Kindle Fire HD 7" eMMC access

[overlode]

Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.

A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.

I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.

I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://xdaforums.com/showthread.php?t=2415870

But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!

My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.

I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.

There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.

 

[SafinWasi]

Hi all, following on from kurohyou's excellent work on the KF2, I thought I would go about trying to develop a tutorial for unbricking a hardbricked Kindle Fire HD 7". This would be for the 2012 model, NOT the 2013.

A little bit of background on myself. I have always had a keen interest in electronics and studied microelectronics at college. I am pretty good at soldering etc even on small SMD devices, even more so now I have spent out on some decent kit (helping hands, rework station etc). Now I have decided to carry out this project as a summer hobby and hopefully I will get some support from you guys.

I have managed to piece together enough information that I think will enable me to complete this tutorial, with the exception of Linux, something that I am very new to and would need some assistance with.

I have seen common names among the forums when it comes to this type of subject, stunts513, soupmagnet, hashcode to name a few. I am hoping with the assistance of these members I can complete a comprehensive guide on unbricking a Kindle Fire HD 7", similar to http://xdaforums.com/showthread.php?t=2415870

But please beware, IF YOU HAVE ANYTHING OTHER THAN A KINDLE FIRE HD 7" DO NOT USE THIS GUIDE!!

My main goal is to acquire a dead Kindle Fire HD 7" motherboard, as easily as possible. Unfortunately looking on eBay there seem to be very few from the UK and they are normally very expensive. I will keep looking but if anyone is willing to donate a non working or working motherboard for this cause I would be very grateful, just PM me if you can help. Just bear in mind due to the process it needs to go through, you will not get a working motherboard back, should you want it returned.

I aim to completely remove the eMMC from the motherboard and get exact pinout locations, as kurohyou did with his excellent KF2 guide. I will then use the same USB SD Card adaptor to see if the eMMC can even be read in the same way as the KF2. I have working knowledge of GParted in linux so I will also be using this to verify partition layouts and sizes. Once I have had any success in doing this I will update this post to reflect my progress.

There is my plan so far, if this has already been done, someone please tell me as I cannot find it anywhere.

Great job,will be useful to a lot of people if successful. And as for the support,we're all here to help ya
A lot of people spend time tinkering with Linux partitions,so getting support won't be as difficult as getting a dead motherboard,which is what worries me now. I would suggest you to buy a Fire HD,root it and leave the rest to your imagination (I would try to flash a Galaxy S3 Kernel using Odin or something )
Anyway,good luck!

 

[overlode]

I have managed to get myself a cheap Fire HD so just waiting for it to come in the post.As far as I can tell the Fire HD uses a very similar eMMC chip as the Fire 2 so I am hoping the partition structure is the same. If /dev/sdc2 is 256Kb and listed as bootloader then I think it should be straightforward to flash in the same way using the dd command.

Anyway, more updates to come

 

[overlode]

Update - I have now got a motherboard from a Kindle Fire HD 7", will go ahead and solder USB adaptor in the next few days and see what happens - more details to follow.

 

[overlode]

Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.

The SD card is wired like so -

https://www.dropbox.com/s/9zsrbevo97ifccj/SD%20Card%20wiring.JPG?dl=0

I drilled some very small holes close to the end of the mini SD internal connections to add stability to the wires. I used Valery_'s image to get the connection labels -

https://www.dropbox.com/s/fur0gxy72lox6yb/SD%20Card%20pinout.jpg?dl=0

For the VCC and VccQ wires, because there are two paired together it was not going to be possible to fit them into the SD card adaptor so I made a fly lead off of the main VCC wire -

https://www.dropbox.com/s/ocmw7p2dgsp4ia6/VCC%20fly%20lead.JPG?dl=0

Next I will be attempting to solder each wire onto the KFHD7 motherboard.

All done. I haven't cut the tracks that have been indicated in this picture as my PC recognises the eMMC under Windows 8 -

https://www.dropbox.com/s/1lyumxvw5h7agx4/Fire%20HD%20Pinout%20with%20VDDI.jpg?dl=0

So here is the motherboard soldered up -

https://www.dropbox.com/s/n30jpvbyhapoub7/Motherboard%20wiring%20KFHD7.JPG?dl=0

Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.

