[eureka]

I've found that eMMC could have "hardware" boot partitions. Which aren't overlapped with user accessible area. (some info)

I've also found path /sys/block/mmcblk0/device/boot_config somewhere in MMC dump, before even start of first partition. Near of this path are strings about update etc., so it should be used by the code from kernel that handles "recovery" updates.

Now, looking at drivers/mmc/core/mmc.c at KT kernel sources, this boot_config file is write-only. And writing to it configures boot partitions. Don't mess with it by writing random values. It could be dangerous.

There is also /sys/block/mmcblk0/device/boot_info which is safe to read. Information from it could be interpreted somehow through reading of mmc.c.

Linux eMMC driver, used in KT, doesn't see boot paritions. So it's possible that u-boot is stored on it. (BTW, recent eMMC drivers could see these partitions as separate /dev/mmcblk0bootX, as patch has been provided.)

EDIT: there are some suspicious comments in mmc.c:

	/* switch the partitions that used to be accessed in OS layer */
	/* partition must be -
	 * 0 - user area
	 * 1 - boot partition 1
	 * 2 - boot partition 2
	 */

	/* Send SWITCH command to change partition for access */

UPD: and according to i.MX50 MCU Reference Manual, it can boot from such the boot partition.