Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful data recovery of broken eMMC chip MCU1

This site may earn commission on affiliate links.
Maybe its a problem thst i connected the sd part of the AllSocket directly into my sd-card slot on the laptop, and i should rather connect it though a usb Sd reader?

Allsocket SD doesn't also work for me with internal SD reader (tested three different ones) because of I/O errors.
But I didn't try in-circuit reading - only with BGA socket.
 
Last edited:
No you just need a computer that see's the SD with emmc as /dev/mmcblkX vs /dev/sdX
Any idea how to make (or what computer it would take to make) the Allsocket USB3 adapter appear as /dev/mmcblk{n} ? I tried 3 different computers and even asked one other member here with the same Allsocket USB adapter, and it is always recognized as a scsi device :(
 
Last edited:
Allsocket SD doesn't also work for me with internal SD reader (tested three different ones) because of I/O errors.
But I didn't try in-circuit reading - only with BGA socket.
Hmm.... that's not good news :(. I don't think in-circuit would make a difference here. Was it on the Hynix part of Swissbit one?

I started on some backup plans already (I ordered the Allsocket SD adapter but it is 2 weeks out, so I started thinking about alternatives and even getting some parts in case I need them). The plan is more or less as follows:
  1. Try to get the USB3 Allsocket to mount as mmcblk (almost giving up on this one)
  2. Try the SD Allsocket on an laptop with internal MMC reader
  3. Try the SD Allsocket on a Beaglebone Black (via a simple adapter, as it has an MMC interface routed to micro SD slot). I know that platform has been used in the past to hack boot partitions and such, so it definitely has a capable controller, so this has a very high chance of success.
  4. Use the SD Allsocket only to give me the signals (it has nice labeled headers with the BGA signals routed out) and wire those signals to another embedded device with its own MMC controller - for example I have an old tablet rooted for work which has its own eMMC and a free MMC port - I know I can send mmc commands to the onboard eMMC, so it should work with the second port just the same.
  5. Route the signals from Allsocket SD adapter headers to a GPIO controller, and bit-bang the necessary commands I need (slow, but I don't need to write the entire flash this way, just configure it).
An alternative, if I get impatient and don't want to wait 2 weeks for the SD adapter, I was thinking to just trace out the needed signals using the removable BGA socket from the Allsocket USB (I know which pin on the BGA is which signal, and I have 2 30 pin mini headers on the back of the removable socket).

For what purpose do you need the mmc-utils?
I need it purely to reconfigure the Swissbit part to reliable mode (a.k.a. pSLC) prior to programming and putting it in the MCU. I plan to convert 100% of the chip to reliable mode, so I will lose 50% of storage, but in exchange I get much improved data retention, faster read/write transfers and higher IO/s. Manufacturer recommends reliable mode for this of application too. Steps are simple (if I can issue mmc commands):
  1. Set the entire chip capacity as reliable region (wear leveling doesn't work across reliable and MLC so no point leaving any) - note, this is a one time operation, you cannot undo it or change it
  2. TRIM the entire device (might not be needed, but just in case)
  3. Write MCU image
  4. Solder it onto the MCU board
By switching chip manufacturers (Hynix to Swissbit) even if Tesla did implement any static refresh, that function will be lost (those usually use proprietary commands - not standardized in JEDEC yet AFAIK), so the most important aspect of reliable mode for me is the improved data retention (IIRC 3x+).
 
Last edited:
I never tried the USB one, I only have the SD one. And some computers see it as mmc some see as sdx.
Thanks, I was hoping maybe there was an alternate USB driver to use for Allsocket USB reader (if you had a computer with Allsocket USB mounting as mmcblk, we could find out what driver it used).

Btw, if you have an internal MMC reader (not via USB) you are more likely to see it as mmcblk. It seems USB readers just identify themselves as generic storage devices, rather than MMC controllers - probably for ease of use, no need to ship drivers with the reader if you can use a generic driver. If the reader supports SDIO (e.g. ones built into laptops), then you know it's not a generic storage device, so most likely will mount as mmcblk.
 
Last edited:
Did you have a look at Swissbit EM-26 series - they are already configured for pSLC by factory?
I got the EM-20 series (a 16GB to play with, and 64GB to install in the car). Excellent point though! I forgot about the EM-26 series (did the parts research a while back, just never got around to doing the swap, I do remember seeing that 32GB was the max size which steered me to the EM-20 64GB instead). Just ordered one (will keep the EM-20 for other experiments/projects). Problem solved. Thanks!

