Introduction

Little is known about the DSP running the filters and mixers inside the OMAP4/5 AESS.

AE = Audio Engine (the DSP)
AESS = Audio Engine Subsystem (the DSP incl. memory and interface to L4 bus)
ABE = Audio Backend (AESS plus interfaces like McPDM and McBSP to audio ADC/DAC)

Memory of the AESS

pmem = 8kB Program Memory
cmem = Coefficient Memory
dmem = Data Memory
smem = Sample Memory

These memory areas are accessible through /sys/kernel/debug/omap-aess/pmem etc.

Firmware

Firmware is derived from https://github.com/omap-audio/abefw/blob/master/fw/009590/abe_firmware.c and wrapped with headers and mixer/link information into a firmware file /lib/firmware/omap_aess-adfw.bin.

This is loaded by the sound/soc/ti/aess/aess-fw.c driver into the AESS pmem area.

It contains initial values for all the memory areas.

Source code is not available.

The general structure seems to be that there is a jmp instruction at the beginning, then the stack pointer is initialized and some values are copied from cmem to dmem and finally something depends on the OPP setting.

AE DSP architecture

Little is known. Not even a vendor or ABI. The following information is derived from reverse engineering the firmware code and deducing some aspects from how the kernel driver interacts with the DSP.

Registers

there are 16 registers
register r15 is a stack pointer addressing bytes (?)
stack seems to store 16bits only, indicating that the PC is 16 bits

Instructions and encoding

instruction width is 32 bit
program counter increments by 4 bytes (or addresses 32 bits in parallel)

OP-Code	Command	Description
00 0x xa bc	? Ra,Rb,Rc	some operation with values in 3 given registers
01 0x xx ds	STORE? Rs,[Rd]	write value in Rs into dmem address in Rd
04 0x xa bc	ADD? Ra,Rb,Rc	add two values and store in third register
08 2x xx xx	RTS	return from subroutine: pop PC (2 Bytes) from stack (R15)
16 0v vv vd	CONST #v,Rd	load 16 bit constant into register Rd (with sign extend if registers are 32 bit???)
40 0x xx ds	LOAD32? [Rs],Rd	load dmem from address in Rd into Rs
41 0x xx ds	LOAD16? [Rs],Rd	load dmem from address in Rd into Rs
A0 2a aa a0	JMP a	jump to pmem address a (byte address 4*a)
A2 2a aa a0	CALL a	jump to pmen address a (byte address 4*a)
A8 2a aa a0	J[cond] a	conditional? jump to instruction address a (byte address 4*a)

Unknown

width of the registers is still unknown
how does sign extend work (separate command or by load instruction?)
add, sub, mul instructions needed for DSP processing
conditional jmp
anything else
how does access to dmem, cmem, smem work

What DSP brand or model is this?

The first assumption was that it is some variant of tms320, e.g. c660. But comparison with programming manuals and experimenting with some tms320 disassemblers did not lead to an understanding of the code. Rather, it seems to be a non-public DSP system.

Some indications can be derived from the fact that the OMAP4 was announced/published 15 Feb 2010 [https://www.engadget.com/2010-02-15-texas-instruments-introduces-arm-based-omap-4-soc-blaze-develop.html].

This means that the AE was likely chosen for design-in 3-4 years before. So it must have been mature and available as a VHDL building block in approx. 2006.

Another hint is that in that era Nokia was the main customer for OMAP processors, especially the omap3430 was designed for them (N9 tablet). In 2012 Nokia stopped this collaboration.

Anyways this means that the omap4 AE could have been completely or jointly been designed proprietarily by Nokia. So TI did just integrate some building block.

Still, another alternative is the C??? that was quite popular at that time for all types of audio applications, but there isn't much public information.

In any case it is not very important to know who did develop this as long as we can analyse and deduce.