spi ...

Re: Smart watch with an MT6260

Whew, long night. I discovered fernvale-nuttx and decided to port that as well. :-)

Sourcerer: Yep, already figured that out, but for safety I'd like to dump the internals to disk first so that I have a backup in case of catastrophe. Is there a procedure to do that?

Re: Smart watch with an MT6260

If I understand you correctly:
./flashrom --programmer fernvale_spi --help
Read from flash to a file:
./flashrom --programmer fernvale_spi -r flash.dat
Flash with a new image:
./flashrom --programmer fernvale_spi -w flash.dat