Drawing on the Bose SoundTouch display directly: OLED framebuffer, clock and volume overlay (Portable spike)

[JRpersonal]

I spent a night on the SoundTouch Portable's display and found a way to draw on it directly. Nothing of this is in STR yet. I'm writing it down so the findings are not lost, and because it reopens two ideas that looked impossible, the clock on the display while streaming (#1098) and a track title without the audio gap (#500).

Everything below was tested on one Portable (taigan, firmware 27.0.6) only. It works in RAM only, a reboot undoes all of it, and nothing on the speaker's storage was changed.

The display is a plain Linux framebuffer

• /dev/fb0, kernel driver ssdspi, an OLED on SPI (spi2.0)
• 128 x 100 pixels, 8 bits per pixel, 12,800 bytes per frame, 16 grey levels (values in steps of 0x11)
• the driver keeps sending the framebuffer to the panel on its own, so anything written into that memory appears on the display, no extra call needed
• cat /dev/fb0 returns exactly what the panel shows, the standby clock included

How BoseApp draws, and how to keep it out

BoseApp maps /dev/fb0 and renders with DirectFB. One of its 74 threads, named DirectFBFlipTas, copies the finished picture into the framebuffer about six times a second, even in standby. Writing your own picture therefore only flashes for a moment.

Overwriting faster than BoseApp works but flickers now and then. The clean way is to hold exactly that one thread with PTRACE_SEIZE followed by PTRACE_INTERRUPT. No signal is involved, so the other threads keep running and playback goes on. While the thread is held, nothing but your own code touches the display, and I counted zero foreign writes in 30 seconds. When the holding process ends, the kernel releases the thread and BoseApp draws again as if nothing happened.

Two other routes are closed on this speaker. The kernel has no cgroups, so there is no freezer, and stopping BoseApp is not an option because Shepherd restarts the whole speaker when it dies (recovery="reboot").

Overlays on BoseApp's own screen

While the flip thread is held, BoseApp keeps rendering into a buffer on its heap. Searching /proc/<pid>/mem for the current frame finds it (skip the /dev/fb0 mapping itself, that is the panel). Reading that buffer ten times a second, drawing on top and writing the result to the framebuffer gives a flicker-free overlay on the live screen. I tested two:

• a permanent clock in the top right corner over the now-playing screen, station changes underneath included
• a volume panel with a large number and a bar

Open before this could become a feature

• the heap address moves, so it has to be found again per boot, with a search that reads memory in small pieces (a naive search ran the box out of memory)
• the other models with a display (SoundTouch 20, 30, 300, Wave) are untested, their panels may differ
• it bypasses the firmware on purpose, so it would only ever be an opt-in

If you own one of those other models and are comfortable with SSH on your own speaker, cat /sys/class/graphics/fb0/virtual_size and cat /sys/class/graphics/fb0/bits_per_pixel would already tell me a lot.

_{Keywords: Bose SoundTouch Portable display hack, SoundTouch OLED framebuffer, /dev/fb0, ssdspi, DirectFB, custom display, clock on display while playing, volume on display, show track title on SoundTouch display, SoundTouch 20 / 30 / 300 / Wave display, reverse engineering, SoundTouch Reborn}

[wbtj847dzp-wq]

ST 20 results

Tue Oct  6 10:18:39 BST 2026

Device name: "SoundTouch 20"
Country GB, Region GB
root@spotty:~# cat /sys/class/graphics/fb0/virtual_size
128,100
root@spotty:~# cat /sys/class/graphics/fb0/bits_per_pixel
8

[JRpersonal]

That is the same 128x100 at 8 bits as the Portable. One more line would tell me whether it is the same driver too, and with that whether the logo animation from the Portable could run on the ST20:

cat /sys/class/graphics/fb0/name

[wbtj847dzp-wq]

Tue Oct  6 10:55:42 BST 2026

Device name: "SoundTouch 20"
Country GB, Region GB
root@spotty:~# cat /sys/class/graphics/fb0/name
ssdspi

[JRpersonal]

Both run the same ssdspi driver as the Portable. Since v1.0.5 the agent decides by the panel, so the logo animation should already show on both after the next update or restart. Let me know if it does.

[RichardPuijk]

I don't know if an extra test on another ST-20 was necessary, but i got the same results:

Wed Oct  7 12:08:17 CEST 2026

Device name: "Woonkamer"
Country EU, Region (not set)
Module type: scm
root@spotty:~# cat /sys/class/graphics/fb0/virtual_size
128,100
root@spotty:~# cat /sys/class/graphics/fb0/bits_per_pixel
8
root@spotty:~# cat /sys/class/graphics/fb0/name
ssdspi

[JRpersonal]

With your ST20, the other one and the Wave all reporting the same panel and driver, the track screen from v1.0.13 runs on the 20, 30, Portable and Wave alike. How it looks and what could be better is in #1305.

[wbtj847dzp-wq]

ST Wave results (same as ST 20)

Tue Oct  6 10:21:35 BST 2026

Device name: "SoundTouch Wave"
Country GB, Region GB
Variant mode: NoAP
root@lisa:~# cat /sys/class/graphics/fb0/virtual_size
128,100
root@lisa:~# cat /sys/class/graphics/fb0/bits_per_pixel
8

[wbtj847dzp-wq]

Tue Oct  6 10:56:43 BST 2026

Device name: "SoundTouch Wave"
Country GB, Region GB
Variant mode: NoAP
root@lisa:~# cat /sys/class/graphics/fb0/name
ssdspi