Repurposing Movistar Home

as a Home Assistant dashboard panel.

This document is only intended for the model IGW-5000A2BKMP-I v2 with an x86 CPU. For model RG3205W, please refer to RG3205W.en.md.

Versión en castellano

HELP NEEDED

I dumped the original Android-x86 firmware from flash, but it failed to boot after I wrote it back in, and the /data partition was encrypted and I couldn't find a way to decrypt it.

Contributions to the repository are very welcomed if you've got any discoveries; or if you have a Movistar Home not in use and willing to help this project, please join our Telegram group chat, much appreciated!

TODO list

• Fix sound card driver (ALSA configs)
• Fix camera driver
• Fix bluetooth driver
• Fix reset button
• Find a way to install Linux without disassembling nor soldering (maybe through easycwmp on port 7547)

Tech specs

CPU	Intel Atom x5-Z8350 (4C4T) @ 1.44 GHz
RAM	Hynix 2 GB DDR3 ECC @ 1600 MHz
Storage	Kingston TB2816 16 GB eMMC
Screen	8-inch 1280x800 with Goodix I2C touch screen
Wi-Fi & Bluetooth	Realtek RTL8822BE
Sound card	Realtek RT5672
Speakers	2 x 5 W (SPL 87 dB @ 1 W | 1 m)
Microphones	4 omnidirectional microphones with dedicated DSP
Camera	OMNIVISION OV2680 with 2 megapixels
Dimensions	21.2 x 23.5 x 12.2 cm (height x width x depth)
Weight	1.1 kg

Driver status

As in the latest Manjaro XFCE with 5.15.76-1 kernel, on November 7, 2022:

Device	Driver	Status
Touch screen	goodix	OK
Wi-Fi	rtw88_8822be	OK
Bluetooth	rtw88_8822be	Not working
Sound card	snd_soc_sst_cht_bsw_rt5672	Not working
Camera	atomisp	Not working

Linux installation

Disassemble the device, there are 10 snap-fits under the back panel edges, be careful not to damage them; then 8 screws under it, and 4 screws hidden under the rubber strip at the bottom of the device.

Locate the unpopulated micro USB port on the left edge of the motherboard:

Solder a micro USB female connector and connect an OTG adapter cable; or just solder a cable with a standard USB-A female connector to it, then short the fourth pin (or the ID pad) to the ground (GND, the fifth pin), making the device function as an OTG host.

Here are two examples for soldering a USB-A female connector, choose whatever you find more convenient:

Flash a USB drive with your favorite Linux distro, I recommend using Xfce desktop environment considering the Movistar Home only has 2 GB RAM.

Connect a keyboard and the drive to a USB hub and connect it to Movistar Home. Power it up while pressing the F2 key, it will boot into BIOS setup, navigate to the last tab (Save & Exit), select your USB drive (should be something like UEFI: USB, Partition 1) in the Boot Override menu, press Enter key to boot it.

Install your Linux distro as usual, it may be necessary to include non-free drivers.

It's recommended to set up the OpenSSH server before unsoldering the USB connector and reassembling the device, for possible future maintenance.

Configurations

The following configurations were made for Manjaro XFCE and may need some modifications for other distros.

Fix screen rotation

Create file /etc/X11/xorg.conf.d/20-monitor.conf with the following content:

Section "Monitor"
        Identifier      "DSI1"
        Option          "Rotate" "right"
        Option          "Scale" "0.8x0.8"
        Option          "DPMS" "true"
EndSection

Section "ServerFlags"
        Option          "StandbyTime" "0"
        Option          "SuspendTime" "0"
        Option          "OffTime" "0"
EndSection

Adjust the scaling parameter (Scale) to your liking, I found 0.8x the most suitable for this screen.

Fix touch screen

For some reason the touch screen won't work at all unless it's soft rebooted once, in dmesg the driver says "Goodix-TS i2c-GDIX1001:00: Invalid config (0, 0, 0), using defaults".

