Skip to content

Commit

Permalink
Add 'x' to define hex values
Browse files Browse the repository at this point in the history
  • Loading branch information
@CTCaer
CTCaer committed Mar 27, 2018
1 parent da35959 commit 5372b08
Show file tree
Hide file tree
Showing 4 changed files with 100 additions and 98 deletions.
132 changes: 66 additions & 66 deletions bluetooth_hid_notes.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,14 +47,14 @@ A timing byte, then 4 bytes of rumble data for left Joy-Con, followed by 4 bytes
The rumble data structure contains 2 bytes High Band data, 2 byte Low Band data.
The values for HF Band frequency and LF amplitude are encoded.

| Byte # | Range | Remarks |
|:--------:|:----------------------------------------:| ------------------------------------------------------------------------ |
| 0, 4 | `04` - `FC` (81.75Hz - 313.14Hz) | High Band Lower Frequency. Steps `+0x0004`. |
| 0-1, 4-5 | `00 01` - `FC 01` (320.00Hz - 1252.57Hz) | Byte `1`,`5` LSB enables High Band Higher Frequency. Steps `+0x0400`. |
| 1, 5 | `00 00` - `C8 00` (0.0f - 1.0f) | High Band Amplitude. Steps `+0x0200`. Real max: `FE`. |
| 2, 6 | `01` - `7F` (40.87Hz - 626.28Hz) | Low Band Frequency. |
| 3, 7 | `40` - `72` (0.0f - 1.0f) | Low Band Amplitude. Safe max: `00 72`. |
| 2-3, 6-7 | `80 40` - `80 71` (0.01f - 0.98f) | Byte `2`,`6` +0x80 enables intermediate LF amplitude. Real max: `80 FF`. |
| Byte # | Range | Remarks |
|:--------:|:------------------------------------------:| ------------------------------------------------------------------------ |
| 0, 4 | `x04` - `xFC` (81.75Hz - 313.14Hz) | High Band Lower Frequency. Steps `+0x0004`. |
| 0-1, 4-5 | `x00 01` - `xFC 01` (320.00Hz - 1252.57Hz) | Byte `1`,`5` LSB enables High Band Higher Frequency. Steps `+0x0400`. |
| 1, 5 | `x00 00` - `xC8 00` (0.0f - 1.0f) | High Band Amplitude. Steps `+0x0200`. Real max: `FE`. |
| 2, 6 | `x01` - `x7F` (40.87Hz - 626.28Hz) | Low Band Frequency. |
| 3, 7 | `x40` - `x72` (0.0f - 1.0f) | Low Band Amplitude. Safe max: `00 72`. |
| 2-3, 6-7 | `x80 40` - `x80 71` (0.01f - 0.98f) | Byte `2`,`6` +0x80 enables intermediate LF amplitude. Real max: `80 FF`. |

For a rumble values table, example and the algorithm for frequency, check rumble_data_table.md.

Expand All @@ -69,12 +69,12 @@ These safe amplitude ranges are defined by Switch HID library.

This input packet is pushed to the host when a button is pressed or released, and provides the "normal controller" interface for the OS.

| Byte # | Sample value | Remarks |
|:-------:|:-------------------------:|:-------------------------:|
| 0 | `3F` | Header, same as report ID |
| 1-2 | `28 CA` | Button status |
| 3 | `08` | Stick hat data |
| 4-11 | `00 80 00 80 00 80 00 80` | Filler data |
| Byte # | Sample value | Remarks |
|:-------:|:--------------------------:|:-------------------------:|
| 0 | `x3F` | Header, same as report ID |
| 1-2 | `x28 CA` | Button status |
| 3 | `x08` | Stick hat data |
| 4-11 | `x00 80 00 80 00 80 00 80` | Filler data |

#### Stick hat data

Expand All @@ -88,10 +88,10 @@ Hold your controller sideways so that SL, SYNC, and SR line up with the screen.

