From 4b8a778c10db0a13d44167af8043b534af56685a Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Fri, 9 Feb 2024 20:45:06 -0800 Subject: [PATCH 01/10] only spoof speed when ACC is active --- board/safety/safety_defaults.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index f336045698c..71af40d6a5f 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -253,9 +253,9 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { } if ((addr == 500) && (bus_num == 0)) { - // is acc ready? (pushing acc button) + // is acc active? // note - steering wheel will need few seconds to adjust the torque - if (GET_BYTE(to_push, 2) >> 4 & 0x1) { + if (GET_BYTE(to_push, 2) >> 5 & 0x1) { steer_type = 1; } else { steer_type = 3; From e07ef4ab865783d5b336edeac0767dc4b6c42d4a Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Sat, 10 Feb 2024 21:31:48 -0800 Subject: [PATCH 02/10] use op active to enable/disable wp speed spoofing this still does not work with MADS --- board/safety/safety_defaults.h | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 71af40d6a5f..2b6b57e99ee 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -199,6 +199,11 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { if ((addr == 658) && (bus_num == 0)) { is_op_active = (GET_BYTE(to_push, 0) >> 4) & 0x1; + if (is_op_active) { + steer_type = 1; + } else { + steer_type = 3; + } lkas_torq = ((GET_BYTE(to_push, 0) & 0x7) << 8) | GET_BYTE(to_push, 1); counter_658 += 1; } @@ -252,16 +257,6 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { acc_torq = (GET_BYTE(to_push, 4) & 0x7F) << 8 | GET_BYTE(to_push, 5); } - if ((addr == 500) && (bus_num == 0)) { - // is acc active? - // note - steering wheel will need few seconds to adjust the torque - if (GET_BYTE(to_push, 2) >> 5 & 0x1) { - steer_type = 1; - } else { - steer_type = 3; - } - } - if ((addr == 500) && (bus_num == 1)) { if (is_oplong_enabled) { org_acc_available = (GET_BYTE(to_push, 2) >> 4) & 0x1; From 8dbb2b2114eba5f9fcfa212feac7074472ba1fcd Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Mon, 12 Feb 2024 15:46:31 -0800 Subject: [PATCH 03/10] spoof lkas torq to 0 when speed is not spoofed yet --- board/drivers/can.h | 6 +++++- board/safety/safety_defaults.h | 18 ++++++++++++++++++ board/safety_declarations.h | 1 + 3 files changed, 24 insertions(+), 1 deletion(-) diff --git a/board/drivers/can.h b/board/drivers/can.h index 13f52c232b5..880a6202829 100644 --- a/board/drivers/can.h +++ b/board/drivers/can.h @@ -420,7 +420,7 @@ void can_rx(uint8_t can_number) { can_send(&to_send, 0, true); can_send(&to_send, 1, true); } else if (bus_number == 0){ - if ((addr != 284) && (addr != 292) && (addr != 324) && (addr != 344) && (addr != 368) && (addr != 514) && (addr != 671) && (addr != 820)) { + if ((addr != 284) && (addr != 292) && (addr != 324) && (addr != 344) && (addr != 368) && (addr != 514) && (addr != 671) && (addr != 820) && (addr != 658)) { if((addr == 502) || (addr == 503) || (addr == 626) || (addr == 838)){} else if (addr == 571) { can_send(&to_send, 2, true); @@ -488,6 +488,10 @@ void can_rx(uint8_t can_number) { send_wheel_button_msg(&to_send_mod); can_send(&to_send_mod, 1, true); } + if (addr == 658) { //lkas command + send_lkas_command(&to_send_mod); + can_send(&to_send_mod, 2, true); + } chrysler_wp(); } diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 2b6b57e99ee..a310110b885 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -43,9 +43,11 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ if(steer_type == 2) { eps_cutoff_speed = apa_enable_speed >> 8 | ((apa_enable_speed << 8) & 0xFFFF); //2kph with 128 factor + is_speed_spoofed = true; } else if (steer_type == 1) { eps_cutoff_speed = lkas_enable_speed >> 8 | ((lkas_enable_speed << 8) & 0xFFFF); //65kph with 128 factor + is_speed_spoofed = true; } to_fwd->RDHR &= 0x00FF0000; //clear speed and Checksum @@ -109,6 +111,20 @@ static void send_apa_signature(CAN_FIFOMailBox_TypeDef *to_fwd){ to_fwd->RDHR |= (((crc << 8) << 8) << 8); //replace Checksum }; +static void send_lkas_command(CAN_FIFOMailBox_TypeDef *to_fwd){ + int crc; + + if ((steer_type == 1) && is_op_active && !is_speed_spoofed) { + to_fwd->RDLR &= 0x00000000; //clear everything for new lkas command + to_fwd->RDHR &= 0x00FF0000; //clear everything except counter + crc = fca_compute_checksum(to_fwd); + to_fwd->RDHR |= (((crc << 8) << 8) << 8); //replace Checksum + } else { //pass through + to_fwd->RDLR |= 0x00000000; + to_fwd->RDHR |= 0x00000000; + } +} + static void send_acc_decel_msg(CAN_FIFOMailBox_TypeDef *to_fwd){ int crc; @@ -203,6 +219,7 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { steer_type = 1; } else { steer_type = 3; + is_speed_spoofed = false; } lkas_torq = ((GET_BYTE(to_push, 0) & 0x7) << 8) | GET_BYTE(to_push, 1); counter_658 += 1; @@ -223,6 +240,7 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { counter_284_658 += 2; if (counter_284_658 - counter_658 > 25){ is_op_active = false; + is_speed_spoofed = false; steer_type = 3; counter_658 = 0; counter_284_658 = 0; diff --git a/board/safety_declarations.h b/board/safety_declarations.h index 8431b60e03e..840461704e6 100644 --- a/board/safety_declarations.h +++ b/board/safety_declarations.h @@ -107,6 +107,7 @@ bool vehicle_moving = false; bool is_op_active = false; int lkas_torq = 1024; int steer_type = 3; +bool is_speed_spoofed = false; bool is_oplong_enabled = false; int acc_set_speed_kph = 255; From df9d38fa3ed001c86fe71d48eded6ab79b896dce Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Mon, 12 Feb 2024 15:47:03 -0800 Subject: [PATCH 04/10] when actual speed is higher than minimum speed, use actual speed --- board/safety/safety_defaults.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index a310110b885..54e2e4823a5 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -37,16 +37,21 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ int eps_cutoff_speed; int lkas_enable_speed = 65 * kph_factor; int apa_enable_speed = 0 * kph_factor; + int actual_speed = GET_BYTE(to_fwd, 4) << 8 | GET_BYTE(to_fwd, 5); int veh_speed = GET_BYTE(to_fwd, 4) | GET_BYTE(to_fwd, 5) << 8; eps_cutoff_speed = veh_speed; if(steer_type == 2) { - eps_cutoff_speed = apa_enable_speed >> 8 | ((apa_enable_speed << 8) & 0xFFFF); //2kph with 128 factor + if (actual_speed < apa_enable_speed) { + eps_cutoff_speed = apa_enable_speed >> 8 | ((apa_enable_speed << 8) & 0xFFFF); //2kph with 128 factor + } is_speed_spoofed = true; } else if (steer_type == 1) { - eps_cutoff_speed = lkas_enable_speed >> 8 | ((lkas_enable_speed << 8) & 0xFFFF); //65kph with 128 factor + if (actual_speed < lkas_enable_speed) { + eps_cutoff_speed = lkas_enable_speed >> 8 | ((lkas_enable_speed << 8) & 0xFFFF); //65kph with 128 factor + } is_speed_spoofed = true; } From 3e867873363244e2d33b1cbd4748e39f1d991fb7 Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Sat, 17 Feb 2024 20:11:11 -0800 Subject: [PATCH 05/10] correct the LKAS can message spoofing --- board/safety/safety_defaults.h | 17 +++++++++-------- board/safety_declarations.h | 2 +- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 54e2e4823a5..00750259337 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -46,13 +46,13 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ if (actual_speed < apa_enable_speed) { eps_cutoff_speed = apa_enable_speed >> 8 | ((apa_enable_speed << 8) & 0xFFFF); //2kph with 128 factor } - is_speed_spoofed = true; + counter_speed_spoofed = counter_speed_spoofed + 1; } else if (steer_type == 1) { if (actual_speed < lkas_enable_speed) { eps_cutoff_speed = lkas_enable_speed >> 8 | ((lkas_enable_speed << 8) & 0xFFFF); //65kph with 128 factor } - is_speed_spoofed = true; + counter_speed_spoofed = counter_speed_spoofed + 1; } to_fwd->RDHR &= 0x00FF0000; //clear speed and Checksum @@ -119,11 +119,12 @@ static void send_apa_signature(CAN_FIFOMailBox_TypeDef *to_fwd){ static void send_lkas_command(CAN_FIFOMailBox_TypeDef *to_fwd){ int crc; - if ((steer_type == 1) && is_op_active && !is_speed_spoofed) { - to_fwd->RDLR &= 0x00000000; //clear everything for new lkas command - to_fwd->RDHR &= 0x00FF0000; //clear everything except counter + if ((steer_type == 1) && is_op_active && counter_speed_spoofed < 5) { + to_fwd->RDLR &= 0x00000000; // clear everything for new lkas command + to_fwd->RDLR |= 0x00000004; // make sure torque highest bit is 1 + to_fwd->RDHR &= 0x000000FF; // clear everything except counter crc = fca_compute_checksum(to_fwd); - to_fwd->RDHR |= (((crc << 8) << 8) << 8); //replace Checksum + to_fwd->RDHR |= (crc << 8); // replace Checksum } else { //pass through to_fwd->RDLR |= 0x00000000; to_fwd->RDHR |= 0x00000000; @@ -224,7 +225,7 