• eMMC — Embedded MultiMedia Card.

• eMCP — Embedded MultiChip Packages.

• uMCP — UFS MultiChip Packages.

• UFS — Universal Flash Storage.

• OTP — One Time Programmable.

• LLC — Logic Level Converter.

• TP — Test-Point.

• RO — Read Only.

MMCFW - performs the same functions as other specialized programmers.

USER - limited program operating mode. In this mode, the user can read information, configuration, and dump any H/W partitions. Writing, configuration, and additional tools are not available.

PRO (Professional) – unlimited program operation mode. In this mode, all program functions are available: reading, writing, configuration, and additional tools.

There's no need to install any additional drivers. All modern Linux distributions include all the necessary drivers for the program.

An update such as 6.1.101-TK7 is intended for assemblies of distributions of the recommended OS with the 6.1.101 update installed (tk2, tk3, tk4, tk5, tk6).

It is necessary for:

• MMC firmware.

• Single-bit connection.

• SD card unlocking.

• Correct MMC clearing.

• Correct logic for handling MMC exceptions.

• And much more.

It can also be installed on a third-party Linux Mint or Ubuntu distribution to support all necessary operations in the program.
Starting with program version 3.4.2, kernel update 6.1.101-TK7 is mandatory for all operating systems!

MMCFW - supports power management from the USB RTS controller to the eMMC.

To do this, you need to enable power management support in the program settings. After this, the RTS button will become clickable.

However, this feature will not work correctly on builds where the eMMC is powered directly from the power source.

For these cases and for users of builds with PLUs, we have developed a simple power management circuit using a pair of transistors and an optocoupler. Open diagram

In eMMC/eMCP there are usually 4 so-called HW partitions:

• Boot0.

• Boot1.

• UserArea (User area).

• RPMB (Replay Protected Memory Block).

You can also optionally configure up to four more General Purpose (GP) partitions in the eMMC. This is rarely used.

Boot0 usually stores the primary boot loader.

Boot1 usually stores a copy of Boot0.

The UserArea stores the partition table itself and its partitions. These partitions contain the main firmware used by the device, user data, etc.

The RPMB stores data that the device developer has chosen to hide from viewing and copying (configs, certificates, etc.). Reading/writing this partition is impossible without the encryption key.

The eMMC also contains the following important configuration and identification data:

• OCR.

• CID.

• CSD.

• ExtCSD (Extended CSD).

The OCR stores information about the supported voltage, the power-on status, and the access mode indication.

The CID stores the manufacturer's name, production date, and other information. On some devices, the CID is used to associate the eMMC with the device. Generally, the CID is considered the eMMC identifier.

The CSD stores device-specific information. The CSD defines the data format, error correction type, maximum data access time, data transfer rate, and so on.

The ExtCSD stores additional configuration information, including the boot configuration. ExtCSD essentially complements the CSD.

So, to correctly dump the eMMC, it is usually enough to:

1. Dump Boot0.

2. Dump Boot1.

3. Dump UserArea.

4. Dump GP partitions (if any).

5. Dump ExtCSD or boot configuration information (Boot partition config, Boot bus conditions, H/W reset function).

This data is generally sufficient to program a new eMMC. That is:

1. Fill Boot0.

2. Fill Boot1.

3. Fill UserArea.

4. Fill GP partitions (if any).

5. Install the boot configuration from the dumped ExtCSD (by loading it into the program) or manually set the Boot partition config, Boot bus conditions, and H/W reset function.

If you need to configure GP partitions, this can also be done using the merged ExtCSD.

If CID binding is used (rare, but possible), then changing the CID is only possible on Samsung eMMCs.

If your device uses RPMB, the success of restoring the device depends on how the RPMB is used. RPMB can be programmed by the manufacturer or automatically.

If the RPMB is programmed automatically, a clean RPMB on the new eMMC is sufficient. When you first turn on the device, the RPMB will be programmed automatically by the device. The RPMB can be cleared by reflashing the eMMC firmware (Samsung only).

If the RPMB is programmed by the manufacturer, it will no longer be possible to recover data from this partition. To read/write this partition, you must know the encryption key.

Also, pay attention to the Extended CSD version when choosing a new eMMC. The Extended CSD version on the new eMMC must be the same or higher as the one on the eMMC being replaced. Otherwise, functionality is not guaranteed.

Verification is the comparison of written data with the data in the file being written after the write process.

Successful verification ensures that the data written to the eMMC is identical to the data in the file being written.

All eMMC/eMCPs adhere to a single JEDEC standard. This applies to all eMMC revisions/versions.

This means that the initialization and interaction process with the eMMC is standardized, and there are no differences between eMMCs.

However, different eMMC models from different manufacturers may differ in their electrical characteristics. This leads to a common problem: some MMCs fail to initialize due to an unstable connection. Different eMMCs have different connection quality requirements.

The eMMC/eMCP contains a protected partition called the RPMB.

Device manufacturers (TVs, radios, smartphones, etc.) can use this partition to store various data. Typically, these include keys, MAC addresses, checksums, etc.

