gd32vw553

my discovery of gd32vw553

New python interactive shell for gd32vw553 supporting read/write Always sync at the begining

plonky@fedora:~/work/test$ ./gd32shell.py /dev/ttyUSB2
[+] Opened /dev/ttyUSB2 at 57600 baud (8E1)
Type 'help' for the list of commands.
boot> sync 
[+] Sync OK
boot> write 0x08000000 led.bin
[*] Firmware led.bin (106 bytes)
    Pages covered : [0] (page size 4096 bytes)
[*] Extended Erase pages [0]
[+] Extended Erase OK on pages: 0x0
    -> Write 0x08000000 len=108
[+] Write completed.
boot> help
Commands:
  sync                      - sync bootloader (0x7F)
  get                       - GET (0x00), list supported commands
  unprotect                 - Program Unprotect (0x73) manually, if needed
  erase page <n>            - Extended Erase page <n> (0x44)
  erase all                 - Extended Erase all pages (0x44 / 0xFFFF)
  write <addr> <file>       - write binary file at addr (erase needed pages + padding)
  read <addr> <len> [file]  - read len bytes and optionally save to file
  go <addr>                 - send GO command to addr (0x21)
  help                      - this message
  quit                      - exit shell
boot> get 
[*] GET (0x00)
    Bootloader version : 0x30
    Supported commands : 0x00 0x11 0x21 0x31 0x44 0x63 0x73 0x82 0x92
boot> erase page 0
[*] Extended Erase pages [0]
[+] Extended Erase OK on pages: 0x0
boot> write 0x08000000 led.bin
[*] Firmware led.bin (106 bytes)
    Pages covered : [0] (page size 4096 bytes)
[*] Extended Erase pages [0]
[+] Extended Erase OK on pages: 0x0
    -> Write 0x08000000 len=108
[+] Write completed.
boot> go 0x08000000
[*] GO 0x08000000
[+] GO sent (MCU should start executing at this address)
boot> quit
[+] Port closed, bye.
plonky@fedora:~/work/test$ 

another session:

plonky@fedora:~/work/test$ ./gd32shell.py /dev/ttyUSB2 921600
[+] Opened /dev/ttyUSB2 at 921600 baud (8E1)
Type 'help' for the list of commands.
boot> sync 
[+] Sync OK
boot> get
[*] GET (0x00)
    Bootloader version : 0x30
    Supported commands : 0x00 0x11 0x21 0x31 0x44 0x63 0x73 0x82 0x92
boot> erase page 0
[*] Extended Erase pages [0]
[+] Extended Erase OK on pages: 0x0
boot> write 0x08000000 led.bin
[*] Firmware led.bin (106 bytes)
    Pages covered : [0] (page size 4096 bytes)
[*] Extended Erase pages [0]
[+] Extended Erase OK on pages: 0x0
    -> Write 0x08000000 len=108
[+] Write completed.
boot> read 0x08000000 106
[*] ReadMemory 0x08000000 len=106
08000000: b7 21 00 80 93 81 a1 86 37 01 01 20 b7 42 02 40
08000010: 93 82 02 80 03 a3 02 03 13 63 43 00 23 a8 62 02
08000020: b7 12 02 40 93 82 02 80 03 a3 02 00 b7 03 00 f4
08000030: fd 13 33 73 73 00 b7 03 00 04 33 63 73 00 23 a0
08000040: 62 00 09 63 b7 03 00 20 23 ac 62 00 15 6e 13 0e
08000050: 0e e2 7d 1e e3 1f 0e fe 23 ac 72 00 15 6e 13 0e
08000060: 0e e2 7d 1e e3 1f 0e fe c5 b7
boot> quit
[+] Port closed, bye.
plonky@fedora:~/work/test$ hexdump led.bin
0000000 21b7 8000 8193 86a1 0137 2001 42b7 4002
0000010 8293 8002 a303 0302 6313 0043 a823 0262
0000020 12b7 4002 8293 8002 a303 0002 03b7 f400
0000030 13fd 7333 0073 03b7 0400 6333 0073 a023
0000040 0062 6309 03b7 2000 ac23 0062 6e15 0e13
0000050 e20e 1e7d 1fe3 fe0e ac23 0072 6e15 0e13
0000060 e20e 1e7d 1fe3 fe0e b7c5               
000006a

you can find a pach for stm32flash (apply path 'git apply' on the master branch).

https://sourceforge.net/p/stm32flash/tickets/178/

Openocd support

I vibe debugged with gemini and #openocd irc channel.

