FreeCalypso > hg > freecalypso-reveng
annotate pirelli/rfcal @ 261:61e0be63559c
pirelli/fw-disasm: pwr_start_CV_charging() analyzed
author | Mychaela Falconia <falcon@freecalypso.org> |
---|---|
date | Tue, 26 Dec 2017 07:13:21 +0000 |
parents | 2cc7a17c3859 |
children |
rev | line source |
---|---|
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
1 The 64 KiB flash sector at 0x027F0000 (the last sector of the 2nd flash bank) |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
2 contains per-unit factory data, including the IMEI and RF calibration values. |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
3 The location of the IMEI record (at offset 0x504) was found back in 2013-07 and |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
4 its encryption was figured out in 2013-11, but it took a bit longer to find the |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
5 RF calibration data. Most of the RF calibration bits were found in 2014-07, |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
6 but the complete picture presented below has only been reconstructed in 2017-11. |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
7 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
8 The data structure corresponding to TI's RF calibration files listed in the |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
9 config_files_common[] and config_files_band[] arrays in l1_cust.c begins at |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
10 offset 0x528, and has space allocated for each and every one of the files |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
11 listed in those arrays in TI's canonical version, in the same order as in that |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
12 canonical version, with the single exception of /sys/uartswitch. Behold: |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
13 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
14 Hex offset Corresponding FFS file in TI's canonical version |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
15 ---------------------------------------------------------------- |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
16 0528 /gsm/rf/afcdac |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
17 052A checksum byte |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
18 052B 442 (0x1BA) unused (all FF) bytes making room for: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
19 /gsm/rf/stdmap |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
20 /gsm/rf/afcparams |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
21 /gsm/rf/rx/agcglobals |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
22 /gsm/rf/rx/il2agc |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
23 /gsm/rf/rx/agcwords |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
24 |
183
827b8977d3c2
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
181
diff
changeset
|
25 06E5 /sys/adccal |
827b8977d3c2
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
181
diff
changeset
|
26 0709 checksum byte |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
27 070A 33 (0x21) unused (all FF) bytes making room for: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
28 /sys/abb |
183
827b8977d3c2
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
181
diff
changeset
|
29 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
30 072B /gsm/rf/tx/ramps.900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
31 092B checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
32 092C /gsm/rf/tx/levels.900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
33 09AC checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
34 09AD /gsm/rf/tx/calchan.900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
35 0A2D checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
36 0A2E /gsm/rf/tx/ramps.1800 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
37 0C2E checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
38 0C2F /gsm/rf/tx/levels.1800 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
39 0CAF checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
40 0CB0 /gsm/rf/tx/calchan.1800 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
41 0D30 checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
42 0D31 /gsm/rf/tx/ramps.1900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
43 0F31 checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
44 0F32 /gsm/rf/tx/levels.1900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
45 0FB2 checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
46 0FB3 /gsm/rf/tx/calchan.1900 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
47 1033 checksum byte |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
48 1034 123 (0x7B) unused (all FF) bytes making room for: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
49 /gsm/rf/tx/caltemp.900 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
50 /gsm/rf/tx/caltemp.1800 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
51 /gsm/rf/tx/caltemp.1900 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
52 |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
53 10AF /gsm/rf/rx/calchan.900 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
54 10D7 checksum byte |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
55 10D8 /gsm/rf/rx/agcparams.900 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
56 10E0 checksum byte |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
57 10E1 /gsm/rf/rx/calchan.1800 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
58 1109 checksum byte |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
59 110A /gsm/rf/rx/agcparams.1800 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
60 1112 checksum byte |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
61 1113 /gsm/rf/rx/calchan.1900 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
62 113B checksum byte |
198
30ba25056ecd
pirelli/rfcal: Rx agcparams and calchan were swapped
Space Falcon <falcon@ivan.Harhan.ORG>
parents:
183
diff
changeset
|
63 113C /gsm/rf/rx/agcparams.1900 |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
64 1144 checksum byte |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
65 1145 more than enough unused (all FF) bytes to fit: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
66 /gsm/rf/rx/caltemp.900 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
67 /gsm/rf/rx/caltemp.1800 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
68 /gsm/rf/rx/caltemp.1900 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
69 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
70 TI's canonical version classifies each of the files listed in those |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
71 config_files_common[] and config_files_band[] arrays into one of 8 categories: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
72 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
73 f = RF calibration |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
74 F = RF config |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
75 r = Rx calibration |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
76 R = Rx config |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
77 t = Tx calibration |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
78 T = Tx config |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
79 s = system calibration |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
80 S = system config |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
81 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
82 Pirelli's factory data structure allocates space for all of the possible files |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
83 in all 8 categories, but out of all these spaces, the only ones that are |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
84 actually filled with bits (not all FF) are the ones corresponding to the 4 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
85 "calibration" categories, and not the "config" ones. It is my (Mychaela's) |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
86 guess that Foxconn folks probably preserved the logic invoked by me 102 through |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
87 me 109 commands unchanged from TI's original, and thus had the theoretical |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
88 ability to write everything into their invented data structure, but only issued |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
89 the me 102/104/106/108 commands in their factory production flow, hence only |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