PS> About my previous comment about retention was not entirely accurate: cell retention at the beginning of life is 10 years, at the end of life is 1 year for both MLC and pSLC, however the life of pSLC is almost 7x of the MLC (the number of cell P/E cycles goes from 3000 to 20000 for pSLC).
 
Last edited:
PS> About my previous comment about retention was not entirely accurate: cell retention at the beginning of life is 10 years, at the end of life is 1 year for both MLC and pSLC, however the life of pSLC is almost 7x of the MLC (the number of cell P/E cycles goes from 3000 to 20000 for pSLC).
To finish this thought, you lose half the cells to pSLC so with wear leveling that means 2x average wear on each cell, but you get 7x the P/E cycles per cell, so overall the same chip in pSLC configuration will yield you ~3.5x the life. :)
 
Allsocket SD doesn't also work for me with internal SD reader (tested three different ones) because of I/O errors.
But I didn't try in-circuit reading - only with BGA socket.
Just an update, I received my Allsocket SD adapter (fastest shipping from China ever), and using it on a laptop with internal MMC controller, I am able to issue mmc commands. Below is the extcsd read output for a 16GB Swissbit (note it is still in MLC mode - ENH_SIZE_MULT == 0):
Code:
root@ubuntu18-lt:/home/******# mmc extcsd read /dev/mmcblk0
=============================================
  Extended CSD rev 1.7 (MMC 5.0)
=============================================

