Exercising the i.MX Serial Download Protocol with a Python Script

Showing results for 
Search instead for 
Did you mean: 

Exercising the i.MX Serial Download Protocol with a Python Script

No ratings

Exercising the i.MX Serial Download Protocol with a Python Script

That Python script exercises the i.MX serial download protocol in UART mode. It can be used with i.MX21/27/25/31/35/51/53, since they are based on the same protocol.

The details on the protocol can be found in the "System Boot" section of the used i.MX reference manual.


- Python 2.7 (not tested with other version)

- Pyserial modules (http://pyserial.sourceforge.net)

The i.MX must boot in serial mode with a serial cable connected to a host running the script.

The COM1 is configured in 115200 - no parity - 1 stop bit - 8-bit. If another COM is used, you will have to make the appropriate changes in the script.

That script uses only hexa formatted address and data for the command parameters.

The following command returns the HAB status whenever it is used, so it helps to check that the setup is functional. Eventually, when some code was downloaded, this command triggers its execution. The returned value is only useful when doing a secure boot, and does not matter otherwise.

By default, it returns in hexa format the following:

> iMX_Serial_Download_Protocol.py get_status

Status is:

F0 F0 F0 F0

Typical usage to download and execute some code:

1. Ensure that the protocol is ready:

> iMX_Serial_Download_Protocol.py get_status

2. Configure the memories and other things like I/O, such does the DCD:

> iMX_Serial_Download_Protocol.py write_mem memory_address access_size data

As this configures only one register at a time, it is necessary to call it several times to configure like a SDRAM.

Of course, feel free to enhance that script by adding like a load from file memory write :-)

3. Download the executable binary:

> iMX_Serial_Download_Protocol.py write_file memory_address file

memory_address is necessary a valid address from the i.MX memory map, meaning that it must be a directly accessible memory area by the ARM core (registers, RAM).

4. Run the executable by jumping from ROM code to this loaded code:

> iMX_Serial_Download_Protocol.py get_status

This must returns: 88 88 88 88, which signifies that the ROM has successfully jumped at the entry point of the executable.

That entry point must be specified in the flash header or Image Vector Table (IVT) depending of the i.MX.

As a consequence, a valid flash header or IVT must be placed at the offset 0x0 of the downloaded code.

In each boot image, this is commonly placed at the offset 0x400, so it is easy to build another one at offset 0x0 which is usually an empty space. Pointer to DCD should remain null.

The script is provided "as is" without any warranty, and is not an official tool supported by Freescale.

The script is here: 19-iMX_Serial_Download_Protocol.py

Labels (1)

Thanks for the useful Python script.

When I send the write_file command, does the ROM code decode the memory_address as the address of the flash header? if so, is this the reason that I need to build another boot image where the flash header is at offset 0x00 instead of at offset 0x400?

Thank you

I actually found the answer in AN4547 Section 7.2. For SDP, the flash header is at offset 0x0.

Thank you

Version history
Revision #:
1 of 1
Last update:
‎09-01-2012 01:57 PM
Updated by: