commaai / commaai/opendbc

Subaru: camera FW query isn't complete on startup

Open
#1,153 9 comments 0 reactions 0 assignees View on GitHub
bug car subaru
Dominant language
Python
Stars
3.4k
Forks
2.3k
Avg merge
2d 8h
Merged PRs (30d)
39

Description

Brought to our attention from the FW bot, many Subarus return different results for the same ECU and request:

```python
1c451e9ed3c48243|2024-01-15--16-10-38:
[('ecu', 'fwdCamera'), ('fwVersion', b'\x00\x00e\x9a\x00\x00\x00\x00\x00\x00'), ('address', 1927), ('subAddress', 0), ('responseAddress', 1935), ('request', [b'"\xf1\x82'])
vs
1c451e9ed3c48243|2024-01-15--20-36-22:
[('ecu', 'fwdCamera'), ('fwVersion', b'\x00\x00e\x9a\x00\x1f@ 1\x00'), ('address', 1927), ('subAddress', 0), ('responseAddress', 1935), ('request', [b'"\xf1\x82']) (edited)
```

Race condition on startup?

Also looks like we've been adding them to the database:

```
(Ecu.fwdCamera, 0x787, None): [
b'\x00\x00df\x1f@ \n',
b'\x00\x00d\x95\x00\x00\x00\x00',
b'\x00\x00d\x95\x1f@ \x0f',
b'\x00\x00d\xfe\x00\x00\x00\x00',
```

Bounty
---

After 10 seconds our Outback's fwdCamera returns the full non-zero-suffixed FW. b'\x00\x00eJ\x00\x00\x00\x00\x00\x00' -> b'\x00\x00eJ\x00\x1f@ \x19\x00'. There is another FW version-related data ID (DID) on 0xf100 when using read data by ID, can we use that instead, or is it the bootloader software version or similar?

Bounty requirements:
- Our existing 0xf182 RDBI query returns the complete FW version every time, even right after startup
- OR using our [commaCarSegments](https://blog.comma.ai/096release/#commacarsegments) database, you can verify that we can use another ECU or DID. There's a EyeSight Monitor ECU that we can query that returns the physical part number and software version for example, but it's a HUD ECU.
- We can use another ECU or DID if you verify that it has enough information to identify the API of the car reliably -- if it has LKAS and ACC we can control -- and we don't fingerprint on cars without the complete API to control the car.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the FW bot examples and the existing 0xf182 read-data-by-ID query, then compare the startup and delayed responses. Investigate the alternative 0xf100 DID and the EyeSight Monitor ECU against the commaCarSegments database. Done means reliably obtaining a complete firmware version or verifying an alternative ECU/DID identifies the controllable LKAS and ACC API without false fingerprints.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
embedded-iot, reverse-engineering
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.