--- a/pirelli/rfcal	Sun Jul 13 07:51:24 2014 +0000
+++ b/pirelli/rfcal	Tue Jul 15 00:24:40 2014 +0000
@@ -2,10 +2,14 @@
 contains per-unit factory data, including the IMEI and RF calibration values.
 The location of the IMEI record (at offset 0x504) was found back in 2013-07 and
 its encryption was figured out in 2013-11, but it took a bit longer to find the
-RF calibration data.  But I finally found the latter as well.  Here they are:
+RF calibration data.  But I finally found most of the latter as well.  Here
+they are:
 
 Hex offset	Corresponding FFS file in TI's canonical version
 ----------------------------------------------------------------
+06E5		/sys/adccal
+0709		    checksum byte
+
 072B		/gsm/rf/tx/ramps.900
 092B		    checksum byte
 092C		/gsm/rf/tx/levels.900
@@ -43,10 +47,19 @@
 is always 0 for the ramps records, as each correctly-formed ramp adds up to 128
 (0x80), and the array has an even number of ramps in total.
 
-The following still remain to be located:
+Unfortunately though, I have not been able to locate these two records:
 
 /gsm/rf/afcdac
 /gsm/rf/afcparams
 
-I don't expect major difficulty in finding them; I just haven't got around to
-studying this part of the calibration system yet.
+These two files appear in Openmoko's FFS on GTA02 modems, and the byte content
+differs for each physical unit, so I assume that these values really do need to
+be calibrated per unit, but I haven't been able to locate them in Pirelli's
+factory data block.  /gsm/rf/afcdac is only 2 bytes long, thus very hard to
+spot visually in a hex dump of an unknown larger data structure;
+/gsm/rf/afcparams is 24 bytes long and has some structure to it, so I was
+hoping to recognize the latter, but no luck.
+
+We will have to try running uncalibrated, or perhaps we'll find the code in
+Pirelli's fw that fills the parts of the T_RF structure that are normally read
+from these files.