Subaru: camera FW query isn't complete on startup

[sshane]

Brought to our attention from the FW bot, many Subarus return different results for the same ECU and request:

1c451e9ed3c48243|2024-01-15--16-10-38:
[('ecu', 'fwdCamera'), ('fwVersion', b'\x00\x00e\x9a\x00\x00\x00\x00\x00\x00'), ('address', 1927), ('subAddress', 0), ('responseAddress', 1935), ('request', [b'"\xf1\x82'])
vs
1c451e9ed3c48243|2024-01-15--20-36-22:
[('ecu', 'fwdCamera'), ('fwVersion', b'\x00\x00e\x9a\x00\x1f@ 1\x00'), ('address', 1927), ('subAddress', 0), ('responseAddress', 1935), ('request', [b'"\xf1\x82']) (edited) 

Race condition on startup?

Also looks like we've been adding them to the database:

    (Ecu.fwdCamera, 0x787, None): [
      b'\x00\x00df\x1f@ \n',
      b'\x00\x00d\x95\x00\x00\x00\x00',
      b'\x00\x00d\x95\x1f@ \x0f',
      b'\x00\x00d\xfe\x00\x00\x00\x00',

Bounty

After 10 seconds our Outback's fwdCamera returns the full non-zero-suffixed FW. b'\x00\x00eJ\x00\x00\x00\x00\x00\x00' -> b'\x00\x00eJ\x00\x1f@ \x19\x00'. There is another FW version-related data ID (DID) on 0xf100 when using read data by ID, can we use that instead, or is it the bootloader software version or similar?

Bounty requirements:

• Our existing 0xf182 RDBI query returns the complete FW version every time, even right after startup
• OR using our commaCarSegments database, you can verify that we can use another ECU or DID. There's a EyeSight Monitor ECU that we can query that returns the physical part number and software version for example, but it's a HUD ECU.
  • We can use another ECU or DID if you verify that it has enough information to identify the API of the car reliably -- if it has LKAS and ACC we can control -- and we don't fingerprint on cars without the complete API to control the car.

[jyoung8607]

Are they known to be doing this currently?

There used to be a similar problem with HKG. IIRC we weren't correctly implementing some aspect of ISO-TP flow control and so we'd intermittently see garbage past the first frame. There could be leftover artifacts in any port's FW from that time period.

[sshane]

I believe it's the latest version, we'll try to reproduce on our Subaru soon. I believe this occasionally still happens for Hyundai's transmission FW but we don't need to rely on it so we're fine.

[jnewb1]

happened on our outback here: 344c5c15b34f2d8a/2024-01-26--09-09-29

so we might be able to replicate this and find the cause

[sshane]

Here's a case where a user's fwdCamera returned b'\r!\x08\x017\x00\x00\x00\x00\x00', a few times until it switched to b'\r!\x08\x017\n!\x08\x003',

2ef74f5bd24ef68b

@jnewb1 Have we figured out anything here?

[sshane]

After 10 seconds our Outback's fwdCamera returns the full non-zero-suffixed FW. b'\x00\x00eJ\x00\x00\x00\x00\x00\x00' -> b'\x00\x00eJ\x00\x1f@ \x19\x00'