#### Button status format

| Byte | Bit `01` | `02` |`04` |`08` |`10` |`20` |`40` |`80` |
|:----:|:--------:|:-----:|:-----------|:-----------:|:----:|:-------:|:-----:|:-------:|
| 1 | Down | Right | Left | Up | SL | SR | -- | -- |
| 2 | Minus | Plus | Left Stick | Right Stick | Home | Capture | L / R | ZL / ZR |
| Byte | Bit `x01` | `x02` |`x04` |`x08` |`x10` |`x20` |`x40` |`x80` |
|:----:|:---------:|:------:|:------------|:------------:|:-----:|:--------:|:------:|:--------:|
| 1 | Down | Right | Left | Up | SL | SR | -- | -- |
| 2 | Minus | Plus | Left Stick | Right Stick | Home | Capture | L / R | ZL / ZR |

### INPUT 0x21

Expand Down Expand Up @@ -189,44 +189,44 @@ The buffer sent must be exactly one byte. If else, Joy-Con rejects it.

The only possible ways to send it, is a Linux device with patched hidraw to accept 1 byte reports or a custom bluetooth development kit.

| Byte # | Sample | Remarks |
|:------:|:--------:| ------------------------------ |
| 0 | `70` | Feature report |
| Byte # | Sample | Remarks |
|:------:|:---------:| ------------------------------ |
| 0 | `x70` | Feature report ID |

### FEATURE 0x71: Setup memory read

[Send] feature Report

Prepares the SPI Read report with the requested address and size.

| Byte # | Sample | Remarks |
|:------:|:-------------:| ------------------------------ |
| 0 | `71` | Feature report |
| 1 - 4 | `F4 1F 00 F8` | UInt32LE address |
| 5 - 6 | `08 00` | UInt16LE size. Max xF9 bytes. |
| 7 | `7C` | Checksum (8-bit 2s Complement) |
| Byte # | Sample | Remarks |
|:------:|:--------------:| ------------------------------ |
| 0 | `x71` | Feature report ID |
| 1 - 4 | `xF4 1F 00 F8` | UInt32LE address |
| 5 - 6 | `x08 00` | UInt16LE size. Max xF9 bytes. |
| 7 | `x7C` | Checksum (8-bit 2s Complement) |

The checksum is calculated as `0x100 - Sum of Bytes`.

Memory map:

| Address # | Size | Remarks |
|:-----------:|:-------:| ---------------------- |
| `x00000000` | `C8000` | ROM region 1 (800KB) |
| `x000D0000` | `10000` | RAM region 1 (64KB) |
| `x00200000` | `48000` | RAM region 2 (288KB) |
| `x00260000` | `C000` | ROM region 2 (48KB) |
| `xF8000000` | `80000` | SPI (512KB, fully R/W) |
| Address # | Size | Remarks |
|:-----------:|:--------:| ---------------------- |
| `x00000000` | `xC8000` | ROM region 1 (800KB) |
| `x000D0000` | `x10000` | RAM region 1 (64KB) |
| `x00200000` | `x48000` | RAM region 2 (288KB) |
| `x00260000` | `xC000` | ROM region 2 (48KB) |
| `xF8000000` | `x80000` | SPI (512KB, fully R/W) |

### FEATURE 0x72: Memory read

[Get] feature Report

| Byte # | Sample | Remarks |
|:------:|:--------:| ------------------------------- |
| 0 | `72` | Feature report |
| 1 | `8E` | Checksum* (8-bit 2s Complement) |
| 2-EOF | | |
| Byte # | Sample | Remarks |
|:------:|:---------:| ------------------------------- |
| 0 | `x72` | Feature report ID |
| 1 | `x8E` | Checksum* (8-bit 2s Complement) |
| 2-EOF | | |

*Checksum is optional.

Expand All @@ -236,13 +236,13 @@ If the 0x71 command wasn't sent previously, it will return zeroed data (except I

The data returned has the following structure:

| Byte # | Sample | Remarks |
|:-------:|:-------------:| ------------------------------ |
| 0 | `74` | Feature report |
| 1 - 4 | `00 80 02 F8` | UInt32LE address |
| 5 - 6 | `F9 00` | UInt16LE size |
| 7-EOF-1 | | Data requested |
| EOF | `DC` | Checksum (8-bit 2s Complement) |
| Byte # | Sample | Remarks |
|:-------:|:--------------:| ------------------------------ |
| 0 | `x74` | Feature report ID |
| 1 - 4 | `x00 80 02 F8` | UInt32LE address |
| 5 - 6 | `xF9 00` | UInt16LE size |
| 7-EOF-1 | | Data requested |
| EOF | `xDC` | Checksum (8-bit 2s Complement) |

The returned size is header + size in 0x71 ft report + 1. So make sure to get your report with an adequate buffer size.

