FreeCalypso > hg > freecalypso-reveng

annotate pirelli/rfcal @ 403:50c0fac9a4a8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
compal/boot/c118-dfboot.disasm: new analysis
author Mychaela Falconia <falcon@freecalypso.org>
date Sun, 15 Jan 2023 00:54:33 +0000
parents 2cc7a17c3859
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
1 The 64 KiB flash sector at 0x027F0000 (the last sector of the 2nd flash bank)
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
2 contains per-unit factory data, including the IMEI and RF calibration values.
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
3 The location of the IMEI record (at offset 0x504) was found back in 2013-07 and
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
4 its encryption was figured out in 2013-11, but it took a bit longer to find the
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
5 RF calibration data. Most of the RF calibration bits were found in 2014-07,
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
6 but the complete picture presented below has only been reconstructed in 2017-11.
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
7
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
8 The data structure corresponding to TI's RF calibration files listed in the
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
9 config_files_common[] and config_files_band[] arrays in l1_cust.c begins at
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
10 offset 0x528, and has space allocated for each and every one of the files
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
11 listed in those arrays in TI's canonical version, in the same order as in that
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
12 canonical version, with the single exception of /sys/uartswitch. Behold:
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
13
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
14 Hex offset Corresponding FFS file in TI's canonical version
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
15 ----------------------------------------------------------------
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
16 0528 /gsm/rf/afcdac
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
17 052A checksum byte
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
18 052B 442 (0x1BA) unused (all FF) bytes making room for:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
19 /gsm/rf/stdmap
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
20 /gsm/rf/afcparams
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
21 /gsm/rf/rx/agcglobals
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
22 /gsm/rf/rx/il2agc
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
23 /gsm/rf/rx/agcwords
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
24
183
827b8977d3c2 pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 181
diff changeset
25 06E5 /sys/adccal
827b8977d3c2 pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 181
diff changeset
26 0709 checksum byte
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
27 070A 33 (0x21) unused (all FF) bytes making room for:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
28 /sys/abb
183
827b8977d3c2 pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 181
diff changeset
29
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
30 072B /gsm/rf/tx/ramps.900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
31 092B checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
32 092C /gsm/rf/tx/levels.900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
33 09AC checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
34 09AD /gsm/rf/tx/calchan.900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
35 0A2D checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
36 0A2E /gsm/rf/tx/ramps.1800
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
37 0C2E checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
38 0C2F /gsm/rf/tx/levels.1800
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
39 0CAF checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
40 0CB0 /gsm/rf/tx/calchan.1800
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
41 0D30 checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
42 0D31 /gsm/rf/tx/ramps.1900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
43 0F31 checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
44 0F32 /gsm/rf/tx/levels.1900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
45 0FB2 checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
46 0FB3 /gsm/rf/tx/calchan.1900
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
47 1033 checksum byte
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
48 1034 123 (0x7B) unused (all FF) bytes making room for:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
49 /gsm/rf/tx/caltemp.900
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
50 /gsm/rf/tx/caltemp.1800
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
51 /gsm/rf/tx/caltemp.1900
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
52
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
53 10AF /gsm/rf/rx/calchan.900
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
54 10D7 checksum byte
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
55 10D8 /gsm/rf/rx/agcparams.900
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
56 10E0 checksum byte
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
57 10E1 /gsm/rf/rx/calchan.1800
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
58 1109 checksum byte
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
59 110A /gsm/rf/rx/agcparams.1800
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
60 1112 checksum byte
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
61 1113 /gsm/rf/rx/calchan.1900
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
62 113B checksum byte
198
30ba25056ecd pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents: 183
diff changeset
63 113C /gsm/rf/rx/agcparams.1900
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
64 1144 checksum byte
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
65 1145 more than enough unused (all FF) bytes to fit:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
66 /gsm/rf/rx/caltemp.900
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
67 /gsm/rf/rx/caltemp.1800
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
68 /gsm/rf/rx/caltemp.1900
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
69
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
70 TI's canonical version classifies each of the files listed in those
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
71 config_files_common[] and config_files_band[] arrays into one of 8 categories:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
72
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
73 f = RF calibration
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
74 F = RF config
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
75 r = Rx calibration
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
76 R = Rx config
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
77 t = Tx calibration
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
78 T = Tx config
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
79 s = system calibration
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
80 S = system config
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
81
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
82 Pirelli's factory data structure allocates space for all of the possible files
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
83 in all 8 categories, but out of all these spaces, the only ones that are
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
84 actually filled with bits (not all FF) are the ones corresponding to the 4
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
85 "calibration" categories, and not the "config" ones. It is my (Mychaela's)
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
86 guess that Foxconn folks probably preserved the logic invoked by me 102 through
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
87 me 109 commands unchanged from TI's original, and thus had the theoretical
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
88 ability to write everything into their invented data structure, but only issued
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
89 the me 102/104/106/108 commands in their factory production flow, hence only
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
90 the "calibration" record slots got filled.
