From e98261556cb0ae50c7c46177a649787bbf5eb291 Mon Sep 17 00:00:00 2001 From: Oliver Nemec <28827159+onemec@users.noreply.github.com> Date: Mon, 12 Oct 2026 11:50:59 -0400 Subject: [PATCH 1/3] docs: warn of permanent root lockout from official OTA firmware --- content/core/firmware-updates.mdx | 56 +++++++++++++++++++------------ 1 file changed, 35 insertions(+), 21 deletions(-) diff --git a/content/core/firmware-updates.mdx b/content/core/firmware-updates.mdx index 306e75a..0a65971 100644 --- a/content/core/firmware-updates.mdx +++ b/content/core/firmware-updates.mdx @@ -34,29 +34,12 @@ The userspace ARM64 binaries (`frankenfirmware`, `libnats`, `nats-server`) run a --- -## Option 1: Factory reset and official OTA (safest) - -If you are using matching hardware (such as a Pod 3 hub with a Pod 3 cover, or a Pod 4 hub with a Pod 4 cover) and want the safest path to the latest vendor firmware, use the official factory reset procedure. - -1. **Perform a hardware factory reset:** - Follow the firmware reset photos for your model in [free-sleep's installation guide](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md). The hub boots from its factory backup partition and resets network settings. -2. **Pair with the official Eight Sleep app:** - Temporarily pair the Pod to the official mobile app over Wi-Fi. Allow the hub to connect to Eight Sleep's servers and download official over-the-air (OTA) updates. Wait until all firmware and subsystem updates finish applying. -3. **Re-gain root access and reinstall sleepypod:** - Once the official firmware is up to date, re-open the root shell using the hardware serial procedure described in [Open your Pod and get root](/core/root-access/), then install sleepypod following [Install and update Core](/core/installation/). - - - **Limitation:** Official OTA will not resolve cross-generation hardware pairings (for example, - official servers will not push STM32G0 Pod 4 cover firmware to a registered Pod 3 hub). For - mismatched hardware or offline setups, use Option 2 below. - - ---- - -## Option 2: Manual subsystem update (surgical extraction) +## Method 1: Manual subsystem update (Recommended) This method extracts universal 64-bit ARM binaries and STM32 microcontroller firmware from an official `.swu` release and stages them directly on your rooted Pod. +Because it works entirely on the local device without connecting the Pod to Eight Sleep cloud servers, this method keeps your existing root shell, masked update services, and SSH keys intact. + ### Step 1: Back up the existing pod state Connect to your Pod over SSH as `root` (port 8822) and back up the current daemon and firmware directory: @@ -367,7 +350,10 @@ Finally, check `/persistent/sleepypod-data/biometrics.db` to confirm that `cap_s This procedure is strictly limited to boards running on the verified **Slot A** eMMC boot path (`/dev/mmcblk0p5`, `rootfs_a`) described in the [root access guide](/core/root-access/#6-boot-a-temporary-administrator-shell). Do not run this on SD-card installations (such as Pod 3 with an SD card), systems booted from Slot B, or unknown partition layouts. -**Leaving Slot B untouched is recommended.** If Slot B retains its original factory installation, a hardware factory reset will safely boot into a pristine stock environment. If you overwrite Slot B, factory reset will boot into this modified environment instead. +**Weighing Slot B synchronization:** + +- **Leaving Slot B untouched:** If Slot B retains its original factory installation, a hardware factory reset will boot into a pristine stock environment. However, if the hub ever boots Slot B and connects to the internet with stock update services active, official over-the-air updates may permanently patch root access. +- **Synchronizing Slot B:** Copying your verified SSH keys, configurations, and masked services to Slot B prevents accidental firmware mismatches or root lockouts if the bootloader ever fails over to Slot B. However, overwriting Slot B means a factory reset boots into this modified environment rather than factory stock. Only synchronize Slot B if you are completely confident in your installation and want to prevent a lockout or firmware mismatch if the hardware ever fails over to Slot B. @@ -502,4 +488,32 @@ ssh -p 8822 root@POD_IP " --- +## Alternative: Official OTA via factory reset (Caution: Root lockout risk) + + + **High risk of permanent root lockout.** + +Recent official Eight Sleep firmware releases reportedly patch known backdoor and root access vectors. If you perform a factory reset and pair the hub with the official Eight Sleep app over Wi-Fi, the hub downloads and applies the latest vendor updates from Eight Sleep's servers. + +Once updated to a patched stock build, you may be permanently blocked from regaining a root shell via serial/UART or reinstalling sleepypod. + +**Do not use this method if you plan to keep root access or run sleepypod.