# HG changeset patch # User Michael Spacefalcon # Date 1405383880 0 # Node ID 827b8977d3c2cee1dd071afd99fac979fee02a28 # Parent c38075b8a625deca7b768be083278c5041c12555 pirelli/rfcal: found /sys/adccal, no luch with /gsm/rf/afc* diff -r c38075b8a625 -r 827b8977d3c2 pirelli/rfcal --- a/pirelli/rfcal Sun Jul 13 07:51:24 2014 +0000 +++ b/pirelli/rfcal Tue Jul 15 00:24:40 2014 +0000 @@ -2,10 +2,14 @@ contains per-unit factory data, including the IMEI and RF calibration values. The location of the IMEI record (at offset 0x504) was found back in 2013-07 and its encryption was figured out in 2013-11, but it took a bit longer to find the -RF calibration data. But I finally found the latter as well. Here they are: +RF calibration data. But I finally found most of the latter as well. Here +they are: Hex offset Corresponding FFS file in TI's canonical version ---------------------------------------------------------------- +06E5 /sys/adccal +0709 checksum byte + 072B /gsm/rf/tx/ramps.900 092B checksum byte 092C /gsm/rf/tx/levels.900 @@ -43,10 +47,19 @@ is always 0 for the ramps records, as each correctly-formed ramp adds up to 128 (0x80), and the array has an even number of ramps in total. -The following still remain to be located: +Unfortunately though, I have not been able to locate these two records: /gsm/rf/afcdac /gsm/rf/afcparams -I don't expect major difficulty in finding them; I just haven't got around to -studying this part of the calibration system yet. +These two files appear in Openmoko's FFS on GTA02 modems, and the byte content +differs for each physical unit, so I assume that these values really do need to +be calibrated per unit, but I haven't been able to locate them in Pirelli's +factory data block. /gsm/rf/afcdac is only 2 bytes long, thus very hard to +spot visually in a hex dump of an unknown larger data structure; +/gsm/rf/afcparams is 24 bytes long and has some structure to it, so I was +hoping to recognize the latter, but no luck. + +We will have to try running uncalibrated, or perhaps we'll find the code in +Pirelli's fw that fills the parts of the T_RF structure that are normally read +from these files.