# Hardware

Static facts about the Lofi-12 XT hardware (own teardown + photos in
`photos/`). Behavioral/firmware side: `../FINDINGS.md`, `bootloader.md`.

## Boards

| PCB | Role |
|---|---|
| `405-VTOR-3852` | I/O board (jacks, MIDI, relays `HFD4/5`, USB-C area) |
| `405-VTOR-3849B` | Main board (`28-AUG-2023` rev on unit): SD slot, MCU, power, FFC to UI |
| `405-VTOR-3853` | Jack sub-board (`2/JUN/2022`) |
| core module (unmarked) | Compute: SoC + DDR + 2× SPI flash, board-to-board `CN200A/CN201A/CN203A/CN203B` |

## Chips (all confirmed visually)

- **TI TMS320C6748** (`TMS320 C6748EZW T / 13CP99W`) — main SoC, ARM9 + C674x DSP.
- **EtronTech EM68C16CWQG-25H** (`B07DY15MSYA0051`) — 1 Gbit DDR2.
- **2× Macronix MX25L12833F** (`MXIC MX 25L12833F M2I-10G`), 16 MiB SPI NOR each,
  silkscreen `IC300` (boot+app) / `IC301` (data). Factory stickers cover the
  marking (`C047`/`C949`-style labels) — peel + photograph before any clip work.
- **ARTERY AT32F421K8T** — USB/aux MCU, separate firmware (strings reference
  `updateMCUSection`/`updateMCUBootSection`; protocol not reversed).

## Memory map (DDR2, base `0xC0000000`, 128 MB)

| Region | Use |
|---|---|
| `0xC2xxxxxx` | SD `.bin` application image (v1.5: code `C2B80C00`, strings `C2D84DE0`) |
| `0xC7074630–C70B0598` | SPI AIS bootloader image, entry `C70A28A0` |
| `0xC706F280` | Updater constant (file/scratch buffer area) |
| `0xC27C6282` | Updater DDR scratch; value reused as checksum seed |

## Rails / probing

- Flash `VCC` measures 3.3 V in-circuit — never apply 5 V (see `RE-PROCESS.md` §1).
- Jack board silkscreen: `A+7.5V / AGND / A-7.5V` analog rails, `DSU`/`AGNC`.
- Main-board silkscreen tables name `UART1_RX1/TX1`, `SPI1_SCK/MOSI`, `SD_*`,
  `USB_DP/DN`, key matrix (`KS1–KS6`, `EN_1A–5B`), `TP1–TP5` — candidates for
  UART/JTAG mapping (continuity not yet traced; see `uart-zoom.jpg`).

## Photos

![Core module: TMS320C6748 + DDR2 + IC300/IC301](photos/core-module-top.jpg)
*Core module — SoC, DDR2 and both SPI flashes (bottom edge).*

![IC300 (left) + IC301 (right), stickers removed](photos/ic300-ic301-closeup.jpg)
*Both are Macronix MX25L12833F, 16 MiB. Pin-1 dots face down-left; note the
`IC300`/`IC301` silkscreen between the packages.*

![UART area](photos/uart-zoom.jpg)
*Close-up of the UART test-point area (unannotated).*