This partition is usually programmed by the processor using an encryption key. Further access to the contents of this partition will only be possible with the encryption key, which can be generated, for example, from the processor serial number using the eMMC CID. This creates a so-called "pair" between the processor and the eMMC. The programmed key cannot be changed.

This pair is created once on the eMMC side, and re-pairing with a new processor is not possible.

When replacing an eMMC that uses the RPMB, the RPMB partition must at least be cleared (not programmed).

The RPMB partition cannot be cleared, reset, or reset using standard tools for reuse. But there are non-standard solutions.

Since the RPMB partition, and all other partitions, are created and controlled by the eMMC controller software, all data in the eMMC, including settings, can be reset by reflashing the eMMC controller.

The process of flashing the eMMC controller is not documented and is not disclosed by the manufacturers. This is not FFU.

FFU is a standardized process for updating the eMMC controller firmware.

Updating the controller firmware does not reset the eMMC settings or destroy data.

It is currently not supported in MMCFW due to lack of need.

There are several revisions/versions of eMMC/eMCP.

Revision = Version:

• 0 = 4.0.

• 1 = 4.1.

• 2 = 4.2.

• 3 = 4.3.

• 5 = 4.41.

• 6 = 4.5.

• 7 = 5.0-5.01.

• 8 = 5.1.

• 9 = 5.1B.

The higher the eMMC revision/version, the more functions it supports.

To ensure compatibility when replacing an eMMC, you must select an eMMC of the corresponding revision/version or higher.

The boot configuration usually depends on the processor. Different processors require different configurations.

In rare cases, no configuration is required.

The boot configuration includes:

• Partition Configuration (Boot) - This register determines the boot partition configuration.

• Boot Bus Conditions (Bus) - This register determines the bus width for the boot operation.

• H/W Reset Function (Rst_n) - This register determines the hardware reset control capability.

More details about the H/W reset function:

• 0x00 (Temporarily disabled): Hardware reset is disabled (default value). The signal on the RST_n pin is ignored by the device.

• 0x01 (Permanently enabled): The reset function is permanently enabled. The eMMC controller will respond to a low RST_n signal.

• 0x02 (Permanently disabled): The reset function is permanently disabled.

Rules regarding H/W reset function when replacing eMMC:

• If the config file specifies that the RST_n register should be 0x01, then it should be set to 0x01.

• If the config file specifies that the RST_n register should be 0x00, then the device doesn't care what it is in the eMMC.

 Important!
Setting the H/W reset function configuration is a one-time, irreversible operation (OTP). The H/W reset function configuration can only be reset by reflashing the eMMC controller.

In eMMC v5.0 and higher, a standard for displaying eMMC memory wear appeared:

• Pre EOL - displays the number of used spare blocks.

• Device life time estimation type A - displays the wear level of memory type A.

• Device life time estimation type B - displays the wear level of memory type B.

MMCFW - analyzes the values ​​of these registers and makes a decision about the state of the memory based on these registers.

In earlier versions of eMMC, there was no common standard for displaying wear. However, MMCFW can calculate S.M.A.R.T. status on Samsung eMMCs v4.3–4.5 using proprietary methods, which are available in the Tools tab.

Optionally, you can configure up to four General Purpose (GP) partitions in the eMMC. These partitions are created from the UserArea.

Partition configuration requires partition management support in the eMMC itself. This information can be found in the eMMC initialization log.

When configuring GP partitions, there are two options:

• ENH (Enhanced) - switches the memory cell operating mode to high-reliability storage mode.

• WR_REL (Write reliability) - an option that relates to data write reliability.

ENH - Enhanced data storage technology. Converts the allocated memory area to a different type. For example, TLC > MLC, MLC > SLC.

Accordingly, if we create a GP1 partition of 50 MB in size with the ENH option, then we will subtract 100 MB from UserArea to create the partition.

WR_REL - This option protects previously written data in the event of a power failure.

The essence of this option is that existing data is not overwritten when writing, and new data is written to a new area.

Thus, in the event of a power failure during recording, we will have old, but valid data, instead of invalid new ones.

Max.ENH (Enhanced)

The maximum available ENH capacity depends on the eMMC manufacturer and model. This capacity is usually specified in KiB.

Enhanced UserArea

The ENH option can also be applied to a portion of the UserArea partition, creating an Enhanced UserArea.

To do this, specify the User ENH offset (HEX 0x) and the User ENH size (HEX 0x or MiB).

For example, if we want to use all available ENH starting at offset 0x00000000, we multiply Max.ENH by 1024 and convert it to HEX.

We copy the resulting values ​​to the User ENH size with the 0x prefix. Values ​​without the prefix will be interpreted as MiB.

Final Configuration (PARTITION_SETTING_COMPLETED) - saves the current partition configuration permanently (OTP).

If you leave the Final Configuration checkbox unchecked, a test partition configuration will be installed, which will be reset when the eMMC is powered off.

Important!

• The final configuration cannot be reset or changed (using standard tools).

• MMCFW - displays the test partition configuration in gray during eMMC reinitialization.

