Panasonic KX-TG6861

con PP:

• DSPG chipset

pro PP:

• SPI flash should be read and writable easily

• cheap, 25€ at store, FP with PP

• ARM926

• JTAG pins exposed (and labelled)

pro FP:

• dialog SC14441

con FP:

FP: KX-TG6861GB

Pins

• GND -5.5V
• URX UTX

UART seems to be 1V8, 19200 baud, at boot prints

''\ \ OK1\ \ ''

pressing ''?'' responds with ''There is no help''

every upper and lower case single char followed by '''' prints ''command unknown''

UART commands

might be incomplete/too long found by brute forcing three-char commands

ada
adc - start ADC0 and ADC1 sampling, and print to uart
adj
ads
akt - no params - OK
ant - allows 0, 1, 2, 3 as param - antenna?
aud
bel
bof
bom
bon - allows 0, 1, 2 as param
btc
bts
btx
buz
cbc
cgs - no params - OK
cid - no params - 0000
cli
cps
crx
cwc - no params - FFFF
dbm
dmv
dto
ecb - FF
ecc
ecw - FFFF
epc - DD
epd
epf
epr
eps
epv - 5B9C or 2CCE
epw
esc
fer - 00
fld
fle
flr
fls - NAK
gtl - 0000
hok
hrl
hsl
idr - FF FF FF FF FF
idw
key
lcd - '  This command is not prepared'
led - '  This command is not prepared'
lim
lnv - 00
lpr - 00
mgr - FF
mgw
mic - FFFF
mip - FFFF
mmn
moc
mss
mtx
ner
new
odb - OK
odh - OK
odl - OK
pal - OK
pan - OK
pap - FFFF
pdl
per - 00
pew - OK
pid - prints "1: 2: 3: 4: 5: 6: " with newlines otherwise empty
ply - prints "PLAY Start" with params 0, 1
rcd - OK
rci
rec - prints "REC Start" with params 0, 1
red
reg
rfa - OK
rfb - print/choose region "EU 0-4ch\n<Usage>RFB 0:EU\n1:US\n2:EU 0-4ch\n3:3ch Shift(Japan) for TEL\n4:4ch\nShift(Japan) for TEL\n5:LA\n6:LB\n7:Taiwan\n8:JP\n9:JP 0-4,9ch"
rfd - OK
rfq - OK
rfr - FF FF FF FF FF
rft
rfw
rgs - FFFFFFFF
rio
rss - 00 00
rst - RESET the device
rwd
scr
sdh - 1FC8
sdl - 15BC
sfr - 0270
sgr - FF
sgw
slf - 08B4 - takes a second or so
smr
sms
srl
stp - prints "STOP"
tdt - 0
tpc
trc
tst
vac
vda
vdd - 08
ver - print version "DG41EC 14.02"
vfw
vpd - NAK
vpe - ACK
vpi
vpl
vrd
vrg
vrm
vse
vwt
wcr
wgs
wrt
wwd

chipset

• IC501: dialog SC14441

• IC601: P25Q16L 1.8V single/dual/quad SPI flash 16MBit

• IC502: 25Q16JWSIM winbond 1.8V dual/quad SPI flash 16MBit

• IC902: PH408A 8bit GPIO expander I2C

strange, why two SPI flashes of same size from different vendors?

PP: KX-TGA685EX

• audio
  • bottom mic THT
  • speaker w/ soldered wires, blu top, red bot
  • earpiece speaker: spring contact, falls apart/disconnected with case open
• RF
  • under metal can, arrow towards bot
  • DSP group
  • DCX81ACPCFAE4FNC
  • (c) (M) 2010 DSPG
  • 88 pin
• PCB
  • IC2 SOIC8
    • winbond
    • 25Q80EWSIG
    • 8Mbit NOR flash, SPI (dual/quad) or QPI
    • 1MByte
    • 1.8V
  • IC3 SOIC8
    • ST 24C32FP
    • 32Kbit I2C EEPROM
    • 4kBytes
  • labelled pads, left, under ant, from top to bottom
    • GND_J
    • TDO
    • TDI
    • TCK
    • TMS
    • CKM
    • VDDC = 1.16V
    • CP3V = 3.05V
  • labelled pads, right
    • 1.8V = 1.82V
    • CP4V = 2.95V
• voltages
  • JTAG
    • VDDC = 1.16V
    • CP3V = 3.05V
  • IC2 flash
    • 1.8V
  • IC3 EEPROM
    • 3.0V

Pictures