Repurposing Movistar Home

as a Home Assistant dashboard panel.

GitHub repository

Versión en castellano

hass

HELP NEEDED

I dumped the original Android-x86 firmware from flash, but it failed to boot after I wrote it back in, and the /data partition was encrypted and I couldn't find a way to decrypt it.

Contributions to the repository are very welcomed if you've got any discoveries; or if you have a Movistar Home not in use and willing to help this project, please contact me through my email in GitHub profile, much appreciated!

TODO list

  • Fix sound card driver (ALSA configs)
  • Fix camera driver
  • Fix bluetooth driver
  • Fix reset button
  • Find a way to install Linux without disassembling nor soldering (maybe through easycwmp on port 7547)

Tech specs

CPU Intel Atom x5-Z8350 (4C4T) @ 1.44 GHz
RAM Hynix 2 GB DDR3 ECC @ 1600 MHz
Storage Kingston TB2816 16 GB eMMC
Screen 8-inch 1280x800 with Goodix I2C touch screen
Wi-Fi & Bluetooth Realtek RTL8822BE
Sound card Realtek RT5672
Speakers 2 x 5 W (SPL 87 dB @ 1 W | 1 m)
Microphones 4 omnidirectional microphones with dedicated DSP
Camera OMNIVISION OV2680 with 2 megapixels
Dimensions 21.2 x 23.5 x 12.2 cm (height x width x depth)
Weight 1.1 kg

Driver status

As in the latest Manjaro XFCE with 5.15.28-1 kernel, on April 9, 2022:

Device Driver Status
Touch screen goodix OK
Wi-Fi rtw88_8822be OK
Bluetooth rtw88_8822be Not working
Sound card snd_soc_sst_cht_bsw_rt5672 Not working
Camera atomisp Not working

Linux installation

Disassemble the device, be careful not to damage those snaps under the back panel.

Locate the unpopulated micro USB port on the left edge of the motherboard:

inside-with-usb-port-location

Solder a micro USB female connector and connect an OTG adapter, or just a cable with a standard USB female connector to it, then short the fourth pin (or the ID pad) to the ground (GND), making the device function as an OTG host.

Flash a USB drive with your favorite Linux distro, I recommend using XFCE desktop environment since it only has 2 GB RAM.

Connect a keyboard and the drive to a USB hub and connect it to Movistar Home. Power it up while pressing the F2 key, it will boot into BIOS setup, navigate to the last tab (Save & Exit), select your USB drive (should be something like UEFI: USB, Partition 1) in the Boot Override menu, press Enter key to boot it.

bios

Install your linux as usual, it may be necessary to include non-free drivers.

It's recommended to set up the OpenSSH server before unsoldering the USB connector and reassembling the device, for possible future maintenance.

Configurations

The following configurations were made for Manjaro XFCE and may need to be adjusted for other distros.

Fix screen rotation

Create file /etc/X11/xorg.conf.d/20-monitor.conf with following content:

Section "Monitor"
        Identifier      "DSI1"
        Option          "Rotate" "right"
        Option          "Scale"  "0.8x0.8"
EndSection

Adjust the scaling parameter to your liking, I found 0.8x most suitable for this screen.

Fix touch screen

For some reason the touch screen won't work at all unless it's soft rebooted once, in dmesg the driver says "Goodix-TS i2c-GDIX1001:00: Invalid config (0, 0, 0), using defaults".

Create file /etc/systemd/system/fix-touchscreen.service with following content:

[Unit]
Description=Fix touchscreen

[Service]
Type=oneshot
ExecStart=sh -c 'dmesg | grep -q " Goodix-TS .*: Invalid config " && reboot now || exit 0'

[Install]
WantedBy=multi-user.target

Then execute sudo systemctl daemon-reload && systemctl enable fix-touchscreen.service to make it run at boot.

For fixing rotation, create file /etc/X11/xorg.conf.d/30-touchscreen.conf with following content:

Section "InputClass"
        Identifier      "calibration"
        MatchProduct    "Goodix Capacitive TouchScreen"
        Option          "TransformationMatrix"  "0 1 0 -1 0 1 0 0 1"
EndSection

Fix touch control in Firefox

Source: Firefox/Tweaks - ArchWiki

Open Firefox and access about:config, search for dom.w3c_touch_events.enabled and make sure it's either set to 1 (enabled) or 2 (default, auto-detect).

