AT commands
From OpenEZX
AT command primer
The AT (Attention) command protocol is used to communicate over a serial line discipline. It combines request/response commands with unsolicited responses that can occur at any time.
The request/response commands often use a request prefix (e.g. 'AT+CPIN?') that is included in the answer (e.g. '+CPIN="READY"'). That way it is simple to match incoming responses to requests. Note though that this is not mandatory (as is the case for the major part of the GSM standards anyways...)
We have to distinguish four+one variants of an AT command. Implementation of all variants is optional -- usually it depends on the AT command in question.
- Execute command
- Test command
- Set command
- Get command
- Unsolicited response
Execute Command
- AT<command>
The execute command is commonly used to trigger simple actions that require no parameters. Example:
AT+CSQ +CSQ: 22,99 OK
Test command
- AT<command>=?
The test command is commonly used to query the valid parameters of a command. Example:
AT+CMER=? +CMER: (0-2), (0), (0), (0-2), (0,1) OK
Get command
- AT<command>?
The get command is commonly used to retrieve the current settings. Example:
AT+CMER? +CMER: 0,0,0,0,0 OK
Set command
- AT<command>=<parameters>
The set command is commonly used to set the current settings. Example:
AT+CMER=2,0,0,2,1 OK
Unsolicited response
- <command>:<parameters>
The unsolicited response is commonly used to indicate a settings change. Example:
+CREG: 0
AT on Motorola EZX
The EZX phones support a wide range of AT commands. Some of them are official GSM commands, other are extension.
We should compare the commands to one known of the 3GPP standards:
- http://www.3gpp.org/ftp/Specs/archive/07_series/07.07/0707-780.zip
- http://www.3gpp.org/ftp/Specs/archive/27_series/27.007/27007-720.zip
Also other documents in this directories are interesting for some parts of the commands:
SMS-Related AT commands:
Note: Official commands should not be listed here. They are already defined in the standards.
Some of the motorola commands can also be found in command references for other chips:
[1] http://developer.motorola.com/docstools/developerguides/G24-Lite_AT_Commands_Reference_Manual.pdf
[2] http://www.phys.unsw.edu.au/~mcba/iridium/Motorola_AT_Command_Set.pdf
[3] http://www.motorola.com/governmentandenterprise/contentdir/he_IL/Files/C18_AT_Commands.pdf
[4] http://www.hw.cz/pdf/motorola/g24_at_commands_reference_manual.pdf
Time / Alarm related
- All commands (and replies) use a date in the format: "<year>/<month>/<day>,<hour>:<minute>:<second>"
Fax commands
- AT+FRH=%d
- Receive DATA with HDLC Frame, [4] page 380
- AT+FRM=%d
- Receive Data, [4] page 378
- AT+FRS=%d
- Receive Silence, [4] page 375
- AT+FTH=%d
- Transmit DATA with HDLC Frame, [4] page 378
- AT+FTM=%d
- Transmit Data, [4] page 376
- AT+FTS=%d
- Transmit Silence, [4] page 375
Motorola Extension commands (and replies) of the BP
See also the origin of this: https://lists.gnumonks.org/pipermail/openezx-devel/2006-December/000917.html
AT+ALERT
AT+BTTONE
AT+CAPF=12,1,%d
- AT+CAPF= 12,1,1 (mux6)
- Turns GPRS ON
- AT+CAPF= 12,1,0 (mux6)
- Turns GPRS OFF
AT+CBSM:
AT+CBSM?
AT+CBSM=%d
AT+CCTP:%d,"%s"
Call Transfer Progress: +CCTP: 1,"12345678"
First value could be callid (as per 07.07 +CCLC), second value is peer number.
AT+CDSM=%d,%d
AT+CDST=%d
AT+CDST=%d,%d
AT+CDST:%%%dS
AT+CDSV:%32D,%32D
AT+CDSV=%d
AT+CDSV=%d,%d
AT+CECH=%d,%d
AT+CEFR
Set Enhanced Full Rate Mode?