** Only follow these steps if you are returning the device permanently to stock operation and will only use the official Eight Sleep service. + + + +For matched hardware returning to stock: + +1. **Perform a hardware factory reset:** + Follow the firmware reset photos for your model in [free-sleep's installation guide](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md). The hub boots from its factory backup partition and resets network settings. +2. **Pair with the official Eight Sleep app:** + Pair the Pod to the official mobile app over Wi-Fi. Allow the hub to connect to Eight Sleep's servers and download official over-the-air (OTA) updates until all firmware and subsystem updates finish applying. + + + **Hardware limitation:** Official OTA will not resolve cross-generation hardware pairings (for + example, official servers will not push STM32G0 Pod 4 cover firmware to a registered Pod 3 hub). + For cross-generation hardware, use Method 1 above. + + +--- + **Source reference:** [`sp-status` output format](https://github.com/sleepypod/core/blob/9bbc7232924fd2b18c7176c259556151aecc6412/scripts/bin/sp-status) · [Root SSH key resolution in the Core installer](https://github.com/sleepypod/core/blob/9bbc7232924fd2b18c7176c259556151aecc6412/scripts/lib/ssh-helpers) · [free-sleep firmware reset and slot check](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md) · [Archived Pod 3 `.swu` releases](http://web.archive.org/web/*/fw.8slp.net/pod3-updates/pod3/releases/*). Stream limits, subject rates, serial port mapping, and the Slot B `sshd` configuration were checked on an MT8365 Pod 3 hub (`pn 20500`, revision `0504`) with a Pod 4 cover, using artifacts extracted from release `77af88bd8b941fed81786c09a9ac3cdb1e97b126`. From 6e7e4469e961c3a8f6497858c3e3b7ddf9c70695 Mon Sep 17 00:00:00 2001 From: Oliver Nemec <28827159+onemec@users.noreply.github.com> Date: Mon, 12 Oct 2026 12:40:29 -0400 Subject: [PATCH 2/3] docs: clarify factory-reset and Slot B environment behavior --- content/core/firmware-updates.mdx | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/core/firmware-updates.mdx b/content/core/firmware-updates.mdx index 0a65971..4c2835c 100644 --- a/content/core/firmware-updates.mdx +++ b/content/core/firmware-updates.mdx @@ -352,10 +352,10 @@ This procedure is strictly limited to boards running on the verified **Slot A** **Weighing Slot B synchronization:** -- **Leaving Slot B untouched:** If Slot B retains its original factory installation, a hardware factory reset will boot into a pristine stock environment. However, if the hub ever boots Slot B and connects to the internet with stock update services active, official over-the-air updates may permanently patch root access. -- **Synchronizing Slot B:** Copying your verified SSH keys, configurations, and masked services to Slot B prevents accidental firmware mismatches or root lockouts if the bootloader ever fails over to Slot B. However, overwriting Slot B means a factory reset boots into this modified environment rather than factory stock. +- **Leaving Slot B untouched:** If Slot B retains its original factory installation, a hardware factory reset can safely boot into a pristine stock environment. However, if the hub ever boots Slot B and connects to the internet with stock update services active, official over-the-air updates may permanently patch root access. +- **Synchronizing Slot B:** Copying your verified SSH keys, configurations, and subsystem binaries to Slot B ensures SSH key access and hardware compatibility survive if the bootloader ever fails over to Slot B. However, overwriting Slot B replaces the pristine factory backup. -Only synchronize Slot B if you are completely confident in your installation and want to prevent a lockout or firmware mismatch if the hardware ever fails over to Slot B. +Only synchronize Slot B if you are completely confident in your installation and want to prevent a firmware mismatch or loss of SSH access if the hardware ever fails over to Slot B. @@ -501,10 +501,10 @@ Once updated to a patched stock build, you may be permanently blocked from regai -For matched hardware returning to stock: +For matched hardware returning to stock (requires an untouched factory Slot B): 1. **Perform a hardware factory reset:** - Follow the firmware reset photos for your model in [free-sleep's installation guide](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md). The hub boots from its factory backup partition and resets network settings. + Follow the firmware reset photos for your model in [free-sleep's installation guide](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md). If Slot B remains untouched, the hub boots from its factory backup partition and resets network settings. If you previously synchronized Slot B, a factory reset boots that modified environment instead of pristine factory stock. 