Pod 3 revision E issues

[craigcabrey]

Hi,

Do you know which revision of the Pod 3 you have? I've pulled apart a Pod 3 but the daughterboard does not carry a microSD card. Do you have any pictures?

This is what I see. I'm wondering if they did a revision to remove the SD card.

[bobobo1618]

Damn, looks like they have a revision with a completely different daughterboard and it looks like they made this one themselves. Is there no SD card on it at all? Nothing on the back of the daughterboard for example?

I've added some info on my board to the readme to hopefully avoid anyone else running into the same problem.

Don't suppose you can share a photo of the back of the daughterboard as well? I'm curious what kind of processor they're using but the chip on this side is a Mediatek MT7668 which is just a wifi/bluetooth chip. If there's no processor on the other side, this board might just only act as a network adapter for the STM32 chips on the larger circuit board, so there wouldn't really be a way to hack it because there'd be nothing to hack.

The only workaround I can think of is to buy the module used on my revision, flash it and install it. Since you wouldn't be able to bootstrap it with the existing Eight Sleep hardware, you'd have to get a dev kit though and that's expensive and I can't guarantee that it'd work.

Something I hope to get to eventually is figuring out the interface the daughterboard uses to communicate with the rest of the hardware. If I can do that, it should theoretically be possible to make an open-source version of the daughterboard hardware and software.

[hongkongkiwi]

Yea, there may be a flash chip on there you can pull the firmware from. Be great to have a picture of the backside of that board..... @craigcabrey ?

Also, a non-blurry photo would be great!

[craigcabrey]

Sorry for the delay, here's the backside (hopefully not too blurry). I didn't see any kind of SPI chip to clip onto. It really seems like it's a fully custom daughterboard.

[craigcabrey]

That said, there are TX/RX pads, though I'm not sure if they are UART or something else. Maybe if somebody is in the ATX area we could collaborate lol

[andrew-kennedy]

@craigcabrey do you know what pod revision shows up in the app for you? I'd like to know if I have a compatible pod 3 without opening it up, if possible. My hub version is 20500-0003-F08-******** (redacted in case the full ID exposes anything private).

[nota-nota-nota]

@bobobo1618 is the SD card supposed to be ON the pop-up daughter board? Or under it?

For my board, the SD card is on the main board. In a slot that was hidden under the daughter board (no sd card on the daughter board).

My main control board is the same as same as the original guide "Control Board 230-0030 Rev-10.7-PRD"

@craigcabrey - There is an unpopulated SD card slot on your main board near the same location of the slot on my board. (it isn't exactly the same. Your SD slot is closer to the screw than mine is).
Unlikely, but connecting an SD card might work...

What revision of the main board do you have?

[misslisa62tx]

I'm fairly certain this is rev 3 of the control board, same version I have, where yours is version 2. (white sticker in the upper left)

Turs out there are a bunch of missing components for the SD card, not just the slot. (at least on mine, not sure about his)

What he didn't show clearly on the daughter board is the Kingston 32GB EMMC flash chip.

I'm fairly certain that's where the code will be now. I don't see any other memory chips on either board.
Unfortunately, I believe it would have to be desoldered in order to read/write it.

[misslisa62tx]

Oh, I meant to say. They've added another set of jumper pads on the main control board in J7. My guess is that is now the factory programming port. I might trace that out and see if I can prove that.

[timwu]

Out of curiosity, can we get the manufacturing dates of the different Pod 3s in question? Might help to discern which Pod 3's are usable before tearing them open.

[misslisa62tx]

I now have two units. One dated 20220920 which is the version with the SD Card. The other dated 20240307 which does not have an SD Card.

My 2022 unit was sold cheap as faulty (I haven't booted it, so I don't know for sure yet). If it boots far enough to flash the processor card and they are compatible, I'm planning to try to program the 2024 unit processor card with the 2022 unit control board or run the 2022 unit processor on the 2024 unit control board.

Right now I've got other things on my plate that have priority. I'll update when I get the chance to try that out.

[timwu]

Thanks! I was meaning to report back on my question above. Sorry if this has diverged a bit off topic.

TL;DR: Pod 3's with FCC ID: TFB-1004 on the back seem to be the moddable ones.

After looking through some listings for used pod 3 hubs, I noticed that there are some (like yours, manufactured ~2022) that have an FCC ID on the back sticker of TFB-1004 like this:

This is in contrast to more recently manufactured ones with an FCC ID of 2AYXT61100001, like this:

Looking up FCC ID: TFB-1004 leads to this. Which looks like the regulatory filing for the Variscite MXM board. Going off that, I bought a used one with the corresponding FCC ID and can confirm it does indeed have the SD card slot and such.

Also interesting, looking up FCC ID 2AYXT61100001, leads to this, which has some pictures of the eight sleep board. Not sure if there's anything else useful in that filing though.

[schrauger]

I now have two units. One dated 20220920 which is the version with the SD Card. The other dated 20240307 which does not have an SD Card.

My 2022 unit was sold cheap as faulty (I haven't booted it, so I don't know for sure yet). If it boots far enough to flash the processor card and they are compatible, I'm planning to try to program the 2024 unit processor card with the 2022 unit control board or run the 2022 unit processor on the 2024 unit control board.

Right now I've got other things on my plate that have priority. I'll update when I get the chance to try that out.

I'd be very interested to know if this works. I'm looking for pods with the older FCC ID showing to purchase, but if we can use the older board on a newer pod, it would mean any future repairs or replacements could be an easy swap out, without worrying about finding an ever-decreasing supply of older revision pods.

[timwu]

I guess another option would be to see if the control board + processor card can be swapped. Maybe the interface for the processor card is proprietary/subtly incompatible, but the lower level connectors (i.e. pump on, fan on, etc.) could be compatible between the older control board and newer pod unit? When I get around to it I can try to take out my control board and compare the connectors with the ones for the newer control board in the FCC filing.

I'd imagine the breakdowns we would expect in the longer term would be the larger mechanical components anyways. Maybe that would prove sufficient.

[morelazers]

Also very interested in this. I have a newer 2AYX... model Pod 3 and after cancelling the subscription lost access to basically all of the features. Happy to perform minor surgery on my unit though I'm useless with a soldering iron.

[davidsilva2841]

Hi @bobobo1618,

I was wondering if you could share a complete copy of the SD card in your Eight Sleep.

I’m trying to hack into my own Eight Sleep, but I have the revision E board, which does not have an SD card. I’m currently attempting to gain access to the OS via the J7 and J10 interfaces.

Having a complete copy of the SD card might provide documentation or clues on how to connect to and communicate with the device.

I won't share or publish the copy anywhere. I’m just looking for guidance since hardware hacking is new to me.

Thank you!

[timwu]

@davidsilva2841 Check out this blogpost, there's a bit of info on how to get the current swupdate image among other interesting tidbits.

[davidsilva2841]

@timwu
The file it links to here, does not exist anymore.

Would you be able to provide a copy of the SD card?

[smiba]

The file still is there just add some numbers to the deviceid :)

It seems they just blocked "1"

[davidsilva2841]

I'm connected to the J7 JTAG using a Tag-Connect TC2070-IDC with my FT2232H-56Q and am trying to determine the pin mapping. I plan to try the J10 JTAG later.

If anyone with access to their SD card could share copies of the /proc/, /sys/, and /dev/ folders, it would be greatly appreciated, as these might contain documentation or hints about the pins. These folders were not included when I downloaded the firmware update following this

Working with JTAGs is new to me, so any help or guidance would be greatly appreciated.