I'm trying to learn about SPI and I have a old Bluetooth headset with SPI solder points on it. I've already soldered the corresponding {MISO,MOSI,CS,CLK} pins and connected them to the Bus Pirate correctly. The chip on the headset is a CSR-31315 (9A11U-717AT) which I've found a PDF for (SPI on pg. 74).
The PDF says to perform a read operation all that needs to happen is the CS needs to go from high to low, then a 8-bit read command of 0b00000011 needs to be sent, then the 16-bit address to read needs to be sent. After that it will output on MISO a check word which is composed of {command, address [15:8]} (what is the [15:8] for?) and then finally the contents of the address. Then last take CS high again so it doesn't continue on to print the Address+1 on MISO.
The command I'm feeding to my Bus Pirate is [ 0b11 0x00 0x00 r:16 r:16 ], which I believe should take CS from high to low (it idles high), output 0b00000011 the read command, write the 16-bit address of 0x00 0x00, read the 16bit checkword, read the 16-bit address data, and finally take CS high again. I think that should work but it doesn't.
Best Answer
The 'r' command for bus pirate reads a single byte, so r:16 is attempting to read 16 bytes, not 16 bits. I'd guess you want "r:2 r:2" (or just "r:4")
But, I doubt that's the problem. If it had worked, you'd have seen the 4 bytes then some FFs.
I think it's more likely that your chip is not ready to accept commands over SPI.
I did some work with the CSR BC04 a few years ago. They can be configured to accept commands over the UART, SPI or USB. It's possible that yours isn't accepting commands over SPI. Fixing this may involve reflashing the firmware.
You might give the Bus Pirate SPI sniffer a go and see if you can intercept some valid looking signals when your device is running normally. That would give some confidence that it really is using SPI. Another way to do this would be to use a 2 channel oscilloscope, trigger on CS and look for the SPI clock ticking while CS is asserted.
To be honest, if you're just trying to get SPI going on the Bus Pirate - choose something easier. The first device I used mine on was an RGB LED matrix from Sparkfun.