[THINK TANK] Enabling the Nexus One FM radio ... - Nexus One Android Development

So I've been looking through the Desire on Nexus One ROM files, and determine a few discoveries with the FM Receiver on the N1.
1. It's present, and works partially (I can scan and get a list of good FM stations in my area)
2. Its controlled via the i2c bus off the snapdragon
3. HTC abandoned using BlueZ on the Desire, and cooked up a custom BT stack (this is at least partially contained in the file /system/bin/btld)
4. Its on the BCM4538 chip, not on the QSD8260 (that being said, looking at the Bravo/Desire kernel source, the QSD8260 is used for part of the audio path.
5. The custom BT stack used on the Desire controls the FM radio at least in part, this is also likely why Bluetooth doesn't work on these ROMs fully.
Here's a bit from the logcat:
I/BTL_IFC ( 578): btl_ifc_ctrl_rx: [BTL_IFC CTRL] recv BTLIF_FM_SEARCH (FM) 10 pbytes (hdl 151)
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): decodePendingEvent: Event ID: 4366
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): enqueuePendingEvent: event ID: 3, ATTACHING THREAD
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): enqueuePendingEvent: THREAD ATTACHED OK
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): [JNI] - TRANSMITTING EVENT UP : event = 3
I/BTAPP_FM( 1086): BTAPP_FM: btui_fm_cback: 3
I/BTAPP_FM( 1086): BTAPP_FM: BTA_FM_SEARCH_CMPL_EVT
I/BTAPP_FM( 1086): btapp_fm_volume_control = 176
I/BTAPP_FM( 1086): BTAPP_FM: clear_af_info
I/BTL-IFS ( 1086): send_ctrl_msg: [BTL_IFS CTRL] send UNKNOWN MSG ID (FM) 12 pbytes (hdl 15)
I/BTL_IFC ( 578): btl_ifc_ctrl_rx: [BTL_IFC CTRL] recv BTLIF_FM_SEARCH_CMPL_EVT (FM) 14 pbytes (hdl 151)
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): decodePendingEvent: Event ID: 4382
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): enqueuePendingEvent: event ID: 4, ATTACHING THREAD
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): enqueuePendingEvent: THREAD ATTACHED OK
I/com_broadcom_bt_service_fm_FmReceiverService.cpp( 578): [JNI] - TRANSMITTING EVENT UP : event = 4
V/FmReceiverEventLoop( 578): onRadioSearchCompleteEvent()
V/FmReceiverService( 578): onRadioSearchCompleteEvent()
D/FmReceiverService( 578): ******* ******* Processing job:FM_SEEK_STATION TimeSent:1:43:58 PM
D/FmReceiverService( 578): ***** ***** processCommands:[]
D/FmReceiverService( 578): []
D/FmReceiverService( 578): ****** ****** Adding FM Job: FM_SEEK_STATION TimeSent:not yet
D/FmReceiverService( 578): ***** ***** processCommands:[FM_SEEK_STATION TimeSent:not yet]
D/FmReceiverService( 578): ***** ***** processCommand:FM_SEEK_STATION TimeSent:1:43:59 PM
V/FmReceiverService( 578): seekStation():1
Part of the FM radio driver is also in /system/lib/android_runtime.so.
The upshot:
The FM Radio is heavily tied into the Desire's firmware (and I'll bet the same is true with the Droid Incredible as well); the FM apk itself is tied to Sense, so if the radio can be made to work, at least for the time being, it will be tied to Desire ROMs.

---

I would die if someone got a radio app working. The local rock station here in baltimore is fantastic and I throughly enjoy listening to them but I dont want to carry another device when I go to the gym or jogging. I'd gladly pay for a pro/donate version too...

