Freebeat: fix serial open (direct POSIX, not Usbserial.java) + add PROTOCOL.md

The Freebeat bike uses an internal UART (/dev/ttyS4), not a USB-CDC/FTDI
adapter, so Usbserial.java was wrong. Now FreebeatUSB opens the port with
POSIX open() + termios on all platforms (Android included), preceded by
chmod 777 on Android (same technique as DCUARTDriver in the original APK).
Removed QAndroidJniObject / rxBuffer since they are no longer needed.

Also add PROTOCOL.md documenting the full binary protocol reverse-engineered
from the APK (packet layout, command table, checksum, power formula).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cagnulein

src/devices/freebeatbike/FreebeatUSB.cpp

@@ -16,10 +16,6 @@
 
 #include "FreebeatUSB.h"
 
-#ifdef Q_OS_ANDROID
-#include <QtAndroid>
-#endif
-
 /* ----------------------------------------------------------------------
  * CONSTRUCTOR/DESTRUCTOR
  * ---------------------------------------------------------------------- */
@@ -36,7 +32,9 @@ FreebeatUSB::FreebeatUSB(QObject *parent, QString deviceFilename, int baudrate)
     devSpeed = 0.0;
     devWatt = 0.0;
     devValid = false;
-#ifndef WIN32
+#ifdef WIN32
+    devicePort = INVALID_HANDLE_VALUE;
+#else
     devicePort = -1;
 #endif
 }
@@ -172,19 +170,16 @@ bool FreebeatUSB::parsePacket(const QByteArray &pkt) {
 
 /* ----------------------------------------------------------------------
  * RAW I/O
+ * Note: Freebeat communicates via internal UART (/dev/ttyS4), NOT USB.
+ * We open the port directly with POSIX open() on all platforms (Android
+ * included) — NOT through Usbserial.java which is for USB-CDC/FTDI adapters.
+ * On Android, chmod 777 is required before open() to get rw access to the
+ * UART device node (same approach used by the original Freebeat app's
+ * DCUARTDriver class).
  * ---------------------------------------------------------------------- */
 int FreebeatUSB::rawWrite(const char *bytes, int size) {
     qDebug() << "Freebeat TX:" << QByteArray(bytes, size).toHex();
-#ifdef Q_OS_ANDROID
-    QAndroidJniEnvironment env;
-    jbyteArray d = env->NewByteArray(size);
-    jbyte *b = env->GetByteArrayElements(d, 0);
-    for (int i = 0; i < size; i++)
-        b[i] = bytes[i];
-    env->SetByteArrayRegion(d, 0, size, b);
-    QAndroidJniObject::callStaticMethod<void>("org/cagnulen/qdomyoszwift/Usbserial", "write", "([B)V", d);
-    return size;
-#elif defined(WIN32)
+#ifdef WIN32
     DWORD cBytes;
     if (!WriteFile(devicePort, bytes, size, &cBytes, NULL))
         return -1;
@@ -199,36 +194,7 @@ int FreebeatUSB::rawWrite(const char *bytes, int size) {
 
