diff --git a/USB-config-%26-command-protocol.md b/USB-config-%26-command-protocol.md
index 938dac3..28399cf 100644
--- a/USB-config-%26-command-protocol.md
+++ b/USB-config-%26-command-protocol.md
@@ -172,16 +172,21 @@ peripheral modes
 additional peripheral ops
 - `0x83` report timing (returns a measurement of the time taken between one controller query and the next)
 
-## Mode 3 (JTAG pinout scanner) (not yet implemented)
+## Mode 3 (JTAG/SWD/... pinout scanner) (not yet implemented)
+
+* Scan types:
+  * JTAG: 0
+  * SWD: 1
 
 * `0x33`: Get status: no argument bytes, one result byte
-  * `0x00`: idle
-  * `0x01`: scan busy
-  * `0x02`: scan failed
-  * `0x03`: scan successful
-* `0x34`: Get scan result (only if status is `0x03`): no argument bytes, 5 result bytes
-  * Result: pin numbers of TCK, TMS, TDI, TDO, TRST
-* `0x35`: Start scan (only valid if status is not `0x01`): two argument bytes (start and end pin numbers, inclusive), no result bytes
+  * `0x0x`: scan busy (type: x, eg. 0x00 = JTAG busy, 0x01 = SWD busy)
+  * `0x7f`: idle
+  * `0b1xxxxxxx`: scan finished, `0bxxxxxxx` matches found
+* `0x34`: Get scan result (only if status is finished): no argument bytes, 8\*x (JTAG) or 6\*x (SWD) result bytes
+  * result: for each match:
+    * JTAG: all bytes: pin numbers of TCK, TMS, TDI, TDO, nTRST, IR length, # of pins toggled, "possibly a short-circuit" warning flag
+    * SWD: swclk, swdio pin numbers (bytes), manufacturer and part numbers (16 bits each, little-endian)
+* `0x35`: Start scan (only valid if status is not `0x01`): three argument bytes (scan type, start and end pin numbers (inclusive)), no result bytes
 
 ## Mode 4 (SUMP logic analyzer)