Pro L RGB Support

[hansemro]

HW info:

• Holtek HT32F1654 (Cortex-M3)
• MXIC 25L4006E 4Mbit SPI Flash
• 3x Macroblock MBI5042GP LED Driver (1 per channel)

Tasks:

• [ ] Add photos
• [ ] Add schematic
• [ ] Write firmware patch
  • [x] Find FW offset: 0x3400
• [x] Patch pok3rtool: https://github.com/hansemro/pok3rtool/commits/cooler-master-dev
  • [x] Add Pro L RGB VID/PID/IPID
    • [x] firmware mode : 2516:003b
    • [x] bootloader mode : 2516:003a
    • [x] CM protocol
• [ ] Working firmware patch
• [x] Dump firmware (1.2.2): https://github.com/hansemro/pok3r_re_firmware/tree/cmprolrgb/disassemble/cmprolrgb/v122
  • [ ] Annotate FW
• [x] Dump bootloader @ 0x0: https://github.com/hansemro/pok3r_re_firmware/tree/cmprolrgb/disassemble/cmprolrgb/builtin
  • [ ] Annotate
• [ ] Dump SPI flash
• [ ] QMK port: https://github.com/hansemro/qmk_firmware/commits/prolrgb_mbi5042_dev
  • [x] working key matrix
  • [x] nKey Rollover
  • [x] working USB
  • [x] Hold Esc while plugging in usb to reboot to bootloader
  • [x] FN+Esc to reboot to bootloader
  • [x] MBI5042 RGB matrix driver
    • [x] init
    • [x] LED matrix
  • [x] SPI flash driver (requires https://github.com/hansemro/ChibiOS-Contrib/commits/ht32-spi-tx-wc-fix)

[hansemro]

ISP info:

$ ./pok3rtool -t isp info --ok
Opened Holtek ISP USB
0000  54160001 00000004 3f003f00 ffffffff fcffffff ffffffff ffffffff ffffffff | T.......?.?.....................
0020  f9efffff ffffffff ffffffff ffffffff ffffffff 08910000 ffffffff ffffffff | ................................
ISP version: v100
model: HT32F1654
page size in bytes: 1024
flash size in bytes: 64512
flash security: true
option byte protection: true
flash page protection: fffff000 ffffffff ffffffff ffffffff
status: 2
true

Also has vulnerable ISP.

[hansemro]

QMK with MBI5042 RGB matrix driver:

[hansemro]

Pro L RGB and Pro L White share the same key and LED matrices, so I had an easier time porting QMK.

[hansemro]

Interestingly Pro L RGB's IAP bootloader does not allow read command even for checking application firmware version. I will update my fork of pok3rtool soon to workaround this quirk.

[hansemro]

Experimental pok3rtool fork that uses checkFlash command for validation (instead of readFlash): https://github.com/hansemro/pok3rtool/commits/cmprolrgb-test

• This fork works for both Pro L RGB and Pro S RGB.
• Relies on GET_REPORT control transfer support to check whether the checkFlash command(s) passed or failed.