I finally got a file allowing openocd to connect using GD-Link v2 hardware debugger connected to jtag interface of the mcu on the board.

Please note that from Giga Device document, gd32vw553 mcu doesn't support swd (swdio/swclk) protocol. It only supports jtag.

Also the GD-Link v2 is used as cmsis-dap hardware inteface.

On my system, i was not able to make openocd access hidraw device as standard user, i had to use sudo command to elevate privilege.

plonky@fedora:~/work/gd32vw553$ sudo openocd -f interface/cmsis-dap.cfg  -c "adapter speed 4000" -f ./gd32vw55x-3.cfg
Open On-Chip Debugger 0.12.0+dev-04260-g67082829d (2025-11-28-14:04)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
adapter speed: 4000 kHz
Info : Using CMSIS-DAPv2 interface with VID:PID=0x28e9:0x0697, serial=8A7A66850637
Info : CMSIS-DAP: SWD supported
Info : CMSIS-DAP: JTAG supported
Info : CMSIS-DAP: Atomic commands supported
Info : CMSIS-DAP: Test domain timer supported
Info : CMSIS-DAP: FW Version = 0255
Info : CMSIS-DAP: Interface Initialised (JTAG)
Info : SWCLK/TCK = 1 SWDIO/TMS = 1 TDI = 1 TDO = 0 nTRST = 0 nRESET = 1
Info : CMSIS-DAP: Interface ready
Info : clock speed 4000 kHz
Info : cmsis-dap JTAG TLR_RESET
Info : cmsis-dap JTAG TLR_RESET
Info : JTAG tap: gd32vw553.cpu tap/device found: 0x10307a6d (mfg: 0x536 (Nuclei System Technology Co Ltd), part: 0x0307, ver: 0x1)
Info : JTAG tap: auto0.tap tap/device found: 0x790007a3 (mfg: 0x3d1 (GigaDevice Semiconductor (Beijing)), part: 0x9000, ver: 0x7)
Warn : AUTO auto0.tap - use "jtag newtap auto0 tap -irlen 5 -expected-id 0x790007a3"
Info : [gd32vw553.cpu] datacount=4 progbufsize=2
Info : [gd32vw553.cpu] Examined RISC-V core
Info : [gd32vw553.cpu]  XLEN=32, misa=0x4010912f
[gd32vw553.cpu] Target successfully examined.
Info : [gd32vw553.cpu] Examination succeed
Info : [gd32vw553.cpu] starting gdb server on 3333
Info : Listening on port 3333 for gdb connections
gd32vw553.cpu halted due to undefined.
Info : Listening on port 6666 for tcl connections
Info : Listening on port 4444 for telnet connections
Info : accepting 'gdb' connection on tcp/3333
gd32vw553.cpu halted due to undefined.
undefined debug reason 8 (UNDEFINED) - target needs reset
Warn : Prefer GDB command "target extended-remote :3333" instead of "target remote :3333"
Info : [gd32vw553.cpu] Found 8 triggers

Please also note that flash module is not yet supported with openocd, so it seems not possible to flash binaries through JTAG.

