Skip to content

Commit

Permalink
Specify MCU to NFC/IR MCU
Browse files Browse the repository at this point in the history 
Also fix some other things
  • Loading branch information
@CTCaer
CTCaer committed Mar 27, 2018
1 parent f45909c commit b1e0c97
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 28 deletions.
12 changes: 6 additions & 6 deletions bluetooth_hid_notes.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,15 +26,15 @@ See "Rumble data" below.

### OUTPUT 0x03

MCU FW Update packet
NFC/IR MCU FW Update packet.

### OUTPUT 0x10

Rumble only. See OUTPUT 0x01 and "Rumble data" below.

### OUTPUT 0x11

Command to MCU.
Request specific data from the NFC/IR MCU. Can also send rumble.

### OUTPUT 0x12

Expand Down Expand Up @@ -71,7 +71,7 @@ This input packet is pushed to the host when a button is pressed or released, an

| Byte # | Sample value | Remarks |
|:-------:|:--------------------------:|:-------------------------:|
| 0 | `x3F` | Header, same as report ID |
| 0 | `x3F` | Input report ID |
| 1-2 | `x28 CA` | Button status |
| 3 | `x08` | Stick hat data |
| 4-11 | `x00 80 00 80 00 80 00 80` | Filler data |
Expand Down Expand Up @@ -99,15 +99,15 @@ Standard input reports used for subcommand replies.

### INPUT 0x23

MCU FW update input report.
NFC/IR MCU FW update input report.

### INPUT 0x30

Standard full mode - input reports with IMU data instead of subcommand replies. Pushes current state @60Hz, or @120Hz if Pro Controller.

### INPUT 0x31

NFC/IR Mode. Pushes large packets with standard input report + NFC/IR input report.
NFC/IR MCU mode. Pushes large packets with standard input report + NFC/IR MCU data input report.

### INPUT 0x32

Expand Down Expand Up @@ -188,7 +188,7 @@ Enables FW update. Unlocks Erase/Write memory commands.

The buffer sent must be exactly one byte. If else, Joy-Con rejects it.

The only possible ways to send it, is a Linux device with patched hidraw to accept 1 byte reports or a custom bluetooth development kit.
The only possible ways to send it, is a Linux device with patched hidraw to accept 1 byte reports, directly through l2cap or a custom bluetooth development kit.

| Byte # | Sample | Remarks |
|:------:|:---------:| ------------------------------ |
Expand Down
45 changes: 23 additions & 22 deletions bluetooth_hid_subcommands_notes.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ All subcommands that do nothing, reply back with ACK `x80##` and `x03`

Replies with `x8000` `x03`

Can be used to get Controller state only (w/o 6-Axis sensor data), like any subcommand that does nothing
Does nothing actually, but can be used to get Controller state only (w/o 6-Axis sensor data), like any subcommand that does nothing.

### Subcommand 0x01: Bluetooth manual pairing

Expand Down Expand Up @@ -56,7 +56,7 @@ Response data after 02 command byte:

| Byte # | Sample | Remarks |
|:------:|:--------------------:| -------------------------------------------------------- |
| 0-1 | `x03 48` | Firmware Version. Latest is 3.86 (from 4.0.0 and up). |
| 0-1 | `x03 48` | Firmware Version. Latest is 3.89 (from 5.0.0 and up). |
| 2 | `x01` | 1=Left Joy-Con, 2=Right Joy-Con, 3=Pro Controller. |
| 3 | `x02` | Unknown. Seems to be always `02` |
| 4-9 | `x7C BB 8A EA 30 57` | Joy-Con MAC address in Big Endian |
Expand All @@ -67,19 +67,20 @@ Response data after 02 command byte:

One argument:

| Argument # | Remarks |
|:----------:| ------------------------------------------------------------------------------------------------ |
| `00` | Used with cmd `x11`. Active polling for IR camera data. 0x31 data format must be set first |
| `01` | Same as `00` |
| `02` | Same as `00`. Active polling mode for IR camera data. For specific IR modes |
| `23` | MCU update state report? |
| `30` | Standard full mode. Pushes current state @60Hz |
| `31` | NFC/IR mode. Pushes large packets @60Hz |
| `33` | Unknown mode. |
| `35` | Unknown mode. |
| `3F` | Simple HID mode. Pushes updates with every button press |