- AT+CEFR=0
- AT+CEFR=1
- AT+CEFR=2
- AT+CEFR=3
URC codes:
- AT+CEFR:%%8D,%%%dC
- AT+CEFR:%%8D,%%%dC
AT+CEFS:
AT+CEME:
AT+CESS:%d,%d
+CESS: 3, 14
Unsolicited response, sent after a call connection has been cleared (disconnect). It probably includes the GSM reason. It might bear resemblence to the answers to +CEER (extended error report) (which is not implemented on EZX), however it is unfortunately not GSM 04.08 Annex H.
AT+CFSN:%%%dS
Read Factory Serial Number [4], page 80
AT+CGTACT
AT+CGTACT=1,1,0,\"brt\",\"brt\",\"0.0"
establishes a GPRS connection. It is yet unclear how this relates to the standard commands.
AT+CLCH
AT+CLCH:%32d
AT+CLIN:%d
Call Line Indicator: +CLIN: 0
Unsolicited response, sent during an incoming call. Looks like it indicates the GSM line the call has allocated.
AT+CLK:
AT+CLNIR?
AT+CLNIR:%8D
AT+CLNIR=%d
AT+CMEP:
AT+CMEP?
AT+CMEP=%d
AT+CMPN:
AT+CMSM:%d
- AT+CMSM: 3
- AT+CMSM: 0
URC only. MSM might translate to "Motorola SIM Mode":
- 0 = "present, locked"
- 1 = ???
- 2 = ???
- 3 = "present, unlocked"
AT+CPUR=1;+CPIN="%s","%s"
Unlocks simcard using PUK (first argument) and sets new pin (second argument). What is AT+CPUR for?
AT+CPIN=1,"%s"
Enters sim pin 1
AT+CPWR=%d
- AT+CPWR=1
- Turns BP off.
- what about +CPWR=6 ?
AT+CRRM
Should be issued after sim card comes ready (unlocked)
AT+CSCL?
AT+CSCL:%8d
AT+CSCL=%d,%d
AT+CSPL:
AT+CSPL?
AT+CSPL=%d
AT+CUSR:
AT+CUSS:
AT+CUSSD:
AT+CVMN?
AT+CVMN:%%%dS
AT+CVMN="%s"
AT+DTSE="%c",%d
- AT+DTSE="<val>",1 (mux0)
- Sends <val> dtmf tone.
AT+DTST?
AT+DTST:%8D
AT+DTST=%d
AT+EACC=%u
Seen on mux4. 64 turns loudspeaker ON, 0 turn it off.
AT+EACH=%u
AT+EAPA?
AT+EAPA:%%%dS,%%8D,%%8D
AT+EAPA="%s",%d,%d
AT+EAPC?
AT+EAPC:%%32D,%%32D,%%32D,%%32D,%%32D,%%%dS
AT+EAPD
AT+EAPD?
AT+EAPD:%%8D,%%8D,%%8D,%%8D,%%%dS,%%%dS,%%32D,%%32D,%%32D
AT+EAPF=0,4,0
AT+EAPF=0,4,1,%d
AT+EAPF=11,1,0
AT+EAPF=11,1,1,%d
AT+EAPF=12,1,0
AT+EAPF=12,1,1,%d
AT+EAPF=13,1,0
AT+EAPF=13,1,1,%d
AT+EAPF=6,4,0
AT+EAPF=6,4,1,%d
AT+EAPF=8,1,0
AT+EAPF=8,1,1,%d
AT+EAPF:%8D,%8D,%8D
AT+EAPG?
AT+EAPG:%%%dS
AT+EAPP?
AT+EAPP:%%8D,%%8D,%%32D,%%32D,%%%dS
AT+EAPT?
AT+EAPT:%%32D
AT+EAPU?
AT+EAPU:%%%dS
AT+EAPU="%s"
AT+EART?
AT+EART:%16D
AT+EART=%d
AT+EAUD:
AT+EBAC:
AT+EBTP=%d
Seen on mux4, turns bluetooth on (1) and off (0)
Note: on gen2 bluetooth power mode control from AP using PCAP2
AT+EBPV:
AT+EBROM?
AT+EBROM:%%32D,%%%dU,%%%dU
AT+ECBD:
AT+ECBD?
