[sane-devel] Re: 610p protocol Info.. My first cut.

[VOLTZ Stéphane]

    Hello,

    I'm afraid that sysinternals utility will be useless. To my 
knowlegde It uses
windows API to monitor parport I/O, and the Vistascan uses a VxD which
does direct hardware access.
    The only way I found was to set I/O breakpoint in a custom VxD and log
accesses to a file. Due some needed "features" if only works with win95
(not win95b).
    Some datas I've allready received show that unlike the umax 1220P which
is built on top of an EPAT (version C7), the 610P does not use EPPADR, but
only EPPDATA, which puzzles me, since I just can't understand how the
ASIC registers are adressed.

Regards,
    Stef

Richard A. Smith wrote:

>Ok... I've spent the better part of wed night with the 610p, the
>logic analyser and SoftICE and VistaScan from the UMAX webpage.
>
>This looks like this may be a tricky RE job as I haven't found the
>magic. Pieces of the puzzle that make everything make sense.
>
>Here's what I've learned:
>
>First in order to get valid data under VistaScan I have to have my
>parallel port set to _either_ SPP or ECP+EPP.  Strictly EPP does
>_not_ work.  If set to EPP the scanner performs all scan functions
>but the data that shows up in the preview windows is scrambled.
>
>Perhaps its using the compression feature built into the ECP?  Dunno
>how it works in SPP mode though.  
>
>Attempting to start out simple I tried to log the IO from a simple
>application called powersave which just turn on and off the scanner
>light.  This app works regardless of what mode the parallel port is
>in.  My thought was that I would set up the LA to trigger on the
>various transfer modes and find the one that matches.
>
>I ran into the problem though that the data I see on the logic
>analyser dosen't seem to match any of the timeing diagrams I have for
>any of the modes.  At least not for any of the modes listed in Jan
>Axelson's Parallel Port Complete.
>
>I can't seem to figure out the exact clocking scheme that will let me
>grab the data on the wire.  Of course it could have just been that it
>was 3am... 
>
>So I began useing SoftICE to try and get a better understanding of
>what it was doing.
>
>SoftICE isn't the greatest thing for logging port IO.  It (at least
>my version) won't let me breakpoint on a rage of IO so I have to
>specifically choose a port address to watch for.  The powersave app
>though appears to have 2 subroutines that do all the IO so I was able
>to break on thier addresses and extract the port address and data
>from each transfer.  But its really tedious.   And I think that since
>I breakpoint on every IO attempt that the transfer is timeing out
>causing it to repeat as the code appeared to get stuck in a loop that
>would drop out after 10 attempts.   I quit about that time. 
>
>See the end of the message for the listing.
>
>So I got some data but by the time I was done it was really late and
>I have not had a chance to study it.  Hopefully somebody can make
>some sense of this and give me a boost.
>
>I think my next step is to set up a windows NT machine and use
>portmon from sysinternals to grab the IO.  Portmon's webpage claims
>to be able to log all parallel IO under NT.  Vistascan is listed to
>run under NT.  On w98 portmon dosen't see any parallel activity I'm
>guessing because the app is doing direct reads and writes rather than
>calling an api call.
>
>Heres the log:
>
>Key:
>
>-> means write to port.
><- means input from port.
>side text describes what the next instructions did with the input
>data at least up until it jumped away.
>
>Program boots.. Then it does lots of IO's to various parallel port
>base IO addresses... You don't have to set the IO base in the app
>anywhere so this must be how it finds the scanner.  My base address
>is 0x378.  All number are in hex.
>
>40 -> 378
>06 <- 37a
>3f <- 379	Mask with 78 look for 38
>07 -> 37a
>3f <- 379	Mask 78 look for f8
>04 -> 37a
>ff <- 379 	Mask f8 look for f8
>05 -> 379
>c5 <- 37a 	Mask 0f look for 05
>04 -> 37a
>cf <- 379	Look for bit 5 to be 0
>c4 <- 37a	Mask 5f assign result to V1. V1 = 44
>V1 (44) -> 37a
>55 -> 37c
>cf <- 379	Look for bit 5 to be 0
>c4 <- 37a	Mask with 5f assign to V2 V2 = 44
>V2 (44) -> 37a
>aa -> 37c
>c4 <- 37a 	OR with a0 assign to V3  V3=e4
>V3 (e4) -> 37a
>cf <- 379	Look for bit 3 to be 0
>
>The last test fails and it looks like it will attempt to try this 10
>times before jumping ou t of the loop.
>
>Thats it for now... I'll try to get the NT logs this weekend.
>
>--
>Richard A. Smith                         Bitworks, Inc.               
>rsmith at bitworks.com               479.846.5777 x104                        
>Sr. Design Engineer        http://www.bitworks.com   
>
>
>
>  
>