SEQ COMMAND TX_OPCODE RX_OPCODE DATA_FIELDS DATA_DEFAULTS OPTION_FIELDS OPTION_DEFAULTS DATA_WIDTH DESCRIPTION
1 READ TIMEOUT
READ
2
YES
1 Read only.
2 GENERIC_COMMAND - Send Generic Opcode/Data Hex String STRING TIMEOUT
READ
10
YES
Enter the opcode and parameters in the Command Data window.
3 BOUNCE - Send BOUNCE message DATA BBCCDDEE TIMEOUT
READ
MSG_ID
2
YES
0004
4 AT_COMMAND - Send AT Command string. STRING AT+MODE=1
5 AT_MODE - Sends AT+MODE=1 for serial comm 41542B4D4F44453D310D0A 41542B4D4F44453D310D0A TIMEOUT
READ
2
YES
No data required
6 AD_CONV - Perform A/D Conversion 0001 0001 PARAMETER 0000 TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
*Denotes 3G unsupported parameter

0000=PA thermistor*
0001=IF thermistor*
0002=BUSMODE*
0003=Uncompensated RSSI*
0004=MCI0*
0005=MCI1*
0006=RF Detect
0007=Raw Ext B+ Voltage*
0008=Main Batt temp.*
0009=CCAP Thermistor*
000A=B+ Voltage
000B=Phased B+SENSE
000C=Main Batt Voltage
000D=Phased BATSENSE
000E=RTC Batt Voltage
000F=Reserved*
0010=MPBSENSE
0011=Phased MPBSENSE
0012=BATT_THERM
0013 Reserved*
0014=CG_DF1
2
0015=Reserved*
0016=BATT_FDBK
0017=Reserved*
0018=DSC_EN_OUT
0019=Reserved*
001A=DOWNLINK
001B=Reserved*
001C=AD9
001D=Reserved*
001E=Touch Screen X1
001F=Reserved*
0020=Touch Screen X2
0021=Reserved*
0022=Touch Screen Y1
0023=Reserved*
0024=Touch Screen Y2
0025=Reserved*
0040=Harmony Lite TXADC_0
0041=Harmony Lite TXADC_1
0042 - 004F=Reserved for WCDMA
00FF=All Parameters*
7 AIRPLANE_MODE - Set the Phone Operating Mode 0C22 0C22 MODE 00 TIMEOUT
READ
2
YES
MODE (1 byte):
00=Handset Mode
01=Airplane Mode
8 AUD_CTRL - Control Audio 0003 0003 DEVICE 01 TIMEOUT
READ
2
YES
DEVICE (1 byte):
* Unsupported by UMTS
** Supported by Paragon Only

00=Vibrator off
01=Vibrator on
04=Sidetone off*
05=Sidetone on*
08=Echo Cancelling off
09=Echo Cancelling on
0C=Noise suppressor off
0D=Noise suppressor on
18=AP controls PCAP Codec**
19=BP controls PCAP Codec**
1C=AP controls Audio Registers**
1D=BP controls Audio Registers**
9 AUD_LPB - Audio Loopback 0004 0004 TYPE
RATE
00
08
TIMEOUT
READ
2
YES
TYPE (1 byte):
00=PCAP Loopback Disable
01=PCAP Loopback Enable
0C=CODEC Loopback Disable
0D=CODEC Loopback Enable
0E=Vocoder Loopback Disable
0F=Vocoder Loopback Enable

RATE (1 byte):
(Only valid for Vocoder Loopback)
00=AMR 4.75
01=AMR 5.15
02=AMR 5.90
03=AMR 6.70
04=AMR 7.40
05=AMR 7.95
06=AMR 10.2
07=AMR 12.2
08=Full Rate
10=Enhanced Full Rate
20=Half Rate
10 AUD_LVL - Audio Level 0005 0005 VOLUME 80 TIMEOUT
READ
2
YES
LEVEL (1 byte):
00 to 07=Set volume level
8x=Read current volume level
11 AUD_PATH - Set Audio Path 0006 0006 PATH
RESERVED
00
00
TIMEOUT
READ
2
YES
PATH (1 byte):
--4 bits: D7-D4 (Input path)--
0x=no change
1x=Mute
2x=Internal Mic (handset)
3x=External CE bus audio in
4x=Boom Mic (headset)
5x=External USB audio in
6x=Ext DAI audio in
7x=Bluetooth TS 1 audio in
8x=Bluetooth TS 2 audio in
9x=Bluetooth TS 3 audio in
--4 bits: D3-D0 (Output path)--
x0=no change
x1=Mute
x2=Internal Speaker (handset)
x3=Alert (model dependent)
x4=Ext CE Bus audio out
x5=Speakerphone (model dependent)
x6=Boom speaker (headset R channel)
x7=Boom speaker (headset L channel)
x8=Boom speaker (headset stereo)
x9=Ext USB audio out
xA=Ext DAI audio out
xB=Bluetooth TS 1 audio out
xC=Bluetooth TS 2 audio out
xD=Bluetooth TS 3 audio out
12 AUD_PLAY_MEDIA_FILE - Play sound file 0C2D 0C2D ACTION
FILE
00 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Start a continious loop on media file
0x01 = Stop

FILENAME (Variable):
Directory and path in unicode of filename of media file to play. Must be null terminated
13 AUD_SAMP - Audio Sample 0C15 0C15 SAMPLE_RATE
SAMPLE_TIME
8
10
TIMEOUT
READ
2
YES
1
1
SAMPLE_RATE (1 byte):
8 or 16 = Sample rate in KHz

SAMPLE_TIME (1 byte):
1 - 99 = Sample time in ms
14 AUD_TN_GEN - Enable/Disable Audio Tone 0044 0044 ACTION
RESERVED
FREQ1
LEVEL1
FREQ2
LEVEL2
FREQ3
LEVEL3
83
00
7E18
0400
786F
0400
62A0
0400
TIMEOUT
READ
2
YES
ACTION (1 byte):
--1 bit: D7 (Enable/Disable)--
1=Generate tone
0=Stop generating tone
--7 bits: D6-D0 (Number of frequencies)--
Valid range=01 to 03

FREQ1 (2 bytes):
First phased frequency

LEVEL1 (2 bytes):
Valid range=0000 to 7FFF

FREQ2 (2 bytes):
Second phased frequency

LEVEL2 (2 bytes):
Valid range=0000 to 7FFF

FREQ3 (2 bytes):
Third phased frequency

LEVEL3 (2 bytes):
Valid range=0000 to 7FFF

15 AUD_TN_LST - Audio Tone List 0000 0000 TONE 8000 TIMEOUT
READ
2
YES
TONE (2 bytes):
--1 bit: D15 (Enable/Disable)--
1=Enable
0=Disable
--15 bits: D14-D0 (Tone)--
Tone to Enable/Disable
16 AUTOCYCLE 0002 0002 ACTION 01 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Reserved for future use
01=Enable Autocycle mode
17 BATCH - Run an Internal phone .bat file 0C2F 0C2F ACTION
ACTION_LOG
REPEAT_CNT
FILE
TIMEOUT
READ
2
YES
ACTION(2 bytes):
0x0000 = Start new batch file
0x0001 = Stop current batch
0x0002 = Get current batch state

ACTION_LOG (2 bytes):
0x0001 = Log success responses
0x0002 = Log error responses
0x0004 = log all commands

FILENAME (variable):
Ascii path to the batch file to run
18 I_BATCH ACTION
DATA
ACTION (2 bytes):
0x0000 = TCMD
0x0001 = WAIT
0x1001 = LOG MASK
0x1002 = Nested batch

DATA (Variable):
19 BAUD_RATE - Change Baud Rate 0C1D 0C1D PORT
BAUD_RATE
01
08
TIMEOUT
READ
2
YES
PORT (1 byte):
00=Reserved (UART 1)
01=UART 2
02=Reserved (UART 3)

BAUD_RATE (in kbps) (1 byte):
00=1
200
01=2
400
02=4
800
03=9
600
04=14
400
05=19
200
06=28
800
07=57
600
08=115
200
09=230
400
0A=460
800
0B=812
500
20 BT - Bluetooth 0042 0042 TCI_PARAMETER
TCI_DATA
80 TIMEOUT
READ
2
YES
TCI_PARAMETER (1 byte):
01=HCI command message type
02=HCI ACL Data message type
03=HCI SCO Data message type
04=HCI Event message type
80=Set no test mode
81=Set HCI test mode
82=Set L2CAP test mode
83=Set BT transceiver test mode
84=Start Bluetooth - test firmware
85=Start Bluetooth - norm firmware
86=Terminate bluetooth

