John - I like the idea of using the byte array to store the bytes read from the device. I will have to try that.
I got my Bus Pirate set up with Open Logic Sniffer and did some testing for this project after some learning time with that hardware and software. It's no fancy high-speed logic analyzer, but it's pretty cool for what I paid for the Bus Pirate years ago and open-source software.
The Bus Pirate can sample at 1 MHz, so I throttled the SPI in sketch down to 125 kHz.
First capture is sending a header byte of 1 0 0 0 0 0 0 0 (128 in decimal or 0x80 in hex). Bit breakdown is as follows:
b7: 1 = read
b6: 0 = single access
b5:0: address of 0x00 (IOCFG2 register for configuration of GDO2 pin)
In the capture below, you can see MOSI is high during the rising edge of the first clock cycle and then low for the remaining 7 rising edges of the clock, so it's sending that byte correctly.
I purposely held CS low for another byte's worth of time (using the delayMicroseconds() function in my sketch) to see if it would return a second byte, but it appears that the MISO line staying low after the first byte is merely it reverting to its low-state behavior described in the last paragraph of page 29 of the datasheet. Also, there's no clock signal after the first byte, so that would indicate no data being sent.
The MISO line appears to have sent the following chip status byte back (looking at the states of MISO at the rising edge of the clock cycles): 0 1 1 0 1 1 1 1. Per table 23 on page 31 of the datasheet, that would mean:
b7: 0 = chip ready
b6:4: 110 = Rx FIFO overflow (believable, as I've run some generic receiver code on this CC1101 module previously)
b3:0: 1111 = number of bytes available for reading in the RX FIFO
FIFOs are 64-byte, so I guess 1111 means it could be anywhere between 15 and 64 bytes.
I also tried sending two bytes of 0x80 back to back to see what would happen (thinking maybe the second byte would keep the SPI clock going so it could send back the data read byte for the register address queried).
Good news: got two clock cycles. Possibly inconclusive news: I either got two bytes back or MISO just stayed low as chip ready during the first byte.
Let's assume the first case. Chip status byte would be 0 0 0 0 0 0 0 0, which would mean chip ready, idle state, and 0 bytes in Rx FIFO. Data byte (with first rising edge of clock just after -1930 µs) would be 0 0 1 0 1 0 0 1, which would mean GDO2 output not invertered and GDO2 configured to 1 0 1 0 0 1 (0x29). See datasheet pages 71 and 62. 0x29 is the default config for this register, as a chip ready signal.
I'll have to see what other addresses I can read that may yield some more conclusive results in order to see if my method of sending the same byte twice is a reasonable way to keep the SPI comm going for receiving a second byte back from the device.