Odroid U3 and the emmc memory

Introduction

The Odroid U3 board can, just as all other Odroid boards, use eMMC memory instead of a micro SD card. This type of memory is not only more "cool" but also much faster.  When I bought my board I did order a 8 Gb eMMC module with Ubuntu on it. My recent thinking was to put Openelec on the eMMC instead of the Ubuntu that came with the board.

Back side Odroid U3 with eMMC (red dot) installed, Micro SD card and eMMC adapter

I have downloaded an image from the Odroid forum here.
With the normal procedure I copied the image to the eMMC:

gunzip OpenELEC-Odroid-U2-6.0.1.0.img.gz
sudo dd if=OpenELEC-Odroid-U2-6.0.1.0.img of=/dev/sdh bs=1M
sync
sudo umount /dev/sdh1
sudo umount /dev/sdh2

All good and booting the board with the eMMC and the following messages from uboot:

OK
U-Boot 2010.12-svn (May 12 2014 - 15:05:46) for Exynox4412
CPU: S5PC220 [Samsung SOC on SMP Platform Base on ARM CortexA9]
APLL = 1000MHz, MPLL = 880MHz
DRAM:  2 GiB
PMIC VERSION : 0x00, CHIP REV : 3
TrustZone Enabled BSP
BL1 version: 20121128
Checking Boot Mode ... EMMC4.41here
REVISION: 2.0
Manufacture ID 0x11 [ 7456MB ] 
NAME: S5P_MSHC4
MMC Device 0: 7456 MB
MMC Device 1: 0 MB
MMC Device 2 not found
*** Warning - using default environment
USB3503 NINT = OUTPUT LOW!
ModeKey Check... run normal_boot 
No ethernet found.
Hit any key to stop autoboot:  1
do_fat_cfgload : cmd = fatload mmc 0:1 0x41000000 boot.ini
reading boot.ini
2697 bytes read in 21 ms (125 KiB/s)
Find boot.ini file. But This file is not odroid4412 config file!
NAME: S5P_MSHC4
NAME: S5P_MSHC4
>>> Load Boot Script from mmc 0:1 <<<
reading boot.scr
** Unable to read file boot.scr **
>>> Load Boot Script from mmc 0:2 <<<
** Unrecognized filesystem type **
>>> Run Default Bootcmd <<<
reading kernel..device 0 Start 2455, Count 16384 
MMC read: dev # 0, block # 2455, count 16384 ... 16384 blocks read: OK
completed
reading RFS..device 0 Count 18839, Start 2048 
MMC read: dev # 0, block # 18839, count 2048 ... 2048 blocks read: OK
completed
Wrong Image Format for bootm command

That didn't work. The same procedure with a micro SD card did result in a booting system.

Somehow is something going wrong with u-boot.
Working micro SD version:

Odroid # version

U-Boot 2015.10 (Feb 29 2016 - 22:54:24 +0000)
armv7a-openelec-linux-gnueabi-gcc-4.9.3 (GCC) 4.9.3
GNU ld (GNU Binutils) 2.25.1

Not work eMMC version from the same image:

Exynos4412 # version


U-Boot 2010.12-svn (May 12 2014 - 15:05:46) for Exynox4412

How can that be, two different versions of u-boot from the same image file?

The old U-boot of 2010.12 is not compatible with the boot.ini file and probably also not with the kernel format / identifier of what ever. It is clearly necessary to use the U-Boot 2015.10 version.

Difference between SD and eMMC

The reason is that the Exynos4412 Prime soc is intended for secure operation. That means that the bootloader and software has to be signed and that a couple of further "hidden" security features are used when an eMMC is available instead of an SD card.
This results in a complicated booting process:

1. ROM
   The rom loader starts when processor is powered up / has had a hard reset. Based on hardware settings (boot pins and availability of interfaces) is the next step boot loader put in to the L2 cache memory
2. BL1
   The signed bootloader "BL1.bin" is pulled into the SOC this is a binary blob that comes from Samsung. It is signed with a key / encrypted. This loader fits into the L2 cache is is able to configure the memory of the processor so that the next boot loader actually fits into the memory.
3. BL2 +  TrustZone
   This loader is basically a signed part of U-boot. This U-boot part is signed by the key of Hardkernel and is therefore an acceptable payload for the BL1 loader.  At this point is also the "TrustZone" configured a kind of security level in the processor to enable things like DRM and payments. From this point U-boot can be loaded.
4. U-Boot
   This is the normal opensource boot loader that understands eMMC, SD, USB, network and the file systems. This loader puls the kernel into the memory and will start it.
5. Kernel and initrd
   When this part is loaded and started we have at last a working linux system.

The different boot loader parts are differently stored on the SD card and unfortunately not in the same way on the eMMC card.

