FC audio mode progress

[Mychaela Falconia]

Hello FC community,

This post is an update on the audio mode-related work I am currently
doing in FreeCalypso, and I also have a little exercise which other
community members may be able to help with.

As far as audio mode work goes, I just put out a new audio mode config
for FCDEV3B, one that enables AEC and incorporates some microphone
uplink path tuning.  In other audio mode-related news, I am currently
working with a Chinese factory that makes wired headsets, on a project
venture to produce a custom wired headset for FreeCalypso.  The special
headset which I seek to produce will be just like the historical one
from iWOW, with the special quality that both legs of the earpiece
speaker are brought out separately on a 4-wire TRRS plug, as opposed to
one leg sharing the ground wire with the microphone, as happens in all
of the more common headsets (Mot C1xx, Pirelli's, old Nokia etc) with
3-wire TRS plugs.  Of course the important difference between iWOW's
historical headset and the one I seek to produce is that of the former
there are only two pieces in the world, whereas for the new one I am
getting 100 pcs made, should be a lifetime buy for our community.

Once we get these FC headsets made, we will finally be able to offer a
voice call option for Caramel2 users: C2 brings out the main audio
channel on a 2.5 mm TRRS jack, but until now we haven't had a headset
to plug into this jack, beyond the single relic from iWOW.  The same
TRRS jack for the main audio channel will be featured on FC Venus,
thus the same headset will be a required component there.  And yes,
when we get these FC headsets made, we will do a custom audio mode
tuning for that configuration just like we did for FCDEV3B loudspeaker
and mic kit: I will do experiments to see if AEC makes any difference
or not, and I will tune the microphone PGA and sidetone level settings.
Furthermore, the headset manufacturer sent me frequency response data
for the earpiece speaker that will be built into our headset, and
armed with this dataset, I will try to construct a FIR filter (meaning
a set of coefficients for the downlink FIR block in our Calypso DSP)
that flattens this earpiece speaker's frequency response - that's what
Calypso FIR blocks are there for!

Meanwhile I am also enriching my Calypso audio knowledge by collecting
some existing known-good configs from historical Calypso phones,
namely Mot C1xx and Pirelli DP-L10.  Reading out Pirelli's audio tuning
settings for all 3 modes (handheld, loudspeaker and headset) was quite
easy because Pirelli's fw retains close similarity to TCS211 baseline
from which it was derived, this fw retains TI's ETM and responds to
ETM commands such as r16 for reading Calypso registers and DSP API
words and abbr for reading Iota ABB registers, and it even supports
the higher-level aur command for reading audio mode parameters.

Now I am getting more ambitious in trying to read out audio tuning
parameters that are set by Motorola's fw on C139.  This one is much
more difficult than Pirelli because Compal's fw is much more heavily
stripped and modified compared to TI's baseline: Compal took out ETM
(or perhaps forked off before TI added it), and the old TM3 protocol
ABB register read command (oabbr in fc-tmsh) cannot be used either
because it's broken - returns garbage.  With no way to read out ABB
registers without killing the fw, I found a much more brutal way:
boot the phone without a SIM so the fw won't be doing much, break into
the running fw with tfc139, then run fc-loadtool along the special
tfc139 entry path (-h compal -c none).  With this horrendous hack,
most ABB registers will still contain values that were programmed by
the official fw as fc-loadtool runs, and we can then use the abbr
command in fc-loadtool to read them.  The same goes for the DSP API
words for AEC and FIR configuration.

I have previous used this method successfully to read out Compal's
battery charging configuration, and also their APCOFF setting in
connection with RF calibration work - so I figured I would try the
same method to get their audio config.  And I did get a readout - see
the compal/audio/tfc139-headset-entry notes file I just added to our
freecalypso-reveng Hg repository.  However, there is a snafu: right
now my only way of connecting to the UART on C1xx phones is by going
through the headset jack, and using the **16379# hidden menu when
breaking in with tfc139, as opposed to cold boot with fc-loadtool.
And here is how this method becomes problematic for the task of reading
out the firmware's audio settings: when the fw sees a plug being
inserted into the headset jack, it switches the audio mode from
handheld (the phone's built-in earpiece and mic) to headset (using the
headset earpiece and mic instead), and this headset mode setting is
still in effect when we break in with tfc139.  Thus we are able to
read the firmware's audio tunings for the headset mode, but not the
ones for the handheld mode - and I am primarily interested in the
latter.

