Panasonic KX-TG6861

con PP:

- DSPG chipset

pro PP:

- SPI flash should be read and writable easily

- cheap, 25€ at store, FP with PP

- ARM926

- JTAG pins exposed (and labelled)

pro FP:

- dialog SC14441

con FP:

Pins

    GND  -5.5V
    URX  UTX

UART seems to be 1V8, 19200 baud, at boot prints



OK1



pressing ?<CR> responds with There is no help

every upper and lower case single char followed by <CR> prints command unknown

might be incomplete/too long found by brute forcing three-char commands

ada
adc - start ADC0 and ADC1 sampling, and print to uart
adj
ads
akt - no params - OK
ant - allows 0, 1, 2, 3 as param - antenna?
aud
bel
bof
bom
bon - allows 0, 1, 2 as param
btc
bts
btx
buz
cbc
cgs - no params - OK
cid - no params - 0000
cli
cps
crx
cwc - no params - FFFF
dbm
dmv
dto
ecb - FF
ecc
ecw - FFFF
epc - DD
epd
epf
epr
eps
epv - 5B9C or 2CCE
epw
esc
fer - 00
fld
fle
flr
fls - NAK
gtl - 0000
hok
hrl
hsl
idr - FF FF FF FF FF
idw
key
lcd - '  This command is not prepared'
led - '  This command is not prepared'
lim
lnv - 00
lpr - 00
mgr - FF
mgw
mic - FFFF
mip - FFFF
mmn
moc
mss
mtx
ner
new
odb - OK
odh - OK
odl - OK
pal - OK
pan - OK
pap - FFFF
pdl
per - 00
pew - OK
pid - prints "1: 2: 3: 4: 5: 6: " with newlines otherwise empty
ply - prints "PLAY Start" with params 0, 1
rcd - OK
rci
rec - prints "REC Start" with params 0, 1
red
reg
rfa - OK
rfb - print/choose region "EU 0-4ch\n<Usage>RFB 0:EU\n1:US\n2:EU 0-4ch\n3:3ch Shift(Japan) for TEL\n4:4ch\nShift(Japan) for TEL\n5:LA\n6:LB\n7:Taiwan\n8:JP\n9:JP 0-4,9ch"
rfd - OK
rfq - OK
rfr - FF FF FF FF FF
rft
rfw
rgs - FFFFFFFF
rio
rss - 00 00
rst - RESET the device
rwd
scr
sdh - 1FC8
sdl - 15BC
sfr - 0270
sgr - FF
sgw
slf - 08B4 - takes a second or so
smr
sms
srl
stp - prints "STOP"
tdt - 0
tpc
trc
tst
vac
vda
vdd - 08
ver - print version "DG41EC 14.02"
vfw
vpd - NAK
vpe - ACK
vpi
vpl
vrd
vrg
vrm
vse
vwt
wcr
wgs
wrt
wwd

- IC501: dialog SC14441

- IC601: P25Q16L 1.8V single/dual/quad SPI flash 16MBit

- IC502: 25Q16JWSIM winbond 1.8V dual/quad SPI flash 16MBit

- IC902: PH408A 8bit GPIO expander I2C

strange, why two SPI flashes of same size from different vendors?

- audio

1. bottom mic THT
2. speaker w/ soldered wires, blu top, red bot
3. earpiece speaker: spring contact, falls apart/disconnected with case open

- RF

1. under metal can, arrow towards bot
2. DSP group
3. DCX81ACPCFAE4FNC
4. © (M) 2010 DSPG
5. 88 pin
6. 

- PCB

1. IC2 SOIC8
   1. winbond
   2. 25Q80EWSIG
   3. 8Mbit NOR flash, SPI (dual/quad) or QPI
   4. 1MByte
   5. 1.8V
   6. 
2. IC3 SOIC8
   1. ST 24C32FP
   2. 32Kbit I2C EEPROM
   3. 4kBytes
   4. 
3. labelled pads, left, under ant, from top to bottom
   1. GND_J
   2. TDO
   3. TDI
   4. TCK
   5. TMS
   6. CKM
   7. VDDC = 1.16V
   8. CP3V = 3.05V

1. labelled pads, right
   1. 1.8V = 1.82V
   2. CP4V = 2.95V

- voltages

1. JTAG
   1. VDDC = 1.16V
   2. CP3V = 3.05V
2. IC2 flash
   1. 1.8V
3. IC3 EEPROM
   1. 3.0V