[sane-devel] Re: HP 4570c - any progress?

[Bertrik Sikken]

Daniel Franke wrote:
> On Sunday 11 September 2005 18:29, I wrote:
> 
>>Is currently anyone working on this specific driver? If not, is there any
>>code to pick up? Any docs from HP someone already acquired? I would also
>>appriciate some hints/documentation about "GL841/GL646" (which seems to be
>>related) [3].
> 
> 
> 
> Re-hi all,
> 
> in reply to my own mail: no answer within 48 hours presumely means that nobody 
> works on this specific driver, that there are no docs available and that 
> there's no code to pick up - correct?!

The stuff in the snoopy log looks similar to the protocol used by
the hp5400 scanner, but in a weird way.

For example, the scanner sends the "SILITEK" string in response
to a USB transfer that contains the bytes 0x1200. For the HP5400
this is the command to read the version string.
On the hp5400, command 0xc500 is used to read back the previously
issued command. These bytes can also be seen in the snoopy log
in USB transfers with apparently the same meaning as for the hp5400.

The protocol is weird because it seems to implement some kind of
'USB-over-USB', i.e. the data payload of the USB control packets
looks like another USB control packet. The payload size never
appears to exceed 8 bytes.
For example, URB #6 has a data payload of c0 04 00 12 00 00 32 00.
This looks exactly like the setup packet from a hp5400 log:

0.84643495	>>>>>>> URB 5 going down...	
0.84644613	-- URB_FUNCTION_VENDOR_DEVICE:	
0.84645954	  TransferFlags          = 00000001
(USBD_TRANSFER_DIRECTION_IN, ~USBD_SHORT_TRANSFER_OK)	
0.84647127	  TransferBufferLength = 00000032	
0.84648244	  TransferBuffer       = 811e5a88	
0.84649250	  TransferBufferMDL    = 00000000	
0.84650312	  UrbLink                 = 00000000	
0.84651345	  RequestTypeReservedBits = c0	
0.84652351	  Request                 = 04	
0.84653385	  Value                   = 1200	
0.84654390	  Index                   = 0000	
0.85850408	 	
0.85850967	<<<<<<< URB 5 coming back...	
0.85852085	-- URB_FUNCTION_CONTROL_TRANSFER:	
0.85853202	  PipeHandle           = 81411314	
0.85854459	  TransferFlags        = 00000003
(USBD_TRANSFER_DIRECTION_IN, USBD_SHORT_TRANSFER_OK)	
0.85855605	  TransferBufferLength = 00000032	
0.85856666	  TransferBuffer       = 811e5a88	
0.85857700	  TransferBufferMDL    = 813f88a8	
0.85858594	 	
0.85871417	    0000: 00 53 69 6c 69 74 65 6b 49 42 6c 69 7a 64 20 43 	
0.85884184	    0010: 33 20 53 63 61 6e 6e 65 72 56 30 2e 38 34 09 60 	
0.85897565	    0020: 09 60 4f b0 6d b0 00 00 00 00 00 00 00 00 00 0a 	
0.85900135	    0030: 00 64 	
0.85901085	  UrbLink              = 00000000	
0.85908377	  SetupPacket          : c0 04 00 12 00 00 32 00 	

I am pretty sure that Silitek makes the niash types of chips.
The HP5400 also uses a niash scanner control chip.

I think you can try to understand this weird protocol a little
better and see where the differences and similarities are with the
HP5400 protocol, then try modify the lower layers of the hp5400 backend.

> If so, I should try to get some docs first. Does someone know something about 
> HP's doc-sharing policy? Are there any established connections to HP? Please 
> let me know any positive and/or negative experiences you had with 
> HP-(developer)-support before, off-list if preferred.

I tried and at least I got an answer although not a very useful one.

HP may not even be able to give you docs if they didn't make the
scanner control chip.

Kind regards,
Bertrik Sikken