-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
They told me they thought it would be fine. They still haven't received my chip. Mail has been understandably slower, especially internationally, since Covid19 hit.
Could I ask a really simple basic question - I thought I knew the answer but have now read so much online I’ve confused myself. Have an easyjtag plus box with 1-bit ISP adaptor but need to use an external regulated bench PSU to power the eMMC on the Tegra board (as it only seems to be 2.6V at the board using the ISP’s power).
The bench PSU has +ve, -ve and GND terminals - do I connect the ISP’s D0, CMD and CLK points to the relevant pads on the Tegra, along with +ve from the PSU (to the 2.8V pad), and then connect -ve on the PSU, GND on the PSU, GND pad on the board and GND on the ISP all together?
The bench PSU has +ve, -ve and GND terminals - do I connect the ISP’s D0, CMD and CLK points to the relevant pads on the Tegra, along with +ve from the PSU (to the 2.8V pad), and then connect -ve on the PSU, GND on the PSU, GND pad on the board and GND on the ISP all together?
I was able to find the correct firmwares for the MCU i have been working on, however i clumsily damaged the connector for the touch panel (at least i believe it is for the touch panel) during disassembly of the MCU. The main board was damaged quite badly (all traces to the connector torn from the board), and i deemed it unrepairable, at least in a reliable manner.
Since i was unable to recover the VPN keys anyway, the owner opted to have the MCU replaced by tesla.
Thanks for all the help and input!
Since i was unable to recover the VPN keys anyway, the owner opted to have the MCU replaced by tesla.
Thanks for all the help and input!
Many thanks - have now tried every which way but can't get the easyjtag plus with ISP to read the emmc, CMD timeout error continously. I know @LuckyLuke has got it to work with this hardware (and has been really helpful in trying to diagnose the issue for me) - has anybody else and is willing to share their setup? @Slexs, or did you end up using something else?
whitex
Well-Known Member
I just ran into the very same issue. p1 and p2 seem fine (they pass fsck) but getting squashfs errors and MCU refuses to come up. Did you resolve this?
whitex
Well-Known Member
Anyone know how to extract a staged update to obtain a valid p1/p2 squashfs images? I got to my emmc a little late, and getting squashfs errors on boot, however there should be a staged update pending on the emmc (I assume p3 or p4). Can I use it to extract a valid firmware image?
whitex
Well-Known Member
... and/or can I just connect to Tesla mothership via openvpn (before May 1st) and find the firmware image I need somewhere on their servers?
whitex
Well-Known Member
Just wanted to update this thread on my earlier comments about using Swissbit in pSLC/reliable mode. I used the 32GB EM-26 series (64GB part factory configured as pSLC) as a replacement and it worked just fine. Given that I didn't even expand the partitions beyond 8GB (didn't want to hack it, or worry what if Tesla assumed 8GB total and some update has a problem with that), this chip should outlive my car easily.
Also, a quick note for those trying to recover their car keys from dead chips, I found 2 copies of them on my emmc chip - as individual file and another file called carkeys.tar which contained a copy of the same files. I can't be sure if that tar file exists on every car, but it did on mine. So, if your chips is dead and you're trying exotic methods to recover them, finding that tar file may be helpful to get some if not all the keys.
Also, a quick note for those trying to recover their car keys from dead chips, I found 2 copies of them on my emmc chip - as individual file and another file called carkeys.tar which contained a copy of the same files. I can't be sure if that tar file exists on every car, but it did on mine. So, if your chips is dead and you're trying exotic methods to recover them, finding that tar file may be helpful to get some if not all the keys.
Last edited:
whitex
Well-Known Member
I also verified that a 32GB EM-20 series Swissbit part configured as 16GB pSLC works in MCU1 as well. pSLC mode is known as the "reliable mode" and it was discussed earlier - it has 7x the program-erase cycles rating and it also yields faster performance (faster reads and writes).
Very nice and helpful thread. Just have few questions.
Is there more affordable emmc chip? The Swiss bit is pretty expensive, 58CAD per chip.
Did anyone have good experience using Easy Jtag programmer with tegra board?
Is there any way to keep MC in reset mode, to make sure, no files will be altered during read/write?
Is there more affordable emmc chip? The Swiss bit is pretty expensive, 58CAD per chip.
Did anyone have good experience using Easy Jtag programmer with tegra board?
Is there any way to keep MC in reset mode, to make sure, no files will be altered during read/write?
whitex
Well-Known Member
You can use as small as 8GB chip, which should be cheaper, even in Swissbit line. Also, it's a standard eMMC interface so any BGA153 eMMC 4.0 or 5.0 should work (Tesla doesn't officially support swapping, so you take a risk, however small, trying a part nobody else has tried before). Is it really worth your time however to look for cheaper one and trying it, vs. using something you know has worked for others? Also, cheaper (and smaller) chips will give you lower expected lifetime (and therefore faster deterioration of performance). I guess only you can decide whether it's worth that. For me I went with Swissbit EM-26 32GB - highest reliability and performance part I could find, which is more than $58CAD (it costed me ~$70 USD), but that's because I wanted a solution so that I never have to worry about changing emmc chip again. Switching emmc chips is a lot of effort, and saving $30 is not worth to me having to have to do it again.
If you don't keep it in reset, it's not the modified files you have to worry about, it's generally the bus contention by you and the MC accessing the bus a the same time.
Last edited:
SevenWithaT
Member
I desoldered the emmc. Putting it easyjtag. It says emmc password locked. Is this normal to everyone? Mine is mcu1 from 2013 model s
whitex
Well-Known Member
I haven't seen this mentioned here before, what version of firmware was on it prior to removing it?
Last edited:
SevenWithaT
Member
whitex
Well-Known Member
That's an old version, no reported password locking. I was worried that maybe Tesla reacted to the recent media coverage of personal information leaks by finding some way to lock the emmc with a password, but for that version, you should be able to just read it. Not sure what makes EasyJTAG say the emmc is password locked. Are you sure you're trying to read the main MLC partition, and not RPMB or boot ones?
SevenWithaT
Member
I desoldered the emmc so the it should be isolated. the chip is h26m42001fmr. You just reminded me that i did brought my car to the service center for a quote on the repair. i don't think they did anything to lock the emmc though.
I hope they are not implementing encryption. 2019.40 is pretty old, we've recovered plenty from that version. Never been prompted for a password for any MCU1 chip yet.
Also encrypting most older chips would probably kill them with all the additional writes.