Card Supported Command sets [S_CMD_SET: 0x01]
HPI Features [HPI_FEATURE: 0x01]: implementation based on CMD13
Background operations support [BKOPS_SUPPORT: 0x01]
Max Packet Read Cmd [MAX_PACKED_READS: 0x3c]
Max Packet Write Cmd [MAX_PACKED_WRITES: 0x3c]
Data TAG support [DATA_TAG_SUPPORT: 0x01]
Data TAG Unit Size [TAG_UNIT_SIZE: 0x03]
Tag Resources Size [TAG_RES_SIZE: 0x00]
Context Management Capabilities [CONTEXT_CAPABILITIES: 0x05]
Large Unit Size [LARGE_UNIT_SIZE_M1: 0x07]
Extended partition attribute support [EXT_SUPPORT: 0x03]
Generic CMD6 Timer [GENERIC_CMD6_TIME: 0x19]
Power off notification [POWER_OFF_LONG_TIME: 0xff]
Cache Size [CACHE_SIZE] is 1024 KiB
Background operations status [BKOPS_STATUS: 0x00]
1st Initialisation Time after programmed sector [INI_TIMEOUT_AP: 0x64]
Power class for 52MHz, DDR at 3.6V [PWR_CL_DDR_52_360: 0x00]
Power class for 52MHz, DDR at 1.95V [PWR_CL_DDR_52_195: 0x00]
Power class for 200MHz at 3.6V [PWR_CL_200_360: 0x00]
Power class for 200MHz, at 1.95V [PWR_CL_200_195: 0x00]
Minimum Performance for 8bit at 52MHz in DDR mode:
 [MIN_PERF_DDR_W_8_52: 0x00]
 [MIN_PERF_DDR_R_8_52: 0x00]
TRIM Multiplier [TRIM_MULT: 0x11]
Secure Feature support [SEC_FEATURE_SUPPORT: 0x55]
Boot Information [BOOT_INFO: 0x07]
 Device supports alternative boot method
 Device supports dual data rate during boot
 Device supports high speed timing during boot
Boot partition size [BOOT_SIZE_MULTI: 0x20]
Access size [ACC_SIZE: 0x07]
High-capacity erase unit size [HC_ERASE_GRP_SIZE: 0x10]
 i.e. 8192 KiB
High-capacity erase timeout [ERASE_TIMEOUT_MULT: 0x11]
Reliable write sector count [REL_WR_SEC_C: 0x01]
High-capacity W protect group size [HC_WP_GRP_SIZE: 0x02]
 i.e. 16384 KiB
Sleep current (VCC) [S_C_VCC: 0x08]
Sleep current (VCCQ) [S_C_VCCQ: 0x08]
Sleep/awake timeout [S_A_TIMEOUT: 0x13]
Sector Count [SEC_COUNT: 0x01d20000]
 Device is block-addressed
Minimum Write Performance for 8bit:
 [MIN_PERF_W_8_52: 0x08]
 [MIN_PERF_R_8_52: 0x08]
 [MIN_PERF_W_8_26_4_52: 0x08]
 [MIN_PERF_R_8_26_4_52: 0x08]
Minimum Write Performance for 4bit:
 [MIN_PERF_W_4_26: 0x08]
 [MIN_PERF_R_4_26: 0x08]
Power classes registers:
 [PWR_CL_26_360: 0x00]
 [PWR_CL_52_360: 0x00]
 [PWR_CL_26_195: 0x00]
 [PWR_CL_52_195: 0x00]
Partition switching timing [PARTITION_SWITCH_TIME: 0x03]
Out-of-interrupt busy timing [OUT_OF_INTERRUPT_TIME: 0x04]
I/O Driver Strength [DRIVER_STRENGTH: 0x1f]
Card Type [CARD_TYPE: 0x57]
 HS200 Single Data Rate eMMC @200MHz 1.8VI/O
 HS Dual Data Rate eMMC @52MHz 1.8V or 3VI/O
 HS eMMC @52MHz - at rated device voltage(s)
 HS eMMC @26MHz - at rated device voltage(s)
CSD structure version [CSD_STRUCTURE: 0x02]
Command set [CMD_SET: 0x00]
Command set revision [CMD_SET_REV: 0x00]
Power class [POWER_CLASS: 0x00]
High-speed interface timing [HS_TIMING: 0x01]
Erased memory content [ERASED_MEM_CONT: 0x00]
Boot configuration bytes [PARTITION_CONFIG: 0x00]
 Not boot enable
 No access to boot partition
Boot config protection [BOOT_CONFIG_PROT: 0x00]
Boot bus Conditions [BOOT_BUS_CONDITIONS: 0x00]
High-density erase group definition [ERASE_GROUP_DEF: 0x01]
Boot write protection status registers [BOOT_WP_STATUS]: 0x00
Boot Area Write protection [BOOT_WP]: 0x00
 Power ro locking: possible
 Permanent ro locking: possible
 ro lock status: not locked
User area write protection register [USER_WP]: 0x00
FW configuration [FW_CONFIG]: 0x00
RPMB Size [RPMB_SIZE_MULT]: 0x20
Write reliability setting register [WR_REL_SET]: 0x1f
 user area: the device protects existing data if a power failure occurs during a write operation
 partition 1: the device protects existing data if a power failure occurs during a write operation
 partition 2: the device protects existing data if a power failure occurs during a write operation
 partition 3: the device protects existing data if a power failure occurs during a write operation
 partition 4: the device protects existing data if a power failure occurs during a write operation
Write reliability parameter register [WR_REL_PARAM]: 0x04
 Device supports the enhanced def. of reliable write
Enable background operations handshake [BKOPS_EN]: 0x00
H/W reset function [RST_N_FUNCTION]: 0x00
HPI management [HPI_MGMT]: 0x01
Partitioning Support [PARTITIONING_SUPPORT]: 0x07
 Device support partitioning feature
 Device can have enhanced tech.
Max Enhanced Area Size [MAX_ENH_SIZE_MULT]: 0x0001d2
 i.e. 7634944 KiB
Partitions attribute [PARTITIONS_ATTRIBUTE]: 0x00
Partitioning Setting [PARTITION_SETTING_COMPLETED]: 0x00
 Device partition setting NOT complete
General Purpose Partition Size
 [GP_SIZE_MULT_4]: 0x000000
 [GP_SIZE_MULT_3]: 0x000000
 [GP_SIZE_MULT_2]: 0x000000
 [GP_SIZE_MULT_1]: 0x000000
Enhanced User Data Area Size [ENH_SIZE_MULT]: 0x000000
 i.e. 0 KiB
Enhanced User Data Start Address [ENH_START_ADDR]: 0x000000
 i.e. 0 bytes offset
Bad Block Management mode [SEC_BAD_BLK_MGMNT]: 0x00
Periodic Wake-up [PERIODIC_WAKEUP]: 0x00
Program CID/CSD in DDR mode support [PROGRAM_CID_CSD_DDR_SUPPORT]: 0x01
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[127]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[126]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[125]]: 0x20
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[124]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[123]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[122]]: 0x20
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[121]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[120]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[119]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[118]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[117]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[116]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[115]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[114]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[113]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[112]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[111]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[110]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[109]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[108]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[107]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[106]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[105]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[104]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[103]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[102]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[101]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[100]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[99]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[98]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[97]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[96]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[95]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[94]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[93]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[92]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[91]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[90]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[89]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[88]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[87]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[86]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[85]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[84]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[83]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[82]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[81]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[80]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[79]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[78]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[77]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[76]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[75]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[74]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[73]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[72]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[71]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[70]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[69]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[68]]: 0x01
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[67]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[66]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[65]]: 0x00
Vendor Specific Fields [VENDOR_SPECIFIC_FIELD[64]]: 0x00
Native sector size [NATIVE_SECTOR_SIZE]: 0x00
Sector size emulation [USE_NATIVE_SECTOR]: 0x00
Sector size [DATA_SECTOR_SIZE]: 0x00
1st initialization after disabling sector size emulation [INI_TIMEOUT_EMU]: 0x00
Class 6 commands control [CLASS_6_CTRL]: 0x00
Number of addressed group to be Released[DYNCAP_NEEDED]: 0x00
Exception events control [EXCEPTION_EVENTS_CTRL]: 0x0000
Exception events status[EXCEPTION_EVENTS_STATUS]: 0x0000
Extended Partitions Attribute [EXT_PARTITIONS_ATTRIBUTE]: 0x0000
Context configuration [CONTEXT_CONF[51]]: 0x00
Context configuration [CONTEXT_CONF[50]]: 0x00
Context configuration [CONTEXT_CONF[49]]: 0x00
Context configuration [CONTEXT_CONF[48]]: 0x00
Context configuration [CONTEXT_CONF[47]]: 0x00
Context configuration [CONTEXT_CONF[46]]: 0x00
Context configuration [CONTEXT_CONF[45]]: 0x00
Context configuration [CONTEXT_CONF[44]]: 0x00
Context configuration [CONTEXT_CONF[43]]: 0x00
Context configuration [CONTEXT_CONF[42]]: 0x00
Context configuration [CONTEXT_CONF[41]]: 0x00
Context configuration [CONTEXT_CONF[40]]: 0x00
Context configuration [CONTEXT_CONF[39]]: 0x00
Context configuration [CONTEXT_CONF[38]]: 0x00
Context configuration [CONTEXT_CONF[37]]: 0x00
Packed command status [PACKED_COMMAND_STATUS]: 0x00
Packed command failure index [PACKED_FAILURE_INDEX]: 0x00
Power Off Notification [POWER_OFF_NOTIFICATION]: 0x01
Control to turn the Cache ON/OFF [CACHE_CTRL]: 0x01
eMMC Firmware Version:
eMMC Life Time Estimation A [EXT_CSD_DEVICE_LIFE_TIME_EST_TYP_A]: 0x01
eMMC Life Time Estimation B [EXT_CSD_DEVICE_LIFE_TIME_EST_TYP_B]: 0x01
eMMC Pre EOL information [EXT_CSD_PRE_EOL_INFO]: 0x01
 