Here is a gdb session on led.bin

plonky@fedora:~/work/gd32vw553$ riscv32-unknown-elf-gdb
GNU gdb (GDB) 16.3
Copyright (C) 2024 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "--host=x86_64-pc-linux-gnu --target=riscv32-unknown-elf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word".
(gdb) set architecture riscv:rv32 
The target architecture is set to "riscv:rv32".
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
Remote connection closed
(gdb) target remote localhost:3333
Remote debugging using localhost:3333
warning: No executable has been specified and target does not support
determining executable automatically.  Try using the "file" command.
0x08000052 in ?? ()
(gdb) n
Cannot find bounds of current function
(gdb) n
Cannot find bounds of current function
(gdb) set architecture riscv:rv32
The target architecture is set to "riscv:rv32".
(gdb) set load-image-address 0x08000000
No symbol table is loaded.  Use the "file" command.
(gdb) restore led.bin binary
Restoring binary file led.bin into memory (0x0 to 0x6a)
(gdb) n
Cannot find bounds of current function
(gdb) p
The history is empty.
(gdb) r
The "remote" target does not support "run".  Try "help target" or "continue".
(gdb) re
record              remote              remove-symbol-file  return              reverse-finish      reverse-nexti       reverse-step        
refresh             remove-inferiors    restore             reverse-continue    reverse-next        reverse-search      reverse-stepi       
(gdb) print
print         print-object  printf        
(gdb) show re
record             remote             remoteaddresssize  remotecache        remoteflow         remotelogbase      remotelogfile      remotetimeout      remotewritesize
(gdb) show re
record             remote             remoteaddresssize  remotecache        remoteflow         remotelogbase      remotelogfile      remotetimeout      remotewritesize
(gdb) re
record              remote              remove-symbol-file  return              reverse-finish      reverse-nexti       reverse-step        
refresh             remove-inferiors    restore             reverse-continue    reverse-next        reverse-search      reverse-stepi       
(gdb) re
record              remote              remove-symbol-file  return              reverse-finish      reverse-nexti       reverse-step        
refresh             remove-inferiors    restore             reverse-continue    reverse-next        reverse-search      reverse-stepi       
(gdb) p
The history is empty.
(gdb) n
Cannot find bounds of current function
(gdb) run
The "remote" target does not support "run".  Try "help target" or "continue".
(gdb) help target
Connect to a target machine or process.
The first argument is the type or protocol of the target machine.
Remaining arguments are interpreted by the target protocol.  For more
information on the arguments for a particular protocol, type
`help target ' followed by the protocol name.

List of target subcommands:

target core -- Use a core file as a target.
target exec -- Use an executable file as a target.
target extended-remote -- Use a remote computer via a serial line, using a gdb-specific protocol.
target record-btrace -- Collect control-flow trace and provide the execution history.
target record-core -- Log program while executing and replay execution from log.
target record-full -- Log program while executing and replay execution from log.
target remote -- Use a remote computer via a serial line, using a gdb-specific protocol.
target sim -- Use the compiled-in simulator.
target tfile -- Use a trace file as a target.