Add MOZ_USE_XINPUT2 DEFAULT=1 to /etc/security/pam_env.conf.

Auto backlight dimming

Create file /etc/X11/xorg.conf.d/10-intel.conf with following content:

Section "Device"
        Identifier      "Intel Graphics"
        Driver          "intel"
        Option          "AccelMethod"   "sna"
        Option          "TearFree"      "true"
        Option          "Backlight"     "intel_backlight"
EndSection

Open Xfce's Power Manager, switch to Display tab, and adjust the Brightness reduction settings. I personally set it to reduce to 20% after 90 seconds of inactivity.

Remember also to disable the auto suspension/shutdown from there.

Create file ~/.config/autostart/set-backlight.desktop with following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=Set Backlight Brightness
Comment=Set backlight brightness on startup
Exec=bash -c "echo 100 > /sys/class/backlight/intel_backlight/brightness"
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

(I found this is somehow not achievable with a systemd service)

Virtual keyboard

Install Onboard with sudo pacman -S onboard, open Xfce's Session and Startup settings, switch to Application Autostart tab, find and enable Onboard (Flexible onscreen keyboard).

After rebooting, open Onboard's settings and adjust them to your liking.

Hide mouse cursor

Install unclutter with sudo pacman -S unclutter.

Create file ~/.config/autostart/hide-cursor.desktop with following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=Hide Cursor
Comment=Hide mourse cursor
Exec=unclutter --hide-on-touch
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

Home Assistant dashboard

Create file ~/.config/autostart/HASS.desktop with following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=HASS Dashboard
Comment=Run HASS dashboard in Firefox kiosk
Exec=firefox -kiosk -url 'https://your.hass.url'
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

Prevent screen burn-in

DO NOT USE this script if you or a family member has photosensitive epilepsy!

Since it will mostly be used to display a HASS dashboard 24/7, it's very likely to get screen burn-in after some time, although it has an LCD screen. To prevent that, I wrote a Python script to have it periodically flash several colors in full screen to refresh all the pixels.

Create file /usr/bin/screensaver.py with following content, then run command chmod +x /usr/bin/screensaver.py to make it executable:

#!/usr/bin/env python3
from time import time
import tkinter as tk

color_interval = 300  # milliseconds
total_time = 10  # seconds, exit after that

colors = ['red', 'green', 'blue', 'black', 'white']
color_index = 0

root = tk.Tk()
w, h = root.winfo_screenwidth(), root.winfo_screenheight()
root.overrideredirect(True)
root.attributes('-fullscreen', True)
canvas = tk.Canvas(root, width=w, height=h, background='black', highlightthickness=0)
canvas.pack()
canvas.focus_set()
canvas.bind('<Button-1>', lambda _: root.destroy())  # exit on touch


def flash_color():
    global color_index
    if time() - time_start > total_time: root.destroy()
    canvas.configure(background=colors[color_index])
    color_index = (color_index + 1) % len(colors)
    root.after(color_interval, flash_color)


time_start = time()
flash_color()
root.mainloop()

Adjust the two variables color_interval and total_time to your liking, with total_time = 10 it will be running for 10 seconds, just touch the screen if you need to stop it immediately.

Run command crontab -e and add a cron job as following, which will run the script every hour:

0 * * * *       export DISPLAY=:0; /usr/bin/screensaver.py

Research notes

Background

Recently while I was lurking around on Wallapop, the Spanish Craiglist, one item caught my attention:

wallapop

This is Movistar Home, a smart home hub from Spain's biggest ISP, Telefónica Movistar. It's basically a smart speaker with a touch screen and built-in AI assistant (called Aura), something like Amazon Echo Show and Google Nest Hub. But it's well-integrated with the other products in Movistar's ecosystem, including controlling TV, WiFi, IoT devices (which I didn't find any detailed information). It can also play movies, TV series, music, and games on the device itself, but I doubt the user experience would be satisfying on that 8-inch screen.

