[sane-devel] hp 2300c

[Henning Meier-Geinitz]

Hi,

On Fri, Jul 04, 2003 at 01:40:00PM +0200, gnawa wrote:
> > Can you post an URL to the full log, so I can check if the protocol
> > is really similar?
> 
> http://gnawa.homeunix.org/2300c_preview.LOG
> http://gnawa.homeunix.org/2300c_scan.LOG

I had a quick look and may have missed some stuff but that's what I
found out. I can see the following types of USB messages (scan log):

-------------------------- control messages ------------------------------

1) Control messages that send one byte of data to the device, e.g. URB
   2162:
   40 0c 83 00 00 00 01 00 (data: 0x41)

Request type 40 means: host-to-device, send to the device itsself (not
a specific interface or endpoint), vendor request (so the other
rules in the USB spec for control messages do not apply).
   
request is 0x0c, value is 0x83

2) Control messages that read one byte of data from the device, e.g. URB
   2163:
   c0 0c 84 00 00 00 01 00 (data: 0x6c)

Request type c0 means: device-to-host, send to the device itsself (not
a specific interface or endpoint), vendor request

request is 0x0c, value is 0x84

3) Control messages that write one byte of data to the device, e.g. URB
   2167:
   40 0c 85 00 00 00 01 00 (data: 0x11)
   
request is 0x0c, value is 0x85
   
The message 1) seems to be always followed by 2), 3) or 4). So maybe
it's used to select the register (or function) and message 2) is used
to read data while 3) is for sending data? 

4) Control messages that write 8 bytes of data to the device, e.g. URB
   2170:
   40 04 82 00 00 00 08 00 (data: 01 11 00 00 06 00 00 00)

request is 0x04, value is 0x82

Message 4) seems to be used to initiate a bulk transfer (see below).
Byte 5 of the data (06 in this example) and byte 6 (little-endian) is the
number of bytes that will be transferred in the following bulk
transfer.

I don't know what the second byte of data (0x11) means. It's sometimes
0x11, sometimes 0x00.

The fisrt byte of data seems to describe the direction of the
following bulk-transfer: 01 is out (write), 00 is in (read).


5) Control messages that write 1 byte of data to the device, e.g. URB
   3800:
   40 0c 8b 00 00 00 01 00 (data: 0x00)
  
request is 0x0c, value is 0x8b

6) Control messages that read 1 byte of data to the device, e.g. URB
   3872:
   c0 0c 8a 00 00 00 01 00 (data: 0x73)
   
request is 0x0c, value is 0x8a

I'm not sure about those ones (5) and 6)), they only appear at the end
of the scan and some URBs are missing here.

-------------------------- bulk messages ------------------------------
   

7) bulk-out tranfers: Different sizes are used. They are initiated by
   control message 4). Maybe the smaller buffers are used to set
   parameters, the bigger ones to set gamma tables or calibration.

8) bulk-in transfers: Different sizes. Seems to be split to more than
   one message sometimes. Looks like the windows driver used fixed
   buffer sizes of e.g. 0x500 bytes, 0x100 bytes or 0x40 bytes. If the
   number of bytes that should be read doesn't fit into that sizes,
   multiple buffers are read. E.g. to read 0x102 bytes, 0x100 and 0x40
   are read and the last buffer is only filled with 2 bytes.
   Probably used for calibration and reading scan data. 

Ok, I think you now have enough information for more digging what that
actually means.

Bye,
  Henning