---

So are we going to maybe see this on sense roms. Coming soon???
-------------------------------------
Sent via the XDA Tapatalk App

---

I have a theory I'd like to try which requires me to successfully boot a custom kernel, but my self-built kernels thus far have failed to boot :-/. If its just a matter of audio path, it should be easy to get this to work (I hope)

---

It's pity that there is no HTC insider to help us.. That would save so much PITA trying to figure out the HW from looking at the SW...
Anyway, several things:
1) The references are incorrect, should be QSD8250 and BCM4329.
2) I've looked up the Broadcom chip. No detailed pinouts and/or HDD/SWI, but a brief is available - and it says enough:
http://www.datasheetdir.com/BCM4329+download
First, FM radio doesn't have its own dedicated interface, it's encapsulated and passed over either WiFi or BT. Later in the spec it specifies BT interface, so that part is clear.
Second, it's also clear that the data coming from BT chip isn't coming analog - it's coming over high speed UART, the same one that's used to control BT. The same HW, but different usage.
So to capture the audio output of FM radio, one needs to look at the Desire source and find in its BT stack - or more probably outside of the stack - the procedures responsible for configuring high-speed UART, select those that reconfigure it for audio, and duplicate on Nexus. I don't know if any recoding takes place, but it should also be visible in the code. Looks like there can't be any HW problem that can prevent the radio, since HS-UART is already connected and functional in controlling BT, and we know for fact that I2C is connected, since Paul's builds control the radio.
I'd do that myself, but it'll take me ages to navigate in the code, not being familiar with it and not having enough SW background. I hope one of the devs can take the job. As it goes for HW, I can support the part that deals with QSD reconfiguration, if there will be any specific questions that I'll know the answers to.

---

Jack_R1 said:
It's pity that there is no HTC insider to help us.. That would save so much PITA trying to figure out the HW from looking at the SW...
Anyway, several things:
1) The references are incorrect, should be QSD8250 and BCM4329.
2) I've looked up the Broadcom chip. No detailed pinouts and/or HDD/SWI, but a brief is available - and it says enough:
http://www.datasheetdir.com/BCM4329+download
First, FM radio doesn't have its own dedicated interface, it's encapsulated and passed over either WiFi or BT. Later in the spec it specifies BT interface, so that part is clear.
Second, it's also clear that the data coming from BT chip isn't coming analog - it's coming over high speed UART, the same one that's used to control BT. The same HW, but different usage.
So to capture the audio output of FM radio, one needs to look at the Desire source and find in its BT stack - or more probably outside of the stack - the procedures responsible for configuring high-speed UART, select those that reconfigure it for audio, and duplicate on Nexus. I don't know if any recoding takes place, but it should also be visible in the code. Looks like there can't be any HW problem that can prevent the radio, since HS-UART is already connected and functional in controlling BT, and we know for fact that I2C is connected, since Paul's builds control the radio.
I'd do that myself, but it'll take me ages to navigate in the code, not being familiar with it and not having enough SW background. I hope one of the devs can take the job. As it goes for HW, I can support the part that deals with QSD reconfiguration, if there will be any specific questions that I'll know the answers to.
Click to expand...
Click to collapse
Bah, my brain was on neutral when I typed those numbers. At least this explains why HTC replaced the Bluetooth stack with something they cooked up, but it will be non-trivial to get FM radio into an AOSP. I think I know what has to change in the kernel to make this work though at this point.

---

Sonic McTails said:
Bah, my brain was on neutral when I typed those numbers. At least this explains why HTC replaced the Bluetooth stack with something they cooked up, but it will be non-trivial to get FM radio into an AOSP. I think I know what has to change in the kernel to make this work though at this point.
Click to expand...
Click to collapse
Go go go! I really want to have it enabled on my N1! Feels like without it, my N1 is lacking some piece of its soul.

---

Keep up the work guys.
No longer will our FM chips remain flaccid and unused. LOL.

---

If u need help building kernel or any other I am there to help.

---

charnsingh_online said:
If u need help building kernel or any other I am there to help.
Click to expand...
Click to collapse
Me two!

---

why don't we invite the great [ cyanogen ], he who has done some great stuff that hasn't been opened by Google .. I think we must request him and open a bounty for FM radio to get working on nexus one.