TCI_DATA (variable):
A byte array of data
21 CAMERA - Camera command (Paragon) 0C1A 0C1A PARAMETER
DATA
02
00
TIMEOUT
READ
5
YES
PARAMETER (1 byte):
0x00 = Read BEP/Imager Rev
0x01 = Start up and Init CAM_IF
I2C
BEP
Imager
0x02 = Start/Stop LCD viewfinder
0x03 = Capture JPEG
0x04 = Capture MP4
0x05 = Camera Rotation
DATA (variable):
22 CAMERA_T - Camera command (Talon) 0C1F 0C1F PARAMETER
DATA
02
00
TIMEOUT
READ
5
YES
PARAMETER (1 byte):
0x00 = Start/Stop Viewfinder
0x01 = Cature JPEG
0x02 = Capture MP4
0x11 = View JPEG
0x12 = View MP4

DATA (variable):
23 CARRIER - Enable/Disable Transmit Carrier 0007 0007 ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Disable
01=All zeroes
03=All ones
05=PRBS w/midamble 0
07=PRBS w/midamble 1
09=PRBS w/midamble 2
0B=PRBS w/midamble 3
0D=PRBS w/midamble 4
0F=PRBS w/midamble 5
11=PRBS w/midamble 6
13=PRBS w/midamble 7
15=RACH Burst
19=PRBS w/midamble 0 in 2 TS
1B=PRBS w/midamble 0 in 3 TS
24 CP_MODE - Set Sub-mode 000A 000A SUBMODE 80 TIMEOUT
READ
2
YES
SUBMODE (1 byte):
8x=Read current submode
00=CDMA AMPS
01=CDMA
02=CDMA PCS
03=GSM 900
04=GSM 1800
05=GSM 1900
06=GSM Dual Band 900/1800
07=(Reserved) GSM Dual Band 850/1900
08=W2100
09=(Reserved) Dual Band W2100/GSM1900
0A=(Reserved) Dual Band W2100/GSM900/1800
0B=W1900
0C=Dual Band W1900/GSM850/1900
0D=Dual Band W2100/GSM900/1800
0E=W800/2100 (Japan)
0F=W850/1900 (N. Amer.)
25 CON_MODE - Configures USB connectivity mode 0C2C 0C2C ACTION
MODE
01 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Set Connectivity mode
0x01 = Get Connectivity mode

MODE (1 byte):
0x00 = USB
0x01 = RS232 mode1
0x02 = RS232 mode 2
0x03 = reserved
0x04 = Mono Audio (Rx audio left to UDM
UDP to TXOUT)
0x05 = Stereo Audio (Rx audio left to UDM
Rx audio right to UDP)
0x06 = Test Mode Right (Rx audio right to TXOUT
USB Tx enabled)
0x07 = Test Mode Left (Rx audio Left to TXOUT
USB Tx enabled)
26 DSP_SPI_TRIG_CONFIG - Configure an MQSPI Trigger 0C04 0C04 SELECT/TRIG_ID
R/W_SELECT
TRIG_ID_POINTER
TRIG_ID_MODE
00
80
0000
0000
TIMEOUT
READ
2
YES
SELECT/TRIG_ID (1 byte):
bit D7
0b=MQSPI 1
1b=MQSPI 2
bit D6
0b=SPI 1
1b=SPI 2
bit D5
0b=low priority
1b=high priority
bits D4-D0 - Trigger ID number

R/W_SELECT (1 byte):
00=Write
80=Read

TRIG_ID_POINTER (2 bytes):
This word is copied into SPICDPx register
bits D15-D8 specify the starting location of write
bits D7-D0 specify the starting location of read

TRIG_ID_MODE (2 bytes):
This word is copied into SPICDMx register

bit D15
0b=Burst mode enabled
1b=Burst mode disabled

bits D14-D9 specify number of messages to transfer (000000b=1 message
111111b=64 messages)

bits D8-D4 specify message data byte length (00000b=1 byte
11111b=32 bytes)

bits D3-D0 - Queue chip select
0000b=SPI_CS0 - Harmony
0001b=SPI_CS1 - Magic
0010b=SPI_CS2
0011b=SPI_CS3
0100b=SPI_CS4
0101b=SPI_CS5
0110b=SPI_CS6
0111b=SPI_CS7
1000b=SPI_CS8
1001b=SPI_CS9
27 EGPM - Enable GSM/PCS Handovers 0904 0904 ACTION 01 TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Disable
01=Enable
28 ERS_PANIC 000C 000C PROCESSOR TIMEOUT
READ
2
YES
PROCESSOR (2 bytes):

NOT REQUIRED FOR BP ONLY PHONES

0x0000=Adjunct Processor
0x0001=Baseband Processor
29 FLASH - Enter Flash Mode 000D 000D TIMEOUT
READ
20
YES
No data fields required. Overwrites the barker code and causes software to jump to the reset vector.
30 FLIP - Flip status (Open/Closed) 0043 0043 PARAMETER 80 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x80 = Read Flip State
31 FSAC - File System Access 004A 004A PARAMETER
DATA
00000004 TIMEOUT
READ
60
YES
PARAMETER (4 bytes):
0x00000000 = Open File
0x00000001 = Read File
0x00000002 = Write File
0x00000003 = Seek File
0x00000004 = Close File
0x00000005 = Delete File
0x00000006 = Clear File
0x00000010 = Format Volume

DATA (variable):
Open file:
Bytes (1-4)
00000000 = Default
00000001 = Read Only
00000002 = Hidden
00000004 = Preload/System
Bytes (5 - (n+4))
Filename

Read File (4 Bytes):
# of bytes to read

Write File:
Bytes (1-4)
# of bytes to write
Bytes (5 - (n+4)
Data to write

Seek File:
(Bytes 1-4)
Offset to move by
(Byte 5)
Initial location of pointer

Close File:
No Data

Delete File:
Filename to delete

Clear File (1 Byte):
00 = All
01 = User Files
02 = Read Only files
03 = Hidden files
04 = Preload/System Files

Format Volume Data
(1-511) bytes = Volume Name
32 GENERIC_DSP - Generic DSP Command 0C00 0C00 QUEUE
REPLY
MESSAGE
00
00
TIMEOUT
READ
2
YES
QUEUE (1 byte):
Selects the destination queue

REPLY (1 byte):
--4 bits: D7-D4 (Reply timeout)--
0x=Default timeout
1x=100ms
2x=200ms
3x=250ms
4x=500ms
5x=750ms
6x=1
000ms
7x=1
250ms
8x=1
500ms
9x=1
750ms
Ax=2
000ms
Bx=2
500ms
Cx=5
000
Dx=7
500ms
Ex=10
000ms
Fx=20
000ms
-4 bits: D3-D0 (Reply Request)--
x1=Expect Reply
x0=No Reply Expected

MESSAGE (variable):
Message data of variable length. Data format is determined by command.
33 GET_PANIC - Read Panic Info 000E 000E OFFSET
SIZE
PROCESSOR
0000
0100
TIMEOUT
READ
2
YES
BP FORMAT

OFFSET (2 bytes):
Offset from beginning of panic block

SIZE (2 bytes):
0=read entire block
Otherwise
# of bytes to read (1-8192)


AP FORMAT

OFFSET (4 bytes):
Offset from beginning of panic block

SIZE (4 bytes):
# of bytes to read
(BP: 1-32768)
(AP: 1-65536)

PROCESSOR (2 bytes)
0x0000=Baseband Processor
0x0001=Adjunct Processor
34 GPIO_MUX_CNTRL - Read/Write GPIO Port 0C2B 0C2B PARAMETER
DATA
00
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 = Read GPIO
0x01 = Write GPIO
0x02 = Configure GPIO

DATA (Variable)
READ (2 bytes):
Byte0
0x00 = MCU
0x01 = SPBA
Byte1
GPIO Pin # (0x00-0x1F)
WRITE (3 bytes):
Byte0
0x00 = MCU
0x01 = SPBA
Byte1
GPIO Pin # (0x00-0x1F)
Byte 2
Data
CONFIGURE (Variable):
35 GPIO_TEST - Read/Write GPIO Port/Register 0041 0041 ACTION
PORT
DIRECTION
I/O_SELECT
PIN_MASK
PIN_VALUES
00
00
00
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Read
01=Write
02=Configure

