I am looking at a SPI EEPROM chip on board which is unfortunately hidden under an epoxy blob. However, I was able to determine the pinout thanks to the silkscreen.
Dumping the EEPROM with a Bus Pirate, I figured that the EEPROM is 16K since the dumped data seems to repeat every 0x4000 bytes.
I hooked up a logic analyzer to the pins and monitored communication with the EEPROM while the device booted. The sniffed communication looks very much like SPI (as it should), however there is a slight discrepancy from the spec I haven't figured out yet.
I've screenshotted three examples of what seems to be a READ operation:
The first byte is 0x03 (READ), followed by three bytes, and a two-byte response on MISO. According to the SPI protocol, a READ opcode should be immediately followed by a two-byte address. Then, data is returned from that address.
However, three bytes follow the READ opcode, not two. Looking at each example, the first byte always seems to be 0x00. The next two bytes may conceivably be the address.
My questions boil down to:
- Is this normal behavior for SPI chips?
- How should this seemingly non-standard communication be interpreted?
- Are there more effective ways of decoding this captured traffic into human-readable SPI commands?