| blob | 34a99b8a04b79137bd818c6b348591d283d9ea33 |
1 \r
2 Document describing protocol used in Nokia phones.\r
3 \r
4 The data provided is for information purposes only. \r
5 Some of the frames might be hazardous to your phone. Be careful!!! \r
6 We do not take any responsibility or liability for damages, etc.\r
7 \r
8 Last update 23.06.2003\r
9 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r
10 Assembled by\r
11 Balazs Nagy <js@iksz.hu>\r
12 Alfred R. Nurnberger <arnu@flosys.com>\r
13 Hugh Blemings <Hugh.Blemings@vsb.com.au>\r
14 Mike Bradley <mike@trumpington.st>\r
15 Odinokov Serge <serge@takas.lt>\r
16 Pavel Janik <Pavel@Janik.cz>\r
17 Pawel Kot <pkot@linuxnews.pl>\r
18 Marcin Wiacek <Marcin@MWiacek.com>\r
19 Jens Bennfors <jens.bennfors@ing.hj.se>\r
20 Michael Hund <michael@drhund.de>\r
21 Jay Bertrand <jay.bertrand@libertysurf.fr>\r
22 <arnu@venia.net>\r
23 Andrew Kozin\r
24 Pavel Machek <pavel@ucw.cz>\r
25 Diego Betancor <dbetancor@duocom.net>\r
26 ... and other members of gnokii mailing list\r
27 and authors of some WWW pages.\r
28 \r
29 NOTE: this information isn't (and can't be) complete. If you know anything\r
30 about features not listed here or you noticed a bug in this list, please\r
31 notify us via e-mail. Thank you.\r
32 \r
33 Frame format for MBUS version 1:\r
34 \r
35 Request from Computer/Answer from Phone:\r
36 \r
37 { DestDEV, SrcDEV, FrameLength, MsgType, {block}, id, ChkSum }\r
38 \r
39 where DestDEV, SrcDEV: 0x00: phone\r
40 0xf8: PC (wakeup msg)\r
41 0xe4: PC (normal msg)\r
42 FrameLength: length of data frame. Maximal 0x78. Longer\r
43 frames are divided into smaller.\r
44 MsgType: see List\r
45 {block}: main frame\r
46 id: request identity number 1..n, incremented after\r
47 the request is accepted\r
48 ChkSum: XOR on frame's all numbers\r
49 \r
50 Ack from Phone:\r
51 \r
52 { DestDEV, 0x00, FrameLength, MsgType, {block} , id, ChkSum }\r
53 \r
54 where DestDEV: taken from original request packet\r
55 FrameLength: 0x7f, when DestDEV = 0xe4\r
56 0x7e, when DestDEV = 0xf8\r
57 MsgType: see List. Present only, when DestDEV = 0xf8\r
58 {block}: main frame. Present only, when DestDEV = 0xf8\r
59 id: request identity number 1..?, corresponding\r
60 to the original request packet id\r
61 the request is accepted\r
62 ChkSum: XOR on frame's all numbers\r
63 \r
64 Update: description above according to the\r
65 http://www.gadgets.demon.co.uk/nokia21xx/protocol.html.\r
66 \r
67 Pavel Machek <pavel@ucw.cz> wrote:\r
68 0x7e is actually registration acknowledge. Both have nothing to do\r
69 with DestDEV, except that special device needs to be used for\r
70 registration.\r
71 \r
72 Ack from Computer:\r
73 \r
74 { 0x00, SrcDEV, 0x7f, id, ChkSum }\r
75 \r
76 where SrcDEV: taken from response packet\r
77 id: request identity number 1..?, corresponding\r
78 to the response packet id\r
79 the request is accepted\r
80 ChkSum: XOR on frame's all numbers\r
81 \r
82 Port settings:\r
83 Speed 9600 bps, Bits 8, ParityOdd, Stop Bits 1, DTR and RTS logic 0\r
84 \r
85 In the MBUS bus, the phone has only one connector for transmition and\r
86 reception.\r
87 \r
88 Because of this characteristics of the phone connector, every time that the\r
89 PC writes into the phone it is writing as well into its own Rx. So every\r
90 time the PC sends info into the phone it finds that same information in its\r
91 own Rx buffers, like a mirror copy. This should be discarded.\r
92 \r
93 The communications is made like an old cb radio, only one\r
94 talking at a time. Many transmission are made this way:\r