Create file /etc/systemd/system/fix-touchscreen.service with the following content:

[Unit]
Description=Fix touchscreen

[Service]
Type=oneshot
ExecStart=sh -c 'dmesg | grep -q " Goodix-TS .*: Invalid config " && reboot now || exit 0'

[Install]
WantedBy=multi-user.target

Then execute sudo systemctl daemon-reload && sudo systemctl enable fix-touchscreen.service to make it run at startup.

To fix rotation, create file /etc/X11/xorg.conf.d/30-touchscreen.conf with the following content:

Section "InputClass"
        Identifier      "calibration"
        MatchProduct    "Goodix Capacitive TouchScreen"
        Option          "TransformationMatrix"  "0 1 0 -1 0 1 0 0 1"
EndSection

Fix touch control in Firefox

Source: Firefox/Tweaks - ArchWiki

Open Firefox and access about:config, search for dom.w3c_touch_events.enabled and make sure it's either set to 1 (enabled) or 2 (default, auto-detect).

Add MOZ_USE_XINPUT2 DEFAULT=1 to /etc/security/pam_env.conf.

Auto backlight dimming

Create file /etc/X11/xorg.conf.d/10-intel.conf with the following content:

Section "Device"
        Identifier      "Intel Graphics"
        Driver          "intel"
        Option          "AccelMethod"   "sna"
        Option          "TearFree"      "true"
        Option          "Backlight"     "intel_backlight"
EndSection

Open Xfce's Power Manager, switch to Display tab, and adjust the Brightness reduction settings. I personally set it to reduce to 20% after 90 seconds of inactivity.

Remember also to disable the auto suspension/shutdown from there.

Create file ~/.config/autostart/set-backlight.desktop with the following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=Set Backlight Brightness
Comment=Set backlight brightness on startup
Exec=bash -c "echo 100 > /sys/class/backlight/intel_backlight/brightness"
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

(I found this is somehow not achievable with a systemd service)

Virtual keyboard

Install Onboard with sudo pacman -S onboard, open Xfce's Session and Startup settings, switch to Application Autostart tab, find and enable Onboard (Flexible onscreen keyboard).

After rebooting, open Onboard's settings and adjust them to your liking.

Hide mouse cursor

Install unclutter with sudo pacman -S unclutter.

Create file ~/.config/autostart/hide-cursor.desktop with the following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=Hide Cursor
Comment=Hide mourse cursor
Exec=unclutter --hide-on-touch
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

Home Assistant dashboard

Create file ~/.config/autostart/HASS.desktop with the following content:

[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=HASS Dashboard
Comment=Run HASS dashboard in Firefox kiosk
Exec=firefox -kiosk -url 'https://your.hass.url'
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false

This will run Firefox in kiosk mode at startup, which you can only exit by pressing alt+F4 or using kill command by SSH.

Control display state from Home Assistant

Create file ~/panel_server.py with the following content:

import os
from subprocess import run
import logging
from flask import Flask, request, make_response
from werkzeug.wrappers import Request, Response

TOKEN = ''

class middleware():
    def __init__(self, app):
        self.app = app

    def __call__(self, env, start_resp):
        request = Request(env)
        if TOKEN != '' and request.headers.get('Authorization') != f'Bearer {TOKEN}':
            res = Response('Unauthorized', mimetype='text/plain', status=401)
            return res(env, start_resp)
        return self.app(env, start_resp)

app = Flask(__name__)
app.wsgi_app = middleware(app.wsgi_app)
log = logging.getLogger('werkzeug')
log.setLevel(logging.ERROR)

@app.route('/display/state', methods=['GET'])
def get_display_state():
    cmd = "xset -display :0.0 q | grep '^  Monitor is' | awk '{print $NF}'"
    state = run(cmd, shell=True, capture_output=True).stdout.decode().strip()
    if state == 'On':
        return make_response('ON', 200)
    elif state == 'Off':
        return make_response('OFF', 200)
    else:
        return make_response(f'Unknown state "{state}"', 500)