Type "help target" followed by target subcommand name for full documentation.
Type "apropos word" to search for commands related to "word".
Type "apropos -v word" for full documentation of commands related to "word".
Command name abbreviations are allowed if unambiguous.
(gdb) info re
record     registers  
(gdb) info re
record     registers  
(gdb) info registers 
ra             0x0	0x0
sp             0x20010000	0x20010000
gp             0x8000186a	0x8000186a
tp             0x0	0x0
t0             0x40020800	1073874944
t1             0x2000	8192
t2             0x20000000	536870912
fp             0x0	0x0
s1             0x0	0
a0             0x0	0
a1             0x0	0
a2             0x0	0
a3             0x0	0
a4             0x0	0
a5             0x0	0
a6             0x0	0
a7             0x0	0
s2             0x0	0
s3             0x0	0
s4             0x0	0
s5             0x0	0
s6             0x0	0
s7             0x0	0
s8             0x0	0
s9             0x0	0
s10            0x0	0
s11            0x0	0
t3             0x2e08	11784
t4             0x0	0
t5             0x0	0
t6             0x0	0
pc             0x8000052	0x8000052
(gdb) info register mstatus
mstatus        0x1800	SD:0 VM:00 MXR:0 PUM:0 MPRV:0 XS:0 FS:0 MPP:3 HPP:0 SPP:0 MPIE:0 HPIE:0 SPIE:0 UPIE:0 MIE:0 HIE:0 SIE:0 UIE:0
(gdb) info register mepc
mepc           0x0	0
(gdb) si
[gd32vw553.cpu] Found 8 triggers
0x08000054 in ?? ()
(gdb) info registers 
ra             0x0	0x0
sp             0x20010000	0x20010000
gp             0x8000186a	0x8000186a
tp             0x0	0x0
t0             0x40020800	1073874944
t1             0x2000	8192
t2             0x20000000	536870912
fp             0x0	0x0
s1             0x0	0
a0             0x0	0
a1             0x0	0
a2             0x0	0
a3             0x0	0
a4             0x0	0
a5             0x0	0
a6             0x0	0
a7             0x0	0
s2             0x0	0
s3             0x0	0
s4             0x0	0
s5             0x0	0
s6             0x0	0
s7             0x0	0
s8             0x0	0
s9             0x0	0
s10            0x0	0
s11            0x0	0
t3             0x2e07	11783
t4             0x0	0
t5             0x0	0
t6             0x0	0
pc             0x8000054	0x8000054
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) si
0x08000052 in ?? ()
(gdb) x/1i $pc
=> 0x8000052:	addi	t3,t3,-1
(gdb) x/1i $pc
=> 0x8000052:	addi	t3,t3,-1
(gdb) si
0x08000054 in ?? ()
(gdb) si
0x08000052 in ?? ()
(gdb) si
0x08000054 in ?? ()
(gdb) si
0x08000052 in ?? ()
(gdb) x/1i $pc
=> 0x8000052:	addi	t3,t3,-1
(gdb) si
0x08000054 in ?? ()
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) set $t3 = 0x0
(gdb) p $t3
$1 = 0
(gdb) x/1i $pc
=> 0x8000054:	bnez	t3,0x8000052
(gdb) si
0x08000058 in ?? ()
(gdb) x/1i $pc
=> 0x8000058:	sw	t2,24(t0)
(gdb) si
0x0800005c in ?? ()
(gdb) si
0x0800005e in ?? ()
(gdb) si
0x08000062 in ?? ()
(gdb) p $t3
$2 = 20000
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x08000052 in ?? ()
(gdb) p $t3
$3 = 369
(gdb) set $t3 = 0x0
(gdb) si
0x08000054 in ?? ()
(gdb) si
0x08000052 in ?? ()
(gdb) si
0x08000054 in ?? ()
(gdb) si
0x08000052 in ?? ()
(gdb) si
0x08000054 in ?? ()
(gdb) p $t3
$4 = -3
(gdb) p $t3
$5 = -3
(gdb) p $t3
$6 = -3
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x08000052 in ?? ()
(gdb) info register
ra             0x0	0x0
sp             0x20010000	0x20010000
gp             0x8000186a	0x8000186a
tp             0x0	0x0
t0             0x40020800	1073874944
t1             0x2000	8192
t2             0x20000000	536870912
fp             0x0	0x0
s1             0x0	0
a0             0x0	0
a1             0x0	0
a2             0x0	0
a3             0x0	0
a4             0x0	0
a5             0x0	0
a6             0x0	0
a7             0x0	0
s2             0x0	0
s3             0x0	0
s4             0x0	0
s5             0x0	0
s6             0x0	0
s7             0x0	0
s8             0x0	0
s9             0x0	0
s10            0x0	0
s11            0x0	0
t3             0xfff9a1b8	-417352
t4             0x0	0
t5             0x0	0
t6             0x0	0
pc             0x8000052	0x8000052
(gdb) set $t3 = 0x1
(gdb) p
$7 = -3
(gdb) p $t3
$8 = 1
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x08000062 in ?? ()
(gdb) x/4xw 0x40000000
0x40000000:	0x00000000	0x00000000	0x00000000	0x00000000
(gdb)