Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful data recovery of broken eMMC chip MCU1

This site may earn commission on affiliate links.
And I did not understand all this fuss with the supply voltage of the emmk, pull-up resistors and expensive programmers.

Above I met sound ideas, let me add.

1. Voltage.
5 volts, preferably from a power bank - to the input power capacitors of the Tegra board.
2. Wires.
The length is not particularly critical, the maximum on which I tried 20 centimeters. But shorter is better, and with good wires. For in-circuit work, I use the so-called MGTF with a cross section of 0.2 - a copper stranded wire in fluoroplastic insulation.
3. Pull-up resistors.
Not required as they are available on the Tegra board.
4. Connection points.
There are 5 of them. CLK, CMD, GND, D0, D1 (connect this pin in parallel with GND)
5. Blocking the Tegra processor.
Jumper to the quartz resonator.
And jumper D1-GND forbids the processor to access EMMC.
6. Reader.
Any USB SD card reader.
7. Content of sections.
FW versions for p1 and p2 partitions can be found in /deploy/platform.ver.
Workable images of these two partitions are best taken from the IC - they are exactly the same as on the MCU. If you know exactly which firmware version is relevant for your MCU, it is enough to write one image to both partitions.
Section p3 strongly recommend reading and saving file-by-file, and not as an image - with a check of what has been preserved - especially certificates and the mcu command key. The most important thing is to keep the /etc folder completely, the rest is secondary.
Section p4 does not have to be written to a new EMMC, but if it is read stably, then it is enough to save and transfer only the tesla folder. The system will add the rest to p4 itself.
8. Magazines
The reasons for MCC failures can be viewed in /log/syslog by searching for the keywords squashfs, mmcblk0p, error with a command like <cat syslog | grep squashfs> (execute in file directory)

The D0 exchange rate is low, reading a full EMMC dump takes about 20 minutes.
Of course, I use the programmer for in-circuit work, but functionally it is completely identical to the SD reader. This circuit has been successfully used for about 5 years, several dozen MCU have been repaired.

Alternative connection - CLK, CMD, GND, D0-D3, jumper to quartz (do not connect D1 to GND) time not less than 20 minutes) - and you can freely access EMMC via 4 data lines :)
 
The MCU1 has peaked my interest quite a bit over the last few weeks.... I've learned a ton about how it works and would love to work with some others with similar interests.


I'm too new of a user to PM, maybe you can PM me to open conversation.

I'm interested in images, emmc swaps, where I might find an image of the 64mb IC FLASH 512MBIT PARALLEL 64FBGA, how to select the boot partition, rooting, etc.
 
  • Like
Reactions: Zeemo and Synthax
My eMMC replacement has gone well all except it doesn't create the OpenVPN connection anymore... syslog reports

RESOLVE: Cannot resolve host address: vpn.vn.teslamotors.com: [HOST_NOT_FOUND] The specified host is unknown.

Googling implies vpn.vn.teslamotors.com and vpn.dev.teslamotors.com should both be dns for Tesla OpenVPN servers but there are no addresses (at least in public dns).

Any pointers would be appreciated.
 
My eMMC replacement has gone well all except it doesn't create the OpenVPN connection anymore... syslog reports

RESOLVE: Cannot resolve host address: vpn.vn.teslamotors.com: [HOST_NOT_FOUND] The specified host is unknown.

Googling implies vpn.vn.teslamotors.com and vpn.dev.teslamotors.com should both be dns for Tesla OpenVPN servers but there are no addresses (at least in public dns).

Any pointers would be appreciated.
The certificates get updates every now and then(least what I read) when did you make a copy and how long after that did you put it into a new chip? Also the certificates could had been in a bad sector of the chip so did not copy correctly.
 
The certificates get updates every now and then(least what I read) when did you make a copy and how long after that did you put it into a new chip? Also the certificates could had been in a bad sector of the chip so did not copy correctly.
looks like OpenVPN is a thing of the past? I've since got the "VPN" going (shows VPN by the WiFi) but it's not OpenVPN, it's HTTPS/SSL Web Socket. It looks like it uses the same keys though?
 
I downgraded my MCU1 from 2020.48.37 to 2019.36.2 but it’s not recognizing my Parrot/WiFi/Bluetooth… nor is it pushing the 2019.36.2 version to my IC and won’t talk to it anymore.

