[sane-devel] Canoscan 3000f protocol

[Stef]

     Hello,

     the Canon 3000F is reported to be a gl660+gl646 genesys ASIC. While 
analyzing USB log from this scanner, I could confirm it is using a GL660 
USB to IEEE-1284 bridge. However the procotol used on top of if doesn't 
look like a genesys GLxxx one. Another thing is that GL646 datasheet 
describes IEEE 1394 (firewire) and USB operation, no IEEE 1284 mode. So 
I would be surprised if an USB genesys scanner ASIC is used. I'd rather 
expect an 1284 chip behind the bridge, not one that can do USB natively.

     In the hope someone can suggest the scanner chip (so I don't have 
to disassemble and unsolder my scanner to find out the real ASIC), here 
are some excerpts of a semi decoded USB log (read/write are actually 
EPPADR+EPPDATA read and write):

At start there are many small blocks like this:
......
write(0x92,0x00)
write(0xcf,0x00)
write(0xa3,0x10)
write(0xa1,0x3f)
write(0x97,0x0a)
read(0x8b)=0x5f
read(0x8b)=0x5f
write(0x97,0x0f)
read(0x8b)=0xc3
.......

     And "full register set" write looks like:
write(0xb0,0x00)
write(0xb1,0x00)
write(0xb2,0x00)
write(0xb3,0xff)
write(0xb4,0x7f)
write(0xb5,0x04)
write(0xb6,0xfc)
write(0xb7,0x0f)
write(0xb8,0xf8)
write(0xb9,0x1f)
write(0xbc,0x00)
write(0xbd,0x01)
write(0x83,0x22)
write(0x85,0xd0)
write(0x83,0x02)
write(0x85,0x07)
write(0x9b,0x14)
write(0x98,0x00)
write(0x99,0x00)
write(0x9a,0x00)
write(0x9b,0x15)
write(0x98,0x00)
write(0x99,0x00)
write(0x9a,0x00)
write(0x9b,0x16)
write(0x98,0x00)
write(0x99,0x00)
write(0x9a,0x00)
write(0x9b,0x17)
write(0x98,0x00)
write(0x99,0x00)
write(0x9a,0x00)
write(0x9b,0x14)
write(0xcf,0x0c)
write(0x9e,0x00)
write(0x9f,0x60)
write(0x83,0xa0)
write(0xa0,0x00)
write(0x9c,0x00)
write(0x9d,0x00)
write(0x8e,0x00)
write(0x8b,0x00)
write(0xbb,0x00)
write(0x80,0xe0)
write(0x80,0xe1)
write(0x83,0x82)
write(0x8d,0x00)
write(0x93,0x86)
write(0x83,0xa2)
write(0x8d,0xff)
write(0xa8,0x80)
write(0x04,0x00)
write(0x00,0x00)
write(0x01,0x03)
write(0x03,0x52)
write(0x02,0x04)
write(0x05,0x00)
write(0x28,0x01)
write(0x29,0x01)
write(0x2a,0x01)
write(0x20,0xb9)
write(0x21,0xb9)
write(0x22,0xb9)
write(0x24,0x00)
write(0x25,0x00)
write(0x26,0x00)
write(0x83,0x22)
write(0x85,0x08)
write(0x83,0x02)
write(0x85,0x00)
write(0x84,0x00)
write(0x84,0x95)
write(0xc0,0xd0)
write(0xc1,0x01)
write(0xc2,0x00)
write(0xc3,0x01)
write(0xc4,0x00)
write(0xc5,0x00)
write(0xc6,0xd0)
write(0xc7,0xd0)
write(0xc8,0x11)
write(0x88,0xd0)
write(0x89,0x24)
write(0x86,0x00)
write(0x90,0x20)
write(0x83,0x82)
write(0x90,0x20)
write(0xb0,0x00)
write(0xb1,0x80)
write(0xb2,0x1e)
write(0xb3,0xfd)
write(0xb4,0xff)
write(0xb5,0x1f)
write(0x92,0x60)
.....

     Only "register" 0x8b seems to be read back from ASIC, while 0x00, 
0x01, 0x02, 0x03, 0x04, 0x05, 0x20, 0x21, 0x22, 0x24, 0x25, 0x26, 0x28, 
0x29, 0x2a, 0x80, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8b, 
0x8c, 0x8d, 0x8e, 0x90, 0x92, 0x93, 0x94, 0x97, 0x98, 0x99, 0x9a, 0x9b, 
0x9c, 0x9d, 0x9e, 0x9f, 0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 
0xa8, 0xa9, 0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 
0xbb, 0xbc, 0xbd, 0xbe, 0xbf, 0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 
0xc7, 0xc8, 0xce, 0xcf are written.

     Any suggestion is welcomed.

Regards,
     Stef