Reverse Engineering an SPI-like Communication

[G2ARV]

Hi,

I am a team of two, trying to understand this custom SPI communication:
The Communication is basically a variant of SPI with CPOL=1, CPHA=1. There is no framing or CS signal, which complicates parsing, and there is an additional variable length ACK clock pulse driven by the MISO (kind of like I²C clock stretching).
Default clock period is 13µs (6.5µs per half cycle) = 77 kHz (80 kHz). This decreases to 2µs for newer Slaves devices (1µs per half cycle) = 500 kHz Intended duty cycle seems to be 50% (fast mode seems to be 0.8µs low / 1.2µs high, but this is likely just an analogy effect).
Power-on timing:
• 1µs low glitch on MOSI (?)
• 42µs delay (?)
• Single 6.5µs low pulse on MOSI (does this serve a purpose?)
• 103µs delay
Command byte timing:
• Master drives MOSI at a random value for ~18µs (slow mode) or ~4µs (fast mode)
• This seems to usually be whatever the last bit of the previous command was, but not always consistent.
• Each bit is driven (by both master and slave) on the falling edge of LCLK, and sampled on the rising edge.
• Master drives MOSI high (or stops driving?) and stops driving LCLK 1µs after the last rising edge of LCLK (this is half a cycle in fast mode, but much shorter than half a cycle in slow mode).
• Slave releases DLC ~4.3µs after the last rising edge of LCLK
• Slave drives LCLK low ~14µs after the last rising edge of LCLK (ACK/BUSY)
• ACK/BUSY pulse seems to last at least 4µs but may be much longer
• Gap between bytes (rising edge of LCLK ACK/BUSY to first falling edge of LCLK) is at least 120µs in slow mode and at least 18µs in fast mode.
Is it possible for you helps us understand this SPI communication.

[AScha.3]

You have no exact description of the used format, so what's the whole thing:

- a game or challenge?

- hacking something to get access to.. ?

- part of a education or training or test?

 

[G2ARV]

Reverse engineering slave SPI communication, I’m trying to recreate the slave device.I’m not confused in SPI commands areas, but I don’t know how to implement i2c clock stretching in SPI and protocol timing.

[AScha.3]

Obviously "Reverse engineering" , but for ...what ?

>

- a game or challenge?

- hacking something to get access to.. ?

- part of a education or training or test?

[G2ARV]

Trying to make canon “EF lens Focus Confirmation Chip” ( this was a chip for old canon cameras lens without any communication ), in normal case whenever focus was near camera use to deep or give signal through viewfinder to get precise focus, what I want to do is make it for newer cameras but with beeper on chip it self to alert when focus is near 

[Andrew Neil]

https://pickandplace.wordpress.com/2011/10/05/canon-ef-s-protocol-and-electronic-follow-focus/

via https://www.google.com/search?q=EF+lens+Focus+Confirmation+Chip+protocol

[G2ARV]

 

John Gall’s Law

True. Big systems that work usually start small and grow over time. Building something complex all at once often fails because it’s too hard to get everything right from the start.

[G2ARV]

I ordered EF confirmation chip with adapter (I needed that adapter), If flash dump is possible. 

[AScha.3]

Something like this ?

AF-confirmation chip

 

So to work with this strange SPI ,(if your description is 100% correct at all), you have to write the "spi/i2c" yourself, to to meet all requirements.

Info here - you found obviously : https://gist.github.com/marcan/858c242db2fc595da1e0bb70a05192fc

 

Seems not so difficult...

...but then : for doing ..what ?  make a copy of these $5 Adapter ? Or build a new one ?

 

ed

this one made it : https://github.com/Jana-Marie/EF-S-Adapter