The different blocks are on the SD or eMMC as follows organized:

Binary	Block offset		Part type
name	SD	eMMC	(eMMC only)
Bl1.bin	1	0	1 (boot)
Bl2.bin	31	30	1 (boot)
U-boot.bin	63	62	1 (boot)
Tzsw.bin	2111	2110	1 (boot)
Uboot Env	2500	2500	0 (user)

What stands out s that the eMMC uses a boot/secure part for the bootloader. This part can (normally) not be accessed from the operating system or when the eMMC is used as SD card. This done to be able to guarantee a secure system and to have a un-brick-able configuration. The user cannot change the bootloader and therefore not really brick the board. Only with a special u-boot or a special kernel module is it possible to access the secure partition.

Basically this means that the boot loader is not updated when an image is written to the eMMC card in it's sd adaptor.

How to update u-boot on an eMMC

Hardkernel has an eMMC recovery tool available. This is an image with a special u-boot that updates the secure boot partition of the eMMC with new bootl loaders. This tool can be found on their forum here. I have used image exynos4412_emmc_recovery_from_sd_20140629.zip, but as always your mileage may vary.

This image must be written to an SD card as normal. The procedure is as mentioned on the Odroid forum as follows:

1. Prepare a microSD card and flash the attached image.
2. Boot with the microSD without eMMC
3. Turn on U2/U3 and wait for a few seconds and blue LED will blink.
4. Plug your eMMC module into U2/U3
5. Plug micro-USB cable into U2/U3 and connect other side to your PC USB host or ODROID's USB host port. (This is a trigger to start the recovery)
6. After recovery process (only a few seconds), the blue LED will turn off automatically.
7. Finish. Install OS on your eMMC with as usual.

When we look at the SD with the image we see the following structure:

hansan@Desk-computer:~$ ls -l /media/hansan/48E0-7CDF/*
-rw-r--r-- 1 hansan hansan 2701 Jun 28  2014 /media/hansan/48E0-7CDF/boot.ini

/media/hansan/48E0-7CDF/update:
total 662
-rw-r--r-- 1 hansan hansan  15360 Mär 18 12:37 bl1.bin
-rw-r--r-- 1 hansan hansan  14592 Mär 18 12:37 bl2.bin
-rw-r--r-- 1 hansan hansan   1392 Jun 28  2014 sd_fusing.sh
-rw-r--r-- 1 hansan hansan 159744 Mär 18 12:37 tzsw.bin
-rw-r--r-- 1 hansan hansan 478121 Mär 18 12:37 u-boot.bin
-rw-r--r-- 1 hansan hansan   2105 Mär 18 12:37 update.sh
hansan@Desk-computer:~$ 

This means that the special u-boot on the SD card is pulling the boot loader parts from the update directory and put those files into the secure boot partition of the eMMC. To make openelec working on an eMMC is it necessary to put the new U-Boot 2015.10 into the boot partition of the eMMC. This can be done by first extracting the boot loader parts for openelec and copy them to a recovery image. That image updates the boot partition and after that is it possible to write the openelec image to the eMMC. This results in a working combination.

My approach to get to the correct version of u-boot was to compile openelec from source.  A different approach would be extracting the parts of the SD-card and save them under the correct names.

I have downloaded the source from here. And followed the instructions:

1. Unpack sources
2. make PROJECT=Odroid DEVICE=$DEVICE image
3. wait for compilation.
4. zcat target/OpenELEC-Odroid-$DEVICE-6.0.2.0.img.gz | dd of=/dev/mmcblk0

    $DEVICE can currently be either U2, XU3 or C1

5. SD card is now complete.

I did need to mangle the download site for the "liberation-fonts-ttf" package. Google on the error messages received during complication can help to fix the issues.  The required files can be found in the image directory.

hansan@Desk-computer:$ ls ./build.OpenELEC-Odroid.U2.arm-6.0.2/image/system/usr/share/bootloader/
bl1  bl2  tzsw  u-boot  update.sh

These four files have to be copied to the SD card with the eMMC recovery image update directory. Don't forget to add the .bin extension to match the "pattern" on the SD card.
With this image is it possible to update the u-boot on the eMMC module to the version need to boot the openelec image from eMMC. It is then not longer needed to use a SD card.
This new image can be backed up  to a file.

hansan@Desk-computer:$ sudo dd if=/dev/sdh of=~/work/Arm_sbc/odroid/openelec/eMMC_openelec_6.0.2.0.img bs=512 count=220501
220501+0 records in
220501+0 records out
112896512 bytes (113 MB, 108 MiB) copied, 6,31194 s, 17,9 MB/s
hansan@Desk-computer:$ 

I have put the updated recovery image here.

By the way it would also be possible to extract the required files from the Odroid OpenElec SD card image. That would remove the need/trouble of compiling the boot loader.