hoverboard-at32f413-firmware

This repo is based on Niklas Fauths Hoverboard Hack Firmware and the modified version for AT32F403RCT6 by cloidnerux.

As the manufacturers of hoverboards try to produce as cheap as possible the mainboards change from time to time and the used components change. This means that for probably every new mainboard a new modification of the custom-firmware needs to be made. This repo tries to do this for mainboards labeled YST-DXT-J20 V5.1 based on the AT32F413RCT7 MCU by Artery.

THIS FIRMWARE IS WORK IN PROGRESS AND WILL PROBABLY BREAK YOUR BOARD

once there is a working version it will be released on github

Hardware Documentation

Information on the AT32F413 (mostly in chinese)

• Datasheet
• Artery Microcontroller Selection Guide (for comparison)
• AT32F413 product overview (you can find libraries and other informations here)

Differences to AT32F403RCT6 from YST-DXT-J20 V4

Specs

MCU	Freq (MHz)	Flash(KB)	SRAM(KB)	I/O	Advanced TM(16bit)	GPTM(32bit)	GPTM(16bit)	Basic TM(16bit)	Systick(24bit)	IWDG	WWDG	RTC	I2C	SPI	I2S	USART/UART	SDIO	USB Device	CAN	ADC engine	12bit ADC channel	DAC engine	12bit DAC channel	XMC	SPIM	Package
AT32F413RCT7	200	256	32/16/64	55	2	2	5	0	1	1	1	1	2	2	2	3+2	1	1	2	2	16	0	0	0	1	LQFP64
AT32F403RCT6	200	256	96/224	51	2	2	8	2	1	1	1	1	3	3	3	3+2	2	1	1	3	16	2	2	0	1	LQFP64

Pinout

Pin number	AT32F413RCT7	AT32F403RTC6	Difference	Functions
64	VDD	VDD_3	Name changed
63	VSS	VSS_3	Name changed
48	PF7	VDD_2	I/O Pin instead of Voltage	I2C1_SCL/I2C2_SCL
47	PF6	VSS_2	I/O Pin instead of Voltage	I2C1_SDA/I2C2_SDA
32	VDD	VDD_1	Name changed
31	VSS	VSS_1	Name changed
19	PF5	VDD_4	I/O Pin instead of Voltage	UART4_RX/TMR5_CH2
18	PF4	VSS_4	I/O Pin instead of Voltage	UART4_TX/TMR5_CH1

Main differences

• Less SRAM (64KB instead of 224KB)
• 4 new I/O pins (probably not accesable on the mainboard)
• Less 16bit Timers
• Less I2C, SPI, I2S (2 instead of 3)
• only one SDIO
• one more CAN (probably not accesable on the mainboard)
• lost one ADC engine (2 left)
• completely lost DAC functionality

Memory addresses

The descriptions are translated with ab online translator, so the might be inaccurate.

Code

Start	End	Used for
0x00000000	0x00017FFF	Align flash memory or system memory according to BOOT pin settings
0x00018000	0x07ffffff	reserved
0x08000000	0x0803ffff	Internal flash memory block 1 (Bank 1)
0x08040000	0x083fffff	reserved
0x08400000	0x093fffff	External SPI Flash Memory Block 3 (Bank 3)
0x09400000	0x1fffafff	reserved
0x1fffb000	0x1fffefff	system memory
0x1ffff000	0x1ffff7ff	reserved
0x1ffff800	0x1ffff82f	Select byte
0x1ffff830	0x1fffffff	reserved

SRAM

Start	End	Used for
0x20000000	0x20007fff	SRAM
0x20008000	0x21ffffff	reserved
0x22000000	0x220fffff	Bit bound mapping region of SRAM
0x22100000	0x3fffffff	reserved

peripherals

Start	End	Used for
0x40000000	0x400237ff	peripherals
0x40023800	0x41ffffff	reserved
0x42000000	0x4246ffff	Bit-binding mapping area for peripherals
0x42470000	0x5fffffff	reserved

reserved

Start	End
0x60000000	0xdfffffff

Cortex-M4F internal peripherals

Start	End
0xe0000000	0xffffffff

Build Instructions

There is nothing to build yet.

Flashing Instructions

Required hardware

• ST-Link v2
• 5 female-female Jumper-Wires
• 4 Solder pins

Preparation

Connect the board to your computer

• solder the pins on the board
• connect the ST-Link to the new pins on the board
• remove the cable of the powerbutton
• connect the powerbutton-pins with a jumperwire

Modify openocd to support the AT32F413

• clone the openocd repo
• find switch (device_id & 0xfff) in src/flash/nor/stm32f1x.c, it's propably around line 715
• add the following case

case 0x240: /* at32f413rc*/
    LOG_WARNING("Found 0x700 for AT32F413");
    page_size = 2048;
    stm32x_info->ppage_size = 2;
    max_flash_size_in_kb = 256;
    break;

• run ./bootstrap
• run ./configure
• run make
• run sudo make install

Unlock the at32f413

run openocd -f interface/stlink.cfg -f target/stm32f3x.cfg -c init -c "reset halt" -c stm32f1x unlock 0"

Debugging

• openocd -f interface/stlink.cfg -f target/stm32f3x.cfg -c init -c "reset halt"
• launch arm-none-eabi-gdb and run target remote localhost:3333

Flashing custom firmware

not yet