Nest Hacking - Revision history

Martiniturbide at 20:21, 3 January 2017

2017-01-03T20:21:12Z

← Older revision		Revision as of 20:21, 3 January 2017
Line 366:		Line 366:
	ln -s . /lib/arm-linux-gnueabihf		ln -s . /lib/arm-linux-gnueabihf
	ln -s ld-2.11.1.so /lib/ld-linux-armhf.so.3		ln -s ld-2.11.1.so /lib/ld-linux-armhf.so.3

			[[Category:Google]]
			[[Category:Nest]]

Luke-Jr: /* Backplate state */

2014-08-10T21:13:51Z

Backplate state

← Older revision		Revision as of 21:13, 10 August 2014
Line 246:		Line 246:
	* 16-bit milli-volts "vo"		* 16-bit milli-volts "vo"
	* 16-bit milli-volts "vb"		* 16-bit milli-volts "vb"
	* 8-bit ("pins" ~~or "wires")~~		* 8-bit "pins"
	* 8-bit ("wires" ~~or "pins")~~		* 8-bit "wires"
	* 16-bit UNKNOWN

	=== "Buffers" ===		=== "Buffers" ===

Luke-Jr: /* Backplate to display */

2014-08-10T21:08:05Z

Backplate to display

← Older revision		Revision as of 21:08, 10 August 2014
Line 186:		Line 186:
	[[#FET presence\|0004 - FET presence]]		[[#FET presence\|0004 - FET presence]]
	0005 - pir? (32-bit data)		0005 - pir? (32-bit data)
	0006 - ack switch?		0006 - "ack switch" (data: 8-bit switch id, 8-bit state)
	0007 - near pid? (every second; 16-bit data)		0007 - near pid? (every second; 16-bit data)
	0008 - proximity?		0008 - proximity?

Luke-Jr: /* Backplate state */

2014-08-10T21:01:08Z

Backplate state

← Older revision		Revision as of 21:01, 10 August 2014
Line 240:		Line 240:
	** Bit 0x40 = charger off (?)		** Bit 0x40 = charger off (?)
	* 8-bit "px0" (may be wider?)		* 8-bit "px0" (may be wider?)
	* 40-bit ~~UNKNOWN~~ (~~includes at least~~ "p2" ~~and~~ "voc")		* ? 16-bit "sw" fraction (0800 = 08/00)
			* ? 8-bit "p2"
			* ? 16-bit "voc"
	* 16-bit centi-volts "vi"		* 16-bit centi-volts "vi"
	* 16-bit milli-volts "vo"		* 16-bit milli-volts "vo"

Luke-Jr: /* Power management */

2014-08-10T07:32:26Z

Power management

← Older revision		Revision as of 07:32, 10 August 2014
Line 330:		Line 330:

	The Nest client sends 0083 every 30 seconds, but at least the periodic temperature status will continue on for an hour before stopping.		The Nest client sends 0083 every 30 seconds, but at least the periodic temperature status will continue on for an hour before stopping.

			=== Power management ===
			Wake vector bits:
			0001 - timer
			0002 - buffers full
			0004 - temperature
			0008 - pir
			0010 - proximity
			0020 - humidity
			0040 - near pir
			0080 - als
			0100 - "vbat"
			0200 - "vergence"

	=== Temperature reading ===		=== Temperature reading ===

Luke-Jr: /* Backplate state */

2014-08-10T04:51:23Z

Backplate state

← Older revision		Revision as of 04:51, 10 August 2014
Line 238:		Line 238:
	* 8-bit "state"		* 8-bit "state"
	* 8-bit "flags"		* 8-bit "flags"
			** Bit 0x40 = charger off (?)
	* 8-bit "px0" (may be wider?)		* 8-bit "px0" (may be wider?)
	* 40-bit UNKNOWN (includes at least "p2" and "voc")		* 40-bit UNKNOWN (includes at least "p2" and "voc")

