Telechips Info

---

Introduction

This page describes the ARM-based range of Telechips SoCs, including TCC76x and TCC77x, which are used in many DAPs, including those listed in the following table (sorted on the CPU number). A data sheet for the TCC76x can be found here.

More DAPs are listed here - http://forum.mp3store.pl/index.php?showtopic=14695&mode=threaded (much of the data for the list above comes from that page)

---

Telechip Versions

There exists a set of different Telechips versions. Here's a summary table of their names and what they do:

Name	Description
TCC720	ARM940TDMI? CPU core 96MHz, 64K SRAM
TCC721	like TCC720 + LCD controller
TCC73x	16bit RISC[*] core 80 MHz + DSP + encoders/decoders
TCC760	ARM940T? CPU core 168 MHz, 64K SRAM
TCC761	like TCC760 + LCD controller
TCC763	like TCC760 + codec + 512KB nor flash
TCC764	like TCC760 + codec + 1MB nor flash
TCC766	like TCC760 + codec + 1MB nor flash + USB 2
TCC767	like TCC760 + 1MB nor flash + USB 2
TCC768	like TCC760 (but 140MHz) + codec + 512KB nor flash + 2 MB SDRAM
TCC770	ARM946E?-S CPU core 120MHz, 64K SRAM
TCC771	like TCC770 + codec
TCC772S?	like TCC770 + 2MB SDRAM
TCC773	like TCC770 + codec + 2MB SDRAM
TCC774	like TCC770 + codec + 1MB NOR flash
TCC7801	dual core ARM926EJ?-S + ARM946ES? 200MHz, 96K SRAM, video hardware accel
TCC820x	ARM946E?-S CPU core 200MHz, 64K SRAM + 2/4/8 MB SDRAM + graphics accel

[*] = This appears to be what is sometimes referred to as CalmRISC16

A very nice chart of all the models can be found here.

---

Firmware format

The firmware upgrade files for all these devices look very similar, and the creation of them is supported by the "scramble" tool available in the tools/ subdirectory of the Rockbox source code.

There are two slightly different firmware formats, which are described here as "simple checksum" and "dual CRCs".

"Simple checksum" firmware format

The first 32 bytes of the firmware file (the usual location of the ARM exception vectors) contain a branch instruction to the entry point in the firmware (when loaded to SDRAM at 0x20000000) followed by 28 bytes of header information as follows (all integers are little-endian):

Offset	Length	Contents
0x0	4	ARM branch instruction - e.g. ldr pc, [pc, #320], where [pc, #320] typically contains 0x70000018
0x4	2	MAGIC - 0x0106
0x6	2	MAGIC - 0xffff
0x8	8	Version string - typically "Ver:0071"
0x10	4	Checksum
0x14	4	Always contains 0x00000000

The firmware itself typically starts at offset 0x18.

For information on how to calculate the checksum, see the function telechips_encode_sum() in tools/telechips.c

"Dual CRCs" firmware format

The first 32 bytes of the firmware file (the usual location of the ARM exception vectors) contain a branch instruction to the entry point in the firmware (when loaded to SDRAM at 0x20000000) followed by 28 bytes of header information as follows (all integers are little-endian):

Offset	Length	Contents
0x0	4	ARM branch instruction - e.g. ldr pc, [pc, #320], where [pc, #320] typically contains 0x20000020 or 0x20000060
0x4	2	MAGIC - 0x0106
0x6	2	MAGIC - 0xffff
0x8	8	Version string - typically "Ver:0071"
0x10	4	32-bit CRC
0x14	4	Always contains 0x00000000
0x18	4	32-bit CRC
0x1c	4	Total length of firmware file in bytes, including these 32 bytes

The firmware itself typically starts at either 0x20 or 0x60. For the firmwares where it starts at 0x60, the bytes between the header and 0x60 are filled with zeros.

For information on how to calculate the CRCs, see the function telechips_encode_crc() in tools/telechips.c

---

NAND Flash Information

Some information about the low-level NAND format used by Telechips devices can be found at TelechipsNAND.

---