FreeCalypso > hg > freecalypso-reveng

comparison pirelli/rfcal @ 183:827b8977d3c2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
author Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
date Tue, 15 Jul 2014 00:24:40 +0000
parents bf4286245c74
children 30ba25056ecd
comparison
equal deleted inserted replaced
182:c38075b8a625 183:827b8977d3c2
1 The 64 KiB flash sector at 0x027F0000 (the last sector of the 2nd flash bank) 1 The 64 KiB flash sector at 0x027F0000 (the last sector of the 2nd flash bank)
2 contains per-unit factory data, including the IMEI and RF calibration values. 2 contains per-unit factory data, including the IMEI and RF calibration values.
3 The location of the IMEI record (at offset 0x504) was found back in 2013-07 and 3 The location of the IMEI record (at offset 0x504) was found back in 2013-07 and
4 its encryption was figured out in 2013-11, but it took a bit longer to find the 4 its encryption was figured out in 2013-11, but it took a bit longer to find the
5 RF calibration data. But I finally found the latter as well. Here they are: 5 RF calibration data. But I finally found most of the latter as well. Here
6 they are:
6 7
7 Hex offset Corresponding FFS file in TI's canonical version 8 Hex offset Corresponding FFS file in TI's canonical version
8 ---------------------------------------------------------------- 9 ----------------------------------------------------------------
10 06E5 /sys/adccal
11 0709 checksum byte
12
9 072B /gsm/rf/tx/ramps.900 13 072B /gsm/rf/tx/ramps.900
10 092B checksum byte 14 092B checksum byte
11 092C /gsm/rf/tx/levels.900 15 092C /gsm/rf/tx/levels.900
12 09AC checksum byte 16 09AC checksum byte
13 09AD /gsm/rf/tx/calchan.900 17 09AD /gsm/rf/tx/calchan.900
41 Each calibration record is followed by a checksum byte. It is a simple ripple- 45 Each calibration record is followed by a checksum byte. It is a simple ripple-
42 carry sum of all bytes in the preceding record. Note that this checksum byte 46 carry sum of all bytes in the preceding record. Note that this checksum byte
43 is always 0 for the ramps records, as each correctly-formed ramp adds up to 128 47 is always 0 for the ramps records, as each correctly-formed ramp adds up to 128
44 (0x80), and the array has an even number of ramps in total. 48 (0x80), and the array has an even number of ramps in total.
45 49
46 The following still remain to be located: 50 Unfortunately though, I have not been able to locate these two records:
47 51
48 /gsm/rf/afcdac 52 /gsm/rf/afcdac
49 /gsm/rf/afcparams 53 /gsm/rf/afcparams
50 54
51 I don't expect major difficulty in finding them; I just haven't got around to 55 These two files appear in Openmoko's FFS on GTA02 modems, and the byte content
52 studying this part of the calibration system yet. 56 differs for each physical unit, so I assume that these values really do need to
57 be calibrated per unit, but I haven't been able to locate them in Pirelli's
58 factory data block. /gsm/rf/afcdac is only 2 bytes long, thus very hard to
59 spot visually in a hex dump of an unknown larger data structure;
60 /gsm/rf/afcparams is 24 bytes long and has some structure to it, so I was
61 hoping to recognize the latter, but no luck.
62
63 We will have to try running uncalibrated, or perhaps we'll find the code in
64 Pirelli's fw that fills the parts of the T_RF structure that are normally read
65 from these files.