Luke-Jr: /* Display to backplate */

2014-08-09T07:51:17Z

Display to backplate

← Older revision		Revision as of 07:51, 9 August 2014
Line 178:		Line 178:
	00c2 - set wakeup temperatures (48-bit data)		00c2 - set wakeup temperatures (48-bit data)
	00c3 - set temp comp mode request (??? data)		00c3 - set temp comp mode request (??? data)
			00fe - DEBUG MODE
	[[#Reset\|00ff - Reset]]		[[#Reset\|00ff - Reset]]

Luke-Jr: /* Backplate to display */

2014-08-09T06:40:18Z

Backplate to display

← Older revision		Revision as of 06:40, 9 August 2014
Line 184:		Line 184:
	[[#Temperature reading\|0002 - Temperature reading (twice every 30 seconds; 32-bit data)]]		[[#Temperature reading\|0002 - Temperature reading (twice every 30 seconds; 32-bit data)]]
	[[#FET presence\|0004 - FET presence]]		[[#FET presence\|0004 - FET presence]]
	0005 - (32-bit data)		0005 - pir? (32-bit data)
	0006 - ?		0006 - ack switch?
	0007 - (every second; 16-bit data)		0007 - near pid? (every second; 16-bit data)
	0008 - ?		0008 - proximity?
	[[#FET presence\|0009 - FET presence]]		[[#FET presence\|0009 - FET presence]]
	000a - (every second; 2x(?) 16-bit data)		000a - als? (every second; 2x(?) 16-bit data)
	[[#Backplate state\|000b - Backplate state]]		[[#Backplate state\|000b - Backplate state]]
	000c - (16-bit values: pir, px1, px1 divisor, px2, px2 divisor, alir, av; included in [[#"Buffers"\|"buffers" data]])		000c - sensor? (16-bit values: pir, px1, px1 divisor, px2, px2 divisor, alir, av; included in [[#"Buffers"\|"buffers" data]])
	000e - ?		000e - power?
	0010 - (24-bit data)		0010 - (24-bit data)
	[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]		[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]
	0012 - ?		0012 - ?
	0013 - ?		0013 - "Wakeup"?
	0014 - "WakeVector" (16-bit data)		0014 - "WakeVector" (16-bit data)
	[[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]		[[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]

Luke-Jr: /* Backplate to display */

2014-08-09T04:08:06Z

Backplate to display

← Older revision		Revision as of 04:08, 9 August 2014
Line 185:		Line 185:
	[[#FET presence\|0004 - FET presence]]		[[#FET presence\|0004 - FET presence]]
	0005 - (32-bit data)		0005 - (32-bit data)
			0006 - ?
	0007 - (every second; 16-bit data)		0007 - (every second; 16-bit data)
			0008 - ?
	[[#FET presence\|0009 - FET presence]]		[[#FET presence\|0009 - FET presence]]
	000a - (every second; 2x(?) 16-bit data)		000a - (every second; 2x(?) 16-bit data)
	[[#Backplate state\|000b - Backplate state]]		[[#Backplate state\|000b - Backplate state]]
	000c - (16-bit values: pir, px1, px1 divisor, px2, px2 divisor, alir, av; included in [[#"Buffers"\|"buffers" data]])		000c - (16-bit values: pir, px1, px1 divisor, px2, px2 divisor, alir, av; included in [[#"Buffers"\|"buffers" data]])
			000e - ?
	0010 - (24-bit data)		0010 - (24-bit data)
	[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]		[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]
			0012 - ?
			0013 - ?
	0014 - "WakeVector" (16-bit data)		0014 - "WakeVector" (16-bit data)
	[[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]		[[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]

