diff --git a/USB-config-%26-command-protocol.md b/USB-config-%26-command-protocol.md
index 8907f27..e955193 100644
--- a/USB-config-%26-command-protocol.md
+++ b/USB-config-%26-command-protocol.md
@@ -38,6 +38,9 @@ These commands work for any mode, and have the same effect across all of them.
 A list of all the currently-implemented modes:
 
 1. Default ('misc')
+2. (N/A)
+3. (N/A: JTAG pinout scanner)
+4. SUMP logic analyzer
 
 ## Mode 1
 
@@ -54,7 +57,7 @@ A list of all the currently-implemented modes:
 * SPI (serprog) command prefix (`0x13`): Perform a SPI command, see below.
 * I2C command prefix (`0x14`): Perform an I2C command, see below.
 * Temperature sensor command prefix (`0x15`): Perform a temperature sensor command, see below.
-* UART↔USB hardware flow control enable/disable (`0x16`): has a single argument byte, `0x00` to disable hardware flow control, any other value to enable. Baud rate and other line control settings are done using the standard USB-CDC line control things.
+* UART↔USB hardware flow control enable/disable (`0x16`): has a single argument byte, `0x00` to disable hardware flow control, `0xc3` to read the current value (one byte returned), any other value to enable. Baud rate and other line control settings are done using the standard USB-CDC line control things.
 
 #### SPI commands
 
@@ -136,4 +139,20 @@ The I2C command format used here is based heavily on the one of [I2C-Tiny-USB](h
 * Get temperature (`0x02`): returns the 2-byte 8.4 fixed point temperature, little endian.
 * Get lower temperature limit (`0x03`): returns the 2-byte minimum temperature fore things start going bad.
 * Get upper temperature limit (`0x04`): returns the 2-byte maximum temperature before things start going bad.
-* Get critical temperature limit (`0x05`): returns the 2-byte critical temperature when things are going really bad.
\ No newline at end of file
+* Get critical temperature limit (`0x05`): returns the 2-byte critical temperature when things are going really bad.
+
+## Mode 3 (JTAG pinout scanner) (not yet implemented)
+
+* `0x30`: Get status: no argument bytes, one result byte
+  * `0x00`: idle
+  * `0x01`: scan busy
+  * `0x02`: scan failed
+  * `0x03`: scan successful
+* `0x31`: Get scan result (only if status is `0x03`): no argument bytes, 5 result bytes
+  * Result: pin numbers of TCK, TMS, TDI, TDO, TRST
+* `0x32`: Start scan (only valid if status is not `0x01`): two argument bytes (start and end pin numbers, inclusive), no result bytes
+
+## Mode 4 (SUMP logic analyzer)
+
+* `0x40`: Get overclocking state: no argument bytes, one result byte (overclocking off/on (resp. `0x00` or nonzero) (or amount, device-dependent, depending on what future devices may bring?))
+* `0x41`: Set overclocking state: one argument byte, no result bytes (same format as `0x40`)
\ No newline at end of file