PORT (1 byte):
00=GPIO Module 1
01=GPIO Module 2

DIRECTION (1 byte):
This value is applied to all pins enabled by PIN_MASK when ACTION is configure.
00=Input
01=Output

I/O_SELECT (2 bytes):
This field specifies the IO configuration
bit D7=Reserved

bits D6-D5 = iconfb
00=GIN driven BOUT
01=ISR driven BOUT
10=GND driven BOUT
11=VCC driven BOUT

bits D4-D3 = ocr (if funct is output)
00=external input AIN
01=external input BIN
10=external input CIN
11=external input DR

bits D4-D3 = iconfa (if funct is input)
00=GIN driven AOUT
01=ISR driven AOUT
10=GND driven AOUT
11=VCC drien AOUT

bits D2-D0 = funct
000=Select fuctional pin
001=Select MUX1
010=Select MUX2
011=Output Configuration
100=Input Configuration

PIN_MASK (4 bytes):
This field applies only when writing or configuring. Bit mask where each bit corresponds to a pin inside the port or register.
0b=No change
1b=Write or configure

PIN_VALUES (4 bytes):
This field applies only when writing to pins. Each bit indicates the value to write to that pin (0 or 1).
36 GPRS_LPB - GPRS Loopback 0903 0903 CHANNEL
TSC
TADVANCE
CODING
DL_TIMESLOT
UL_TIMESLOT
ALPHA
GAMMA_TN0
GAMMA_TN1
GAMMA_TN2
GAMMA_TN3
GAMMA_TN4
GAMMA_TN5
GAMMA_TN6
GAMMA_TN7
T_AVG_T
CHAN_MEAS
UL_BURST_TYPE
ACCESS_BURST_TYPE
0014
00
00
02
BA
00
00
00
C0
C0
00
00
00
00
00
00
00
00
00
TIMEOUT
READ
2
YES
CHANNEL (2 bytes):
0-1023 = Channel number

TSC (1 byte):
0-7 = Training Sequence Code

TADVANCE (1 byte):
0-63 = Timing Advance

CODING (1 byte):
Coding Scheme
0=CS-1
1=CS-2
2=CS-3
3=CS-4

DL_TIMESLOT (1 byte):
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
0b=Timeslot unassigned
1b=Timeslot assigned

UL_TIMESLOT (1 byte):
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
0b=Timeslot unassigned
1b=Timeslot assigned

ALPHA (1 byte):
0-19 = Alpha

GAMMA_TN0 - GAMMA_TN7 (1 byte each):
0 = 0dB
1 = 2dB
..........
..........
30 = 60dB
31 = 62dB

T_AVG_T (1 byte):
0-25 = sig strength filter period for pwr cont

CHAN_MEAS (1 byte):
0 = DL meas for pwr cont are on BCCH
1 = DL meas for pwr cont are on PDCH

UL_BURST_TYPE (1 byte):
0 = Normal burst
1 = Access burst
MSB corresponds to TS0
LSB corresponds to TS7

ACCESS_BURST_TYPE (1 byte):
0 = Normal burst
1 = Access burst
Bitmask where each bit represents a timeslot from 0 to 7
MSB = TS0
LSB = TS7
37 GPRS_SEND - Initiate Sending GPRS Data 0905 0905 TYPE
PDU
LENGTH
PRIORITY
THRP
0
0
0
1
0
TIMEOUT
READ
2
YES
1
1
2
1
1
TYPE (1 byte):
LLC Frame Type
00=LLC ACK mode
01=LLC UNACK mode

PDU (1 byte):
0-255=Number of PDUs to send

LENGTH (2 bytes):
0-1530=Data length for RLC to generate

PRIORITY (1 byte):
1-4=Radio Priority

THRPT (1 byte):
0-9=Throughput
38 GPS - GPS Test Command 0C17 0C17 PARAMETER
DATA
08 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 GPS Power Control
0x01 GPS Geolocation
0x02 GPS Logging Mode
0x03 Reserved
0x04 GPS Set Almanac Mode
0x05 Enter GPS Test mode
0x06 Exit GPS Test Mode
0x07 GPS Start C/No Tracking
0x08 GPS Retrieve C/No Tracking Request
0x09 GPS Stop C/No tracking request
39 INVM - Clear/Reset Non-volatile Memory 0012 0012 LEVEL 00 TIMEOUT
READ
90
YES
LEVEL (1 byte):
00=Master Reset
01=Master Clear
02 - 04 Reserved
05=MC & Reset Codes
06=Reset Lock Code
07=Reset Security Code
08=Reset Lock & Security
40 IRDA - Activate / Deactivate the IrDA Port 0040 0040 ACTION
TIME
00
5000
TIMEOUT
READ
6
NO
1
2
ACTION (1 byte):
00=Activate IrDA
01=Deactivate IrDA
02=IrRC Tx Activate
03=IrRC Tx Deactivate

TIMEOUT (2 bytes):
Timeout in milliseconds.
41 IS_FR - Is Handset Future Ready 0C20 0C20 TIMEOUT
READ
2
YES
42 KEY_TEST - Return the Last Key Pressed 003F 003F TIMEOUT
READ
2
YES
No data fields required. Returns the last keypress detected.
43 KEYS - Send string of keycodes 0013 0013 KEY_LIST 00 TIMEOUT
READ
2
YES
KEY_LIST (20 bytes max.):
This field is a variable size array of bytes representing key codes to send.
00=Key 0
01=Key 1
02=Key 2
03=Key 3
04=Key 4
05=Key 5
06=Key 6
07=Key 7
08=Key 8
09=Key 9
0A=Asterisk *
0B=Sharp #
0C=Scroll up
0D=Scroll down
0E=Softkey 1 (Left)
0F=Softkey 2 (Center)
10=Softkey 3 (Right)
11=End
12=Send
13=Power
14=Menu
15=Smartkey
16=Single volume
17=Side volume up
18=Side volume down
19=Side volume up (no scroll)
1A=Side volume down (no scroll)
1B=SMS feature key
1C=Voice mail feature key
1D=Phone book feature key
1E=Menu scroll backward
1F=Mute
20=Multiband knifeswitch
21=Voice annotator key
22=Service Dialing Numbers feature key
23=Option key
24=Fast access key
25=Clear key
26=Reserved
27=NOSCROLL_STAR
28=NOSCROLL_POUND
29=FORWARD
2A=BACKWARD
2B=VOICE
2C=JOYSTICK_UP
2D=JOYSTICK_DOWN
2E=JOYSTICK_LEFT
2F=JOYSTICK_RIGHT
30=Menu scroll forward
31=SPEAKER
32=Headset with single position
33=Headset with double position
34=Wild any digit (0-9)
35=Wild any digit (1-9)
36=Wild any CCITT (0-9
+
#
*)
80=Lock keypad
44 KJAVA 0054 0054 PARAMETER
DATA
00 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
0x00 Get Version Info from Java Pack
Code objects and data files
0x01 Set Version Info for Java Pack
Code objects and data files
0x02 Get Version Info from Java Pack
data files
0x03 Get Version Info from Java Pack
Code objects
0x04 kJava Backup
0x05 kJava Restore
45 L1T_TCCT - L1 Timer - Change Channel Timing 0C0A 0C0A L1T_SELECT
UPDATE_MODE
QBCO_DATA
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

UPDATE_MODE (2 bytes):
0000=Asynch Update to QBCO
0001=Increment by QBCO on CFI
0002=Decrement by QBCO on CFI
0003=Update to QBCO on CFI
0004=Update to QBCO on RFI
0005=Update to QBCO at UDT
0006=Update to QBCO at event code
0007=Early Update (GSM only)

QBCO_DATA (2 bytes):
For update modes 1 and 2
this field specifies the amount to move the QBCO. For all other modes
this is the new QBCO value.
46 L1T_TFTS - L1 Timer - Frame Table Select 0C06 0C06 L1T_SELECT
TABLE_ID
LENGTH
TABLE_DATA
0000
00

TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

TABLE_ID (1 byte):
ID number of the next active frame table.