Expand All @@ -256,12 +256,12 @@ Should be used only with SPI (0xF8000000 - 0xF807FFFF), because SPI needs to be

0x70 command must be sent before using this. Otherwise, Joy-Con will reply with invalid report ID.

| Byte # | Sample | Remarks |
|:------:|:-------------:| ------------------------------ |
| 0 | `73` | Feature report |
| 1 - 4 | `00 80 02 F8` | UInt32LE address |
| 5 - 6 | `00 10` | UInt16LE size. |
| 7 | `03` | Checksum (8-bit 2s Complement) |
| Byte # | Sample | Remarks |
|:------:|:--------------:| ------------------------------ |
| 0 | `x73` | Feature report ID |
| 1 - 4 | `x00 80 02 F8` | UInt32LE address |
| 5 - 6 | `x00 10` | UInt16LE size. |
| 7 | `x03` | Checksum (8-bit 2s Complement) |

This command only checks `& 0x00FFF000` to acquire the sector number. Size is also irrelevant, but it's best to use values `x01 - x100`.

Expand All @@ -279,13 +279,13 @@ Writes to SPI. Can write locked sectors.

0x70 command must be sent before using this. Otherwise, Joy-Con will reply with invalid report ID.

| Byte # | Sample | Remarks |
|:-------:|:-------------:| ------------------------------ |
| 0 | `74` | Feature report |
| 1 - 4 | `00 80 02 F8` | UInt32LE address |
| 5 - 6 | `F9 00` | UInt16LE size. Max xF9 bytes. |
| 7-EOF-1 | | Data to write |
| EOF | `DC` | Checksum (8-bit 2s Complement) |
| Byte # | Sample | Remarks |
|:-------:|:--------------:| ------------------------------ |
| 0 | `x74` | Feature report ID |
| 1 - 4 | `x00 80 02 F8` | UInt32LE address |
| 5 - 6 | `xF9 00` | UInt16LE size. Max xF9 bytes. |
| 7-EOF-1 | | Data to write |
| EOF | `xDC` | Checksum (8-bit 2s Complement) |

#### Warning:

Expand All @@ -301,13 +301,13 @@ If address is `x0000` the Host should assume that the device will reboot.

0x70 command must be sent before using this. Otherwise, Joy-Con will reply with invalid report ID.

| Byte # | Sample | Remarks |
|:-------:|:-------------:| ---------------------------------------- |
| 0 | `75` | Feature report |
| 1 - 4 | `00 80 02 F8` | UInt32LE entry address for firmware jump |
| 5 - 6 | `04 00` | UInt16LE size. Always 4. |
| 7 | `00 80 02 F8` | UInt32LE entry address for firmware jump |
| 8 | `DC` | Checksum (8-bit 2s Complement) |
| Byte # | Sample | Remarks |
|:-------:|:--------------:| ---------------------------------------- |
| 0 | `x75` | Feature report ID |
| 1 - 4 | `x00 80 02 F8` | UInt32LE entry address for firmware jump |
| 5 - 6 | `x04 00` | UInt16LE size. Always 4. |
| 7 | `x00 80 02 F8` | UInt32LE entry address for firmware jump |
| 8 | `xDC` | Checksum (8-bit 2s Complement) |

Sending x75 00000000 0400 00000000 CRC will reboot the device and load the bootrom at 0x0. This is a good practice after finishing erasing/writing proccess.