95 \r
96 <computer sends request>\r
97 <phone sends ack>\r
98 <phone sends response>\r
99 <computer sends ack>\r
100 \r
101 Some frames are sent from phone without asking for them\r
102 \r
103 You have to implement collision protocol. IE. you should listen for\r
104 what you are transmitting, and if it does not come back, you have\r
105 collision.\r
106 \r
107 You should wait for bus to be free for 3 miliseconds before normal\r
108 message, and for 2.5 miliseconds before acknowledge. You should wait\r
109 for acknowledge for 200 miliseconds, then retransmit.\r
110 \r
111 Frame format for FBUS version 1:\r
112 \r
113 { FrameID, FrameLength, MsgType, {block}, SeqNo, ChkSum }\r
114 \r
115 where FrameID: 0x01 Command frame from computer to Nokia \r
116 0x02 ??? - Data call frame from computer to Nokia - ??? \r
117 0x03 Data call frame from Nokia to computer \r
118 0x04 Command frame from Nokia to computer \r
119 FrameLength: {block} + 2\r
120 MsgType: see List\r
121 SeqNum: Sequence number of command in case where direction is\r
122 from ME to computer, the sequence number is \r
123 counting from 0x30 to 0x37 and resetting back to 0x30.\r
124 When direction is from computer to ME,\r
125 sequence number counts from 0x08 to 0x0f and resets back to 0x08.\r
126 It may not be required to be this way.\r
127 Sequence numbers are used in acknowledging commands.\r
128 ChkSum1: CRC = 0;\r
129 for (i = 0; i < (2 + CMD_LEN); i++)\r
130 CRC ^= frame[i];\r
131 \r
132 Frame format for FBUS version 2/Direct IRDA:\r
133 \r
134 { FrameID, DestDEV, SrcDEV, MsgType, 0x00, FrameLength, {block}, FramesToGo,\r
135 SeqNo, PaddingByte?, ChkSum1, ChkSum2 }\r
136 \r
137 where FrameID: 0x1c: IR / FBUS\r
138 0x1e: Serial / FBUS\r
139 DestDev, SrcDev: 0x00: mobile phone\r
140 0x0c: TE (FBUS) [eg. PC]\r
141 MsgType: see List\r
142 FrameLength: {block} + 2 (+ 1 if PaddingByte exists)\r
143 FramesToGo: 0x01 means the last frame\r
144 SeqNo: [0xXY]\r
145 X: 4: first block\r
146 0: continuing block\r
147 Y: sequence number\r
148 PaddingByte: 0x00 if FrameLength would be an odd number\r
149 anyways it doesn't exists\r
150 ChkSum1: XOR on frame's odd numbers\r
151 ChkSum2?: XOR on frame's even numbers\r
152 \r
153 Frame format for MBUS version 2:\r
154 \r
155 { FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLO, FrameLengthHI, {block},\r
156 SeqNo, ChkSum }\r
157 \r
158 where FrameID: 0x1f: Serial / M2BUS\r
159 DestDev, SrcDev: 0x00: mobile phone\r
160 0x1d: TE (M2BUS)\r
161 0x10: TE (M2BUS) (Service Software ?)\r
162 0x04: Carkit?\r
163 0x48: DLR3 cable?\r
164 0xF8: unknown target?\r
165 0xFF: global target?\r
166 MsgType: see List\r
167 FrameLength: {block}\r
168 SeqNo: sequence number\r
169 ChkSum: XOR on frame's all numbers\r
170 \r
171 Please note that M2BUS has only one checksum: XOR on frame[FrameID..SeqNo]\r
172 \r
173 Ack:\r
174 \r
175 { FrameID, DestDEV, SrcDEV, 0x7f, Id_SeqNo, ChkSum }\r
176 \r
177 where Id_SeqNo: Is the sequence number that you are\r
179 \r
180 Frame format for Infrared:\r
181 \r
182 { FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLo, FrameLengthHi, {block}}\r
183 \r
184 where FrameID: 0x14\r
185 DestDev, SrcDev: 0x00: mobile phone\r
186 0x0c: TE [eg. PC]\r
187 MsgType: see List\r
188 FrameLength: {block}\r
189 \r
190 Frame format for Bluetooth:\r
191 \r
192 { FrameID, DestDEV, SrcDEV, MsgType, FrameLengthLo, FrameLengthHi, {block} }\r
193 \r
194 where FrameID: 0x19\r
195 DestDev, SrcDev: 0x00: mobile phone\r
196 0x10: TE [eg. PC]\r
197 MsgType: see List\r