LENGTH (1 byte):
Only used if TABLE_ID is 0xFF

TABLE_DATA (variable):
Only used if TABLE_ID is 0xFF.
47 L1T_THEG - L1 Timer - Halt Event Generator 0C07 0C07 L1T_SELECT 0000 TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer
48 L1T_TOLS - L1 Timer - Override L1 Signals 0C05 0C05 L1T_SELECT
SELECT_MASK
STATE_MASK
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM L1 Timer

SELECT_MASK (2 bytes):
Bitmask indicating L1 signals to override. 1st entry is WCDMA
2nd is GSM 1=override.
bit0=RX_SLOT/DMCS Magic
bit1=TX_RAMP/TX_EN
bit2=TX_PREKEY/EXC_EN
bit3=TX_SLOT/RX_EN
bit4=RX_ACQ/TX_KEY
bit5=RX_ON/DMCS_EDMIC
bit6=TX_FRAME/RX_ACQ
bit7=WCDMA_EN/Unused
bit15=WB_LY1H spare to HL sequence manager/Unused

STATE_MASK (2 bytes):
Bitmask indicating desired state of L1 signal.
0b=low
1b=high
49 L1T_TRRC - L1 Timer - Read Register Command 0C09 0C09 L1T_SELECT
OFFSET
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM Timer

OFFSET (2 bytes):
Offset of the L1T register from the base address of the L1T.
50 L1T_TWRC - L1 Timer - Write Register Command 0C08 0C08 L1T_SELECT
TYPE
OFFSET
DATA
0000
0000
0000
0000
TIMEOUT
READ
2
YES
L1T_SELECT (2 bytes):
0000=WCDMA Timer
0001=GSM Timer

TYPE (2 bytes):
0=AND register with DATA
1=OR register with DATA
2=REPLACE register with DATA

OFFSET (2 bytes):
Offset of the L1T register from the base address of the L1T.

DATA (2 bytes):
Data value to write to L1T register.
51 LEDS - LED Control 003E 003E LED
ACTION
DATA
00
00
TIMEOUT
READ
2
YES
LED (1 byte):
00=Keypad Backlight
01=Main Display Backlight
02=Reserved
03=Red LED
04=Green LED
05=Toggle Green/Red
06=Fun Lights

ACTION (1 byte):
00=Disable
01=Enable
02=Set Pulse Current
03=Set Duty Cycle
04=Disable Pulse Skip
05=Enable Pulse Skip
06=Setup
07=Enable Color Combination

DATA (variable size):
*If ACTION=02 (1 byte)*
00=Low
01=Med
02=High
03=Full
*If ACTION=03 (1 byte)*
00=Off
01=Duty Cycle 0.1/1.9
02=Duty Cycle 0.2/1.8
03=Duty Cycle 0.5/1.5
04=Duty Cycle 0.25/0.75
05=Duty Cylce 0.25/1.75
06=Duty Cycle 0.25/1.95
07=Duty Cycle 0.5/0.5
08=Duty Cycle 0/0.5
0.5/0
09=Duty Cycle 0.125/0.5
0.075/1.5
0A=Duty Cycle 0.125/0
0/2.075
0B=Duty Cylce 0/0.625
0.075/1.5
0C=On
*If ACTION=06 (3 bytes)*
byte1=Pulse current
byte2=Duty cycle
byte3=Pulse skip
*If ACTION=07 (1 byte)*
01=Red
02=Green
03=Red/Green
04=Blue
05=Red/Blue
06=Green/Blue
07=Red/Green/Blue
52 LOAD_SYN - Load Synthesizer 0014 0014 CHANNEL
RESERVED
50
0
TIMEOUT
READ
2
YES
2
1
CHANNEL (2 bytes):
1-124=PGSM 900 MHz
0
975-1023=EGSM 900 MHz
512-885=DCS 1800 MHz
512-810=PCS 1900 MHz
TBD=WCDMA 1950 MHz

RESERVED (1 byte):
TBD
53 LONG_STAT - Return Radio Status Info 0015 0015 STATUS 00 TIMEOUT
READ
2
YES
STATUS (1 byte):
00=Request Table status
01=Request Channel status
02=Request Long status
03=Request Packet Data status
54 MEMACS - Read/Write Memory Address 0016 0016 ADDRESS
DEVICE/SIZE
DATA
00000000
0000
TIMEOUT
READ
2
YES
ADDRESS (4 bytes):
32 bit address

DEVICE/SIZE (2 bytes):
--1 bit: D15 (Read/Write)--
0b=Read
1b=Write
--3 bits: D14-D12 (Device)--
000b=MCU
001b=Starcore**
010b=Vocoder X*
011b=Vocoder Y*
100b=Vocoder P*
101b=Modem X*
110b=Modem Y*
111b=Modem P*
--12 bits: D11-D0 (Size)--
000-FFF=Number of bytes to read or write.

* These options are only valid for BB2
** These options are not valid for BB2

DATA (variable):
Write only. Variable size array of bytes.
55 MSG_INJ - Send a SUAPI Message 0033 0033 TYPE
DEST_LENGTH
REPLY_LENGTH
DATA_LENGTH
DEST_NAME
REPLY_NAME
DATA
00000000
00
00
0000


TIMEOUT
READ
2
YES
TYPE (4 bytes):
Message type identifier

DEST_LENGTH (1 byte):
Length of string identifying destination port (DEST_NAME).

REPLY_LENGTH (1 byte):
Length of string identifying reply port (REPLY_NAME).

DATA_LENGTH (2 bytes):
Length of SUAPI message to be sent.

DEST_NAME (variable):
ASCII string identifying destination port.

REPLY_NAME (variable):
ASCII string identifying reply port.

DATA (variable):
SUAPI message.
56 MSG_RT - Set Routing Of SUAPI Ports 0034 0034 SELECTION
PORT_LIST
00
TIMEOUT
READ
2
YES
SELECTION (1 byte):
00=Changes take effect at next power up.
40=Changes are immediate.
80=Both immediate and at power up.

PORT_LIST (320 bytes max.):
List of port names to be set to intercept mode.
57 OCD - On Chip Debugger 0C23 0C23 TIMEOUT
READ
2
YES
58 PDLOG - Power-down Log 0C20 0C20 SUB_COMMAND 00 TIMEOUT
READ
2
YES
SUB_COMMAND (1 byte):
00=Dump Power-down log entries
01=Clear Power-down log entries
59 PHASE - Read/Write Phasing Parameters 001D 001D PARAMETER
RECORD
DATA
0000
08
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
5B=SEEM_PA_Calibration
5E=SEEM_AGC_Table
61=SEEM_AFC_Adjust
63=SEEM_HAPI_DTOA
64=SEEM_HAPI_ATOD
65=SEEM_PA_Phasing_Configuration
78=SEEM_RX_IQ_Balance

RECORD (1 byte):
--2 bits: D7-D6 (Action)--
00b=Set phasing parameter
01b=Get phasing parameter
--3 bits: D5-D3 (Record number)--
001b=GSM 900
010b=GSM 1800
011b=GSM 1900
100b=Reserved (GSM 850)
101b-111b=spare
--3 bits: D2-D0 (Reserved)--
set to 000

DATA (variable):
Data to be written. Valid only for writes.
60 PING - Check the TCI Connection 0FFF 0FFF TIMEOUT
READ
2
YES
No data fields required.
61 POLL 1FFF TIMEOUT
READ
2
YES
No data fields. Read only.
62 PUMODE - Report the power up mode and reason 0062 0062 SUB_COMMAND 00 TIMEOUT
READ
2
YES
SUB COMMAND (1 byte):00= Request PowerUp Mode/Reason.
63 PWR_OFF - Power Off 001E 001E TIMEOUT
READ
2
YES
No data fields required.
64 RDELEM - Read NVM Element 0020 0020 ELEMENT_ID
RECORD
OFFSET
LENGTH
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID

RECORD (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of the data to be read.
65 RDWR_DSP_SPI - Read/Write DSP SPI Bus Devices 0C03 0C03 LENGTH
DEVICE
DATA
0000
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to be sent out on the SPI bus.

DEVICE (1 byte):
00=Read Synthesizer 1
01=Write to Synthesizer 1
02=Read Synthesizer 2
03=Write to Synthesizer 2
04=Read D/A Converter
05=Write to D/A Converter
06=Read A/D Converter
07=Write to A/D Converter
08=Read EEPROM
09=Write to EEPROM

DATA (variable):
Array of bytes to be sent on the SPI bus (MSb first). If number of bits to be sent (specified in LENGTH) is not an integer number of bytes
the last byte must be padded with 0s.
66 RDWR_DSP_SPI(RAINBOW) - Read/Write DSP SPI Bus Devices 0C03 0C03 LENGTH
MQSPI_SELECT
TRIGGER
DATA
0000
00
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to be sent out on the SPI bus.

