vin: alternate functional and direct requests across attempts - #3721
Open
SpysyWeeb wants to merge 1 commit into
Open
vin: alternate functional and direct requests across attempts#3721SpysyWeeb wants to merge 1 commit into
SpysyWeeb wants to merge 1 commit into
Conversation
Some ECUs answer a request addressed to them and stay silent on the functional one, even for a data identifier they carry. The 2021 Hyundai Palisade instrument cluster at 0x7c6 is one: no response to the functional UDS or OBD VIN requests on buses 0 and 1, the full VIN to a UDS 22 F1 90 sent to it directly on bus 0. Without a VIN the cached CarParams are never reused, so every ignition runs the full firmware query and its OBD multiplexing window. The first attempt is unchanged. The next one sends the request directly to the standard VIN addresses instead of functionally, and attempts keep alternating from there. A direct request never shares a query with a functional one, so an ECU that answers both cannot put two responses on one receiver. A car that answers the functional request never retries, no query is added and the startup timing refs are untouched. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Contributor
Car behavior reportReplays driving segments through this PR and compares the behavior to master. ✅ No changes detected |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some ECUs answer a request addressed to them and stay silent on the functional one, even for a data identifier they carry. The 2021 Hyundai Palisade instrument cluster at
0x7c6on bus 0 is one: nothing to the functional UDS or OBD VIN requests on either bus, the full VIN to a UDS22 F1 90sent to it directly. Without a VIN the cached CarParams are never reused, so every ignition runs the full firmware query and its OBD multiplexing window.The first attempt is unchanged. Retries send the request directly to
STANDARD_VIN_ADDRSinstead of functionally, so a direct request never shares a query with a functional one and an ECU that answers both cannot put two responses on one receiver. A car that answers the functional request never retries. No query is added and the startup timing refs are untouched; a retry, which today already means no VIN, sends one single frame per standard VIN address per request, plus a flow control frame for each ECU that answers. A first step toward theTODO: query physical addrsinget_vin, which stays.Tests:
test_fw_fingerprint.pygains a fake ISO-TP ECU: found only on the retry when it ignores the functional request, never addressed directly when it answers it, and a single direct request on the retry when it answers both but missed the first attempt. The timing test is unchanged.Route (2021 Palisade, dongle ff9dba54b42b3afa): 0000004d--9a6fe8181a runs the full query (first ignition after an update) and finds the VIN on the retry:
vin_rx_addr0x7e8, so on this car the ECM at 0x7e0 answers the request addressed to it and not the functional one either; 00000051--39b47d07c0 is the next ignition on the cached CarParams. Once the VIN is cached, the next ignition hits the stale-params race in pandad's safety setter; commaai/openpilot#38780 fixes that.🤖 Generated with Claude Code