Tracing EARN & EARP outputs from Iota.  On L1 they go to vias at (2422,518) and
(2449,518).  On L2 they go to vias at (2455,322) and (2492,323).  Tracing made
difficult by flaws in steve-m's grind-down process, but they appear to go to L4,
where they then seem to go to other vias at (491,1254) and (490,1292).  Found
them on L7: going to immediately adjacent micro-vias at (514,1255) and
(514,1295).  On L8 they go to the earpiece speaker.

Tracing the loudspeaker signal path starting with the physical speaker connector
on L1.  The connector part center is about (1930,212).  The connector footprint
on L1 is damaged by steve-m's grind-down process (almost gone), but there seem
to be micro-vias at (1756,251) and (2005,237).  On L2 they go to (1788,231) and
(2021,264).  On L7 they go to micro-vias at (1784,262) and (1992,252).  On L8
they go by some caps and then back to new micro-vias!  The latter are at
(1902,220) and (1903,259).  On L7 the grind-down damage gets in the way again,
but they appear to go to vias at (1935,218) and (1934,260).  Found them on L3:
going to new vias at (3703,311) and (3739,313).  (It might actually be L4.)
Found them on L7: fat traces to micro-vias at (3870,934) and (3898,869).
Finally on L8 they go to the Winbond chip!  The speaker connection pins appear
to be the two leftmost ones in the top row of 9 pins.

Winbond chip connections

Chip orientation: as viewed in steve-m's depopulated L8 picture, the pinout
is a L/R flip of the diagram in the datasheet (top and bottom match up, left
and right flipped).

VREF appears to go to a cap to GND like in the reference schem.
VDD has a fat trace going to a cap; there must be some via(s) to L7 for the
actual power source, but nothing is visible.  Coord range to search:
x between 3786 and 3975, y between 1205 and 1387.  Might be a bump at
(3880,1380).  Probably connects to the "fat finger" trace on L7.

LED output goes to exposed TP, no visible signs of going anywhere else.
IRQ output goes to exposed TP at (4174,1316), look for it on L7.  Couldn't
find it - maybe it isn't connected after all?  Will try programming the
chip w/o interrupts.

RST input: visible microvia at (4078,1357), found it on L7, goes to (4232,1515),
looks like a microvia back to L8.  Found it on L8: it's an exposed test point
with the microvia in its centre, and the trace from it goes to SPCA552E ball
J7!  From the Nokia schem, it looks like this SPCA pin is an LCM output that
can also be repurposed as a GPIO.

CS input: visible microvia at (4325,1105) inside an exposed TP. On L7 the long
trace ends at (1760,1385), looks like a possible microvia back to L8.
Found it on L8: it connects to a pin on one of the little ICs under the LCD,
suspected chip select decoder.

Calypso-Iota Voice Band interface

Tracing the Calypso voice output signal, starting from Calypso ball P14 (VDX).
On L1 it goes to a via at (3401,429).  On L2 it branches: one end goes to
(3366,304) - suspected via back to L1 for a test point, and the other end goes
to (2885,917) - also a suspected via back to L1.  Found the 1st branch on L1:
it's a short trace to another via at (3291,304).  Found the 2nd branch on L1
too: it goes to Iota ball F5 (VDR), matching the Leonardo schematics.

Now let's trace the branch that went to (3291,304) on L1.  On L2 it goes to a
short trace that goes to (3349,197) - suspected micro-via back to L1.  Looking
on L1: yes, indeed the trace seems to lead back here, but then the edge
grind-down damage gets in the way.  Looking at the L1 populated photo, the
trace definitely seems to go to an exposed test point.

The apparent lack of a switch or MUX on the Iota digital voice input strongly
suggests that in Wi-Fi VoIP operation the Calypso DSP acts as a forwarder for
the digital voice samples, which are being fed to it from the VoIP chip via
another interface: MCSI, or perhaps the otherwise unused MODEM UART switched
over to DSP ownership.