MQSPI_SELECT (1 byte):
00=Read MQSPI 1
80=Write MQSPI 1
40=Read MQSPI 2
C0=Write MQSPI 2

TRIGGER (1 byte):
MQSPI trigger select

DATA (32 bytes max.):
Array of bytes to be sent on the SPI bus (MSb first). If number of bits to be sent (specified in LENGTH) is not an integer number of bytes
the last byte must be padded with 0s.
67 RDWR_HARM - Read/Write Harmony Lite 0C13 0C13 REG_ADDR
REG_LENGTH
FIELD_MSB
FIELD_LSB
DATA
0000
01
00
00
00
TIMEOUT
READ
2
YES
REG_ADDR (2 bytes):
Address of HL register

REG_LENGTH (1 byte):
--2 bits: D7-D6 (Mode)--
00b = Read
01b = Write
10b = Modify
--6 bits: D5-D0 (Reg Length)--
Register access length in bytes
1-29 bytes for Read or Write
1
2
3
4
8 bytes for Modify

FIELD_MSB (1 byte):
MSb bit position of register to modify

FIELD_LSB (1 byte):
LSb bit position of register to modify

DATA (variable)
68 RDWR_HWCFG - R/W Hardware Configuration 0065 0065 ACTION
RESERVED
HW_CONFIG_ID
DATA
00
00
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 Read

RESERVED (1 byte)

HW_CONFIG_ID (2 bytes):
Hardware Configuration ID

DATA (variable):
Only applicable for a write
69 RD_ID - Read IC ID 0C21 0C21 IC 00 TIMEOUT
READ
2
YES
IC ( 1 Byte):
00=POG
70 RDWR_I2C - Read/Write I2C Bus Device 0063 0063 ACTION
DEVICE
SLAVE_ADDR
LENGTH
DATA
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read
01 = Write

DEVICE (1 byte):
00 = default for now

SLAVE ADDR (1 byte):

LENGTH (1 byte):
Length of data field

DATA (variable):
71 RDWR_IO - GPIO Read/Write 0C25 0C25 ACTION
RESERVED
SIGNAL
WRITE_DATA
00
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00=Read
01=Write
02=Enable Alt Sig
03=Disable Alt Sig

RESERVED (1 byte):
Set to 00

SIGNAL (1 byte):
The signal number.

WRITE_DATA (1 byte):
00=Write a value of 0
01=Write a value of 1
72 RDWR_SPI - Read/Write SPI Bus Device 0021 0021 LENGTH
DEVICE
DATA
0000
00
TIMEOUT
READ
2
YES
LENGTH (2 bytes):
This field specifies the number of bits to write to the SPI device.

DEVICE (1 byte):
00=Read from ZIFSYN (CDMA)
01=Write to ZIFSYN (CDMA)
02=Read from GCAP/PCAP
03=Write to GCAP/PCAP
04=Read from Merlin (TDMA)
05=Write to Merlin (TDMA)
06=Read from SDC (TDMA)
07=Write to SDC (TDMA)
08=Read from SDD (TDMA)
09=Write to SDD (TDMA)
0A=Read from MAGIC DM (GSM)
0B=Write to MAGIC DM (GSM)
0C=Read from MAGIC LV (GSM)
0D=Write to MAGIC LV (GSM)
0E=Read MQSPI1
0F=Write MQSPI1
10=Read MQSPI2
11=Write MQSPI2

DATA (variable):
Array of bytes to send on the SPI bus (MSb first). If the number of bits to send (specified in LENGTH) is not an integer number of bytes
then the last byte must be padded with 0s.
73 RDWR_STATIC_RAM - Read/Write to Static Ram Values 0069 0069 ACTION
PARAMETER
WRITE_DATA
01
01
1
1
ACTION (1 byte):
- Read - 0x00
- Write - 0x01

PARAMETER (1 byte):
00=Init AFC
01=Close TransAAM PA Loop
02=Open TransAAM PA Loop

WRITE_DATA (variable)
74 RDWR_UART - Read/Write UART 0C01 0C01 ACTION
PORT
PARITY
STOP_BITS
BAUD
DATA_BITS
DATA
00
00
00
00
00000000
00
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read
01 = Write
02 = Configure
03 = Reset UART (n/a for Pgn)
04 = Receive Ready (UART 1 and 3 only) (n/a for Pgn)
05 = Enable Tx and Rx Int. Loopback (n/a for Pgn)
06 = Disable Tx and Rx Int. Loopback (n/a for Pgn)
07 = Flush Tx and Rx FIFOs (n/a for Pgn)

PORT (1 byte):
00 = UART1
01 = UART2
02 = UART3

PARITY (1 byte):
00 = Even
01 = Odd
02 = Off

STOP_BITS (1 byte):
00 = 1 bit
01 = 2 bits

BAUD (4 bytes):
00000000 = Auto Detect
000004B0 = 1200 baud
00000960 = 2400 baud
000012C0 = 4800 baud
00002580 = 9600 baud
00003840 = 14400 baud (n/a for Pgn)
00004B00 = 19200 baud
00007080 = 28800 baud (n/a for Pgn)
0000E100 = 57600 baud
0001C200 = 115200 baud
00038400 = 230400 baud
00070800 = 460800 baud
000C65D4 = 812500 baud (n/a for Pgn)

DATA_BITS (1 byte):
00 = 7 bits
01 = 8 bits

DATA (1 byte):
Data to be written to UART TX register.
75 RESTART - Software Power Recycle 0022 0022 TIMEOUT
READ
2
YES
No data fields required. Generates a software restart of the phone.
76 RQ - General Information Request 0026 0026 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=GSM Camp Status
02=Smart Battery Data
03=System Information
0D=User Alerting
0E=Hardware Band Capability
0F=IQ Gain Imbalance Phasing
10=Estimate Power
11=Phase Imbalance
12=WCDMA Camp Status
13=WCDMA AFC DAC Counts

DATA (variable):
A byte array of data
77 RQBER - Request PN9 Bit Error Rate 0C14 0C14 TIMEOUT
READ
2
YES
Count and return bit errors.
78 RSSI_RSCP - Receive Signal Strength Indicator/Receive Signal Code Power 0C0D 0C0D PARAMETER 00 TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00 = Raw RSSI from HarmonyLite
01 = Frequency and temperature compensated RSSI
02 = Calculated RSCP
FF = All supported parameters
79 RTCC - Read/Write Real Time Clock 0029 0029 ACTION
DAY
TIME
01 TIMEOUT
READ
2
YES
1
2
4
ACTION (1 byte):
0=Set RTC
1=Read RTC

DAY (2 bytes):
0-32767=Number of days elapsed since any specific date.

TIME (4 bytes):
0-86399=Number of seconds elapsed since midnight.
80 SBSDY_LCK - lock/unlock service passcode. Get status of MSL. 0035 0035 ACTION
CODE
00 TIMEOUT
READ
10
YES
ACTION (1 byte):
00=Get Status of Subsidy Lock
01=Check if SIM Lock code is valid
02=Change MSL password (CDMA)
03=Check if initial phone locking is active and code is valid (TDMA)
04=Check if service password is valid.

CODE (14 bytes):
01=The MSL code as a null terminated UNICODE string. 12 bytes (code string) + 2 bytes (NULL string)

02=The MSL code as a null terminated UNICODE string. 12 bytes (code string) + 2 bytes (NULL string)

03=Initial phone lock code in BCD. (TDMA) Only the first 3 bytes are used. Bytes 4 through 14 must be 0.

04=Service password to be validated and unlock this feature. Only the first 4 bytes are used. Bytes 5 through 14 must be set to 0.
81 SCMP - Simple Camp 0901 0901 ACTION
CHANNEL
1
0
TIMEOUT
READ
2
YES
1
2
ACTION (1 byte):
0=Initiate Simple Camp
1=Stop Simple Camp

CHANNEL (2 bytes):
Specifies the channel number on which the Simple Camp is started.
82 SET_RF_PWR - Set the PA Power Level 002D 002D LEVEL 5 TIMEOUT
READ
2
YES
1 LEVEL (1 byte):
0-19=Power Level
83 SMARTCARD - Read/Write From/To a Smart Card 003C 003C ACTION
CARD_ID
INDEX
FILE
REC
OFFSET
LENGTH
DATA
00
00
00
00
00
0000
0000
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Read from elementary file
01 = Write to elementary file

CARD_ID (1 byte):
This field specifies the card of the file that is being read/written

INDEX (1 byte):
This field specifies the ADF index of the file

FILE (1 byte):
This field specifies the name of the file that is being read/written

REC (1 byte):
This field specifies which record is being read/written

OFFSET (2 bytes):
This field specifies the offset
in bytes
into the record. Set field to 0 to read/write entire record

LENGTH (2 bytes):
The length
in bytes
to be read/written

DATA (variable):
A byte array fo the data to write to the Smart card
84 STELEM - Store Memory Element 002F 002F ELEMENT_ID
REC
OFFSET
LENGTH
DATA
0000
0000
0000
0000
TIMEOUT
READ
2
YES
ELEMENT_ID (2 bytes):
Specifies the Element ID

REC (2 bytes):
Specifies the record number of the element.