198 FrameLength: {block}\r
199 \r
200 Frames list format:\r
201 \r
202 hex: Short description\r
203 x msg desc { ... }\r
204 0xXX -> one byte\r
205 0xXXYY -> two bytes (== 0xXX, 0xYY)\r
206 \r
207 where hex: message type\r
208 x: s=send (eg. to mobile), r=receive\r
209 { ... }: data after 0x00, 0x01 header\r
210 {+... }: raw data (without header)\r
211 \r
212 -------------------------------------------------------------------------------\r
213 \r
214 Misc (about MBUS version 2):\r
215 \r
216 0x4E commands:\r
217 (sent from a 5160i TDMA / 6160i TDMA / 6185 CDMA or 7110 GSM \r
218 phone to the uC in the DLR-3 cable) \r
219 DLR-3 req:\r
220 1F 48 00 4E 00 02 01 XX SQ CS\r
221 frame sent from the phone to the DLR-3 cable\r
222 (after 15kOhm resistor detected betw. XMIC (3) and DGND (9).) \r
223 DSR,DCD,CTS flow control data is coded into the 2nd databyte \r
224 XX: bit.0=/CTS \r
225 bit.1=/DCD\r
226 bit.2=CMD/DATA\r
227 bit.3=DSR\r
228 bit.4-7=0 \r
229 \r
230 0x78 / 0x79 commands:\r
231 (used by handsfree carkit) Works also on GSM phones (5110 / 6110 / etc) \r
232 These commands are used by the Nokia Carkits to switch the phone audio path to \r
233 XMiC and XEAR , turn the phone on/off according to the car ignition, and\r
234 control the PA loudspeaker amplifier in the carkit and the car radio mute\r
235 output which silences the car radio during a call \r
236 mute status tone:\r
237 1F 04 00 78 00 04 01 02 0E 00 SQ CS\r
238 status indication = disable carkit audio amplifier (no audio / no tone) \r
239 mute status tone:\r
240 1F 04 00 78 00 04 01 02 0E 03 SQ CS\r
241 status indication = enable carkit audio amplifier (audio / tone present) \r
242 mute status call:\r
243 1F 04 00 78 00 04 01 02 07 00 SQ CS\r
244 status indication = disable radio mute output (no call) \r
245 mute status call:\r
246 1F 04 00 78 00 04 01 02 07 01 SQ CS\r
247 status indication = enable radio mute output (call active) \r
248 enable ???:\r
249 1F 04 00 78 00 04 01 02 08 01 SQ CS\r
250 status indication = enable ??? sent to HFU-2 on power on \r
251 byte 9 (07,08,0E) seems to be a pointer to a memory location,\r
252 byte 10 is the data at this memeory location. \r
253 response from HFU:\r
254 1F 00 04 78 00 03 02 01 03 SQ CS\r
255 response message from HFU-2 (use unknown) \r
256 go HF and IGN on:\r
257 1F 00 04 79 00 05 02 01 01 63 00 SQ CS\r
258 enables carkit mode + turns phone on + req. mute status \r
259 go HF and IGN off:\r
260 1F 00 04 79 00 05 02 01 01 61 00 SQ CS\r
261 enables carkit mode + powers phone off (1 min delay) + req. mute status \r
262 ext. HS Offhk:\r
263 1F 00 04 79 00 05 02 01 01 23 00 SQ CS\r
264 enables carkit mode + external handset lifted (OFF-Hook) \r
265 ext. HS Onhk:\r
266 1F 00 04 79 00 05 02 01 01 63 00 SQ CS\r
267 enables carkit mode + external handset put back (ON-Hook) \r
268 Ignition and Hook are coded into one byte \r
269 bit.0 = 0:on power on 1:when in operation \r
270 bit.1 = IGNITION STATUS \r
271 bit.2 = x can be 1 or 0 \r
272 bit.3 = 0 \r
273 bit.4 = 0 \r
274 bit.5 = 1 \r
275 bit.6 = Hook (inverted) \r
276 bit.7 = 0 \r
277 HFU-2 version:\r
278 1F 00 04 79 00 12 02 01 02 06 00 56 20 30 36 2E 30 30 0A 48 46 55 32 00 SQ CS\r
279 for HFU-2:\r
280 1F 04 00 DA 00 02 00 02 SQ CS\r
281 function unknown - sent from Nokia phone to HFU-2mute output (call active ) \r
282 \r
283 0xD0 commands: \r
284 init:\r
285 1F 00 1D D0 00 01 04 SQ CS\r
286 sent by the Service Software or HFU-2 on startup \r
287 init resp:\r
288 1F 1D 00 D0 00 01 05 SQ CS\r
289 response from phone to above frame \r