--- a/doc/Compal-calibration	Mon Nov 20 16:24:22 2017 +0000
+++ b/doc/Compal-calibration	Mon Nov 20 17:51:23 2017 +0000
@@ -326,3 +326,48 @@
 factory records, and given that the tolerances for Tx power levels given in the
 GSM 05.05 spec are quite generous, we expect to still be within these tolerances
 despite the lack of channel correction.
+
+In vivo approach: tried and failed
+==================================
+
+Before I figured out the format of Mot/Compal's factory calibration records in
+their flash and wrote the c1xx-calextr "in vitro" extraction and conversion
+tool, I tried an "in vivo" approach: reading the calibration values out from
+the running firmware via TI's L1/RF Test Mode commands which are still present
+in Mot/Compal's fw.  This approach successfully yielded the tables of Tx ramp
+templates which are calibrated per design rather than per unit and thus compiled
+into the fw and not present in the per-unit factory calibration records (these
+extracted Tx ramps tables are now used by FC Magnetite fw when built for the
+C139 target), but does not help with much of anything else:
+
+* One can read the calibrated Tx levels table (rftr 16) for the low frequency
+  band (850 or 900 MHz), but not for the high (1800 or 1900 MHz) band: in order
+  to access the tables for the high band, one needs to issue an rfpw 7 command,
+  but in Mot/Compal's version the latter command only loads the compiled-in
+  tables and does not apply their non-TI calibration records.
+
+* The Rx agcparams table returned in response to rftr 31 always has the GMagic
+  field set to the fw's compiled-in value and not the calibrated one.
+
+* The Rx calchan table (which Mot/Compal enlarged from 10 to 63 entries as
+  explained earlier in this article) cannot be read out at all: the rftr 25
+  command crashes the firmware, probably via a buffer overflow from the
+  enlarged table.
+
+* The Tx calchan table can be read out with rftr 17, but it does not make any
+  sense: it still has 4 copies of a table of 8 subbands like in TI's canon,
+  even though when we look at their factory calibration records, we can clearly
+  see that the table of Tx channel correction values is also enlarged.  But the
+  correction values themselves are centered around 0 in this strange table
+  returned in response to rftr 17, and not around 128 like in TI's canon.
+
+The fc-readcal utility was written before c1xx-calextr, and it was my original
+idea of how to extract Mot/Compal's factory RF calibration values.  It features
+a -c command line option for "Compal mode" which disables the reading of Rx
+calchan and Tx calchan tables via rftr 25 and rftr 17, respectively (the former
+crashes the fw, the latter has the wrong semantics), but because it issues
+rfpw 7 commands for each band preceded by tms 1, it will only yield the
+firmware's compiled-in values, and not any of the factory-calibrated ones.
+
+Therefore, the fc-readcal method should not be used, and the c1xx-calextr method
+described in the main body of this article should be used instead.