lofi-12xt-firmware/docs/bootloader.md

Bootloader

How the device boots, from power-on to app. Static analysis of the IC300 SPI dump (kept local, never shipped) + TI C6748 public boot docs.

Chain

1. SoC ROM (ARM9) reads boot-mode pins → SPI flash master mode.
2. ROM parses the AIS image at flash 0x0 (magic 0x41504954, TIPA).
3. AIS prelude runs PLL/DDR/EMIF init (opcodes 0x5853590D ×2 at file 0x8/0x1C), so DDR is usable before any load.
4. ROM processes 10× Section Load (0x58535901), copying code/data to 0xC7074630–0xC70B0598 (see table below), then JumpClose (0x58535906, file 0x38660) to entry C70A28A0.
5. Entry is DSP code (C674x reset prelude ZERO b0; mvc b0,ier; mvc b0,csr, stack align) — from here the DSP owns the system; ARM ROM's job is done. No AIS CRC opcodes are present.

AIS section table (file off → DDR, size)

File	DDR	Size	Role
0x000050	C7074630	0x1D0	header/code
0x00022C	C7074800	0x33B00	main code (updater lives here)
0x033D38	C70A8300	0x28CC	rodata (strings, vtables)
…	C70AABD0/C70AABE0/C70AABF0	C/C/D44	small records
…	C70AF000/C70AF4E8/C70AF5EC/C70AF660	200/104/70/F38	tables/tail

Re-split any dump with tools/ais_unpack.py.

What the bootloader contains

• Full C++ application core (libc++, TI CGT): Foundation::SystemUpdater, SystemVerify, BootLoader(Delegate), HAL drivers (N3HAL SPI/I2C/UART/SD), OLED/display stack, crash dumper (Legacy NMI Exception, register dump).
• Updater methods per flash section: updateBootSection, updateMainSection (the SD .bin = SYSTEM), updatePresetSection, updateMCUSection, updateMCUBootSection, all taking CatMetaData::ROMSection.
• Checksum engine: bitwise CRC-32/IEEE at C70A0A60 (NOT init/final in/around the routine ⇒ zlib chaining F(buf,len,init)), 4 KiB-chunk driver at C708E4E4, file check at C709E7C0 (16-byte header CRC seed 0 → chained 0x40000 chunks → CMPEQ vs stored), orchestrated from C708678C. Ghidra decompilations that proved this are described in RE-PROCESS.md §3–4 (project kept local).

Rest of IC300 flash

Past the AIS image: FF to ~0x100000, data to ~0x1EFFFF, FF gap 0x1F–0x4Fxxxx, data 0x500000–0xFC7C17 (app/data sections loaded by the updater; exact section table not yet mapped — open question in FINDINGS.md). IC301 is separate factory content (AILS, pattern names, 24 WAVs).