Bus Pirate SPI guide

See the latest version in the documentation wiki.

Bus: SPI (serial peripheral interface).
Connections: four pins (MOSI/MISO/CLOCK/CS) and ground.
Output type: 3.3volt normal, or open collector (pull-up resistors required).
Pull-up resistors: required for open drain output mode (2K – 10K).
Maximum voltage: 5.5volts (5volt safe).

Syntax Description
A/a/@ Toggle auxiliary pin. Capital “A” sets AUX high, small “a” sets to ground. @ sets aux to input (high impedance mode) and reads the pin value.
D/d Measure voltage on the ADC pin (v1+ hardware only).
W/w Capital ‘W’ enables the on-board power supplies. Small ‘w’ disables them. (v1+ hardware only).
[ Chip select (CS) active (low).
{ CS active (low), show the SPI read byte after every write.
] or } CS disable (high).
R or r Read one byte by sending dummy byte (0xff). (r:1…255 for bulk reads)
0b Write this binary value. Format is 0b00000000 for a byte, but partial bytes are also fine: 0b1001.
0h/0x Write this HEX value. Format is 0h01 or 0×01. Partial bytes are fine: 0xA. A-F can be lower-case or capital letters.
0-255 Write this decimal value. Any number not preceded by 0x, 0h, or 0b is interpreted as a decimal value.
, Value delimiter. Use a coma or space to separate numbers. Any combination is fine, no delimiter is required between non-number values: {0xa6,0, 0 16 5 0b111 0haF}.
& Delay 1uS. (&:1…255 for multiple delays)
(#) Run macro, (0) for macro list
Macro Description
0 Macro menu
1 SPI bus sniffer with configurable CS filter.

Configuration options

Speed - 30kHz, 125kHz, 250kHz, 1MHz.

Clock polarity - idle low, idle high.

Output clock edge - idle to active, active to idle.

Input sample phase – middle, end.

Output type - open drain/open collector (high=Hi-Z, low=ground) , normal (high=3.3volts, low=ground). Use open drain/open collector output types with pull-up resistors for multi-voltage interfacing.

SPI Bus sniffer

The SPI sniffer is implemented in hardware and should work up to 10MHz. It follows the configuration settings you entered for SPI mode.

  • [/]  – CS enable/disable
  • 0xXX – MOSI read
  • (0xXX)  – MISO read

SPI CS pin transitions are represented by the normal Bus Pirate syntax. The byte sniffed on the MISO pin is displayed inside ().

SPI>(1)
Sniff when:
1. CS low
2. CS high
3. All traffic
(1) >
SPI bus sniffer, any key exists
[0x30(0x00)0xff(0x12)0xff(0x50)][0x40(0x00)]

The SPI sniffer can read all traffic, or filter by the state of the CS pin. The byte sniffed on the MOSI pin is displayed as a HEX formatted value, the byte sniffed on the MISO pin is inside the ().

  1. I’m using the bus-pirate (v2go with v3.1FW) to sniff a SPI port, I sometimes get an output in the terminal which isn’t correctly HEX formatted, for example: 0×0x01F.
    Any ideas of what is causing this?

    Reply

  2. Oh nevermind.. I’m sniffing continuous 8Mhz SPI data, so the little BusPirate isn’t happy as it is over running the buffer. I really should be using a logic analyser instead.

    Reply

  3. I think there is a bug in CS sniffing. It’s set like an output and goes low after entering sniffing mode, then goes up after exiting sniffing mode.
    Anyone got the same behaviour?

    Reply

    1. I’ll check it out before the next release. Thanks for the bug report.

      Reply

  4. We need BusPirate for SPI sniffing only (no outputs on bus, not exercising devices), but SPI mode interferes whenever connected to SPI bus!
    When SPI mode is not sniffing (at SPI prompt, esp. after sniffing interrupted by keystroke), data line (at least MOSI) appears to be driven or held by BusPirate, instead of released or left open (Hi-Z). The effect is system under test ceases to operate when BusPirate at SPI> prompt is attached. Workaround is to start sniffing “macro” (1) before attaching to SPI bus.
    What is needed (should be default, IMHO) is for all SPI pins to input-only except when issuing output onto the bus; or else a setting option for this.
    What is SPI (1) “macro” — can it be edited, can its commands be used?
    [Also, any option for BusPirate to power up back into last-used configuration and state, after power-down? We would like to "set and forget" instead of having to record/remember all configuration choice each time we re-power the device.]

    Reply

    1. Hi Pete,

      The SPI sniffer macro is here:
      http://code.google.com/p/the-bus-pirate/source/browse/trunk/source/SPI.c#225

      It uses two hardware SPI modules in the PIC to sniff the SPI traffic. The actual functions that do this are here:
      http://code.google.com/p/the-bus-pirate/source/browse/trunk/source/SPI.c#433

      Your suggestion is very interesting, and I’m not sure quite sure how to integrate it into the code. The PIC hardware SPI modules actually control the pin state after the module is configured. Peripherals with the PIC PPS function override user pin configurations. Leaving all pins input unless they are outputting could adversely effect some chip clocks and CS (maybe not?). I guess we could assign and remove the SPI module from the pins between every write to make it an input, but this would probably send extra clock bits and CS line noise, especially with high-impedance bus configurations.

      Maybe we could make the SPI sniffer resettable so it would stay in high-z SPI sniffer mode instead of falling to the command prompt – space to reset/pause, X to exit, something like that?

      I started a discussion for this in the development forum. I’ll try to get some form of solution rolled into the next nightly build:
      http://dangerousprototypes.com/forum/index.php?topic=685.0

      Unfortunately the PIC in the Bus Pirate doesn’t have an EEPROM or anything (besides flash, which is all used up) to store persistent settings. It’s definitely something we have planned for the next version though.

      Reply

  5. I’ll be more than happy to try things out and provide feedback.
    I’d also like to try some tweaks and builds of our own; if I can join the fray without disrupting it, is the build setup written up somewhere?

    Reply

    1. Here’s the older instructions:
      http://dangerousprototypes.com/2009/09/08/compile-the-bus-pirate-firmware/

      The v5 branch requires slightly different export instructions, they should be here, but I’ll try to wire an updated guide too:
      http://dangerousprototypes.com/forum/index.php?topic=689.0

      Reply

  6. I am trying to use BP to do some SPI sniffing as well… Not much success, even the instructions look straight forward….

    In my case, I just wanted to make sure I understand the process correctly. I am tapping into a circuit I build, with SPI running @ 5MHz. Beside from the effects (hold up the SPI bus before going into sniffing mode) I can’t seem to getting anything (maybe a [ or ] for one time and that’s it)

    And for the whole time I know the SPI bus is working because the other (16F88 -> MAX7219) end continuously receiving data…

    On a side note…. a tutorial (or even new feature – CAN Bus interface. Hint: OBD II) to use it with MCP2515 would be awesome!

    Reply