 

[overlode]

Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting

Any help on this would be much appreciated.

 

[overlode]

Ok, another post, sorry

Been doing some more research on the eMMC chip and I have found an official data sheet for the chip here

It seems that there are different pins for Vss and Vcc and I am wondering if this is causing the problem as I may be supplying power to the wrong part of the eMMC. Will see if R10 and T10 on the schematic lead to anywhere else and negate the need to cut the tracks, something which I still don't quite fully understand. Edit - R10 (Vss) does not seem to have a place on the board

As you can see from the following table it lists all the necessary locations for applying power to modify the eMMC -

https://www.dropbox.com/s/a7f299p492gf7qe/eMMC%20Pinout.jpg

VDDF is Vcc and VDD is VccQ .

I will check out these two pins later on and see where they lead on the board.

More to follow...

 

[Valery_]

Ok, a little frustrating but after checking and rechecking the solder points on the motherboard they are definitely correct, however Vcc, VccQ and Vss are still casting some doubt in my mind, considering that the VccQ and Vss points are both sides of capacitor 801 (C801). I am not 100% convinced that Vcc, VccQ and Vss have other points on the board. Reading the eMMC specifics here there are lots of Vcc, Vss and VccQ. I am not totally sure if there is a definite one that needs connecting

Any help on this would be much appreciated.

http://xdaforums.com/attachment.php?attachmentid=2784284&d=1402079403
http://xdaforums.com/showthread.php?t=2775022
good luck

 

[overlode]

http://xdaforums.com/attachment.php?attachmentid=2784284&d=1402079403
http://xdaforums.com/showthread.php?t=2775022
good luck

Ok, I have put your image side by side with your top image and colour coded the points (Just bear in mind the right hand image is a mirror image of the BGA). No matter how I look at it, everything is correct and all Vcc, VccQ and Vss points are interconnected so I do not see how it is not working. Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?

How have you got on with this? The closest I have been is Windows 8 detecting something but Ubuntu doesn't see anything.



Cheers

 

[Valery_]

Can you explain to me the need for cutting the tracks in your original image and what the version 1 and version 2 mean please?

Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Schottky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)

 

[overlode]

Cutting the tracks had two goals: 1. to decrease power of supply from cardreader, 2. to protect the chips which are supplying 1.8 V
Additionally I used diode Shotky to decrease voltage to 1.6 V
There were impulses CMD and CLK, but there was a problem with signals Data0 - Data3. Level on these pinouts didn't change, was about 1 V
Supposedly the processor blocked Data0..3
I tried to connect cardreader with signal Reset on the motherboard, but there weren't Data0..3
So both in the case with 1.8 V and in the case with 3.3 V on the contact VccQ, there was a voltage about 1 V on Data0..3
I think there is a possibility of access to eMMC if OMAP is blocked and then it will make Data0..3 free (third output state Z)

I can't understand why they changed it so radically just for the KFHD 7" as the eMMC on the KF2 and the KFHD 8.9" are both easily accessible. It seems weird how they would use the OMAP to block it just on this model. Looking at the datasheet, are we missing something with VDDI, there is a suggestion to ground it via a 0.1 micro farad capacitor. Any thoughts on this?

VDDi Connections
The VDDi (K2) ball must only be connected to an external capacitor that is connected to VSS. This signal may not be left floating. The capacitor’s specifications and its placement instructions are detailed below.
The capacitor is part of an internal voltage regulator that provides power to the controller.
Caution: Failure to follow the guidelines below, or connecting the VDDi ball to any external signal or power supply, may cause the device to malfunction.
The trace requirements for the VDDi (K2) ball to the capacitor are as follows:
• Resistance: <2 ohm
• Inductance: <5 nH
The capacitor requirements are as follows:
• Capacitance: >=0.1 uF
• Voltage Rating: >=6.3 V
• Dielectric: X7R or X5R

Thanks to RolF2 from this post

SanDisk iNAND has three power domains assigned to VCCQ, VCC and VDDi, as shown in Table
10.
Table 10 - Power Domains
Pin Power Domain Comments
Supported voltage ranges:
High Voltage Region: 3.3V (nominal)
VCCQ Host Interface
Low Voltage Region: 1.8V (nominal)
VCC Memory Supported voltage range:
High Voltage Region: 3.3V (nominal)
VDDi Internal VDDi is the internal regulator connection to an
external decoupling capacitor.

