can't read/write data from/to 4-bit eMMC (USDHC4)

cancel
Showing results for 
Search instead for 
Did you mean: 

can't read/write data from/to 4-bit eMMC (USDHC4)

291 Views
Contributor III

Hello. I've connected eMMC memory to pins USDHC4 (4-bit data) of i.mx6 solo.

I can read information about device, but I/O operations has been excepted.

U-Boot > mmc dev 2
MMC: mmc_getcd(mmc) = 1
MMC: mmc_send_cmd
                CMD_SEND:0
                ARG                      0x00000000
                MMC_RSP_NONE
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x000001AA
                MMC_RSP_R1,5,6,7         0x2FF67610
                MMC: mmc_send_cmd result=-19
MMC: mmc_send_cmd
                CMD_SEND:55
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x2FF67610
                MMC: mmc_send_cmd result=-19
MMC: mmc_send_cmd
                CMD_SEND:0
                ARG                      0x00000000
                MMC_RSP_NONE
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:1
                ARG                      0x00000000
                MMC_RSP_R3,4             0x00FF8080
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:1
                ARG                      0x40300000
                MMC_RSP_R3,4             0x00FF8080
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:1
                ARG                      0x40300000
                MMC_RSP_R3,4             0x00FF8080
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:1
                ARG                      0x40300000
                MMC_RSP_R3,4             0xC0FF8080
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:2
                ARG                      0x00000000
                MMC_RSP_R2               0x9D010149
                                         0x53303332
                                         0x475011C3
                                         0xA0D31500

                                        DUMPING DATA
                                        000 - 9D 01 01 49
                                        004 - 53 30 33 32
                                        008 - 47 50 11 C3
                                        012 - A0 D3 15 00
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:3
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000500
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:9
                ARG                      0x00010000
                MMC_RSP_R2               0xD04F0132
                                         0x0F5903FF
                                         0xFFFFFFEF
                                         0x8A400000

                                        DUMPING DATA
                                        000 - D0 4F 01 32
                                        004 - 0F 59 03 FF
                                        008 - FF FF

U-Boot > mmc part
## Unknown partition table

U-Boot > mmc write 1000 0 1

MMC write: dev # 2, block # 0, count 1 ... MMC: mmc_set_blocklen = 512
MMC: mmc_send_cmd
                CMD_SEND:16
                ARG                      0x00000200
                MMC_RSP_R1,5,6,7         0x00000001
                MMC: mmc_send_cmd result=-19
0 blocks written: ERROR

FF EF
                                        012 - 8A 40 00 00
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:13
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000700
                MMC: mmc_send_cmd result=0
CURR STATE:3
MMC: mmc_send_cmd
                CMD_SEND:7
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000700
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:6
                ARG                      0x03B90100
                MMC_RSP_R1b              0x00000800
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:13
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
CURR STATE:4
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:6
                ARG                      0x03B70200
                MMC_RSP_R1b              0x00000800
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:13
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
CURR STATE:4
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=-19
MMC: mmc_send_cmd
                CMD_SEND:6
                ARG                      0x03B70100
                MMC_RSP_R1b              0x00000800
                MMC: mmc_send_cmd result=0
MMC: mmc_send_cmd
                CMD_SEND:13
                ARG                      0x00010000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
CURR STATE:4
MMC: mmc_send_cmd
                CMD_SEND:8
                ARG                      0x00000000
                MMC_RSP_R1,5,6,7         0x00000900
                MMC: mmc_send_cmd result=0
MMC: mmc_bread
MMC: mmc_set_blocklen = 512
MMC: mmc_send_cmd
                CMD_SEND:16
                ARG                      0x00000200
                MMC_RSP_R1,5,6,7         0xBEFB25EF
                MMC: mmc_send_cmd result=-19
MMC: mmc_set_blocklen = -19

 U-Boot > mmcinfo
Device: FSL_SDHC
Manufacturer ID: 9d
OEM: 101
Name: IS032
Tran Speed: 52000000
Rd Block Len: 512
MMC version 5.0
High Capacity: Yes
Capacity: 29.1 GiB
Bus Width: 4-bit
Erase Group Size: 512 KiB
HC WP Group Size: 8 MiB
User Capacity: 29.1 GiB WRREL
Boot Capacity: 4 MiB ENH
RPMB Capacity: 4 MiB ENH

U-Boot > mmc part
## Unknown partition table

U-Boot > mmc write 1000 0 1

MMC write: dev # 2, block # 0, count 1 ... MMC: mmc_set_blocklen = 512
MMC: mmc_send_cmd
                CMD_SEND:16
                ARG                      0x00000200
                MMC_RSP_R1,5,6,7         0x00000001
                MMC: mmc_send_cmd result=-19
0 blocks written: ERROR

What I'm doing wrong?

Thanks!

Labels (2)
Tags (2)
0 Kudos
7 Replies

66 Views
Contributor I

There have been many different papers and presentations on auditing hardware in the past, and several of them went into the topic of acquiring the code from the target. One such example comes from Micah Elizabeth Scott. On her blog, Micah discussed how she went about reverse engineering an eMMC flash pinout upsers

0 Kudos

66 Views
Contributor III

Hello.

This eMMC has a public datasheet and pinout.

So, there is no need on reverse engineering.

0 Kudos

66 Views
NXP TechSupport
NXP TechSupport

what is the status of the WP pin?

0 Kudos

66 Views
Contributor III

It's shorted to GND.
However, WP just forbids data write, but reading should work.

error -19 is command timeout.

I've checked CMD and DATA channels by osciloscope, I'm seeing normal voltage levels (1V8), host and eMMC have transferred some requests and responces to each other.

CLK has signal 386.7kHz

0 Kudos

66 Views
NXP TechSupport
NXP TechSupport

Could you tell me which BSP are you using?

Could you send me the device tree file of your board?

0 Kudos

66 Views
NXP TechSupport
NXP TechSupport

The u-boot version seem quite old.

You may try to use the BSP from NXP.

i.MX Software and Development Tools | NXP 

for example : Linux L4.14.98_2.0.0 Documentation

0 Kudos