I've always wanted to have a Home Assistant dashboard panel like everyone on /r/homeassistant with wall-mounted tablets, but I feel like something that sits on the desk would suit my use cases better, also I don't want to install something possibly permanent on the wall.

After searching around, I couldn't find any useful information about hacking this device. A video published on YouTube gave a glance of its virtual keyboard, which is obviously a Gboard on Android. And according to the official website it has a CPU from Intel, which should be one of the Atom series widely used in Android & Windows tablets, so it seems like it's basically a tablet running Android-x86, not something too bizarre.

characteristics

Tempted by the cheap price, I bought one for only 15 euros from a nice dude, including that wireless handset.

Trying to break out

When I first powered it up, it asks me to connect to a Wi-Fi, but I couldn't find mine in the list, and it specifically said "Connect you to a Movistar Wi-Fi".

original-wifi

I tried to setup an AP with SSID and MAC address copied from the ones in the list, but it never showed up, even after reboot.

Since I couldn't find a way to continue, I had to dissasemble it:

inside

The top green PCB has the four microphones, mute button and speaker volume buttons; the central blue PCB is the motherboard, with Wi-Fi & Bluetooth module in the upper right corner, speaker amplifier circuit in the bottom right corner, and CPU + RAM + eMMC + other stuff all inside an EMI shield under that big heat sink; the bottom green PCB has the reset button, 12V DC power jack and power button.

On the motherboard, there are two unpopulated 6-pin connector pads which I don't know what they are; a serial port (the 3 pads above the 6-pin connector on the left edge) with output of boot logs.

What really seemed useful was the unpopulated micro USB port pad on the left edge:

usb-port

I soldered a cable with a standard USB female connector to it, and shorted the fourth pin (or the ID pad above) to ground, which made the device as OTG host.

After that, I connected a USB keyboard and tried to escape from the kiosk mode, but the only useful finding was bringing up the browser with Win + B, although it's unable to access any website since not connected to Wi-Fi.

Then I connected a USB hub with a USB ethernet adapter, now it's connected to the Internet:

browser

I was able to download APKs but couldn't find a way to install them. I could read local files using the file:// protocol (e.g. file:///system/build.prop) but when I try to open an APK file with file:///sdcard/download/xxx.apk it only gives me a toast saying that such files can only be accessed with HTTP(S) protocol.

easycwmp

I scanned the open ports on the device, found a HTTP service of easycwmp listening on port 7547, but it's protected with basic authentication. Later in the flash dump I found its credentials should be easycwmp/easycwmp, but it won't boot into the original Android-x86 after I wrote the dump back. easycwmp is a TR-069 client, which usually should only appear in ISP-provided modems and routers, my guess here is that it's for the OS's OTA updates. That means it might be possible to take advantage of this service and flash custom firmware (Linux) without having to disassemble the device and solder USB cable. But unfortunately, I no longer have one with the original OS to do research on it.

So far nothing useful, so I decided to try to get into the BIOS setup which I believe it should have one since it's x86.

Into the BIOS

I tried pressing several different keys on startup, F12 got me a black screen with a text DNX FASTBOOT MODE..., and F2 got me into the BIOS (well actually it's UEFI-only):

bios

From there, I was able to boot Linux normally from a USB drive:

neofetch

For Windows, it always gives me a BSOD with stop code ACPI_BIOS_ERROR whatever version I try (Win7 & Win10 installer, WinPE and WindowsToGo). But anyway I don't think it's a good idea running Windows on that poor 2 GB RAM.

bsod


4 Comments

juan · 2022-05-02 at 18:09

Hola , he seguido el tutorial y me ha funcionado perfectamente
Seguire mirando de vez en cuando por si hay actualizaciones.
Ahora gracias a ti tambien tengo una dashboard para mi home assintant
Gracias.

    zry98 · 2022-05-02 at 20:56

    Una pregunta, la placa base del tuyo era la misma que la mía? He visto a otros con placas diferentes (fabricadas por una otra empresa en 2020).

      juan · 2022-05-03 at 07:11

      Es igual al tuyo . Tambien comprado por Wallapop ha alguien que lo tuvo bastante tiempo en la caja sin usar.

Leave a Reply

Avatar placeholder

Your email address will not be published.