Now comes the point where other community members can get involved.
Here is one vitally important tidbit about the UART on Mot C1xx that
is known only to more advanced tinkerers: the headset jack is not the
only way to access this UART.  The other connection path to this UART
is by way of little contact pads on the phone's main PCB, accessible
from inside the battery compartment when the battery is removed.
These contact pads are clearly intended for connection by way of a
special bed-of-nails test fixture, but I have heard that many
community tinkerers have soldered little wires to these pads.  In some
older C1xx models the set of signals brought out to these contact pads
included JTAG and the second UART; on C139 both JTAG and the second
UART have been removed to the best of my knowledge, but the contact
pads for the Modem UART (the same one that goes to the headset jack)
are still there.

At this point you have every good reason to ask: why mess around with
soldering wires to pads, or building a special bed-of-nails fixture,
to connect to the same UART that is brought out on the headset jack?
Two reasons:

1) With no plug inserted into the headset jack, the firmware won't see
a "headset plugged in" condition, thus hopefully the register settings
at the time of tfc139 break-in will be the ones for the handheld mode,
not headset.

2) For even more advanced reverse eng or aftermarket fw development,
the UART connection to the contact pads inside the battery compartment
is always there, whereas the headset jack is electrically switched
between the analog headset interface and the digital UART.  Thus if
the UART connection is made the "hard" way, the headset jack becomes
available for testing and fw development related to the actual headset
function.

At this point the most proper course of action would be to design and
build a special bed-of-nails test fixture that would accept a battery-
removed C1xx phone and have nails connecting to the battery contacts
and to the UART contact pads, bringing these power and UART interfaces
out to a FreeCalypso Weidmuller battery power connector and to an
LVCMOS UART connection header.  However, given that a C139-like phone
will never be good enough for me personally, i.e., given my focus on
building our own FC phone handset that would be more like Pirelli
DP-L10 than like C139, I am not in a position to fund the development
of this proposed C1xx bed-of-nails test fixture with my own money -
instead my spending priorities currently go to various prerequisites
toward our own FC handset.

However, there is also a much quicker way: I know that some people in
the past have brute-force soldered little wires to those contact pads
in order to play with JTAG on C1xx phones.  I don't know what they did
for power, as the battery needs to be removed in order to access those
contact pads: perhaps they soldered wires to the battery spring
contacts too, or perhaps the little wires soldered to the UART or JTAG
connection pads were slim enough to fit around a battery that was
reinserted after the soldering job.

If no one else beats me to it, I could try doing this little wire hack
myself - but it will take me a while.  I would need to acquire strips
of 30 AWG wire in 3 different colors (one for GND, one for UART Rx,
one for UART Tx), I would need to crimp Molex female terminals onto
one end of these 3 tiny wires just like I do more commonly with larger
wire gauges, I would assemble the crimped end into a 3-wire connector
that would plug into my DUART28 adapter, and then ask my friends at
Technotronix to solder the other end to the inside of the battery
compartment of a C139 phone.

I remember, however, that some years ago our dear Das Signal was doing
these kinds of little wire soldering hacks with a C1xx phone, probably
mostly for JTAG, but maybe also for the UART connection.  DS - do you
still have that C1xx phone with little wires soldered to contact pads?
Or if not, would it be easier or faster for you to recreate that hack
with UART wires on a C139 than it would be for me to do what I
described above?

If DS or anyone else in our community has a C139 phone with a UART
connection that does not go through the headset jack and that
connection is working at a basic level, I will be happy to provide
further instructions for breaking in with tfc139 and reading out the
audio config.

Hasta la Victoria, Siempre,
Mychaela aka The Mother