OFFSET (2 bytes):
Specifies the offset
in bytes
into the record. Set to 0 to read the entire record.

LENGTH (2 bytes):
Length
in bytes
of data to be written

DATA (variable):
A byte array of data
85 SUSPEND - Set Mode 0036 0036 MODE 00 TIMEOUT
READ
4
YES
MODE (1 byte):
8x = Read Current Mode
00 = Test Mode
01 = Normal Mode
02 = Handset Test Mode
86 SUSPEND_COMP - Suspend Component 0C18 0C18 COMPONENT
ACTION
00
00
TIMEOUT
READ
2
YES
COMPONENT (1 byte):
00 = Audio Manager
01 = GPS Chipset

ACTION (1 byte):
00 = Unsuspend Component
01 = Suspend Component
02 = Request Status
87 SWDL - Sftwr DL file creation 0057 0057 MODE 00 TIMEOUT
READ
2
YES
MODE (1 byte):
00 = Create file w Phone Information
01 = Create file w Parameter Data
02 = Create file w Data Settings
88 SWUL - Sftwr UL file restore 0058 0058 MODE 01 TIMEOUT
READ
2
YES
MODE (1 byte):
00 = Invalid Mode
01 = Load Parameter Data
02 = Load Data Settings
89 TLPB - Traffic Channel Loopback 0902 0902 ACTION
CHANNEL
LEVEL
0
50
5
TIMEOUT
READ
2
YES
1
2
1
ACTION (1 byte):
0=Stop TCH Loopback
64=Start TCH Loopback

CHANNEL (2 bytes):
Channel number

LEVEL (1 byte):
0-19=Power Level
90 TOUCH_SCREEN (Paragon only) 0C19 0C19 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Read position

01=Read pressure

DATA (variable):
91 TST_CAMERA - Camera command (Talon) 0061 0061 PARAMETER
DATA
02
00
TIMEOUT
READ
10
YES
PARAMETER (1 byte):
0x00 = Start/Stop Viewfinder
0x01 = Cature JPEG
0x02 = Capture MP4
0x03 = Set/Get Attribute
0x11 = View JPEG
0x12 = View MP4

DATA (variable):

Start/Stop Viewfinder (2 Bytes):
Set/Get (1/2 byte) [D7-D4]:
0x0 = Set
0x01 = Get
Action (1/2 byte) [D3-D0]:
0x0 Stop Viewfinder
0x1 = Start Viewfinder
0x2 = Switch to external viewfinder
0x3 = Switch to internal viewfinder
Media Type (1/2 byte) [D7-D4]:
0x0 = Still Image
0x1 = Video
Still Image Res (1/2 Byte) [D3-D0]:
0x0 = VGA
0x1 = QVGA
0x2 = SQVGA
0x3 = QQVGA
0x4 = QQQVGA
0x5 = CIF
0x6 = QCIF
0x7 = SQCIF

Capture JPEG (variable):
Action (1 byte):
0x00 = Capture Still Image
Filename (Bytes 1-257 variable)

Capture MP4 (variable):
Action (1 byte):
0x00 = Starts Video Capture
0x01 = Stops Video Capture
Filename (Bytes 1-257 variable)

Set/Get Attribute (2 Bytes):
Set/Get (Byte 1)[D7]:
0b = Set Attribute
1b = Get Attribute
Camera Attribute (Byte 1)[D6-D0]:
0000000b = White balance
Attribute (Byte 2):
0x00 = Reserved
0x01 = Sunny
0x02 = Cloudy
0x03 = Indoor Home (incandescent)
0x04 = Indoor Office (fluorescent)
0x05 = Automatic
92 TST_DISP - Test Display 0037 0037 PARAMETER
DATA
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
This value selects the operation to perform. (See below)

DATA (variable):
The value of the DATA field is dependent on the PARAMETER selected.
The table below defines the meaning of the PARAMETER/DATA field values.

--------------------------
PARAMETER = 00
Get display configurations

DATA (0 bytes)
--------------------------
PARAMETER = 01
Select Display

DATA (1 byte):
00=Main display
01=CLI display
02=External display
--------------------------
PARAMETER = 02
Display predefined pattern

DATA (1 byte):
00=All pixels OFF
01=All pixels ON
02=Checkerboard pattern A
03=Checkerboard pattern B
04=Border pixels ON
05=Gray scale block
06=Horizontal Zebra line
07=Vertical Zebra line
08=16 color strip
09=White screen
0A=Black screen
0B=Red screen
0C=Blue screen
0D=Green screen
0E=Eight color box pattern
--------------------------
PARAMETER = 03
Display input pattern

DATA (variable 1 byte to 5K bytes):
byte0=0x00 denotes the final stream of bytes
and triggers the bitmap display of all buffered bytes.

byte0=0x01 denotes more data to follow on subsequent command.

byte1+ specifies the bitmap to be displayed.
--------------------------
PARAMETER = 04
Continuously shift the current pattern to the left

DATA (2 bytes):
byte0 specifies the number of pixels to shift to the left

byte1 specifies the period in 1/10 sec. (Range: 0.1 to 25.5 secs.) (Value of 0x00 shifts just once)
--------------------------
PARAMETER = 05
Continuously shift the current pattern to the right

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 06
Continuously shift the current pattern up

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 07
Continuously shift the current pattern down

DATA (2 bytes):
(same as in parameter 04 description)
--------------------------
PARAMETER = 08
Stop continuous shift

DATA (0 bytes)
--------------------------
PARAMETER = 09
Turn On/Off the front light

DATA (1 byte):
00=OFF
01=ON
full intensity
02=ON
Low intensity
03=Increase intensity by TBD
04=Decrease intensity by TBD
--------------------------
PARAMETER = 0A
Display input pattern with selected palette colors/levels

DATA (1 byte):
00=4/16 gray levels
01=16/16 gray levels
02=16/4096 colors
03=256/4096 colors
04=4096/4096 colors
--------------------------
PARAMETER = 0B
Disable display

DATA (0 bytes)
--------------------------
PARAMETER = 0C
Enable display

DATA (0 bytes)

--------------------------
PARAMETER = 0D
Display Crosspoints

DATA (1 byte)
00= Display all Crosspoints
01= Display Leftmost Up
02= Display Rightmost Up
03= Display Leftmost Down
04= Display Rightmost Down
05= Display Center Crosspoint
06= Display all Points Reversed
07= Clear Display
93 TST_MMC - Test MultiMedia Card 0C1B 0C1B CATEGORY
SUB_CATEGORY
DATA
00
00
TIMEOUT
READ
2
YES
CATEGORY (1 byte):
00 = Get
01 = Put

SUB_CATEGORY-GET (1 byte):
00 = Read MMC addresses
01 = Read MMC register
02 = Read MMC data

SUB_CATEGORY-PUT (1 byte):
00 = Write MMC data
94 TST_MSD - Test Mass Storage Device 0C1B 0C1B CATEGORY
SUB_CATEGORY
DATA
00
00
TIMEOUT
READ
2
YES
CATEGORY (1 byte):
00 = Get
01 = Put

SUB_CATEGORY-GET (1 byte):
00 = Read MMC addresses
01 = Read MMC register
02 = Read MMC data

SUB_CATEGORY-PUT (1 byte):
00 = Write MMC data
95 TXBD - Transmit Burst Data 0906 0906 ACTION
ARFCN
PCL_DAC
TX_RANGE_GAIN
OFS
SAT
SAT_OFFSET
DP_GAIN
00
0026
0200
00
25
00
82
41
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