Expand Down
48 changes: 24 additions & 24 deletions bluetooth_hid_subcommands_notes.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,11 @@

### Subcommand 0x##: All unused subcommands

All subcommands that do nothing, reply back with ACK `x80` `x##` and `x03`
All subcommands that do nothing, reply back with ACK `x80##` and `x03`

### Subcommand 0x00: Get Only Controller State

Replies with `x80` `x00` `x03`
Replies with `x8000` `x03`

Can be used to get Controller state only (w/o 6-Axis sensor data), like any subcommand that does nothing

Expand All @@ -24,19 +24,19 @@ The procedure must be done sequentially:

Host Pair request x01 (send HOST BT MAC and request Joy-Con BT MAC):

| Byte # | Sample | Remarks |
|:------:|:-------------------:| --------------------------------------- |
| 0 | `01` | subcmd |
| 1 | `01` | Pair request type |
| 2-7 | `16 30 AA 82 BB 98` | Host Bluetooth address in Little-Endian |
| Byte # | Sample | Remarks |
|:------:|:--------------------:| --------------------------------------- |
| 0 | `x01` | subcmd |
| 1 | `x01` | Pair request type |
| 2-7 | `x16 30 AA 82 BB 98` | Host Bluetooth address in Little-Endian |

Joy-Con Pair request x01 reply:

| Byte # | Sample | Remarks |
|:------:|:-------------------:| ------------------------------- |
| 0 | `01` | Pair request type |
| 1-6 | `57 30 EA 8A BB 7C` | Joy-Con BT MAC in Little-Endian |
| 7-31 | | Descriptor? |
| Byte # | Sample | Remarks |
|:------:|:--------------------:| ------------------------------- |
| 0 | `x01` | Pair request type |
| 1-6 | `x57 30 EA 8A BB 7C` | Joy-Con BT MAC in Little-Endian |
| 7-31 | | Descriptor? |

Host Pair request x03 (request LTK):

Expand All @@ -54,14 +54,14 @@ If the command is `x11`, it polls the MCU State? Used with IR Camera or NFC?

Response data after 02 command byte:

| Byte # | Sample | Remarks |
|:------:|:-------------------:| -------------------------------------------------------- |
| 0-1 | `03 48` | Firmware Version. Latest is 3.86 (from 4.0.0 and up). |
| 2 | `01` | 1=Left Joy-Con, 2=Right Joy-Con, 3=Pro Controller. |
| 3 | `02` | Unknown. Seems to be always `02` |
| 4-9 | `7C BB 8A EA 30 57` | Joy-Con MAC address in Big Endian |
| 10 | `01` | Unknown. Seems to be always `01` |
| 11 | `01` | If `01`, colors in SPI are used. Otherwise default ones. |
| Byte # | Sample | Remarks |
|:------:|:--------------------:| -------------------------------------------------------- |
| 0-1 | `x03 48` | Firmware Version. Latest is 3.86 (from 4.0.0 and up). |
| 2 | `x01` | 1=Left Joy-Con, 2=Right Joy-Con, 3=Pro Controller. |
| 3 | `x02` | Unknown. Seems to be always `02` |
| 4-9 | `x7C BB 8A EA 30 57` | Joy-Con MAC address in Big Endian |
| 10 | `x01` | Unknown. Seems to be always `01` |
| 11 | `x01` | If `01`, colors in SPI are used. Otherwise default ones. |

### Subcommand 0x03: Set input report mode

Expand Down Expand Up @@ -408,13 +408,13 @@ The end result values are translated to `GPIO_PIN_OUTPUT_LOW = 0` and `GPIO_PIN_

| Value # | PIN @Port 1 | GPIO Output Value |
|:-------:|:-----------:| -------------------- |
| `0x00` | `7` | GPIO_PIN_OUTPUT_HIGH |
| `x00` | `7` | GPIO_PIN_OUTPUT_HIGH |
| | `15` | GPIO_PIN_OUTPUT_LOW |
| `0x04` | `7` | GPIO_PIN_OUTPUT_LOW |
| `x04` | `7` | GPIO_PIN_OUTPUT_LOW |
| | `15` | GPIO_PIN_OUTPUT_LOW |
| `0x10` | `7` | GPIO_PIN_OUTPUT_HIGH |
| `x10` | `7` | GPIO_PIN_OUTPUT_HIGH |
| | `15` | GPIO_PIN_OUTPUT_HIGH |
| `0x14` | `7` | GPIO_PIN_OUTPUT_LOW |
| `x14` | `7` | GPIO_PIN_OUTPUT_LOW |
| | `15` | GPIO_PIN_OUTPUT_HIGH |