@app.route('/display/state', methods=['POST'])
def set_display_state():
    req_body = request.get_data().decode()
    if req_body == 'OFF':
        cmd = 'xset -display :0.0 dpms force off'
    elif req_body == 'ON':
        cmd = 'xset -display :0.0 dpms force on'
    else:
        return make_response('Bad Request', 400)

    ret = run(cmd, shell=True).returncode
    if ret == 0:
        return make_response(req_body, 200)
    else:
        return make_response(f'Command returned {ret}', 500)

if __name__ == '__main__':
    TOKEN = os.environ.get('TOKEN', '')
    app.run(host=os.environ.get('HOST', '0.0.0.0'), port=os.environ.get('PORT', 8080))

Run sudo pacman -S python-pip && pip install flask to install Flask.

Create file /etc/systemd/system/panelserver.service with the following content:

[Unit]
Description=Panel Server
Wants=network-online.target nss-lookup.target
After=network-online.target nss-lookup.target

[Service]
Environment="TOKEN=aa83720a-0bc1-4d5b-82fc-bf27a6682aa4"  # replace it with your secret token
User=panel  # replace it with your user
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
WorkingDirectory=~
ExecStart=/usr/bin/python3 panel_server.py
Restart=always

[Install]
WantedBy=multi-user.target

Then execute sudo systemctl daemon-reload && sudo systemctl enable panelserver.service to make it run at startup.

Create a RESTful switch in your Home Assistant's YAML config like:

- platform: rest
  name: Panel Display
  unique_id: panel_display
  resource: http://panel:8080/display/state  # replace `panel` with your panel's hostname or IP address
  body_on: 'ON'
  body_off: 'OFF'
  is_on_template: '{{ value == "ON" }}'
  headers:
    Authorization: Bearer aa83720a-0bc1-4d5b-82fc-bf27a6682aa4  # replace it with your secret token (after `Bearer `)
  verify_ssl: false

Reload your Home Assistant instance, use Developer Tools to test the switch and sensor.

Then you can use it in Automations, e.g., turn it off when you go to sleep at night and turn it back on when you get up in the morning.

Prevent screen burn-in

Since it will mostly be used to display a Home Assistant dashboard 24/7, it's very likely to get screen burn-in after some time, although it has an LCD screen.

To prevent that, I wrote a Python script to have it periodically flash several colors in full screen to refresh all the pixels.

DO NOT USE this script if you or a family member has photosensitive epilepsy!

Create file /usr/bin/screensaver.py with the following content:

#!/usr/bin/env python3
from time import time
import tkinter as tk

color_interval = 300  # milliseconds
total_time = 10  # seconds, exit after that

colors = ['red', 'green', 'blue', 'black', 'white']
color_index = 0

root = tk.Tk()
w, h = root.winfo_screenwidth(), root.winfo_screenheight()
root.overrideredirect(True)
root.attributes('-fullscreen', True)
canvas = tk.Canvas(root, width=w, height=h, background='black', highlightthickness=0)
canvas.pack()
canvas.focus_set()
canvas.bind('<Button-1>', lambda _: root.destroy())  # exit on touch


def flash_color():
    global color_index
    if time() - time_start > total_time: root.destroy()
    canvas.configure(background=colors[color_index])
    color_index = (color_index + 1) % len(colors)
    root.after(color_interval, flash_color)


time_start = time()
flash_color()
root.mainloop()

Adjust the two variables color_interval and total_time to your liking, with total_time = 10 it will be running for 10 seconds, just touch the screen if you need to stop it immediately.