 // Read up to maxLen bytes with a timeout in ms; returns bytes read
 int FreebeatUSB::rawRead(char *buf, int maxLen, int timeoutMs) {
-#ifdef Q_OS_ANDROID
-    int total = 0;
-    int elapsed = 0;
-    const int step = 10;
-    while (elapsed < timeoutMs && total < maxLen) {
-        // Drain Android USB serial into rxBuffer
-        QAndroidJniObject dd = QAndroidJniObject::callStaticObjectMethod(
-            "org/cagnulen/qdomyoszwift/Usbserial", "read", "()[B");
-        jint len = QAndroidJniObject::callStaticMethod<jint>(
-            "org/cagnulen/qdomyoszwift/Usbserial", "readLen", "()I");
-        if (len > 0) {
-            QAndroidJniEnvironment env;
-            jbyteArray d = dd.object<jbyteArray>();
-            jbyte *b = env->GetByteArrayElements(d, 0);
-            rxBuffer.append(reinterpret_cast<const char *>(b), len);
-            env->ReleaseByteArrayElements(d, b, JNI_ABORT);
-        }
-        int avail = qMin(maxLen - total, rxBuffer.size());
-        if (avail > 0) {
-            memcpy(buf + total, rxBuffer.constData(), avail);
-            rxBuffer.remove(0, avail);
-            total += avail;
-        }
-        if (total >= maxLen)
-            break;
-        QThread::msleep(step);
-        elapsed += step;
-    }
-    return total;
-#elif defined(WIN32)
+#ifdef WIN32
     DWORD cBytes = 0;
     COMMTIMEOUTS ct;
     GetCommTimeouts(devicePort, &ct);
@@ -256,15 +222,7 @@ int FreebeatUSB::rawRead(char *buf, int maxLen, int timeoutMs) {
  * PORT OPEN / CLOSE
  * ---------------------------------------------------------------------- */
 int FreebeatUSB::openPort() {
-#ifdef Q_OS_ANDROID
-    QAndroidJniObject portName = QAndroidJniObject::fromString(QStringLiteral("auto"));
-    QAndroidJniObject::callStaticMethod<void>("org/cagnulen/qdomyoszwift/Usbserial", "open",
-                                              "(Landroid/content/Context;ILjava/lang/String;)V",
-                                              QtAndroid::androidContext().object(),
-                                              baudrate,
-                                              portName.object<jstring>());
-    return 0;
-#elif defined(WIN32)
+#ifdef WIN32
     COMMTIMEOUTS timeouts;
     QString portSpec;
     int portnum = deviceFilename.midRef(3).toString().toInt();
@@ -309,6 +267,17 @@ int FreebeatUSB::openPort() {
     SetCommTimeouts(devicePort, &timeouts);
     return 0;
 #else
+    // POSIX path — used on Linux, macOS, and Android.
+    // On Android the UART (/dev/ttyS4) is owned by root; chmod 777 grants access.
+#ifdef Q_OS_ANDROID
+    {
+        QString cmd = "chmod 777 " + deviceFilename;
+        int rv = system(cmd.toLatin1().constData());
+        if (rv != 0)
+            qDebug() << "Freebeat: chmod failed for" << deviceFilename;
+    }
+#endif
+
 #if defined(Q_OS_MACX)
     int ldisc = TTYDISC;
 #else
@@ -353,8 +322,6 @@ int FreebeatUSB::openPort() {
 int FreebeatUSB::closePort() {
 #ifdef WIN32
     return (int)!CloseHandle(devicePort);
-#elif defined(Q_OS_ANDROID)
-    return 0;
 #else
     tcflush(devicePort, TCIOFLUSH);
     return close(devicePort);

src/devices/freebeatbike/FreebeatUSB.h

@@ -34,11 +34,6 @@
 #endif
 #endif
 
-#ifdef Q_OS_ANDROID
-#include "keepawakehelper.h"
-#include <QAndroidJniObject>
-#endif
-
 #include <errno.h>
 #include <fcntl.h>
 #include <stdint.h>
@@ -132,10 +127,6 @@ class FreebeatUSB : public QThread {
     int devicePort;
     struct termios deviceSettings;
 #endif
-
-#ifdef Q_OS_ANDROID
-    QByteArray rxBuffer;
-#endif
 };
 