Replies with ACK `x80` `x51`.
Expand Down
2 changes: 2 additions & 0 deletions rumble_data_table.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,8 @@ byte[3] = lf_amp & 0xFF;

## Frequency Table

Values # are in HEX.

| HF Byte 0-1 # | LF Byte 3 # | Frequency (Hz) | Frequency Rounded (Hz) |
|:--:|:---:|:---:|:---:|
| | `01` | 40.875885 | 41 |
Expand Down
16 changes: 8 additions & 8 deletions spi_flash_notes.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,20 +11,20 @@
| Pairing info (factory2) | `x4000` | `x1000` | Empty. (Dev-units use it?) |
| Shipment | `x5000` | `x1000` | Only first byte is used |
| Config and calibration | `x6000` | `xA000` | Stores Factory configuration and calibration, user calibration |
| PatchRAM section | `x10000`| `x70000 | Stores Broadcom PatchRAMs, by default @0x10000 and @0x28000 |
| PatchRAM section | `x10000`| `x70000`| Stores Broadcom PatchRAMs, by default @0x10000 and @0x28000 |

## x0000: Initial PatchRAM

Initial PatchRAM section starts at `x0000` and ends at `x03B0`. Has a total of 13 records and does not end with the usual PatchRAM EOF footer (xFE 0000).

Includes Magic numbers, OTA FW DS1 address and code that loads the PatchRAM @0x10000 or @0x28000 by checking the 0xx1ff4 address.

| Range | Sample | Remarks |
|:---------------:|:----------------------------------:| --------------------------------------------------- |
| `x0000`-`x0010` | `01 08 00 F0 00 00 62 08 C0 5D 89` | Loader Magic or it sends x895DC008 @x620000F0 MMIO |
| `x0012`-`x001A` | `40 0600 x5730EA8ABB7C` | BD_ADDR type record, in LE (7C:BB:8A:EA:30:57) |
| `x001B`-`x03AF` | --- | Initial code that loads one of the main PatchRAM |
| `x03B0`-`x03B7` | `02 0A 00000100 00200000 0010` | DS1 Uint32LE (`x010000`) and 2 values (x200, x1000) |
| Range | Sample | Remarks |
|:---------------:|:-----------------------------------:| --------------------------------------------------- |
| `x0000`-`x0010` | `x01 08 00 F0 00 00 62 08 C0 5D 89` | Loader Magic or it sends x895DC008 @x620000F0 MMIO |
| `x0012`-`x001A` | `x40 0600 x5730EA8ABB7C` | BD_ADDR type record, in LE (7C:BB:8A:EA:30:57) |
| `x001B`-`x03AF` | --- | Initial code that loads one of the main PatchRAM |
| `x03B0`-`x03B7` | `x02 0A 00000100 00200000 0010` | DS1 Uint32LE (`x010000`) and 2 values (x200, x1000) |

## x1000 Failsafe mechanism

Expand Down Expand Up @@ -91,7 +91,7 @@ The first byte is probably set to x1 on new Joy-Con. Switch makes sure to set it

| Section Range | Subsection Range | Remarks |
|:---------------:|:----------------:| ----------------------------------------------------------------------- |
| `x6000`-`x600F` | ------------- | Serial number in non-extended ASCII. If first byte is >= `80`, no S/N. If a byte is `00` `NUL`, skip. Max 15 chars, if 16 chars last one is skipped.|
| `x6000`-`x600F` | ------------- | Serial number in non-extended ASCII. If first byte is >= `x80`, no S/N. If a byte is `00` `NUL`, skip. Max 15 chars, if 16 chars last one is skipped.|
| `x6012` | ------------- | Device type. JC (L): `x01`, JC (R): `x02`, Pro: `x03`. Only the 3 LSB are accounted for. Used internally and for `x02` subcmd. |
| `x6013` | ------------- | Unknown, seems to always be `xA0` |
| `x601B` | ------------- | Color info exists if `x01`. If 0, default colors used are ARGB `#55555555`, `#FFFFFFFF`. Used for `x02` subcmd. |
Expand Down

0 comments on commit 5372b08

Please sign in to comment.