I'm using the i.MX6Q in USB boot mode and suspect I've found a ROM bug in the implementation of the Serial Download Protocol (SDP). Someone please correct me where I've gone wrong...
According to the reference manual (section 188.8.131.52.3) the WRITE_FILE command allows me to specify "Valid values for WRITE_FILE COMMAND, ADDRESS, DATA_COUNT". The issue is with DATA_COUNT.
The USB HID protocol requires me to always send complete packets to the i.MX6Q. As the output packet size is 1025 bytes (1024 of data preceded by a 0x02 for the Report ID), I must always send 1025 bytes of data even if DATA_COUNT in the SDP is smaller, but this is OK. The problem I've got is that if I wish to send 2 bytes of data to address 0x00910000 then I must send a 1025 byte packet, and the i.MX6Q ROM then loads all 1024 bytes into memory starting at 0x00910000. That is, it rounds DATA_COUNT up to whole packet sizes.
I've reproduced this behavior in sb_loader (part of the mfgtools), so it doesn't appear to be a bug of my own.
Have I misunderstood something? Clearly I can work around this by first reading the contents of the last K of memory I'm going to write into, then writing my own data on top of it, and transmitting it back. But I'd rather not code up a hack (unless it isn't my bug).