`31` input report has all zeroes for IR/NFC data if a `11` ouput report with subcmd `03 00` or `03 01` or `03 02` was not sent before.
| Arg # | Remarks |
|:------:| ------------------------------------------------------------------------------------------------ |
| `x00` | Used with cmd `x11`. Active polling for NFC/IR camera data. 0x31 data format must be set first. |
| `x01` | Same as `00`. Active polling mode for NFC/IR MCU configuration data. |
| `x02` | Same as `00`. Active polling mode for NFC/IR data and configuration. For specific NFC/IR modes |
| `x03` | Same as `00`. Active polling mode for IR camera data. For specific IR modes |
| `x23` | MCU update state report? |
| `x30` | Standard full mode. Pushes current state @60Hz |
| `x31` | NFC/IR mode. Pushes large packets @60Hz |
| `x33` | Unknown mode. |
| `x35` | Unknown mode. |
| `x3F` | Simple HID mode. Pushes updates with every button press |

`x31` input report has all zeroes for IR/NFC data if a `11` ouput report with subcmd `03 00/01/02/03` was not sent before.

### Subcommand 0x04: Trigger buttons elapsed time

Expand Down Expand Up @@ -170,17 +171,17 @@ Replies with `x8011` ack and a uint8 status. `x00` = success, `x01` = write prot
Takes a Little-endian uint32. Erases the whole 4KB in the specified address to 0xFF.
Replies with `x8012` ack and a uint8 status. `x00` = success, `x01` = write protected.

### Subcommand 0x20: Reset MCU
### Subcommand 0x20: Reset NFC/IR MCU

### Subcommand 0x21: Set MCU configuration
### Subcommand 0x21: Set NFC/IR MCU configuration

Write configuration data to MCU. This data can be IR configuration, NFC configuration or data for the 512KB MCU firmware update.

Takes 38 or 37 bytes long argument data.

Replies with ACK `xA0` `x20` and 34 bytes of data.

### Subcommand 0x22: Set MCU state
### Subcommand 0x22: Set NFC/IR MCU state

Takes one argument:

Expand All @@ -194,7 +195,7 @@ Takes one argument:

Takes a 38 byte long argument.

Sets a byte to `x01` (enable something?) and sets also an unknown data (configuration? for MCU?) to the bt device struct that copies it from given argument.
Sets a byte to `x01` (enable something?) and sets also an unknown data (configuration? for NFC/IR MCU?) to the bt device struct that copies it from given argument.

Replies with `x80 24 00` always.

Expand All @@ -204,15 +205,15 @@ Sets the above byte to `x00` (disable something?) and resets the previous 38 byt

Replies with `x80 25 00` always.

### Subcommand 0x28: Set unknown MCU data
### Subcommand 0x28: Set unknown NFC/IR MCU data

Takes a 38 byte long argument and copies it to unknown array_222640[96] at &array_222640[3].

Does the same job with OUTPUT report 0x12.

Replies with ACK `x80` `x28`.

### Subcommand 0x29: Get `x28` MCU data
### Subcommand 0x29: Get `x28` NFC/IR MCU data

Replies with ACK `xA8` `x29` and 34 bytes data, from a different buffer than the one the x28 writes.

Expand All @@ -226,7 +227,7 @@ Replies always with ACK `x00` `x2A`.

`x00` as an ACK here is a bug. Devs forgot to add an ACK reply.

### Subcommand 0x2B: Get `x29` MCU data
### Subcommand 0x2B: Get `x29` NFC/IR MCU data

Replies with ACK `xA9` `x2B` and 20 bytes long data (which has also a part from x24 subcmd).

Expand Down

0 comments on commit b1e0c97

Please sign in to comment.