Run command chmod +x /usr/bin/screensaver.py to make it executable, then run command crontab -e and add a cron job as following, which will run the script every hour:

0 * * * *       export DISPLAY=:0; /usr/bin/screensaver.py

Research notes

Background

Recently while I was lurking around on Wallapop, the Spanish Craiglist, one item caught my attention:

This is Movistar Home, a smart home hub from Spain's biggest ISP, Telefónica Movistar. It's basically a smart speaker with a touch screen and built-in AI assistant (called Aura), something like Amazon Echo Show and Google Nest Hub. But it's well-integrated with the other products in Movistar's ecosystem, including controlling TV, Wi-Fi, IoT devices (which I didn't find any detailed information). It can also play movies, TV series, music, and games on the device itself, but I doubt the user experience would be satisfying on that 8-inch screen.

I've always wanted to have a Home Assistant dashboard panel like everyone on /r/homeassistant with wall-mounted tablets, but I feel like something that sits on the desk would suit my use cases better, also I don't want to install something possibly permanent on the wall.

After searching around, I couldn't find any useful information about hacking this device. A video published on YouTube gave a glance of its virtual keyboard, which is obviously a Gboard on Android. And according to the official website it has a CPU from Intel, which should be one of the Atom series widely used in Android & Windows tablets, so it seems like it's basically a tablet running Android-x86, not something too bizarre.

Tempted by the cheap price, I bought one for only 15 euros from a nice dude, including that wireless handset.

Trying to break out

When I first powered it up, it asks me to connect to a Wi-Fi, but I couldn't find mine in the list, and it specifically said "Connect you to a Movistar Wi-Fi".

I tried to setup an AP with SSID and MAC address copied from the ones in the list, but it never showed up, even after reboot.

Since I couldn't find a way to continue, I had to dissasemble it:

The top green PCB has the four microphones, mute button and speaker volume buttons; the central blue PCB is the motherboard, with Wi-Fi & Bluetooth module in the upper right corner, speaker amplifier circuit in the bottom right corner, and CPU + RAM + eMMC + other stuff all inside an EMI shield under that big heat sink; the bottom green PCB has the reset button, 12V DC power jack and power button.

On the motherboard, there are two unpopulated 6-pin connector pads which I don't know what they are; a serial port (the 3 pads above the 6-pin connector on the left edge) with output of boot logs.

What really seemed useful was the unpopulated micro USB port pad on the left edge:

I soldered a cable with a standard USB female connector to it, and shorted the fourth pin (or the ID pad above) to ground, which made the device as OTG host.

After that, I connected a USB keyboard and tried to escape from the kiosk mode, but the only useful finding was bringing up the browser with Win + B, although it's unable to access any website since not connected to Wi-Fi.

Then I connected a USB hub with a USB ethernet adapter, now it's connected to the Internet:

I was able to download APKs but couldn't find a way to install them. I could read local files using the file:// protocol (e.g. file:///system/build.prop) but when I try to open an APK file with file:///sdcard/download/xxx.apk it only gives me a toast saying that such files can only be accessed with HTTP(S) protocol.

easycwmp

I scanned the open ports on the device, found a HTTP service of easycwmp listening on port 7547, but it's protected with basic authentication. Later in the flash dump I found its credentials should be easycwmp/easycwmp, but it won't boot into the original Android-x86 after I wrote the dump back. easycwmp is a TR-069 client, which usually should only appear in ISP-provided modems and routers, my guess here is that it's for the OS's OTA updates. That means it might be possible to take advantage of this service and flash custom firmware (Linux) without having to disassemble the device and solder USB cable. But unfortunately, I no longer have one with the original OS to do research on it.

So far nothing useful, so I decided to try to get into the BIOS setup which I believe it should have one since it's x86.

Into the BIOS

I tried pressing several different keys on startup, F12 got me a black screen with a text DNX FASTBOOT MODE..., and F2 got me into the BIOS (well actually it's UEFI-only):

From there, I was able to boot Linux normally from a USB drive:

For Windows, it always gives me a BSOD with stop code ACPI_BIOS_ERROR whatever version I try (Win7 & Win10 installer, WinPE and WindowsToGo). But anyway I don't think it's a good idea running Windows on that poor 2 GB RAM.