PCL_DAC (2 bytes):
PCL DAC Value

TX_RANGE_GAIN (1 byte):
00 = 1dB
01 = 3.16dB
02 = 10dB
03 = Reserved

OFS (1 byte):
OFS Value

SAT (1 byte):
00 = Disable
01 = Enable

SAT_OFFSET (1 byte):
--4 bits: D7-D4 (Delay)--
Microsecond delay after ramp
--2 bits: D3-D2 (Reserved)--
set to 00
--2 bits: D1-D0 (Saturation Correction Steps)--

DP_GAIN (1 byte)
--6 bits: D7-D2 (DP Gain)--
--2 bits: D1-D0 (DP Delay)--
96 TXBD_C - Transmit Burst Data - Colorado 0906 0906 ACTION
ARFCN
PCL_DAC
TX_RANGE_GAIN
OFS
SAT
SAT_CORR_STEPS
CP/DP_GAIN
TRKL/DP_DLY
SAT_THRESH
ACC_INIT
Pgf
Pgs
Egf
Egs
RAMPSEL/GSM_INIT
ACT_TH
PRoff
RAMP_CLKDIV
00
0026
0200
00
25
00
00
BF
48
0082
0018
14
00
07
00
2004
0002
C0
05
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

PCL_DAC (2 bytes):
PCL DAC Value

TX_RANGE_GAIN (1 byte):
00 = 1dB
01 = 3.16dB
02 = 10dB
03 = Reserved

OFS (1 byte):
OFS Value

SAT (1 byte):
00 = Disable
01 = Enable

SAT_CORR_STEPS (1 byte):
--3 bits: D7-D5 (Reserved)--
set to 00
--5 bits: D4-D0 (Sat Correction Steps)--
# of LSBs to use in D/A stepping

CP/DP_GAIN (1 byte)
--1 bit: D7 (CP Gain)--

--1 bit: D6 (Tx Gain)--
--6 bits: D5-D0 (DP Gain)--

TRKL/DP_DLY (1 byte)
--2 bits: D7-D6 (TRKL)--

--2 bits: D5-D4 (DP Gain Ana)--
--4 bits: D3-D0 (DP Delay)--

SAT_THRESH (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(Saturation Threshold)

ACC_INIT (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(ACC Init)

Pgf (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Proportional Gain for
Fast)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Pgs (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Proportional Gain for
Slow)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Egf (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Error Gain for Fast)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

Egs (1 byte):
--1 bit: D7 (Reserved)--
set to 00
--7 bits: D7-D0 (Error Gain for Slow)--
D6 - D4 is fine adjust
D3 - D0 is coarse adjust

RAMPSEL/GSM_INIT (2 bytes):
--Byte 0 - 3 bits: D7-D5 (RampSel)--
--Byte 0 - 3 bits: D4-D2 (Reserved)
--Byte 0-1 - 10 bits: D2-D0 - D7-D0
(GSM Init)

ACT_TH (2 bytes):
--Byte 0 - 6 bits: D7-D2 (Reserved)--
set to 00
--Byte 0-1 10 bits: D2-D0 - D7-D0
(ACT_TH)

PRoff (1 byte)
--3 bits: D7-D5
D7 - PRoff
D6 - ACT_EN
D5 - ACT_SEL
--5 bits: D5-D0 (Reserved)--
set to 00

RAMP_CLKDIV (1 byte)
--2 bits: D7-D6 (Reserved)--
set to 00
--6 bits: D5-D0 (RAMP_CLKDIV)--
97 TXBD_R - Transmit Burst Data - RFMD 0906 0906 ACTION
ARFCN
Mod_Type
PA_Ramp_Delay
TXENU
TXEND
DAC1
PAG
Power_Range
Tx_Curr_Thresh
Pwr_backoff_Slope
PA_Power_Mode
DN
AMPM1
AMPM2
AMAM1
AMAM2
EDGE_Subband
Adelays
00
0026
00
C3
C0
02
0DAC
01F4
00
82
05
01
1E35
00F007
00BC00
001350
2F
00
51
TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Set
01 = Get (not supported)
02 = Reset
03 to FF = Reserved

ARFCN (2 bytes):
Channel Number

MOD_TYPE (1 bit - LSB)
Modulation Type CFG3(EGS)

PA_RAMP_DELAY (1 byte)
Delay from TXST to ramp start

TX_ENU (1 byte)
Delay from TXST to ramp start

TXEND (1 byte)
TXEN to TXST falling edge

DAC1 (2 bytes)

PAG (2 bytes)

POWER_RANGE (2 bits)
bits 7-2 Reserved
bits 1-0
0=Low 1=Med 2=High

TX_CURR_THRESH (1 byte)

PWR_BACKOFF_SLOPE (1 byte)

PA_POWER_MODE (1 bit - LSB)
0=Low 1=High

DN (9 bits)
Delta N value for KV calibration
byte 1 bits 7-1 Reserved
Byte 1 bit 0
Byte 0 bits 7-0 -> DN

AMPM1 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMPM1

AMPM2 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMAM1

AMPM1 (18 bits)
Byte 2 bits 7-2 -> Reserved
Byte 2 bits 1-0
Byte 1
Byte 0 -> AMPM1

AMAM2 (1 byte)

EDGE_SUBBAND (2 bits)
bits 7-2 -> Reserved
bits 1-0
0=1st subband 1=2nd subband 2=3rd subband

Adelays (1 byte)
bits 7-5 -> Adelay1
bit 4 -> Adelay2
bits 3-1 -> Adelay3
bit 0 -> Adelay4
98 VERIFY_EFUSE - verify production or development chipsets 0C2E 0C2E ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
00 = Verify fuses are programmed for engineering
01 = Verify fuses are programmed for production
99 VERIFY_PHASE - Calculate and verify SEEM checksum 0C2A 0C2A ACTION 00 TIMEOUT
READ
2
YES
ACTION (1 byte):
0x00 = Verify
0x01 - 0xFF = Reserved
100 VERSION - Read Software Version Numbers 0039 0039 TYPE 1106 TIMEOUT
READ
2
YES
TYPE (2 bytes):
1000=DSP modem
vocoder
RXCRP
searcher
TXCRP
and RF versions
1100=File creator
1101=Build time
1102=Clearcase view tag name
1103=Base label
1104=Product ID
1105=Version number
1106=Build commentary
1200=Flash Booter version number
FFFF=Product Base Release Label
101 W_CARRIER - WCDMA Carrier 0C0E 0C0E CHANNEL_ID
ACTION
TRANSMIT_POWER
MAX_POWER
MIN_POWER
CHANNEL_CONFIG
SPREAD_FACTOR
CHAN_CODE
SCRAM_CODE
2616
00
00
1A
C0
15
00
00
000000
TIMEOUT
READ
2
YES
CHANNEL_ID (2 bytes):
0000 to 3FFF (0 - 16383)

ACTION (1 byte):
00=Enable Carrier
01=Disable Carrier

TRANSMIT_POWER (1 byte):
Initial Transmit Power (dBm)
80 to 7F (-128 to 127)

MAX_POWER (1 byte):
Maximum Transmit Power (dBm)
80 to 7F (-128 to127)

MIN_POWER (1 byte):
Minimum Transmit Power (dBm)
80 to 7F (-128 to 127)

CHANNEL_CONFIG (1 byte):
--3 bits: D5-D3 (Data Pattern)--
000b = All 0s
001b = All 1s
010b = PN9
011b = PN15
100 - 111b = Undefined
--1 bit: D2 (Channelization)--
0 = Disable spreading
1 = Enable spreading
--2 bits: D1-D0 (Scrambling)--
00b = Disable scrambling
01b = Enable long scrambling
10b = Enable short scrambling
11b = Undefined

SPREAD_FACTOR (1 byte):
--3 bits: D5-D3 (DPCCH SF)--
000b = SF256
slot format 0
001b = SF256
slot format 1
...
101b = SF256
slot format 5
110 - 111b = Undefined
--3 bits: D2-D0 (DPDCH SF)--
000b = SF256
slot format 0
001b = SF128
slot format 1
...
110b = SF4
slot format 6
111b = Undefined

CHAN_CODE (1 byte):
Channelization Code

SCRAM_CODE (3 bytes):
Scrambling Code
102 W_PHASE - WCDMA Phase 0C0F 0C0F ACTION
ELEMENT_ID
BAND
OFFSET
LENGTH
DATA
00
00
00
00
0000
00
TIMEOUT
READ
2
YES
ACTION (1 byte):
--4 bits: D7-D4 (Action)--
0x=Read from NVM
1x=Write to DSP
2x=Write to NVM
3x=Write phasing table to DSP
--4 bits: D3-D0 (Table type)--
x0=AOC/Power Control
x1=AFC
x2=AGC
x3=DCOC

ELEMENT_ID (1 byte):
Identifier to specify phasing table element ID

BAND (1 byte):
Specifies the WCDMA band.
00=W2100 (Band 1)
01=W1900 (Band 2)
02=Reserved
03=Reserved
04=W850 N. Am & J800 Japan (Bands 5 & 6)

OFFSET (1 byte):
Offset (in bytes) into the selected table. (Works on tables of fixed length only.)