Luke-Jr at 21:16, 8 August 2014

2014-08-08T21:16:00Z

← Older revision		Revision as of 21:16, 8 August 2014
Line 58:		Line 58:
	Send [[#FET presence\|008f - FET presence]]		Send [[#FET presence\|008f - FET presence]]
	Send [[#Periodic status\|0083 - Periodic status request]]		Send [[#Periodic status\|0083 - Periodic status request]]
	Send 0090 - get ~~mono~~ id (no data; response 0010 with 3 bytes)		Send 0090 - get Mono/TFE id (no data; response 0010 with 3 bytes)
	Recv 0001 - (message from backplate; ASCII)		Recv 0001 - (message from backplate; ASCII)
	Recv 0001 - (message from backplate; ASCII)		Recv 0001 - (message from backplate; ASCII)
	Recv 0010 - (24-bit data)		Recv 0010 - (24-bit data)
	Send [[#Get TFE version\|0098 - Get TFE version]]		Send [[#Get Mono/TFE version\|0098 - Get Mono/TFE version]]
	Recv 000a - (every second; 16-bit data)		Recv 000a - (every second; 16-bit data)
	Recv 0007 - (every second; 16-bit data)		Recv 0007 - (every second; 16-bit data)
	Recv [[#Get TFE version\|0018 - Get TFE version (response)]]		Recv [[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]
	Send [[#Get build info\|0099 - Get build info]]		Send [[#Get Mono/TFE build info\|0099 - Get Mono/TFE build info]]
	Recv [[#Get build info\|0019 - Get build info (response)]]		Recv [[#Get Mono/TFE build info\|0019 - Get Mono/TFE build info (response)]]
	Sometimes:		Sometimes:
	Send 009d - get ~~bsl~~ id (no data; responds with 001d)		Send 009d - get BSL id (no data; responds with 001d)
	Recv 001d - bsl id (response to 009d; 16-bit data)		Recv 001d - bsl id (response to 009d; 16-bit data)
	Sometimes:		Sometimes:
Line 75:		Line 75:
	Recv [[#Get BSL version\|001b - Get BSL version (response)]]		Recv [[#Get BSL version\|001b - Get BSL version (response)]]
	Sometimes:		Sometimes:
	Send 009c - (no data; responds with 001c (constant?) data="BSL")		Send 009c - get BSL info (no data; responds with 001c (constant?) data="BSL")
	Recv 001c - Response to 009c; always(?) "BSL"		Recv 001c - Response to 009c; always(?) "BSL"
	Send [[#Get serial number\|009f - Get serial number]]		Send [[#Get serial number\|009f - Get serial number]]
	Recv [[#Get serial number\|001f - Get serial number (response)]]		Recv [[#Get serial number\|001f - Get serial number (response)]]
	Send [[#Get hardware version?\|009e - Get hardware version?]]		Send [[#Get hardware version\|009e - Get hardware version]]
	Recv [[#Get hardware version?\|001e - Get hardware version? (response)]]		Recv [[#Get hardware version\|001e - Get hardware version (response)]]

	== Nest backplate interface ==		== Nest backplate interface ==
Line 154:		Line 154:
	[[#Periodic status\|0083 - Periodic status request]]		[[#Periodic status\|0083 - Periodic status request]]
	[[#FET presence\|008f - FET presence]]		[[#FET presence\|008f - FET presence]]
	0090 - get ~~mono~~ id (no data; response 0010 with 3 bytes)		0090 - get Mono/TFE id (no data; response 0010 with 3 bytes)
	[[#Backplate firmware upload\|0091 - Backplate firmware upload (start)]]		[[#Backplate firmware upload\|0091 - Backplate firmware upload (start)]]
	[[#Backplate firmware upload\|0092 - Backplate firmware upload]]		[[#Backplate firmware upload\|0092 - Backplate firmware upload]]
	[[#Backplate firmware upload\|0093 - Backplate firmware upload (finish)]]		[[#Backplate firmware upload\|0093 - Backplate firmware upload (finish)]]
	[[#Get TFE version\|0098 - Get TFE version]]		[[#Get Mono/TFE version\|0098 - Get Mono/TFE version]]
	[[#Get build info\|0099 - Get build info]]		[[#Get Mono/TFE build info\|0099 - Get Mono/TFE build info]]
	[[#Get BSL version\|009b - Get BSL version]]		[[#Get BSL version\|009b - Get BSL version]]
	009c - (no data; responds with 001c (constant?) data="BSL")		009c - get BSL info (no data; responds with 001c (constant?) data="BSL")
	009d - get ~~bsl~~ id (no data; responds with 001d)		009d - get BSL id (no data; responds with 001d)
	[[#Get hardware version?\|009e - Get hardware version?]]		[[#Get hardware version\|009e - Get hardware version]]
	[[#Get serial number\|009f - Get serial number]]		[[#Get serial number\|009f - Get serial number]]
	00a1 - quiet (16-bit max sleep seconds)		00a1 - quiet (16-bit max sleep seconds)
Line 169:		Line 169:
	[[#"Buffers"\|00a3 - ACK to 002f (no data)]]		[[#"Buffers"\|00a3 - ACK to 002f (no data)]]
	00a4 - set wakeup mask (16-bit data)		00a4 - set wakeup mask (16-bit data)
	00b1 - button pressed/unpressed (no data)		00b1 - "temperature lock" (sent when button pressed/unpressed; no data)
	00b3 - set humidity thresholds (32-bit data)		00b3 - set humidity thresholds (32-bit data)
	00b5 - set near pir threshold (16-bit data)		00b5 - set near pir threshold (16-bit data)
			00b7 - set pir thresholds (??? data)
			00b8 - set proximity thresholds (??? data)
	00b9 - set als thresholds (32-bit data)		00b9 - set als thresholds (32-bit data)
	00ba - set vergence mode (48-bit data)		00ba - set vergence mode (48-bit data)
	00c2 - (48-bit data)		00c2 - set wakeup temperatures (48-bit data)
			00c3 - set temp comp mode request (??? data)
	[[#Reset\|00ff - Reset]]		[[#Reset\|00ff - Reset]]

