Command protocol¶

Protocol state machine¶

Each cmd request has 4 states which are encoded in the sent messages:

• DRH sends a query message (packet type 0) to DRC

• DRC acks the query (packet type 1)

• DRC sends the reply (packet type 2)

• DRH acks the reply (packet type 3)

Until a ACK is received, DRH/DRC will retry sending.

Main protocol header¶

struct CmdHeader {
    le16 packet_type;
    le16 query_type;
    le16 payload_size;
    le16 seq_id;
};

Packet type

See the state machine documentation above.

Query type

The query type describes what the cmd payload will look like. 3 query types exist:

• Generic command (query type 0)

• UVC/UAC command (query type 1)

• Time command (query type 2)

Payload size

Should be packet_size - sizeof (CmdHeader).

Sequence ID

Incremented for each new request sent from DRH. Stays the same between packets of the same request.

This header is followed by a payload of varying type, depending on the query type field.

Generic command header¶

Generic commands are the most used cmd requests. They allow access to most of the features of the GamePad not already exported through the input protocol. It is also used for firmware upgrade.

struct GenericCmdHeader {
    u8 magic_0x7E;
    u8 version;
    be12 transaction_id;
    be12 fragment_id;
    u8 flags;
    u8 service_id;
    u8 method_id;
    be16 error_code;
    be16 payload_size;
};

Version

Assumed to be there to support several versions of the same method call in upcoming firmware versions. Currently it is copied from query to reply.

Transaction and Fragment ID

Used for commands that require payloads larger than the size of a 802.11n packet. Currently only seen in use for firmware upgrades. Set to 0 for most commands.

Flags

Usually set to 0x40 in queries and set to ((query.flags>>3)&0xFC|1) in replies. If flags & 0x3, this is a multi-fragment query.

Service and method ID

Used to specify what method to call. Service ID very roughly groups similar methods together.

Error code

Set in replies with an error code if the query failed.

Payload size

Size of the query payload. Should be packet_size - sizeof (GenericCmdHeader) - sizeof (CmdHeader).

UVC/UAC command¶

For some reason, UVC/UAC commands are not using the generic command header but have their own query type. UVC/UAC commands control settings of the internal camera and microphone.

struct UvcUacCommand {
    u8 f1;
    u16 unknown_0;
    u8 f3;
    u8 mic_enable;
    u8 mic_mute;
    s16 mic_volume;
    s16 mic_volume_2;
    u8 unknown_A;
    u8 unknown_B;
    u16 mic_freq;
    u8 cam_enable;
    u8 cam_power;
    u8 cam_power_freq;
    u8 cam_auto_expo;
    u32 cam_expo_absolute;
    u16 cam_brightness;
    u16 cam_contrast;
    u16 cam_gain;
    u16 cam_hue;
    u16 cam_saturation;
    u16 cam_sharpness;
    u16 cam_gamma;
    u8 cam_key_frame;
    u8 cam_white_balance_auto;
    u32 cam_white_balance;
    u16 cam_multiplier;
    u16 cam_multiplier_limit;
};

The meaning and values of most of these fields is not known yet.

This command is issued every second. Recent versions of the GamePad firmware will only show the video stream after receiving one such command.

Setting f3 to 1 switches the GamePad to vWii mode, setting it to 3 shuts it down (this is how the GamePad is shut down in vWii mode).

Time command¶

Once again, this should have no reason to be its own query type. Time commands are used to set time information on the GamePad. DRH usually sends a time command when a DRC connects to it.

struct TimeCommand {
    u16 days_counter;
    u16 padding;
    u32 seconds_counter;
};

This is counting from an unknown point in time.