[sane-devel] Canoscan 3000F backend dev started

[Ralph Little]

Hi,
OK, I see some great similarity in the canon630u backend.
That is for a GL640 frontend, although I can't find anything like that 
in the innards.

Cheers,
Ralph

On 2020-01-19 2:27 p.m., Ralph Little wrote:
> Hi,
> Some basic analysis, in case someone recognises a pattern:
>
> bRequest either 4 or 12.
> wValue one of 0x82 (OUT), 0x83 (OUT), 0x84 (IN), 0x85 (OUT), 0x8e (IN)
>
> 0x8e looks like a status response request and nearly always returns 0x01.
>
> 0x83 and 0x85 usually seen in pairs. (i.e. 0x83, 0x85, 0x83, 0x85...) 
> and might be set register, set value pairs. (?)
>
> bRequest of 4
> ===============
> OUT commands are accompanied by data fragments of up to 8 bytes, 8 
> byte args being the most common.
> Examples:
> 00000000b83b0000 (very common)
> 00000000dc1d0000
> 9385a880b000
> b100b200 - these look like pair sequences (e.g. reg/val pairs)
> 850084008494 - also here
>
> bRequest of 12
> ================
> OUT commands only ever have a single byte data fragment.
>
> Receiving bulk scan data
> =====================
> A typical bulk reading sequence for a package of scan data looks like 
> this:
>
> CONTROL OUT bRequest=4, wValue=0x82, wIndex=0, wLength=8 
> fragment=00000000b83b0000
> CONTROL IN bRequest=12, wValue=0x8e, wIndex=32, wLength=1 (returns 
> 0x01 in response)
> BULK IN 14848 bytes
> BULK IN 440 bytes
>
> I'm guessing that the 8 byte arg encodes a max request buffer size 
> somehow.
>
> Ah yes, 14848+440=0x3bb8, so that would be a little-endian size 
> starting from the third byte.
> Another example confirms it:
>
> 00000000dc1d0000
> Bytes in=7168+476=0x1ddc :)
>
> ---------------------------------------
>
> Does this look familiar to anyone?
>
> Cheers,
> Ralph
>