Line 190:		Line 193:
	[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]		[[#Backplate firmware upload\|0011 - Backplate firmware upload (ACK)]]
	0014 - "WakeVector" (16-bit data)		0014 - "WakeVector" (16-bit data)
	[[#Get TFE version\|0018 - Get TFE version (response)]]		[[#Get Mono/TFE version\|0018 - Get Mono/TFE version (response)]]
	[[#Get build info\|0019 - Get build info (response)]]		[[#Get Mono/TFE build info\|0019 - Get Mono/TFE build info (response)]]
	[[#Get BSL version\|001b - Get BSL version (response)]]		[[#Get BSL version\|001b - Get BSL version (response)]]
	001c - Response to 009c; always(?) "BSL"		001c - Response to 009c; always(?) "BSL"
	001d - bsl id (response to 009d; 16-bit data)		001d - bsl id (response to 009d; 16-bit data)
	[[#Get hardware version?\|001e - Get hardware version? (response)]]		[[#Get hardware version\|001e - Get hardware version (response)]]
	[[#Get serial number\|001f - Get serial number (response)]]		[[#Get serial number\|001f - Get serial number (response)]]
	[[#"Buffers"\|0022 - buffered temperature reading (possibly multiple times)]]		[[#"Buffers"\|0022 - buffered temperature reading (possibly multiple times)]]
Line 289:		Line 292:
	In a power outage condition, 0004 will report all absent (including unknown ones), whereas 0009 will continue to report the same as when power is available.		In a power outage condition, 0004 will report all absent (including unknown ones), whereas 0009 will continue to report the same as when power is available.

	=== Get build info ===		=== Get Mono/TFE build info ===
	Message 0099 (no data) requests the backplate report information about its build.		Message 0099 (no data) requests the backplate report information about its build.
	The response will be message 0019 in ASCII (one line, no trailing newline).		The response will be message 0019 in ASCII (one line, no trailing newline).

	=== Get hardware version? ===		=== Get hardware version ===
	Message 009e (no data) requests the backplate report a "Backplate-"X.Y version string.		Message 009e (no data) requests the backplate report a "Backplate-"X.Y version string.
	Since the firmware file on the display CPU uses these strings as "MinApplicability" and "MaxApplicability" ranges, it is probable they refer to the hardware.		Since the firmware file on the display CPU uses these strings as "MinApplicability" and "MaxApplicability" ranges, it is probable they refer to the hardware.
Line 304:		Line 307:
	The response will be message 001b in ASCII.		The response will be message 001b in ASCII.

	=== Get TFE version ===		=== Get Mono/TFE version ===
	Message 0098 (no data) requests the backplate report its TFE version number.		Message 0098 (no data) requests the backplate report its TFE version number.
	The response will be message 0018 in ASCII.		The response will be message 0018 in ASCII.