The smartwatch 2 is sony's new smartwatch. I got one from a hackerthon in Berlin, where everybody
who attended got one from Sony. I liked to open it, but I'm a litte bit scared broking it's waterproofness.
So I'll wait for ifixit or other disassembly website.
Still I'm interested what's inside and how does it works?
The software side heavily depending on your android phone. There are some applications running
direct on the watch. Like alarm clock, settings, countdown.
Everything else is running on your phone and using it's display as canvas. Yes, you are writing over bluetooth
into a canvas. When you are clicking on your watch, the Sony Smartwatch app on your phone is sending an broadcast intent
which is starting your app. But that is a service in the background.
For more information look into ligi's github repo.
Now get into the firmware and hardware. As Sony already written for the smartwatch (1) you can easy
access the dfu bootloader. It's a dfu compatable bootloader.
As already described on Sony's hacker documentation
- Shutdown your smartwatch
- Disconnect usb cable
- only connect micro usb connector to smartwatch
- you have around 1sec for this: press the powerbutton, plug the other usb cable end to the computer and release the powerbutton
dfu-util -l will show you when it's connected.
You can read and write it. Let's look into it.
dfu-util -l
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=0, name="@Internal Flash /0x08000000/03*016Kg,01*016Kg,01*064Kg,07*128Kg,03*016Kg,01*016Kg,01*064Kg,07*128Kg"
Found DFU: [0fce:f0fa] devnum=0, cfg=1, intf=0, alt=1, name="@eMMC /0x00000000/01*512Mg"
I think all firmware is placed within the first flash. It's the internal one. An eMMC is an soldered sdcard.
Because we have the same partition layout twice, I think this is used for OTA firmware update. It's a common case
on embedded device. Double size your flash and split it into 2 identical parts. I'll name the first part A and part B is the other half.
We are booting part A, now an OTA update comes, the firmware will write this into part B and tell the bootloader:
'Try the B partition but only once.' Now the device will reboot and the bootloader boot part B. When the new firmware successful booted it tells the bootloader 'Boot everytime B now'. If the new firmware fails in B, the device has to be reboot and falling back to boot part A. This can be done by a hardware watchdog automatically.
I believe on the emmc we'll find all additional icons and application name we installed over the android.
Remember the smartwatch is only a remote display with sensors. Nothing more.
Let's disassemble the firmware. Put your device into dfu mode.
dfu has also upload capabilities. Upload means from device to a file. Download is for firmware flashing.
Upload the 2M flash into a file.
dfu-util -a 0 -U /tmp/smartwatch_internal -s 0x08000000:2097152
Now let's do a simple strings /tmp/smartwatch_internal.
As we know from the settings menu we have an STM32F42x, a Cortex M4.
Look at the filenames.
Technical Details:
type: chip [interfaces] (detailed description)
CPU: STM32F4xx (STM32F-427 or 429)
RAM: 256k
ROM/flash: 2M
eMMC: 512M? [connected over sdio] (maybe less I could only load 128M over dfu-util. Could be also a edge in dfu-util)
BT: STLC2690 (low power but only BT 3.0. I guess low power means not BT4.0 low power. But it seems to has an own cortex m3 + fw upgrade functionality)
Accelerometer: bma250 [SPI (4-wire, 3-wire), i2c, 2 interrupt pins] (Bosch Sensoric)
Compass: ak8963 [SPI, I2C] (really? sony didn't exposed it or is this just a leftover from a debug board?)
NFC-tag: ntag203f [interupt pin for rf-activity] (only a tag - the mcu only knows if it got read)
Touch: ttsp3 (i'm not sure if this is a Cypress TTSP with i2c)
LiIonController: Max17048 [i2c] (fuel gauge and battery controller)
Light/AmbientSensor: Taos TSL2771 [I2C]
RTC: included CPU
Display: TC358763XBG [SPI (3,4 wire), SSI for display data; i2c, spi, pwm for control] (Display Controller)
Buzzer: GPIO wired
Most of the sensors and actors are already supported by linux kernel because they are built in some (Sony) smartphones.
No I don't want run linux on it. But we have already working driver which we can adapt for an alternative firmware.
Search or github' search for STM32F4xx_StdPeriph_Driver which is freely available SDK.
I think they don't written a complete firmware from scratch. Because of some strings I guess it's a 'uCos' extended
to their needs.
Sony please provide us with the correct wiring of the sensors and actors so we can build our own firmware?!