FreeCalypso > hg > freecalypso-reveng
diff pirelli/rfcal @ 183:827b8977d3c2
pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc*
author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
---|---|
date | Tue, 15 Jul 2014 00:24:40 +0000 |
parents | bf4286245c74 |
children | 30ba25056ecd |
line wrap: on
line diff
--- a/pirelli/rfcal Sun Jul 13 07:51:24 2014 +0000 +++ b/pirelli/rfcal Tue Jul 15 00:24:40 2014 +0000 @@ -2,10 +2,14 @@ contains per-unit factory data, including the IMEI and RF calibration values. The location of the IMEI record (at offset 0x504) was found back in 2013-07 and its encryption was figured out in 2013-11, but it took a bit longer to find the -RF calibration data. But I finally found the latter as well. Here they are: +RF calibration data. But I finally found most of the latter as well. Here +they are: Hex offset Corresponding FFS file in TI's canonical version ---------------------------------------------------------------- +06E5 /sys/adccal +0709 checksum byte + 072B /gsm/rf/tx/ramps.900 092B checksum byte 092C /gsm/rf/tx/levels.900 @@ -43,10 +47,19 @@ is always 0 for the ramps records, as each correctly-formed ramp adds up to 128 (0x80), and the array has an even number of ramps in total. -The following still remain to be located: +Unfortunately though, I have not been able to locate these two records: /gsm/rf/afcdac /gsm/rf/afcparams -I don't expect major difficulty in finding them; I just haven't got around to -studying this part of the calibration system yet. +These two files appear in Openmoko's FFS on GTA02 modems, and the byte content +differs for each physical unit, so I assume that these values really do need to +be calibrated per unit, but I haven't been able to locate them in Pirelli's +factory data block. /gsm/rf/afcdac is only 2 bytes long, thus very hard to +spot visually in a hex dump of an unknown larger data structure; +/gsm/rf/afcparams is 24 bytes long and has some structure to it, so I was +hoping to recognize the latter, but no luck. + +We will have to try running uncalibrated, or perhaps we'll find the code in +Pirelli's fw that fills the parts of the T_RF structure that are normally read +from these files.