  • Like
Reactions: scaesare
Differences in where data is stored? Differences in formatting partitions? Who knows. Just trying to figure out reasons why I can't find my certificates.
That only matters if you want to root your car, or your emmc is not entirely recoverable and you plan to use some other image but substituting your own certs and configuration. If you're just trying to proactively replace the emmc, cloning the entire 8GB block by block and should work, regardless of format of partitions, encryption, etc (as long as they don't tie it to a specific chip).
 
If it wasn't obvious from my previous posts, my emmc was not completely recoverable. I can see p1 and p2, but p3 and p4 just produce 128 mb and about 5 gb of zeros, respectively.
It very is unlikely that the zeroing of most of the data has to do with a new software version. Your emmc chip has lost data. Are the zeros being read-out as actual zeros, or are they read errors that whatever you are using to copy the content just writes as zeros? If the latter, you could try freezing the chip, see if you can recover enough. If they are reading out as valid zero values, that would mean somehow they blocks got erased, or the chip has spectacularly failed in a way where the data became all zeros (including matching checksums which allow the chip to detect errors), for most of the chip area - recovering that might not be possible.

PS> There is one other long shot possibility, maybe your reader has issues, or maybe the chip pins are not connecting quiet right (did one of the pads come off during desoldering for example?). Low chance, but might be worth a try to make sure all the pins are clean and there, and if that doesn't work, maybe try another reader.
 
Last edited:
  • Helpful
Reactions: Banjo