 #endif // FREEBEATUSB_H

src/devices/freebeatbike/PROTOCOL.md

@@ -0,0 +1,115 @@
+# Freebeat Fit Bike — Communication Protocol
+
+Reverse-engineered from APK `freebeat_original.apk` (decompiled with apktool).
+Key smali files: `UsbParseData.smali`, `UsbParseData$ParseAction.smali`, `SerialPortSDK.smali`, `DCUARTDriver.smali`.
+
+## Physical Layer
+
+| Parameter | Value |
+|-----------|-------|
+| Interface | Internal UART (`/dev/ttyS4` on the bike's Android tablet) |
+| Baud rate | 9600 bps |
+| Frame | 8N1 |
+| Library | `libserial_port.so` (JNI wrapper of `android-serialport-api`) |
+
+**Not USB serial** — the bike's Android tablet communicates with the hardware controller
+over a native UART. QZ opens this port directly with `open()` + `termios`, preceded by
+`chmod 777 /dev/ttyS4` to obtain rw access (same approach as `DCUARTDriver` in the original app).
+
+---
+
+## Command Packets (Host → Bike)
+
+### 5-byte command
+
+```
+[ startCode | action | data | checksum | 0xA0 ]
+checksum = (action + data) & 0xFF
+```
+
+### 4-byte LED heartbeat
+
+```
+[ 0xB5 | 0x08 | 0x08 | 0xA0 ]
+```
+Must be sent periodically to keep the bike alive.
+
+### Command table
+
+| Name              | startCode | action | data   | Notes                         |
+|-------------------|-----------|--------|--------|-------------------------------|
+| SET_RESISTANCE    | 0x25      | 0x03   | 1–100  | Set resistance level          |
+| DAME_MIX          | 0x25      | 0x05   | 0x00   |                               |
+| DAME_MAX          | 0x25      | 0x06   | 0x00   |                               |
+| MACHINE_RESET     | 0x25      | 0x07   | 0x00   |                               |
+| MACHINE_QUERY     | 0x25      | 0x08   | 0x00   | Request status packet         |
+| MACHINE_STOP      | 0x25      | 0x09   | 0x00   |                               |
+| CHECK_SERIAL_VER  | 0x25      | 0x2F   | 0x00   |                               |
+| CHECK_LED_LIGHT   | 0xB5      | 0x08   | 0x08   | LED heartbeat (4-byte form)   |
+| LED_LIGHT_CHANGE  | 0xB5      | 0x03   | value  |                               |
+
+---
+
+## Telemetry Packets (Bike → Host)
+
+### Data packet — 13 bytes
+
+```
+byte[0]  = 0x55          sync byte
+byte[1]  = type          0x15 | 0x03 | 0x25
+byte[2]  = 0x00
+byte[3]  = 0x00
+byte[4]  = speed_lo      speed (km/h × 10) little-endian
+byte[5]  = speed_hi
+byte[6]  = 0x00
+byte[7]  = resistance    1–100
+byte[8]  = rpm_lo        RPM little-endian
+byte[9]  = rpm_hi
+byte[10] = 0x00
+byte[11] = checksum      sum(bytes[1..10]) & 0xFF
+byte[12] = 0x3F          verify byte
+```
+
+**Parsing:**
+```
+speed (km/h)  = ((byte[5] << 8) | byte[4]) * 0.1
+resistance    = byte[7]          (1–100)
+rpm           = (byte[9] << 8) | byte[8]
+```
+
+### LED status packet — 20 bytes
+
+```
+byte[0] = 0xE5           sync byte for LED packets
+...                      (remaining bytes not decoded; ignore for telemetry)
+```
+
+---
+
+## Power Calculation
+
+The original app uses two coefficients depending on wheel circumference:
+
+```
+watt = rpm * coefficient * resistance / 100.0
+```
+
+| Variant      | Coefficient |
+|--------------|-------------|
+| Standard     | 4.56        |
+| Alternative  | 7.39        |
+
+QZ uses the standard coefficient (4.56).
+
+---
+
+## Initialization Sequence
+
+1. Open `/dev/ttyS4` at 9600 baud 8N1
+2. Send `MACHINE_QUERY` (`[0x25, 0x08, 0x00, 0x08, 0xA0]`)
+3. Wait 500 ms
+4. Enter polling loop (200 ms interval):
+   - Send `SET_RESISTANCE` if pending
+   - Send `MACHINE_QUERY`
+   - Send LED heartbeat (`[0xB5, 0x08, 0x08, 0xA0]`)
+   - Read and parse response