[sane-devel] [snapscan backend] EPSON Perfection 3490 Photo firmware upload

Tue Aug 13 19:14:19 BST 2024

Hello,

I own an almost  20 years old Epson 3490 scanner. I use it with SANE
from day #1, but some time ago - I guess several years ago - it started
to behave erratically. Namely, it has problems with initial firmware
upload. Or maybe it always had, I don't know for sure.

The scanner is built around the Ali M5623 High-Speed USB2.0 Scanner
Controller chip. The initial firmware - stored in the M5623 chip itself
or maybe contained in some serial flash ROM or EEPROM - is used by SANE
(snapscan backend) to upload (download from scanner's perspective) the
firmware contained normally in /lib/firmware/Esfw52.bin file.

The file is 64000 bytes long, the actual firmware sent to the scanner is
63239 bytes long.

The scanner (and the snapscan backend) uses some sort of SCSI over USB.

The problem is apparently this: all SCSI commands (6- or 10-byte) to the
scanner are directly sent to the USB OUT endpoint. Then the scanner
responds with an 8-byte "packet", with the important value in the first
(#0) byte:

#define TRANSACTION_COMPLETED 0xfb /* Scanner considers the transaction done */
#define TRANSACTION_READ      0xf9 /* Scanner has data to deliver */
#define TRANSACTION_WRITE     0xf8 /* Scanner is expecting more data */

Depending on the received value, the snapscan backend sends or reads
more data to/from the scanner, then the request is completed.

Firmware transfer is done with a SEND(10) command, with parameters
(SCSI-2 clause 15.2.6):
- operation code 0x2A in byte #0
- Data type code in byte #2 = 0x87 is firmware upload (vendor-defined)
- Data type qualifier in #4 and #5 = 0
- Xfer length in #6 (MSB) - #8 (LSB) is firmware length

The problem is, the original scanner firmware in ROM doesn't seem to
bother following this protocol to the end. Instead, it executes the new
firmware as soon as it's received, so SANE is not seeing the
TRANSACTION_COMPLETED response. Interestingly, the USB interface isn't
reset in this process.

Now the question is - are other similar scanners doing the same, or is
it only the 3490? Or maybe it depends on the flash ROM version? I wish
this fixed at last, but I don't want to break other people's setups.

The relevant parts of log:
Snapscan backend version 1.4.53
usb_cmd: cmdlen=6, datalen=0
usb_write: writing:  0x12 0x00 0x00 0x00 0x24 0x00
Written 6 bytes <<<< INQUIRY command
usb_read: reading:  0xf9 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes <<<< TRANSACTION_READ
usb_read: reading:  0x06 0x00 0x02 0x02 0x49 0x00 0x00 0x00 0x45 0x50 ...
Read 36 bytes <<<< INQUIRY data
usb_read: reading:  0xfb 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes <<<< TRANSACTION_COMPLETED
snapscani_check_device: Is vendor "EPSON" model "EPSON Scanner" a supported scanner?
snapscani_get_model_id(EPSON Scanner, 0, 2)
snapscani_get_model_id: looking up scanner for ID 0x04b8,0x0122.
snapscani_get_model_id: scanner identified
snapscani_check_device: Autodetected driver: Perfection 3490
...

Here is the problematic part:

usb_cmd: cmdlen=10, datalen=63239
usb_write: writing:  0x2a 0x00 0x87 0x00 0x00 0x00 0x00 0xf7 0x07 0x00
Written 10 bytes <<<< SEND = firmware upload command
usb_read: reading:  0xf8 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes <<<< TRANSACTION_WRITE
usb_write: writing:  0x02 0xf2 0xd5 0x32 0xff 0xff 0xff 0xff 0xff 0xff ...
Written 63239 bytes

(1 minute passes)

usb_read Only 0 bytes read
usb_read: reading:  0xf8 0x00 0x00 0x00 0x00 0x00 0x00 0x00
(The above is a false dump - a residual buffer contents).
Read 0 bytes
sane_snapscan_open: download_firmware command failed: Error during device I/O

scanimage: open of device snapscan:libusb:001:005 failed: Error during device I/O

Subsequent runs of xsane do this:

usb_cmd: cmdlen=6, datalen=0
usb_write: writing:  0x12 0x00 0x00 0x00 0x24 0x00
Written 6 bytes
usb_read: reading:  0xfb 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes <<<< TRANSACTION_COMPLETED - no data?
snapscani_check_device: Is vendor "" model "" a supported scanner?
usb_cmd: cmdlen=6, datalen=0
usb_write: writing:  0x00 0x00 0x00 0x00 0x00 0x00
Written 6 bytes
usb_read: reading:  0xfb 0x02 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes
usb_read_status: scanner structure not set, returning default error
2nd read 2 write 2

sane_get_devices: found 0 devices

Eventually (running again after few minutes) it fixes itself:
usb_cmd: cmdlen=6, datalen=0
usb_write: writing:  0x12 0x00 0x00 0x00 0x24 0x00
Written 6 bytes
usb_read: reading:  0xf9 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes
usb_read: reading:  0x06 0x00 0x02 0x02 0x49 0x00 0x00 0x00 0x45 0x50 ...
Read 36 bytes
usb_read: reading:  0xfb 0x00 0x00 0x00 0x00 0x00 0x00 0x00
Read 8 bytes
snapscani_check_device: Is vendor "EPSON" model "EPSON Scanner1" a supported scanner?

The original (ROM) INQUIRY response (removed some zeros for clarity,
it's a longer response than used by SANE):
00: 06 00 02 02 49 00 00 00 45 50 53 4F 4E 20 20 20  ....I...EPSON   
10: 45 50 53 4F 4E 20 53 63 61 6E 6E 65 72 20 20 20  EPSON Scanner   
20: 30 31 31 30 20 00 00 00 02 22 00 00 00 00 00 00  0110 ...."......
30: 04 B0 00 00 00 00
40:
50:
60: 54 75 65 20 46 65 62 20 32 35 20 32 30 30 33 20  Tue Feb 25 2003 
70: 30 39 3A 35 38                                   09:58
80:

The uploaded firmware shows this:
00: 06 00 02 02 49 00 00 00 45 50 53 4F 4E 20 20 20  ....I...EPSON   
10: 45 50 53 4F 4E 20 53 63 61 6E 6E 65 72 31 20 20  EPSON Scanner1  
20: 31 2E 30 38 20 9D 40 C8 00 00 37 A0 37 A0 00 00  1.08 . at ...7.7...
30: 0C 80 00 01 FF FF
40:
50:
60: 54 68 75 20 41 70 72 20 31 34 20 32 30 30 35 20  Thu Apr 14 2005 
70: 31 34 3A 33 32                   80 FD 80 82 7D  14:32..........}
80: 84 00 00 00 00 00 00 00 00 07 01

USB ID is 04b8:0122.
I'm using Fedora 40's sane-backends-drivers-scanners-1.3.1-1.fc40.x86_64.

Other details are, of course, available or request.

BTW: do you know of a datasheet etc. for the M5623 (or similar) chip?
I only found a 2-page brief.

BTW2: the scanner list on sane-project.org shows that that the
esfw52.bin firmware is for 3590, and 3490 should use esfw51.bin instead.
EPSON's package for 3490 contains Esfw52.bin, and other sources indicate
it's the file I should use. Both scanners apparently use the same
hardware, with 3590 also using an automatic film loader or something.

Any ideas?

Of course, I could buy some other device, but this old EPSON is
a quality scanner (for paper stuff, anyway - easily cleaned etc.) and
I don't know if a new one would be as good.

TIA.
-- 
Krzysztof "Chris" Hałasa