2. **Pair with the official Eight Sleep app:** Pair the Pod to the official mobile app over Wi-Fi. Allow the hub to connect to Eight Sleep's servers and download official over-the-air (OTA) updates until all firmware and subsystem updates finish applying. From fdfbab2615e2b70d884eb212d729f9c66d32bd14 Mon Sep 17 00:00:00 2001 From: Jonathan Ng Date: Wed, 14 Oct 2026 00:18:13 -0700 Subject: [PATCH 3/3] docs: qualify firmware recovery claims and guard modified Slot B --- content/core/firmware-updates.mdx | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/content/core/firmware-updates.mdx b/content/core/firmware-updates.mdx index 4c2835c..0b34e06 100644 --- a/content/core/firmware-updates.mdx +++ b/content/core/firmware-updates.mdx @@ -34,11 +34,11 @@ The userspace ARM64 binaries (`frankenfirmware`, `libnats`, `nats-server`) run a --- -## Method 1: Manual subsystem update (Recommended) +## Method 1: Manual subsystem update This method extracts universal 64-bit ARM binaries and STM32 microcontroller firmware from an official `.swu` release and stages them directly on your rooted Pod. -Because it works entirely on the local device without connecting the Pod to Eight Sleep cloud servers, this method keeps your existing root shell, masked update services, and SSH keys intact. +This procedure replaces selected subsystem files without installing a complete stock operating system. It does not intentionally change your SSH keys or masked update services. That narrower scope does not guarantee compatibility or recovery: use only the verified hardware combination and keep the backups below. ### Step 1: Back up the existing pod state @@ -352,8 +352,8 @@ This procedure is strictly limited to boards running on the verified **Slot A** **Weighing Slot B synchronization:** -- **Leaving Slot B untouched:** If Slot B retains its original factory installation, a hardware factory reset can safely boot into a pristine stock environment. However, if the hub ever boots Slot B and connects to the internet with stock update services active, official over-the-air updates may permanently patch root access. -- **Synchronizing Slot B:** Copying your verified SSH keys, configurations, and subsystem binaries to Slot B ensures SSH key access and hardware compatibility survive if the bootloader ever fails over to Slot B. However, overwriting Slot B replaces the pristine factory backup. +- **Leaving Slot B untouched:** If Slot B retains its original factory installation, a hardware factory reset boots that factory environment. If stock update services are active and the hub has internet access, it may then install newer firmware. The root-access procedure has not been verified against every resulting firmware version. +- **Synchronizing Slot B:** Copying SSH keys, configurations, and subsystem binaries to Slot B is intended to preserve access and the verified subsystem combination after failover. It does not guarantee access: this script does not disable Slot B’s stock update services, and a later OTA may replace the copied files. Synchronizing Slot B also modifies the factory backup. Only synchronize Slot B if you are completely confident in your installation and want to prevent a firmware mismatch or loss of SSH access if the hardware ever fails over to Slot B. @@ -488,20 +488,20 @@ ssh -p 8822 root@POD_IP " --- -## Alternative: Official OTA via factory reset (Caution: Root lockout risk) +## Alternative: Official OTA via factory reset - **High risk of permanent root lockout.** + **Root access after OTA is not guaranteed.** -Recent official Eight Sleep firmware releases reportedly patch known backdoor and root access vectors. If you perform a factory reset and pair the hub with the official Eight Sleep app over Wi-Fi, the hub downloads and applies the latest vendor updates from Eight Sleep's servers. +Factory reset and pairing with the official app can install newer vendor firmware. The pinned root-access instructions describe particular hardware and firmware; they do not establish that the same serial/UART procedure works after every future update. -Once updated to a patched stock build, you may be permanently blocked from regaining a root shell via serial/UART or reinstalling sleepypod. +Do not assume that you can regain root access or reinstall sleepypod afterward. This guide has no verified firmware-version evidence establishing a permanent UART lockout, so it does not claim that a particular update patches that method. **Do not use this method if you plan to keep root access or run sleepypod.** Only follow these steps if you are returning the device permanently to stock operation and will only use the official Eight Sleep service. -For matched hardware returning to stock (requires an untouched factory Slot B): +For matched hardware returning to stock, first confirm that Slot B is untouched. **If Slot B was synchronized or its state is unknown, stop: do not continue to app pairing under this procedure.** A reset into modified Slot B is not a verified stock-restoration method. If you need to keep root access, use Method 1 only for a supported subsystem update. 1. **Perform a hardware factory reset:** Follow the firmware reset photos for your model in [free-sleep's installation guide](https://github.com/throwaway31265/free-sleep/blob/e5172139874a274d1ced12c8da052ab2cbaa286d/INSTALLATION.md). If Slot B remains untouched, the hub boots from its factory backup partition and resets network settings. If you previously synchronized Slot B, a factory reset boots that modified environment instead of pristine factory stock.