---

thalib_atc said:
why don't we invite the great [ cyanogen ], he who has done some great stuff that hasn't been opened by Google .. I think we must request him and open a bounty for FM radio to get working on nexus one.
Click to expand...
Click to collapse
-----------
great idean infact he might be comin up with some new rom already thats my assumption can be true u never knw

---

thalib_atc said:
why don't we invite the great [ cyanogen ], he who has done some great stuff that hasn't been opened by Google .. I think we must request him and open a bounty for FM radio to get working on nexus one.
Click to expand...
Click to collapse
I'd def donate to anyone that got the FM radio working..... I know many people would, I'm sure there are people working on it (if they believe its possible that is)..... Sure would be an awesome feature to add and would allow me to get my buddy to shut up about his incredible......

---

this is a useful dmesg (enabling FM Radio)
Code:
[ 705.437744] Enable FM HEADSET
[ 705.460845] Disable TTY
[ 705.471862] Audio: FM: start
[ 705.471984] q6fm_open()
[ 705.472106] Audio: _audio_rx_clk_enable: device 0x0107ac8a, group 0
[ 705.472320] Audio: _audio_rx_clk_enable: icodec_rx_clk_refcount = 1
[ 705.472595] Audio: _audio_rx_clk_enable: icodec_rx_clk enabled
[ 705.509124] acdb: 974 bytes for device 5, rate 48000.
device is controlled by btld through
/sys/class/htc_accessory/fm & /sys/class/htc_accessory/tty
desire source code:
arch/arm/mach-msm/htc_headset_common.c
arch/arm/mach-msm/qdsp6/audio_ctl.c
drivers/serial/msm_serial_hs_bcm.c

---

Kali- - it's great info. Thanks.

---

HTC Desire FM Radio App
Hi
In my case, i have an HTC Desire and i want to develop an application to delay the radio.
This is because in my country many people like to listen to the radio while watching football, but it is usually 2 o 3 second ahead of the image (since DVB)
I've decompilied the HTC Radio application with Dexeter, but it's a little bit complicated to understand (not impossible, but difficult).
For example, this is a piece of code from BroadcomFMTuner:
Code:
.method private setCmdStatus(I)V
.limit registers 5
; this: v3 (Lcom/htc/fm/BroadcomFMTuner;)
; parameter[0] : v4 (I)
.line 25
iget-object-quick v0,v3,[obj+0x8]
new-instance v1,java/lang/StringBuilder
invoke-direct {v1},java/lang/StringBuilder/<init> ; <init>()V
const-string v2,"setCmdStatus("
invoke-virtual-quick {v1,v2},vtable #0x3b
move-result-object v1
invoke-virtual-quick {v1,v4},vtable #0x36
move-result-object v1
const-string v2,")"
invoke-virtual-quick {v1,v2},vtable #0x3b
move-result-object v1
invoke-virtual-quick {v1},vtable #0x7
move-result-object v1
invoke-static {v0,v1},com/htc/fm/FMLog/d ; d(Ljava/lang/String;Ljava/lang/String;)V
There's a better way to decompile the application or is the source code available anywhere?
There's other similar code to access the fm chip or documentation i can look?
Thanks
Sergio

---

I know you can make it guys! Thanks for your hard work on this!
Grande Kali- ! Let's put some italian flavour on this ...

---

thalib_atc said:
why don't we invite the great [ cyanogen ], he who has done some great stuff that hasn't been opened by Google .. I think we must request him and open a bounty for FM radio to get working on nexus one.
Click to expand...
Click to collapse
I've poked around with it a bit but haven't really had any success.
CodeAurora has a bunch of code for FM radio- I don't know how much of it is applicable though. Most of it is framework/HAL stuff and geared towards a specific board.

---

I'll start working on it from tomorrow. Will see where I can get it too. I would need someone who already has worked on it to make stuff faster. Shoot me a pm anyone who has already worked on it

---

hey charnsingh... any news so far?