AT+ECBD=%d
AT+ECCC:
AT+ECDR:
AT+ECDR?
AT+ECSP?
AT+ECSP:%8D,%8D
AT+ECSS:
AT+ECTM=%d
AT+EDCH=%u
AT+EFLEX:
AT+EFNN
AT+EHOZ:
Most likely homezone reporting.
AT+EHSS=%d
AT+EICD:
AT+EIDATA:%%8D,%%8D,%%%dU
AT+EIDATA=%d
AT+EIMG?
AT+EIMG:%%8D,%%8D,%%%dU
AT+EINFO:%%16D,%%16D,%%16D,%%16D
AT+EINFO="%s"
AT+EINR=?
AT+EINR:%%16D,%%%dS,%%8D,%%%dU
AT+EINR:%32D
AT+EINR=%d,%d
AT+EKEV: %d,%d
Key Event Notification
- AT+EKEV: 19,1
- a notification command that can be read on mux4 when power key is pressed for a while. When tapisrv reads that, it sends "AT+CPWR=1\r" on mux4 and then shut down the phone.
AT+ELAI?
AT+ELAI:%8D,%8D,%8D,%8D,%8D
AT+ELOCK:
AT+ELOCK?
AT+ELOCK=%d
AT+EMBEEP
AT+EMCR=0
AT+EMCR=1
AT+EMGA?
AT+EMGA:%%%dS
AT+EMGA="%s"
AT+EMGL
Extension of +CMGL, list messages without changing their status to read.
Note: need to be issued on gen2 after AT+EPMS? to initialise sim card.
AT+EMGW=%d,%d,%d
Extension of +CMGW, without any restrictions wrt. status.
AT+EMPC="%s"
Unlocking or Locking Subsidy Code, [4] page 274
AT+EMPI:
AT+EMPI?
AT+EMSR:
AT+EMUTE:
AT+EMWF=%d,%d
AT+ENITZTIME:
AT+ENITZTIME?
AT+ENMA=%d,%d,%d,%d
AT+ENTNAME:
AT+ENTTIME
- AT+ENTTIME=<val> (mux4)
- Gets the network time
- with <val>=1 replies with +ETIME: "<datetime>"
- +ENTTIME? queries network time.
AT+EONS:
AT+EOPER:%d[,%s]
Operator Registration: +EOPER: 5,"262-03"
This is slightly related to the standard +CREG event. Value is not in conformance to +CREG, operator name unfortunately only available as MCC & MNC. Operating system seems to match the SIM list of operators to gather the operator code. I have yet to find out how to do that, since neither +COPN nor +COPL are implemented.
AT+EPANIC:
AT+EPING
Pinging the modem.
- AT+EPING
- AT+EPING?
Execution and query command triggers answer:
- +EPING: 0
AT+EPING:
AT+EPMS?
- Query the number of SMS slots on the SIM card.
Note: AT+CRRM should be issued first
Note: This command will only work the first time.
AT+EPMS:%16D
- Response to +EPMS? Value is number of SMS slots on SIM.
AT+EPOM=%d,%d
- AT+EPOM=1,0
- Seems to trigger registration to the network on E6.
Extension to 07.07 +COPS?
AT+EPROV:
AT+EPROV?
AT+ERDL:
AT+EREADY
AT+ERED:
AT+ERTCAV=%d[,%s]
- AT+ERTCAV=0 (mux4)
- Turns all alarms off.
- AT+ERTCAV=1,"<val>" (mux4)
- Turns the phone on at time <val>. Used for the alarm. Repeat to add more.
Note: on gen2 alarm works via /dev/power_ic ioctls on 2.4 or with the pcap-rtc driver (standard rtc subsystem) with 2.6.
AT+ERTR=0
AT+ERTR=10
AT+ERTR=9
AT+ERTR=%d
AT+ERTR:%%%dS
AT+ESATA=%d
SIM Application Toolkit...
AT+ESATE="%s",%d,%d,%d,%d
SIM Application Toolkit...
AT+ESATM:
SIM Application Toolkit...
AT+ESATM=%d,%d
SIM Application Toolkit...
