Exercising the i.MX Serial Download Protocol with a Python Script

Document created by grantw on Sep 1, 2012Last modified by Jozef Maslik on Nov 5, 2014
Version 5Show Document
  • View in full screen mode

That Python script exercises the i.MX serial download protocol in UART mode. It can be used with i.MX21/27/25/31/35/51/53, since they are based on the same protocol.


The details on the protocol can be found in the "System Boot" section of the used i.MX reference manual.


- Python 2.7 (not tested with other version)

- Pyserial modules (http://pyserial.sourceforge.net)


The i.MX must boot in serial mode with a serial cable connected to a host running the script.

The COM1 is configured in 115200 - no parity - 1 stop bit - 8-bit. If another COM is used, you will have to make the appropriate changes in the script.

That script uses only hexa formatted address and data for the command parameters.


The following command returns the HAB status whenever it is used, so it helps to check that the setup is functional. Eventually, when some code was downloaded, this command triggers its execution. The returned value is only useful when doing a secure boot, and does not matter otherwise.

By default, it returns in hexa format the following:

> iMX_Serial_Download_Protocol.py get_status

Status is:

F0 F0 F0 F0


Typical usage to download and execute some code:


1. Ensure that the protocol is ready:

> iMX_Serial_Download_Protocol.py get_status


2. Configure the memories and other things like I/O, such does the DCD:

> iMX_Serial_Download_Protocol.py write_mem memory_address access_size data

As this configures only one register at a time, it is necessary to call it several times to configure like a SDRAM.

Of course, feel free to enhance that script by adding like a load from file memory write :-)


3. Download the executable binary:

> iMX_Serial_Download_Protocol.py write_file memory_address file

memory_address is necessary a valid address from the i.MX memory map, meaning that it must be a directly accessible memory area by the ARM core (registers, RAM).


4. Run the executable by jumping from ROM code to this loaded code:

> iMX_Serial_Download_Protocol.py get_status

This must returns: 88 88 88 88, which signifies that the ROM has successfully jumped at the entry point of the executable.

That entry point must be specified in the flash header or Image Vector Table (IVT) depending of the i.MX.

As a consequence, a valid flash header or IVT must be placed at the offset 0x0 of the downloaded code.

In each boot image, this is commonly placed at the offset 0x400, so it is easy to build another one at offset 0x0 which is usually an empty space. Pointer to DCD should remain null.


The script is provided "as is" without any warranty, and is not an official tool supported by Freescale.

The script is here: 19-iMX_Serial_Download_Protocol.py

1 person found this helpful