Audio on tsvinc

FiiO X1 EQ table: seven register bytes my generator never read

Sun, 31 May 2026 00:00:00 +0000

My project notes for the FiiO X1 have a gotchas section, and for a while one line in it was wrong in a way that sounded careful. It said that the EQ coefficients I had generated in Q23, a 24-bit fixed-point format, broke the boot, so the PCM5142, the player's DAC chip, probably had constraints beyond the math of the Audio EQ Cookbook, the standard recipe for these filters.

It reads like a finding. It was a shrug with a datasheet attached. I distrust a root cause the way I distrust a datasheet, by how much it explains without having been tested, and this one explained everything and had been tested against nothing.

FiiO X1 PCM5142 DSP blocks: the flat head I believed

Sun, 31 May 2026 00:00:00 +0000

For the length of one hex dump, three blocks of DAC coefficients in the FiiO X1's firmware were solved. I had read the first 96 bytes of each, seen nothing but unity filters, which pass the signal through unchanged, and written down that all three were a flat, do-nothing initialization. Then the decoder read the rest.

The X1 is a pocket music player from 2014 whose sound comes out of a TI PCM5142, a DAC with a small programmable DSP inside it. The firmware, HiBy's, on the µC/OS-II kernel, talks to the DAC over a three-wire serial line it drives by toggling GPIO pins; Part 9 found that line and the equalizer table behind it, and Part 15 decoded that table. My notes on the audio code still listed three other blocks as undecoded: 2,708 bytes each, sitting just below the equalizer table in memory, streamed to the DAC every time the firmware opens an audio stream. Nobody puts 8 KB of nothing in a firmware image and then sends it to a chip on every stream, which should have been my first clue.

FiiO X1 bare-metal audio: four GPIO offsets, all wrong

Tue, 26 May 2026 00:00:00 +0000

The build was clean: 18,672 bytes, nothing worse than unused-function warnings. A clean build is the most reassuring thing a compiler can say and the least informative, and this one was vouching for an audio driver that, as written, could not have made a sound.

The driver belongs to a bootloader for the FiiO X1, a $99 music player on an Ingenic JZ4760B MIPS chip. Part 13 wrote that bootloader: it runs from the SD card as factory.x1, a file the stock loader executes without checking, and it can load an image of Rockbox, the open-source player firmware. The next step toward Rockbox is sound, and the smallest honest test of sound is a sine wave from bare-metal code: no codecs, no DMA, no mixer. As far as I knew then, that meant three things the stock loader, which doesn't play music, has no reason to set up: an I2C controller to configure the TI PCM5142 DAC, the AIC (the chip's audio interface) to send it I2S samples, and the GPIO pins both of them need.

FiiO X1 EQ presets: floats in .data, not a NAND cache

Sun, 25 Jan 2026 00:00:00 +0000

Where does a music player keep its equalizer presets? On the FiiO X1 I had a confident answer, a cache on the flash chip that the firmware writes once and trusts forever, and the answer had cost me an evening of flashing.

The X1 is a $99 player on an Ingenic JZ4760B MIPS chip, running firmware that HiBy wrote on the µC/OS-II real-time kernel. In Part 10 I built a patcher that rewrites sys.bin, the firmware binary inside the official update file x1.fw, and the one change I wanted most showed up once, one slot off, and never again after I fixed the slot: I patched the preset gains, flashed, opened the EQ screen, and Rock still read all zeros. Meanwhile my custom EQ setting and my theme choice had survived the flash. So I wrote down a theory: the presets live in a cache on the NAND's userdata partition, and the values in the binary only matter the first time. This part reads the firmware's EQ code in Ghidra, a disassembler and decompiler, instead of guessing at it.