summaryrefslogtreecommitdiff
path: root/registers.txt
blob: 6907eef58ef218a9cd0dbd2077a11c544ae1de18 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
Overview

USB VID 0x046d
USB PID 0xc52b

Message Sub ID
0x80 SET_REGISTER
0x81 GET_REGISTER
0x82 SET_LONG_REGISTER
0x83 GET_LONG_REGISTER
0x8F ERROR_MSG

Notifications
0x40 Device Disconnection
0x41 Device Connection
0x4A Unifying Receiver Locking Change information

Registers
0x00 Enable HID++ Notifications
0x02 Connection State
0xB2 Device Connection and Disconnection (Pairing)
0xB3 Device Activity
0xB5 Pairing Information
(more undocumented below)

Not documented:
Long register B5 (Pairing Information) - nn=03 "Receiver information?"
Send: 10 FF 83 B5  03 00 00 00 - Long (10) message for receiver (FF) to retrieve
	long register (83) PairingInfo (B5) with special param 03 00 00 00.
Recv: 11 FF 83 B5  03 AF 4F 95  EA 05 06 0E  00 00 00 00  00 00 00 00
11 - Long message
FF - Receiver target
83 - LONG_REGISTER_RESPONSE
B5 - Pairing Info
03 - "Receiver information"?
AF 4F 95 EA - Serial Number of receiver
05
06 - Max Device Capability? (not sure, but it is six)
0E  00 00 00 00  00 00 00 00
Remaining information:
- Wireless Status (0x03)
- ModelId (0x46d c52b)
- Handle: 0xff000001 (0xff is device ID, 01 is internal to the software, ordered)
- Dfu Status (0x1)
- Is Dfu Cancellable (yes)

Short register F1 - "Version information" (guessed)
Header: 10 FF 81 (short msg, receiver is target, GET_REGISTER)
Data: F1 nn xx yy (xx yy is empty for request and contains version for response)
nn=01 xx,yy=12 01
nn=02 xx,yy=00 19
nn=03 error 03 (Invalid address) (but returns 00 07 for keyboard)
nn=04 xx,yy=02 14
Displayed firmware version: 012.001.00019 (x1 . y1 . x2 y2)
Displayed bootloader version: BL.002.014 (BL . x4 . y4)

10 ix 17  3C 00 00 0n
received when the keyboard illumination level is changed. (n = 1..5)
10 ix 07  07 00 00 00
received when battery level is requested using keyboard Fn+F7

More undocumented short regs:
17 rw Illumination info
get 00 00 00 - Retrieve illimunation status?
rsp: 3C 00 02 - (illimunation is disabled)
set 3C 00 01 - Activate illumination only when I start typing
set 3C 00 02 - Disable keyboard illumination

01 rw "Keyboard hand detection?"
get 00 00 00 - retrieve keyboard hand detection status?
rsp: 00 00 20 - (hand detection is disabled)
set 00 00 00 - Enable hand detection
set 00 00 20 - Disable hand detection

09 rw "F key functions"
get 00 00 00 - Retrieve F key function state
rsp: 00 00 00 - (F key functions are not swapped)
set 00 01 00 - Swap F key functions
set 00 00 00 - Do not swap F key functions

00 rw ENABLED_NOTIFS, 10 02 00, 10 is Battery info, buy what is 02?

07 r Likely the battery status of the kbd, not observed for M525 mouse
get 00 00 00
rsp: 07 00 00 - (Battery full?)

17 rw ???

Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=3C 00 01 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=3C 00 01 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=07 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=10 02 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=10 02 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=17   params=3C 00 01 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=3C 00 01 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=17   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=01   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
        report_id=10 short device=02 DEV2 type=80 SET_REG                 reg=09   params=00 00 00 
Send    report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=02 DEV2 type=81 GET_REG                 reg=07   params=07 00 00 

Documented in hidpp10:
Allows for testing protocol version.
Request: 10 DeviceIndex 00 1n 00 00 uu
- n is SwId
- UU is "ping data" defined by SW
Responses:
HID++ 1.0: 10 ix  8F  00 Fn 01 00 (ERR_INVALID_SUBID)
HID++ 2.0: 10 ix 00 1n 02 00 UU
HID++ X.Y: 10 ix 00 1n XX YY UU

Discovery:
1. Get Reg 00
2. Set Reg 00 to value from (1) with bit 0 of the second byte enabled (v1[1] |= 1)
3. Send read CONNECTION_STATE register for total number of devices
4. Write CONNECTION_STATE 02 00 00 register
5. (4) triggers a 0x41 notification (Device Paired notification) for each
   device. Note, device index does not have to start at 1 (if device got
   unpaired before).
5. Got response for (3).
6. (disable discovery) Get Reg 00
7. Set Reg 00 to value from (6) with bit 0 of the second byte disabled (v1[1] &= ~1)

Startup (all targeted at receiver, notifications come from device 1..6):
 1. Get receiver details from pairing info register (serial number, etc)
 2. Get firmware version (recv)
 3. Get bootloader version (recv)
 4. Get enabled notifications
 5. Enable wireless notifications (set enabled notifs reg)
 6. Read connection state register for number of machines
    for each machine from (6):
    7. Write params to connection state register (02 00 00 was written) (read
       returns after (8)) (possibly a "trigger report all paired devices")
    8. (7) immediately triggers a Device Paired notification for a previously paired dev
    9. Send/Read request for paired device device name
    10. Send/Read request for paired device extended info (serial, .., location of power switch)
11. Read fw+bootloader version information again (this seems useless?)

A1. Pairing starts: write DEVICE_PAIRING register, enable pairing with timeout (read returns after (A2))
A2. (A1) triggers Receiver Lock Changed notification (subid=0x41) (reason: no error)
A3. On timeout, Receiver Lock Changed notification is received (reason: timeout)
A4. (close button) On close, DEVICE_PAIRING register is written to disable pairing discovery
A5. Receiver Lock Changed notification is immediately received (reason: timeout)

Advanced:
B1. Advanced button is pressed. Polling starts, every x time, DEVICE_ACTIVITY register request is sent/read
B2. Unpair device, Device Unpaired notification (subid=0x40) received (reason:
    device disconnected) (note, report id 10 and 20 received, ignore 20)

Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=03 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=03 AF 4F 95  EA 05 06 0E  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=00 ENABLED_NOTIFS  params=00 01 00 
Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 01 00 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=00 ENABLED_NOTIFS  params=00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=02 CONNECTION_STATE  params=00 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=02 CONNECTION_STATE  params=00 01 00 
Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=02 CONNECTION_STATE  params=02 00 00 
        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 61 10 20 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=02 CONNECTION_STATE  params=00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 04 4B 38  30 30 00 00  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 FB 84 1B  86 1A 40 00  00 07 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14

No paired devices, start pairing:
 1. Enable device pairing (response read returns after (2))
 2. Got receiver lock notification (locking open)

 3. Enable device, got Device Paired notif (kbd, link encrypted, link not established)
 4. Send read request for device name (response in (6))
 (5. got report_id=20 for device paired notif)
 5. Got Receiver Lock changed notification (lock closed)
 6. Response for device name (sent in (4)), Send/Read request for paired device
    extended info (serial, .., location of power switch)
 7. Got Device Paired notif (kbd, link encrypted, link established, link with payload)
 8. (??) Send dev1 [header 10 01 00] 12 28 3F 94
 9. Got notification ("Pair accepted"?) [header 10 01 4B] 01 00 00 00
10. Dev1 request (8) returned error message (err=01 SUCCESS)
11. Read dev1 register 0D, but it returns an error (err=02 INVALID_SUBID)
12. Request/read dev1 register 07
13. Read dev1 firmware, bootloader version
14. Read recv firmware, bootloader version
15. Write DEVICE_PAIRING register (close lock)
16. Got Receiver Lock changed notification (lock closed) (was already closed in (5) though)

Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=01 53 3C 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=01 00 00 00 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=00 00 00 

        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 61 10 20 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 00 00 
        report_id=20 unkn  device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=00 10 20 1A  40 00 00 00  00 00 00 00 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=40 04 4B 38  30 30 00 00  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
        report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 FB 84 1B  86 1A 40 00  00 07 00 00  00 00 00 00 
        report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 A1 10 20 
Send    report_id=10 short device=01 DEV1 type=00                         params=12 28 3F 94 
        report_id=10 short device=01 DEV1 type=4B ?NOTIF_PAIR_ACCEPTED    params=01 00 00 00 
        report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=00   reg=12   err=01 SUCCESS  
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=0D   params=00 00 00 
        report_id=10 short device=01 DEV1 type=8F _ERROR_MSG              SubID=81 GET_REG  reg=0D   err=02 INVALID_SUBID  
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=07   params=00 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=07   params=07 00 00 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 22 01 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 07 
Send    report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=01 DEV1 type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=01 12 01 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=02 00 19 
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=03 00 00 
        report_id=10 short device=FF RECV type=8F _ERROR_MSG              SubID=81 GET_REG  reg=F1 VERSION_INFO?  err=03 INVALID_ADDRESS  
Send    report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 00 00 
        report_id=10 short device=FF RECV type=81 GET_REG                 reg=F1 VERSION_INFO?  params=04 02 14 

Send    report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=02 53 94 
        report_id=10 short device=FF RECV type=80 SET_REG                 reg=B2 DEVICE_PAIRING  params=00 00 00 
        report_id=10 short device=FF RECV type=4A NOTIF_RECV_LOCK_CHANGED params=00 00 00 00 

Somewhere in the below stream is the battery condition of the M525 mouse (good).
Recv    report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 52 13 40 
Recv    report_id=10 short device=FF RECV type=80 SET_REG                 reg=02 CONNECTION_STATE  params=00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
Recv    report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 DA FA 33  5E 04 00 00  00 01 00 00  00 00 00 00 
Recv    report_id=10 short device=01 DEV1 type=41 NOTIF_DEVICE_PAIRED     params=04 92 13 40 
Recv    report_id=20 unkn  device=01 DEV1 type=42 NOTIF_CONNECTION_STATUS params=00 00 00 00  00 00 00 00  00 00 00 00 
Send    report_id=10 short device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 00 00 
Recv    report_id=11 long  device=01 DEV1 type=05                         params=00 01 01 01  00 00 00 00  00 00 00 00  00 00 00 00  00 
Recv    report_id=11 long  device=FF RECV type=83 GET_LONG_REG            reg=B5 PAIRING_INFO  params=30 DA FA 33  5E 04 00 00  00 01 00 00  00 00 00 00 
Send    report_id=10 short device=01 DEV1 type=00                         params=05 00 03 00 
Recv    report_id=11 long  device=01 DEV1 type=00                         params=05 02 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=02 MOUSE                   params=05 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=02 MOUSE                   params=05 01 00 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=02 MOUSE                   params=15 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=02 MOUSE                   params=15 00 52 51  4D 27 02 00  28 00 40 13  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 00 00 00 
Recv    report_id=11 long  device=01 DEV1 type=04 SYSTEM_CONTROL          params=05 5A 05 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Send    report_id=10 short device=01 DEV1 type=0B                         params=15 01 00 00 
Recv    report_id=11 long  device=01 DEV1 type=0B                         params=15 01 04 00  00 00 00 00  00 00 00 00  00 00 00 00  00 
Recv    report_id=20 unkn  device=01 DEV1 type=02 MOUSE                   params=00 00 00 00  00 FF 00 00  00 00 00 00 
Recv    report_id=20 unkn  device=01 DEV1 type=02 MOUSE                   params=00 00 00 00  00 FF 00 00  00 00 00 00