Reading factory RF calibration values out of Mot C1xx phones
============================================================

Motorola C1xx phones are based on the Calypso+Iota+Rita chipset from TI and
their firmware is also loosely based on TI's reference, but Compal (Motorola's
ODM and the maker of these phones) have made lots and lots of changes moving
away from TI's canonical way of doing things.  When it comes to RF calibration,
Mot/Compal have performed it on each individual unit on their factory production
line just like all other GSM phone and modem manufacturers, but instead of
storing the results of this calibration in TI's flash file system, Mot/Compal
have put these calibration values into a completely different flash data
structure of their own invention.

We don't know the proper name for Mot/Compal's flash data structure that has no
counterpart in TI's canonical solution, but we know its location in the flash:

* On C1xx phones with 2 MiB flash (most C11x/12x variants), it is the 8 KiB
  flash sector at 0x1FC000;

* On C139/140 phones and the rare C11x/12x variants with 4 MiB flash, it is the
  8 KiB flash sector at 0x3FC000;

* On C155/156 phones with 8 MiB flash, the data structure in question is
  contained in the first 8 KiB of the 64 KiB physical flash sector at 0x7E0000.

The flash sector in question contains record-structured data; we don't know the
meaning of most of these records, but we have been able to find the RF
calibration records among them and locate the actual calibration values of
interest inside those records.

In order to extract the RF calibration values from your C1xx phone for use with
FreeCalypso, you will need a dump of your phone's flash, or at least a dump of
the specific 8 KiB sector at the model-dependent offset given above.  As a
specific example, if your phone is a C139/140 or a C11x/12x variant with 4 MiB
flash and you have a complete dump of that flash, execute a command like the
following:

c1xx-calextr -b rfbin flashdump.bin 0x3FC000

The c1xx-calextr utility locates the RF calibration records in the flash dump
binary, extracts the specific calibration values of primary importance (Rx
"magic gain" and Tx APC DAC values), and converts them to TI's canonical format
for use with FreeCalypso firmware.  The numeric argument after the flash image
filename is the offset within that image file where the magic sector should be
sought, and the -b option directs the tool to save the converted RF calibration
tables in binary format (the alternative is -a for ASCII format) in the
directory named after the option, named rfbin in this example.

If you use the binary output option as recommended here, the resulting output
directory will have two subdirectories in it, named rx and tx.  The rx
subdirectory will have two files named agcparams.BAND where BAND is 900 and 1800
for EU-band phones or 850 and 1900 for US-band ones, and the tx subdirectory
will have two files named levels.BAND.  This directory structure and these
names for the binary files correspond directly to the /gsm/rf directory subtree
in the flash file system (FFS) of TI's canonical solution, hence once the C1xx
phone in question is converted to FreeCalypso (i.e., runs FreeCalypso fw with
an aftermarket FFS created for it), you can upload the extracted and converted
RF calibration values into it like this:

fc-fsio upload-subtree rfbin /gsm/rf

Limitations
===========

In the traditional RF calibration procedure performed by most GSM phone and
modem manufacturers including Motorola, the Rx "magic gain" and the Tx APC DAC
values (Tx power levels) are calibrated for the center frequency of each band
at first, and then additional measurements are performed at other frequencies
within the band to arrive at channel-dependent corrections for both Rx and Tx.
On devices that follow TI's canonical way of doing things, you can find these
channel correction tables in /gsm/rf/rx/calchan.* and /gsm/rf/tx/calchan.*
files in the FFS.

However, in the case of C1xx phones, Mot/Compal have changed the way in which
they do these channel corrections (both Rx and Tx) from TI's canon, and the
channel correction values stored in their factory calibration records do not
naturally translate to TI's Rx calchan and Tx calchan tables.

In the case of Rx calibration, Mot/Compal have calibrated the channel
corrections with much finer granularity than is called for in TI's canonical
version.  In TI's canon each band is divided into up to 10 subbands for the
purpose of Rx channel compensation, but Mot/Compal used much narrower subbands
of only 6 ARFCNs each, resulting in 21 subbands in the narrowest GSM850 band
and 63 subbands in the widest DCS (1800 MHz) band.  We can see where the
channel correction values for each of these tiny subbands are stored, but
making use of them in FreeCalypso is not easy.

850 MHz band:

128-134
135-140

141-146
147-152

153-158
159-164

165-170
171-176

177-182
183-188

189-194
195-200

201-206
207-212

213-218
219-224

225-230
231-236

237-242
243-248
249-251

900 MHz band:

0-6
7-12
13-18

19-24
25-30
31-36

37-42
43-48
49-54

55-60
61-66
67-72

73-78
79-84
85-90

91-96
97-102
103-108

109-114
115-120
121-124

975-975
976-981
982-987

988-993
994-999
1000-1005

1006-1011
1012-1017
1018-1023

1800 MHz band:

512-518
519-524
525-530
531-536
537-542
543-548

549-554
555-560
561-566
567-572
573-578
579-584

585-590
591-596
597-602
603-608
609-614
615-620

621-626
627-632
633-638
639-644
645-650
651-656

657-662
663-668
669-674
675-680
681-686
687-692

693-698
699-704
705-710
711-716
717-722
723-728

729-734
735-740
741-746
747-752
753-758
759-764

765-770
771-776
777-782
783-788
789-794
795-800
801-806

807-812
813-818
819-824
825-830
831-836
837-842
843-848

849-854
855-860
861-866
867-872
873-878
879-884
885-885

1900 MHz band:

512-518
519-524
525-530
531-536
537-542

543-548
549-554
555-560
561-566
567-572

573-578
579-584
585-590
591-596
597-602

603-608
609-614
615-620
621-626
627-632

633-638
639-644
645-650
651-656
657-662

663-668
669-674
675-680
681-686
687-692

693-698
699-704
705-710
711-716
717-722

723-728
729-734
735-740
741-746
749-752

753-758
759-764
765-770
771-776
777-782

783-788
789-794
795-800
801-806
807-810