AT+ESATM=%d,%d,%d
SIM Application Toolkit...
AT+ESATM=%d,%d,%d,%d,"%s"
SIM Application Toolkit...
AT+ESATP:
SIM Application Toolkit Init? URC sent right after SIM is unlocked.
AT+ESATR=%d,"%s"
SIM Application Toolkit...
AT+ESATSD
SIM Application Toolkit...
AT+ESATSD:
SIM Application Toolkit...
AT+ESCER:
AT+ESCER?
AT+ESCL=%d
AT+ESCR
AT+ESIMR:%%16D,%%16D,%%16D,%%16D,%%%dU
AT+ESIMR=%d,%d,%d,"%s"
AT+ESIMW:%%16D
AT+ESIMW=%d,%d,%d,%d,"%s","%s"
AT+ESLS:
AT+ESMOC:
AT+ESMT:
AT+ESPN?
Query service provider name in PDU format.
gen1: Does not work here. I guess there is some command that needs to be sent beforehand, so that the mapping is initialized or read from the SIM.
gen2: Works on /dev/mux1 after recieving +CREG on /dev/mux0
AT+ESPN:%%8D,%%%dU
AT+ESTC=%d,"%s",%d,%d
AT+ETIME:
AT+ETTYM:
AT+ETTYM?
AT+ETTYM=%d
AT+ETTYT:
AT+EVMN?
AT+EVMN:%%8D,%%%dS,%%%du
AT+EVMN=%d,"%s","%s"
AT+EWEL:
AT+MAAD:
AT+MAAD?
AT+MAAD=%d
AT+MARD=%d
Enable/Disable Auto-Redial, [3] page 67
AT+MBAN=%s
Motorola Banner. +MBAN: Copyright 2000-2002 Motorola, Inc.
AT+MBDN=?
AT+MBDN?
AT+MBDN:%8D
AT+MBDN:%%8D,%%%dS,%%%du
AT+MBDN=%d,"%s","%s"
AT+MCCI:
AT+MCNT?
AT+MCNT:%%8D,%%8D
AT+MCNT=%d,%d
AT+MDAI=%d
AT+MEBA=0
AT+MEBA:%32d
AT+MECM:
AT+MECM=3,%d
AT+MECM=%d,%d
AT+MEDA=%d,%d,"%s"
AT+MEFT:
AT+MEFT?
AT+MEFT=0,%d
AT+MEFT=1,%d
AT+MERP:
AT+MFTS:
AT+MGLLCD=?
AT+MGLLCD:
AT+MGLLCD=%d,%u,%d,%d
AT+MICT:
AT+MMGL:
Contains a SMS message on SIM. This is a result of the +MMGL query command. Extension to 07.07 +CMGL.
Motorola List Messages [3], page 138
AT+MMGL="%s"
List messages from SIM. Extension to 07.07 +CMGL with command "HEADER ONLY".
AT+MMGR:%8D,%8D
List a number messages from SIM. Extension to 07.07 +CMGR.
Motorola Read Message, [3] page 143
AT+MMGR=%d
List one message from SIM. Extension to 07.07 +CMGR.
AT+MODE?
Test command returns Modem (0) or Phonebook mode (1). Set command seems to work, but BP fails to reinitialize virtual channel. Other valid modes seems to be:
- AT+MODE=8
- PST, new HW
- AT+MODE=9
- Testagent
- AT+MODE=10
- AP logger
- AT+MODE=11
- motcdc; will find a new HW: Belcarra: VID:22B8 PID:6004
- AT+MODE=12
- MotDSPLog, new HW
- AT+MODE=13
- MotNet, New HW: USBLAN
- AT+MODE=24
- Mass storage
- AT+MODE=30
- MODEM enter test data mode
- AT+MODE=31
- MODEM exit
Select Interface Mode, [3] page 250
AT+NREC=%d
AT+SCAN=%d
AT+SHOW:
AT+STTONE
AT+USBSTAT=%d,%d:
This command is to signal BP about mini-USB port status (as BP is responsible to control charging on A780/E680), it has no relation with the watchdog at all.
Enable charging the battery over USB with AT+USBSTAT=255,1
