Tapping In to the eMMC

From Unofficial Tesla Tech
Revision as of 00:12, 17 February 2020 by Carl (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search

My prior post is the way to fix this problem of the eMMC chip 'wearing out' with age. In early years Tesla did extensive logging which writes to /var in this chip. This Hynix chip is not very good quality, and anyway chips not labeled 'endurance' or similar can't take too much writing.

The result is at some point, now affecting cars 2016 and older, the eMMC will wear out, the Tegra processor will not be able to boot, and your MCU screen will be black or the MCU will reboot and reboot. This is inevitable, unless one of these commercial rooters has disabled logging. Most ppl have their MCU replaced and reprogrammed, but all that needs done is the eMMC chip replaced. I believe I'm the first to suss this out three years ago.

Myself, I replaced the 8GB Hynix with an industrial-grade SwissBit chip as I'd detailed before.

So doing the rework to remove and replace this chip is risky. And once the MCU is dead it is not very likely you'll be able to recover the /var partition, which is partition 3 on the chip. It would be a very good idea to get a dump of the chip before it fails so here is a less risky way to do that.

MMC/SD is actually an interface standard which allows different manufacturers to make chips that are drop-in replacements. If you don't want to replace the chip for now and just dump it, you can solder fine wires onto the right pads on the back of the CID, connect those to the AllSocket's header pins, and read the eMMC that way.

This isn't one of those easy things to do. It's not for shoe salesmen... worthwhile things are rarely easy. But if you've a steady hand and an accurate mind, you'll be fine.

100px Safety Glasses Warning
  • This is very fine work and you should use a PCB microscope to do the work. If there's a Maker's Lab near you they may well have an electronics workstation with a scope like mine does. Alternatively you may get by with a pair of Coil high magnification glasses.
  • You need a controllable 3 volt regulated DC power supply. Keep the voltage supplied to exactly 2.8v or else you'll wake up the Tegra which will cause all kinds of havoc. Some Tegras wake up at just above 2.8v, so it's important to use a regulated power supply (as opposed to a cheapie or wall-wart), which can supply at least 5A.

So assuming you've made it this far, here's what my early effort looks like:

CID - wired.jpg

What are the connections? (credit: ce2078)

Click to enlarge, choose highest-rez, then magnify

Connect these wires to the correct header pins on the AllSocket, tune the voltage, and plug it into your machine. Use my instructions from the prior post for dumping the images. Likely you'll only get 1bit mode to work, and it will take a good while.

Scaesare.png Update from scaesare

"Well, crap. I can't read from my eMMC at all. The block device shows up, but I couldn't dd from it, and ddrescue has been chewing on it for 15 minutes, and midway through the second pass it's managed to recover 0.00%

Not what I had hoped for."

The response scaesare got from AllSocket:

Our engineer confirms that the BGA153/169-SD Adapter is with the 0.1μf capacitor, but it can be changed to 1uf by setting the C2(capacitor) on the SD Adapter, please view this screenshot:
AllSocket cap.jpg

This will correct the problem some are having with reading the Hynix chip using the AllSocket carrier.

Where to get a cap like this? Well 1μF is a common rating fortunately, and the size looks like about an 0402. Check Mouser to pay alot, or go to a manufacturer like Kemet and request engineering samples. (free) The correct Kemet part# is C0402C102J8RAC. Also these will work: C0402C102J8JAC and C0402T102J8RBC. I have a bunch extra if you'd like a free one. Get out your magnifying glass (or Coils) and tweezers!

Thank you scaesare.

Carl A. Cook