• The actual size of the Enhanced UserArea may differ slightly from the test configuration after installing the final configuration.

Different devices (TVs, stereos, speakers, set-top boxes, phones, etc.) use different types of partition tables.

A partition table describes the location of partitions in the UserArea and their boundaries. These are also called soft parts.

MMCFW currently supports the following partition tables (read/write):

• GPT (GUID Partition Table).

• MBR (Master Boot Record).

• EBR (Extended Boot Record).

• MSTAR (...).

• MTD (...).

• MPT (...).

• Various modifications of GPT (NintendoSW, AUTO CHIPS).

These are the most widely used data structures in all consumer multimedia devices today.

MMCFW also supports preliminary UserArea dump analysis and troubleshooting for some partition tables.

Support for data structures (partition tables) is often necessary for full functionality with eMMC/eMCP.

Formatting
After restoring the GPT partition table, MMCFW automatically formats the User Data partition to the appropriate format if it is detected. This is typically the EXT4 file system. EXT4 is the default file system on many devices and is supported by Android and Linux-like systems. If the User Data partition is unformatted, the device will not be able to mount it. The device will also be unable to boot into the operating system. During the partition mounting process, the device will freeze or reboot.

Some devices can format the User Data partition automatically, or they can be formatted manually in Recovery.

Repartitions
When writing a dump to a UserArea with a GPT partition table, MMCFW will repartition the partition table if the corresponding checkbox is checked in the GPT-Tools settings. This is often necessary in order to scale the partition table data to the desired UserArea size. If the dump was read from a 64GB eMMC, it cannot be written to a smaller eMMC. If the dump was read from an 8GB eMMC, then after writing this dump to a larger eMMC, the device will use only 8GB. To solve these problems, MMCFW uses repartitioning. Only the User Data partition is subject to scaling. Partitions located after the User Data partition will be shifted. Also, repartitioning the partition table can fix some problems in the partition table, bringing it to the standard. Use this function only when necessary!

eMMC/eMCP has several types of locks and protections:

• Password lock (Protects all data from reading/writing).

• Temporary locking (Protects data from writing).

• Permanent RO Lock (Protects all or a group of data from being written).

Password Lock

This lock is set by the user using a user password.

The password can vary, but must be no more than 16 characters or 32 in HEX.

This lock is often used to lock SD cards in automotive devices.

If the password is unknown, it can only be reset by completely erasing the data.

Temporary blocking

This blocking can be removed and re-installed without any problems.

Permanent RO Lock

This lock can be applied to the entire memory area or to a specific part (group).

RO lock is often found on worn-out eMMC/eMCP memory. It can be reliably removed by reflashing the eMMC controller. However, removing it is pointless!

A lock set due to wear will soon reappear, even if removed.

Almost every eMMC/eMCP has a so-called TP (Test-Point) contact, which puts the eMMC into BOOT mode. It's also common to find eMMC/eMCP already in Boot mode. This is usually due to wear on the eMMC/eMCP memory.

• BOOT mode is used to restore the eMMC controller firmware.

• The location of the TP pin varies depending on the eMMC/eMCP manufacturer and model.

• Typically, the TP pin is connected to GND.

Important!
After initializing the eMMC in a system with a connected TP, the TP must be disconnected!

Otherwise, the firmware update will fail. The initialization process can be monitored in the Logger (KMSG), which is available in MMCFW > Advanced > Logger (KMSG).

Flashing the eMMC firmware allows you to reset all settings and configurations on the eMMC, restoring it to a new state.

This operation erases all data on the eMMC, including:

• Clears RPMB.

• Clears the bad block map.

• Clears the CID.

• Resets partition configuration settings.

• Resets boot configuration settings.

• Resets the device life time estimation.

• Removes all locks.

This operation can also be used to install a new CID on eMMC version 5.1.

This is because after flashing the eMMC firmware, CID installation (OTP) becomes available.

Currently, MMCFW only supports reading and writing eMMC firmware for Samsung eMMC/eMCP devices.

Flashing eMMC firmware is often necessary for those using used eMMCs for installation in their devices.

Important!
Flashing eMMC firmware is an extremely dangerous operation and can damage your eMMC. Do not use this operation unless absolutely necessary, and only if you can afford to lose the eMMC.

When MMCFW starts, all connected drives (disks, flash drives, etc.) disappear from view. This is done for security reasons, so that the system or user cannot use a drive the program might be working with. After the program finishes, all devices and drives are re-initialized by the system and become accessible.

MMCFW version 3.4.2 introduced a method for testing SD/MMC drives in linear read/write mode. The benefit of this test is that it shows how SD/MMC drives perform under real-world conditions. In the screenshot above, we see constant drops in the read test scale in the memory area from 0.44 GiB to 1.14 GiB, which indicates that this area of ​​memory is heavily worn out. The block counters recorded 14,796 good blocks, 115 slow blocks, and 1 bad block. Such an MMC can be considered faulty if a repeat test confirms the result.

A review of this tool is available on the Samodelkin 33 channel: YouTube, RuTube