[sane-devel] Back-end for CanoScan 3200F?

[Gerald Murray]

Quoting Lauri Pirttiaho <lauri.pirttiaho@luukku.com>:

> Hello,
>=20
> A while back there was some discussion about the back-end
> for CanoScan 3200F, a currently unsupported scanner.
> I would like to know if someone is actively working on
> this scanner. Also if anyone has definitive information
> about the on-board controller ASIC, I would be very
> thankful. Especially if someone has soldered open
> the EMI shield of the controller board, I would like
> to hear what is there beneath.

The genesys backend gl841 MAY be the closest to what=20
you are describing here, but some details you mention
show small variance from the gl841.  The backend for the
gl841 probably best described as an early start, or a stalled
project.  The project remains blocked due to access to the=20
registers, and unknown vendor read/write commands.  From my
tests on Canon LiDE 35 that scanner NAKs every attempt I have
tried so far. =20

> What I know so-far is that the suspected chip is some
> of the S&Q chips and that there is on-board MCS51
> micro controller (MCU), either built-in to the controller
> ASIC or as a separate chip.
>=20
> From analyzing the USB traffic in Windows XP I have
> already deduced the working boot procedure, some scan
> head control commands and partial procedure to make a
> full plate scan.
>=20
> The controlling procedure involves three types of=20
> control "commands". There are direct writes to/reads from
> the external memory space of the MCU, some high addresses
> of which seem to be memory mapped peripherals.
> These are the single byte vendor write and read requests
> 0x0c (read) and 0x04 (write) to wValue 0x00e1 (read)
> and 0x00e0 (write) with the address at wIndex.

Providing details on what went down the usb bus would=20
certainly help.  The log from a scan may provide some clues
to what is currently unknown.  It would also be helpful is
someone with a Canon LiDE 35 could post a log so that more
information would become available to that project.

> Then there are command with varying values and
> indices of varying length (some of which have easy
> to find uses (like write to value 0x0071 index 0 which=20
> homes the scan head, read form value 0x0040 index 0
> which returns some status information like whether
> the scan head is moving and if it is at home position,

My read of the gl841 registers show that the home position
sensor would be in register 0x0041

> values 0x0023 and 0x0024 index 0 which move the

Here the gl841 seems to show register 0x0022 and 0x0023
for this, probably.

> scan head forward and backward by given length etc.)
> Some are not so easy to deduce.
> Third type of "command" is upload of several blocks
> of data to the external memory space of the MCU
> (at address 0xdd00) which seem to contain various
> masking, ramping etc. data details of which is
> unknown to me but which directly affects e.g. whether
> the scan comes out as all black or something visible
> and also seems to affect the motor operation.

The logs that would show data being written to the address
of a MPU are of interest, as the gl841 still has some=20
unknown problems that stall that backend.
=20
> If anyone can deduce from the description above more
> about the on-board controller, I would like to hear.
>=20
> I am in process of preparing a more detailed collection
> of my findings, but if there is already a project to
> make the back-end for this scanner, I would like
> to submit the findings to that common pool.
>

I hope you will keep this list informed of your effort.
The genesys gl646 portion of the genesys backend has been mentioned
as "ready", but the other gl841 is positively not ready to be included
in the sane CVS.  I think the gl646 could use more testing.  The project
can be accessed in the sane CVS, co experimental.

=20
> With best regards,
>=20
> Lauri Pirttiaho
> Oulu
> Finland
>=20

Thanks for your news.  Good luck with your efforts.

Gerald=20
--=20