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
91
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
92 Please note that the slots corresponding to the missing files in the "config"
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
93 categories are filled with all FF bytes, and do NOT contain the "standard" or
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
94 "never changed" bits compiled into the firmware. Because these bits are not
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
95 present in the factory record in the flash, any aftermarket firmware running on
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
96 these phones needs to provide these bits on its own. This category very notably
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
97 includes the afcparams table.
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
98
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
99 Each calibration record is followed by a checksum byte. It is a simple ripple-
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
100 carry sum of all bytes in the preceding record. Note that this checksum byte
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
101 is always 0 for the ramps records, as each correctly-formed ramp adds up to 128
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
102 (0x80), and the array has an even number of ramps in total. It is also my
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
103 (Mychaela's) guess that Pirelli's fw probably uses this checksum byte to detect
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
104 that the "config" files are missing and avoid loading the FF bytes into the
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
105 corresponding L1 RAM data structures: the sum of all FF bytes in the data space
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
106 does not equal FF unless the record length is 1 byte or 257 or 513... bytes,
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
107 and none of TI's calibration/config records match those byte lengths.
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
108
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
109 Absence of the afcparams table
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
110 ==============================
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
111
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
112 The afcparams table is placed in the "RF config" category in TI's TCS211
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
113 reference fw, rather than "RF calibration". It appears that in the very old
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
114 days of Sara RF (before the D-Sample) this table contained only the Psi
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
115 constants (no min/max/nominal DAC), and these Psi constants were tweaked in the
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
116 source code in l1_rfN.h, rather than via per-unit calibration - hence the
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
117 "config" rather than "calibration" classification. Then RF 10 (Clara) came
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
118 along, TI started using "plain" VCXOs without the "TC" part, they implemented a
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
119 new AFC algorithm (VCXO_ALGO), and the min/max/nominal DAC fields got added to
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
120 the afcparams table. The complete story is not clear, but the end result is
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
121 that when the days of Openmoko came around, FIC (OM's factory) had a production
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
122 line calibration program, presumably from TI (I never got a copy of it, but I
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
123 was told it was a Windows binary sans source), that performed individual
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
124 per-unit calibration of the VCXO along with the expected Rx and Tx band
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
125 calibrations, and the afcparams table is calibrated per unit on Openmoko
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
126 devices.
181
bf4286245c74 Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff changeset
127
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
128 Both theory and practice indicate that OM's way of calibrating the afcparams
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
129 table on a per-unit basis is not the only way: the per-unit calibration does
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
130 not help much in practice because of the strong temperature sensitivity, and
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
131 the new AFC algorithm implemented by TI has to deal with wide uncertainties in
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
132 the initial VCXO frequency. Instead it appears to be sufficient to calibrate
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
133 the VCXO and the settings in the afcparams table on a per-design basis, rather
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
134 than per unit, and it appears that Motorola/Compal did just that on their C1xx
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
135 phones - which use a "plain" VCXO and not a VCTCXO like the Pirelli.
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
136
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
137 Querying Pirelli's fw for the actively used afcparams table via rftr 9 returns
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
138 the following:
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
139
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
140 rf_table afcparams
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
141
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
142 6974 # psi_sta_inv
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
143 8 # psi_st
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
144 492713 # psi_st_32
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
145 8717 # psi_st_inv
183
827b8977d3c2 pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents: 181
diff changeset
146
220
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
147 888 # dac_center
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
148 -9568 # dac_min
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
149 11352 # dac_max
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
150 2560 # snr_thr
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
151
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
152 Because the slot in the factory data structure where the afcparams record ought
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
153 to go is all FF bytes, the table returned by the fw above can only be hard-coded
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
154 in the fw itself. The 4 numbers in the second group are exactly the same as
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
155 the hard-coded numbers in l1_rf12.h in TI's reference fw, but the Psi numbers
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
156 are different - Foxconn/Pirelli folks must have tuned them for their VCTCXO.
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
157
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
158 In this light, it is worthy to note that the afcdac record *is* present in
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
159 Pirelli's factory data block, and it differs from one unit to the next, i.e.,
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
160 it has been calibrated on a per-unit basis. TI's reference fw selects the
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
161 ALGO_AFC_LQG_PREDICTOR AFC algorithm which does not use this afcdac setting
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
162 at all, but perhaps Pirelli's fw does something different because of their use
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
163 of a VCTCXO instead of a "plain" VCXO - we don't know, and the reverse eng
2cc7a17c3859 pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents: 198
diff changeset
164 effort to find the needed answers would be more than we can currently justify.