90 the "calibration" record slots got filled. |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
91 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
92 Please note that the slots corresponding to the missing files in the "config" |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
93 categories are filled with all FF bytes, and do NOT contain the "standard" or |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
94 "never changed" bits compiled into the firmware. Because these bits are not |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
95 present in the factory record in the flash, any aftermarket firmware running on |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
96 these phones needs to provide these bits on its own. This category very notably |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
97 includes the afcparams table. |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
98 |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
99 Each calibration record is followed by a checksum byte. It is a simple ripple- |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
100 carry sum of all bytes in the preceding record. Note that this checksum byte |
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
101 is always 0 for the ramps records, as each correctly-formed ramp adds up to 128 |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
102 (0x80), and the array has an even number of ramps in total. It is also my |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
103 (Mychaela's) guess that Pirelli's fw probably uses this checksum byte to detect |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
104 that the "config" files are missing and avoid loading the FF bytes into the |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
105 corresponding L1 RAM data structures: the sum of all FF bytes in the data space |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
106 does not equal FF unless the record length is 1 byte or 257 or 513... bytes, |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
107 and none of TI's calibration/config records match those byte lengths. |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
108 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
109 Absence of the afcparams table |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
110 ============================== |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
111 |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
112 The afcparams table is placed in the "RF config" category in TI's TCS211 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
113 reference fw, rather than "RF calibration". It appears that in the very old |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
114 days of Sara RF (before the D-Sample) this table contained only the Psi |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
115 constants (no min/max/nominal DAC), and these Psi constants were tweaked in the |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
116 source code in l1_rfN.h, rather than via per-unit calibration - hence the |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
117 "config" rather than "calibration" classification. Then RF 10 (Clara) came |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
118 along, TI started using "plain" VCXOs without the "TC" part, they implemented a |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
119 new AFC algorithm (VCXO_ALGO), and the min/max/nominal DAC fields got added to |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
120 the afcparams table. The complete story is not clear, but the end result is |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
121 that when the days of Openmoko came around, FIC (OM's factory) had a production |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
122 line calibration program, presumably from TI (I never got a copy of it, but I |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
123 was told it was a Windows binary sans source), that performed individual |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
124 per-unit calibration of the VCXO along with the expected Rx and Tx band |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
125 calibrations, and the afcparams table is calibrated per unit on Openmoko |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
126 devices. |
181
bf4286245c74
Pirelli's RF calibration cracked
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
127 |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
128 Both theory and practice indicate that OM's way of calibrating the afcparams |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
129 table on a per-unit basis is not the only way: the per-unit calibration does |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
130 not help much in practice because of the strong temperature sensitivity, and |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
131 the new AFC algorithm implemented by TI has to deal with wide uncertainties in |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
132 the initial VCXO frequency. Instead it appears to be sufficient to calibrate |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
133 the VCXO and the settings in the afcparams table on a per-design basis, rather |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
134 than per unit, and it appears that Motorola/Compal did just that on their C1xx |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
135 phones - which use a "plain" VCXO and not a VCTCXO like the Pirelli. |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
136 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
137 Querying Pirelli's fw for the actively used afcparams table via rftr 9 returns |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
138 the following: |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
139 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
140 rf_table afcparams |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
141 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
142 6974 # psi_sta_inv |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
143 8 # psi_st |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
144 492713 # psi_st_32 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
145 8717 # psi_st_inv |
183
827b8977d3c2
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
181
diff
changeset
|
146 |
220
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
147 888 # dac_center |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
148 -9568 # dac_min |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
149 11352 # dac_max |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
150 2560 # snr_thr |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
151 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
152 Because the slot in the factory data structure where the afcparams record ought |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
153 to go is all FF bytes, the table returned by the fw above can only be hard-coded |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
154 in the fw itself. The 4 numbers in the second group are exactly the same as |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
155 the hard-coded numbers in l1_rf12.h in TI's reference fw, but the Psi numbers |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
156 are different - Foxconn/Pirelli folks must have tuned them for their VCTCXO. |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
157 |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
158 In this light, it is worthy to note that the afcdac record *is* present in |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
159 Pirelli's factory data block, and it differs from one unit to the next, i.e., |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
160 it has been calibrated on a per-unit basis. TI's reference fw selects the |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
161 ALGO_AFC_LQG_PREDICTOR AFC algorithm which does not use this afcdac setting |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
162 at all, but perhaps Pirelli's fw does something different because of their use |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
163 of a VCTCXO instead of a "plain" VCXO - we don't know, and the reverse eng |
2cc7a17c3859
pirelli/rfcal: new understanding
Mychaela Falconia <falcon@freecalypso.org>
parents:
198
diff
changeset
|
164 effort to find the needed answers would be more than we can currently justify. |