LENGTH (2 bytes)
Length (in bytes) of data to be written

DATA (variable):
A byte array of data to be written according to action
103 WAIT TIMEOUT
READ
2
NO
Causes the TCI to wait for the specified TIMEOUT (seconds).
104 WLAN - WLAN 0C1F 0C1F PARAMETER
DATA
0001
0000
TIMEOUT
READ
2
YES
PARAMETER (2 bytes):
0000 = Raw Data
0001 = DL Firmware
0002 = Reset IC
0003 = Read MAC address
0005 = Start Tx Signal
0006 = Get Tx Attributes
0007 = Start Rx packet counter
0008 = Query Rx Packet Counter
0009 = Start RSSI Measurements
000A = Query RSSI Measurements
000B = Power Down
105 WLOAD_SYN - WCDMA Load Synthesizer 0C0B 0C0B RX_FREQ_ID
TX_FREQ_ID
10700
65535
TIMEOUT
READ
2
YES
2
2
RX_FREQ_ID (2 bytes):
0 to 16383 = Receive UARFCN
(if TX_FREQ_ID = 65535 then valid range = 950 to 16383)

TX_FREQ_ID (2 bytes):
0 to 16383 = Transmit UARFCN
65535 = Transmit UARFCN is (RX_FREQ_ID - 950)
106 WLONG_STAT 0C24 0C24 Sub_Command 00 TIMEOUT
READ
2
YES
Only SUB Command supported at this time is WSCMP status
107 WOPCHAN - WCDMA Open Channel 0C16 0C16 UARFCN
ACTION
TYPE
L1LOG
TFCI
CODING
COMP_MODE
10700
0
1
1
2
2
0
TIMEOUT
READ
2
YES
2
1
1
1
1
1
1
UARFCN (2 bytes):
Channel number

ACTION (1 byte):
0=Open 12.2K Channel
1=Open 64K Channel
2=Open 144K Channel
3=Open 384K Channel
255=Close Channel

TYPE (1 byte):
0=Uplink RMC
1=Downlink RMC
2=Reserved
3=Loopback Mode 2

L1LOG (1 byte):
0=Layer 1 Logging Off
1=RQBER Logging On

TFCI (1 byte):
0=None
1=Force Decode of TFCI 1
2=Force Decode of TFCI 2
3=Force Decode of TFCI 3
4=Force Blind Rate Detection

CODING (1 byte):
0= Coding Off
1=1/2 Rate Coding
2=1/3 Rate Coding
3=Turbo Coding

COMP_MODE (1 byte):
00= Compressed Mode Off
01= Compressed Mode On - SF Reduction on DL
02= Compressed Mode On - Puncturing on DL
108 WPC_DTAR - WCDMA Power Control RF Detect Target 0C11 0C11 VALUE
MODE
0
0
TIMEOUT
READ
2
YES
2
1
VALUE (2 bytes):
If MODE=1 then value is raw RF detect counts
If MODE=2 then value is in dBm in 1/16 of a dB

MODE (1 byte):
0 = Disable force value
1 = Force value is counts
2 = Force value is power
109 WPC_TBLL - WCDMA Power Control Table Load 0C0F 0C0F TIMEOUT
READ
2
YES
110 WPC_TPC - WCDMA Power Control TPC Patterns 0C12 0C12 TPC_SETUP
PATTERN
STEP
09
10
01
TIMEOUT
READ
2
YES
TPC_SETUP (1 byte):
--1 bit: D3 (Mode)--
0b=Single shot
1b=Continuous
--1 bit: D2 (Link Indicator)--
0b=Uplink
1b=Downlink
--2 bits: D1-D0 (Algorithm)--
01b=Algorithm 1
10b=Algorithm 2

PATTERN (1 byte):
00=All zeros
01=Repeat:1 one
1 zero
02=Repeat:2 ones
2 zeros
03=Repeat:3 ones
3 zeros
...
10=All ones

STEP (1 byte):
00 to FF (1/2 dB increments)
111 WPC_VAR - WCDMA Power Control Variables 0C10 0C10 RD_MASK
WR_MASK
DATA
00000000
00000000
TIMEOUT
READ
2
YES
RD_MASK (4 bytes):
Bit mask selector for read.
bit D7=Compensated RF Detect (U16)
bit D9=RF Detect Power (S11.4)
bit D10=TX Power Target (S11.4)
bit D11=VGC1 (U16)
bit D12=VGC2 (U16)
bit D13=TX Index (U16)
bit D17=PA Bias 1 (U16)
bit D18=PA Bias 2 (U16)
bit D19=PA Supply (U16)
bit D20=LS High Power Flag (U16)
bit D22=Raw RF Detect (U16)
bit D23=Temp. Comp. (U16)

WR_MASK (4 bytes):
Bit mask selector for write. (same mask as read)

DATA (variable):
Values to be written (each value is 2 bytes). First value corresponds to the lowest bit set in the mask.
112 WRITE_DA - Set D/A Value 003B 003B PARAMETER
DATA
00
00
TIMEOUT
READ
2
YES
PARAMETER (1 byte):
00=Battery/GSM (4 bytes)
01=AGC/GSM (2 bytes)
02=AFC/no Magic/GSM (2 bytes)
03=TX AFC/Magic/GSM (4 bytes)
04=RX AFC/Magic/GSM (4 bytes)
07=Battery charger/GCAPIII/WCDMA (2 bytes)
08=Battery charger/PCAP/WCDMA (2 bytes)
09=AFC/Harm/WCDMA (2 bytes)
0A=DAC0/VGC1/Harm/WCDMA (2 bytes)
0B=DAC1/VGC2/Harm/WCDMA (2 bytes)
0C=DAC2/LDSW/Harm/WCDMA (2 bytes)
0D=DAC3/PA1/Harm/WCDMA (2 bytes)
0E=DAC4/PA2/Harm/WCDMA (2 bytes)
0F=AGC/Harm/WCDMA (2 bytes)

DATA (variable):
A byte array of D/A value to set. (Size is dependent on D/A selection)
113 WSCMP - WCDMA Simple Camp 0C02 0C02 UARFCN
ACTION
2943
01
TIMEOUT
READ
2
YES
UARFCN (2 bytes):
Downlink channel

ACTION (1 byte):
00 = Enable Simple Camp
01 = Disable Simple Camp
02 = Enable Simple Camp S2 OFF
FF = Disable Simple Camp
114 WSCMP2 - WCDMA Simple Camp 0C02 0C02 UARFCN
ACTION
2943
01
TIMEOUT
READ
2
YES
UARFCN (2 bytes):
Downlink channel

ACTION (1 byte):
00 = Enable Simple Camp
01 = Disable Simple Camp
115 WUPD_COMP - WCDMA Update Compensated Values 0C1C 0C1C BITMASK
RESERVED
UARFCN
255
0
9750
TIMEOUT
READ
2
YES
1
1
2
BITMASK (1 byte):
Compensation update type.
0=No Update
1=Channel Gain Compensation
2=Temperature Gain Compensation
255=All Compensation Values

RESERVED (1 byte):

UARFCN (2 bytes):
Valid range = 9600-9900
116 WVAR - Write/Read WCDMA Variables 0C30 0C30 MODE
SLOT_COUNT
WRITE_ID_COUNT
READ_ID_COUNT
WRITE_IDS
READ_IDS
DATA
00
01
00
00


TIMEOUT
READ
2
YES
MODE (1 byte):
00=Single shot
01=Start continuous
02=Stop continuous

SLOT_COUNT (1 byte): Number of slots to write/read.
1 - 128 for single shot
15 - 128 for continuous

WRITE_ID_COUNT (1 byte): Number of IDs to write

READ_ID_COUNT (1 byte): Number of IDs to read

WRITE_IDS (2 bytes x # of write IDs): List of write IDs.

READ_IDS (2 bytes x # of read IDs): List of read IDs.

DATA (variable): Array of write values for Write IDs. Length is 2x number of slots for each write ID listed.
EOF