Was downgrading my MCU simply not something I should be doing?

I am trying to repair an MCU1. The firmware (2019.16.*) was corrupted. Do you have a copy of this version? I have other version like 2020.36.* but have not figure out how to upgrade without a working one first
 
Hi all.

Could anyone help me? I have purchased a used Model S with dead MCU. (EMMC was dead) I have sent it to a company to get it replaced, however they were not able to read the data off it, so they asked me what firmware does the car have which I didn’t know.

They ended up installing 2020.36 and sending the chip back to me, I have re-assembled the MCU and it did power on, however does not want to charge.

The people who replaced the EMMC were able to login to the car remotely and they found out that the IC had 2019.8.8, so they installed that version remotely and now the MCU didn’t even boot up.

So they reverted back to 2020.36 and now I have following issues:


Code:
GTW_f209_noChargeAllowed
There is either a version mismatch or a platform mismatch, which is preventing the Gateway from allowing charge.
GTW_f210_noSupportAllowed
There is either a firmware version mismatch or a platform mismatch, which is preventing the Gateway from allowing 12V support.
GTW W042 TASversionMismatch
TAS may not function properly
GTW f208 noDriveAllowed
There is either a firmware version mismatch or a platform mismatch, which is preventing the Gateway from allowing Drive.
GTW_w016_BLEEPCENTERversionMismatch
BLEEPCENTER is running different version than the expected
BLEEPCENTER may not function properly

So now the car won’t even drive anymore.

At this point this company abandoned me with my issues…

I have in the meantime sent away the old eMMC chip to multi-com.pl and they were able to extract my vpn certs and keys. :)


However now I am still stuck, how can I upload the data to the new eMMC? Is there a possibility without taking it apart again?

If the certificate is restored can I request a new software install from Service Mode within the MCU?

Any help is appreciated.
 
Hi all.

Could anyone help me? I have purchased a used Model S with dead MCU. (EMMC was dead) I have sent it to a company to get it replaced, however they were not able to read the data off it, so they asked me what firmware does the car have which I didn’t know.

They ended up installing 2020.36 and sending the chip back to me, I have re-assembled the MCU and it did power on, however does not want to charge.

The people who replaced the EMMC were able to login to the car remotely and they found out that the IC had 2019.8.8, so they installed that version remotely and now the MCU didn’t even boot up.

So they reverted back to 2020.36 and now I have following issues:


Code:
GTW_f209_noChargeAllowed
There is either a version mismatch or a platform mismatch, which is preventing the Gateway from allowing charge.
GTW_f210_noSupportAllowed
There is either a firmware version mismatch or a platform mismatch, which is preventing the Gateway from allowing 12V support.
GTW W042 TASversionMismatch
TAS may not function properly
GTW f208 noDriveAllowed
There is either a firmware version mismatch or a platform mismatch, which is preventing the Gateway from allowing Drive.
GTW_w016_BLEEPCENTERversionMismatch
BLEEPCENTER is running different version than the expected
BLEEPCENTER may not function properly

So now the car won’t even drive anymore.

At this point this company abandoned me with my issues…

I have in the meantime sent away the old eMMC chip to multi-com.pl and they were able to extract my vpn certs and keys. :)


However now I am still stuck, how can I upload the data to the new eMMC? Is there a possibility without taking it apart again?

If the certificate is restored can I request a new software install from Service Mode within the MCU?

Any help is appreciated.

It sounds to me like you have one or more modules in your car that are still running the 2019.8.8 code (or some version other than 2020.36). I would suggest performing a service-redeploy

nc cid 25956
watch
service-redeploy

then wait for about an hour.
 
It sounds to me like you have one or more modules in your car that are still running the 2019.8.8 code (or some version other than 2020.36). I would suggest performing a service-redeploy

nc cid 25956
watch
service-redeploy

then wait for about an hour.
Hi.

Thank you, this worked.

Now, I had to replace the charging port as it was dead even after service redeploy.

However, I am now left with a new error.. CHG_u005 charging station not powered error. I tried 3 different UMC and same results. 1 phase or 3 phase don’t make a difference.

Anyone has any idea what this can be? Onboard charger?

My onboard charger is the v3 so it has no replaceable fuses as far as I seen from forums.
I would really only want to buy a new onboard charger as a last resort. :/

Thank you in advance for any advice, how could I test this further.