Page 25+26 of this document explains it more. Looks like we may only need to ground VDDI with a 0.1uf capacitor. From what I can see on the motherboard all other connections already have capacitors grounding Vcc and VccQ.

Found the connection for VDDI -

https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg

 

[Valery_]

Found the connection for VDDI -

https://www.dropbox.com/s/gzk11dywlmxzcmk/Fire%20HD%20Pinout%20with%20VDDI.jpg

I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.

 

[overlode]

I think that this will not resolve the problem. Connection of capacitor is strange. But this finding is a plus in the investigation.

The thing that confuses me is the fact that there are no other connections to the BGA array that come from a different source, all Vcc, VccQ and Vss connections are linked and already grounded with capacitors so you should be able to apply power to anywhere of these points. The fact that it is stated that this particular chip has 3 power domains, not 2 like the previous chips is encouraging.

As for your comment about the OMAP blocking access to the eMMC I don't think this is the case as the chip is used in a lot of nand flash technologies that do not have any OMAP device paired with them.

As soon as I get my next motherboard I am going to try the VDDI connection, it cannot do any harm as it controls internal voltage to the eMMC.

I will keep digging but I am pretty sure there is nothing more we have missed as I have been over the data sheet again and again.

Ok, I understand VDDI now, you don't need to touch this connection as it is used internally to regulate chip voltage. So back to the drawing board

 

[overlode]

Ok, I am going to make a simple voltage regulator to go inline with my USB card reader to make sure input voltage to the eMMC is 3.3v as I suspect over voltage may be causing a malfunction within the internal voltage stabiliser circuit of the eMMC. It seems over voltage triggers complete shutdown of the eMMC using internal diodes so this may explain the 1v or less output from the DAT pins.

Valery_, if I make sure input voltage is 3.3v then that would dismiss the need to cut the tracks yes?

 

[overlode]

Ok, I think this project has to be put on hold again. No matter what I try Ubuntu will not recognise the partitions of the eMMC even though the SD card adaptor flashes and then stops flashing as if being read properly. Connecting to VDDI fries your card reader instantly so do not try this!!

I just cannot see what we are missing and why this motherboard is so different from the KF2 yet not?

There has to be some way to gain access to the eMMC as the chip is so commonly used with other devices.

I will continue this project if I make any break through or if someone finds out something that we may be missing.

For the meantime I will continue with the KF2 unbricking as that is going rather well for me at the moment.

 

[overlode]

Reserved

 

[Valery_]

Reserved

Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.

 

[overlode]

Maybe this information will be useful:
The MAX3002 accept VL voltages from +1.2V to +5.5V and VCC voltages from +1.65V to +5.5V, making them ideal for data transfer between low-voltage ASICs/PLDs and higher voltage systems.

Isn't this just what we have been supplying though? My simple voltage regulator supplied 3.3v

 

[kero2005]

picture not load

Ok, so I have opted to try and use a mini SD card adaptor for this project as it is very easy to kill a USB SD card adaptor if you get just one wiring point wrong, although this does have an increased risk of frying your USB port if you are VERY unlucky.

The SD card is wired like so -



Update - after the eMMC was not recognised by Ubuntu I cut the 2 tracks in question, and still nothing. I am also now getting 0v from the card reader however the laptop still recognises SD cards inserted. I will acquire some more USB SD card adaptors and try again with those. More to follow.

can you fix those picture? . it was prolem with dropbox
Thanks

 

[overlode]

can you fix those picture? . it was prolem with dropbox
Thanks

Pictures fixed, for what it's worth