My Saleae Logic doesn't always like to trigger on the 3.0V signal level (I guess) but once running it does record the transactions. One simple invocation of "raspistill -o test.jpg" results in 956 separate I2C packets over the ensuing 6 seconds. After some dummy read/write activity (prime a state machine?), action starts with a read at location 0x300A (Device ID) and the result is 0x5647. And sure enough, this is a OV5647 camera. I didn't realize that was the actual ID code in hex. Following that, 0x0103:01 (RESET) and 0x0100:00 (SLEEP) (which is then repeated twice more) ...and so forth. Note 0x6C is the "write register" code, and 0x6D is "read register". Maybe not of interest to most, but I like to be able to see inside the black box, at least a bit.
Code: Select all
Time [s],Packet ID,Address,Data,Read/Write,ACK/NAK -------------------------------------------- 0.752239375,6,0x6C,0x30,Write,ACK # Register 0x300A 0.752329375,6,0x6C,0x0A,Write,ACK 0.752529375,7,0x6D,0x56,Read,ACK # DEVICE ID HIGH 0.7526195,7,0x6D,0x47,Read,NAK # DEVICE ID LOW 0.753461375,8,0x6C,0x01,Write,ACK # Register 0x0103 0.753551375,8,0x6C,0x03,Write,ACK 0.753641375,8,0x6C,0x01,Write,ACK # RESET command 0.753851375,9,0x6C,0x01,Write,ACK # Register 0x0100 0.753941375,9,0x6C,0x00,Write,ACK 0.754031375,9,0x6C,0x00,Write,ACK # SOFTWARE SLEEP command ...and a lot more, ending with: 6.7975905,956,0x6C,0x38,Write,ACK # Register 0x380E 6.7976805,956,0x6C,0x0E,Write,ACK 6.797770625,956,0x6C,0x04,Write,ACK # TIMING_VTS (Bit 7:2 => Debug mode, Bit 1:0 => vertical size bits 9:8)
So far I am just capturing data, but I have considered installing a shim; a CPU in-between the R-Pi and camera, and reading the I2C traffic from the master and doing a little translation on the fly. Could possibly access additional modes (eg: real manual exposure)? The I2C clock is 100 kHz, not all that fast when a Teensy 3 runs at 48+ MHz, or a Propeller at 80+ MHz, so this kind of hack may be workable without breaking the actual capture... maybe.