Reverse-Engineering SWIO: Why Existing CH32V003 Programmers Fail and How I Built One That Works

A journalist sought to determine whether an ESP32-S3 could serve as a programmer for the WCH CH32V003, as opposed to relying on a specialized WCH-Link device. The final configuration connected the PC to the ESP32-S3, which then communicated with the SWIO interface and ultimately connected to the CH32V003 debug/DMI module. The ESP32-S3 controlled the timing-critical SWIO communication and managed the CH32 debug/DMI interface.

The system incorporated target detection, memory access, flash unlock, page erase, programming, read-back verification, and reset/run operations.

A hardware setup included an ESP32-S3 N8R2, a CH32V003A4M6 (SOP-16) chip, a 4.7kΩ–10kΩ SWIO pull-up resistor, a CP6208 motor driver, a small DC motor, and a 3.7V Li-ion battery. The essential connections involved linking the ESP32-S3 GPIO10 to the CH32V003 SWIO, and the ESP32-S3 3.3V to the CH32V003 VDD. A common ground was established between the two components. Additionally, an external pull-up was placed on the SWIO line, and PC4 of the CH32V003 was connected to the CP6208 motor driver control input.

The software architecture consisted of several layers, starting with the programmer's text interface. The programmer was divided into several layers: a Python host tool, an ESP32-S3, SWIO, WCH DMI, and finally the CH32V003 debug module. The ESP32-S3 handled the SWIO timing directly, eliminating the need for a separate programmer IC.

Open-source CH32V003 and SWIO implementations were utilized as references during development. The initial attempts to establish a reliable SWIO connection were unsuccessful, with one notable error being the failed DMCFGR = 0xFFFFFFFF setting.