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { steer_type = 1; } else { steer_type = 3; - is_speed_spoofed = false; + counter_speed_spoofed = 0; } lkas_torq = ((GET_BYTE(to_push, 0) & 0x7) << 8) | GET_BYTE(to_push, 1); counter_658 += 1; @@ -245,7 +246,7 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { counter_284_658 += 2; if (counter_284_658 - counter_658 > 25){ is_op_active = false; - is_speed_spoofed = false; + counter_speed_spoofed = 0; steer_type = 3; counter_658 = 0; counter_284_658 = 0; diff --git a/board/safety_declarations.h b/board/safety_declarations.h index 840461704e6..392dc6c8050 100644 --- a/board/safety_declarations.h +++ b/board/safety_declarations.h @@ -107,7 +107,7 @@ bool vehicle_moving = false; bool is_op_active = false; int lkas_torq = 1024; int steer_type = 3; -bool is_speed_spoofed = false; +uint32_t counter_speed_spoofed = 0; bool is_oplong_enabled = false; int acc_set_speed_kph = 255; From a1df07968e61a8fe0169850ce2cc74a192ea3c83 Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Mon, 26 Feb 2024 08:44:44 -0800 Subject: [PATCH 06/10] Better count number of speed spoofs --- board/safety/safety_defaults.h | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 00750259337..26b52dd52db 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -54,6 +54,13 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ } counter_speed_spoofed = counter_speed_spoofed + 1; } + else { + if (actual_speed < lkas_enable_speed) { + counter_speed_spoofed = 0; + } else { + counter_speed_spoofed = counter_speed_spoofed + 1; + } + } to_fwd->RDHR &= 0x00FF0000; //clear speed and Checksum to_fwd->RDHR |= eps_cutoff_speed; //replace speed @@ -225,7 +232,6 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { steer_type = 1; } else { steer_type = 3; - counter_speed_spoofed = 0; } lkas_torq = ((GET_BYTE(to_push, 0) & 0x7) << 8) | GET_BYTE(to_push, 1); counter_658 += 1; @@ -246,7 +252,6 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { counter_284_658 += 2; if (counter_284_658 - counter_658 > 25){ is_op_active = false; - counter_speed_spoofed = 0; steer_type = 3; counter_658 = 0; counter_284_658 = 0; From ad623e19ec682f5c0d34fc0cb4a10b0dc2ea71b9 Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Thu, 29 Feb 2024 09:21:34 -0800 Subject: [PATCH 07/10] fix occasional LKAS error --- board/safety/safety_defaults.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 26b52dd52db..00f593a10f3 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -238,6 +238,10 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { } if ((addr == 284) && (bus_num == 0)) { + // the following two conditions are to stop spoofing + // when comma stops sending LKAS or ACC commands for whatever reason + // 284 is sent by the vehicle, and 502/658 is sent by comma, + // and they are sent in the same frequency (50Hz) if (counter_502 > 0) { counter_284_502 += 1; if (counter_284_502 - counter_502 > 25) { @@ -249,7 +253,7 @@ int default_rx_hook(CAN_FIFOMailBox_TypeDef *to_push) { } if (counter_658 > 0) { - counter_284_658 += 2; + counter_284_658 += 1; if (counter_284_658 - counter_658 > 25){ is_op_active = false; steer_type = 3; From 69fb11cc583028678d91178f0745f8bed4a476fc Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Thu, 29 Feb 2024 13:44:12 -0800 Subject: [PATCH 08/10] adjust wait time for EPS based on vehicle speed it seems EPS will fault when the speed is low (e.g. <15mph) and LKAS torque is sent too soon. introduce a way to dyanmically adjust the wait time (cycles) based on the speed before spoofing for speed <3mph, the wait time is 1s. for speed <9mph, the wait time is 0.5s. for speed <15mph, the wait time is 0.2s. for speed <39mph, the wait time is 0.1s. for speed >=39mph, no wait time. --- board/safety/safety_defaults.h | 24 +++++++++++++++++++++--- board/safety_declarations.h | 2 ++ 2 files changed, 23 insertions(+), 3 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 00f593a10f3..dd86d814588 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -46,19 +46,36 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ if (actual_speed < apa_enable_speed) { eps_cutoff_speed = apa_enable_speed >> 8 | ((apa_enable_speed << 8) & 0xFFFF); //2kph with 128 factor } - counter_speed_spoofed = counter_speed_spoofed + 1; + if (!is_lkas_ready && counter_speed_spoofed >= speed_spoofed_threshold) { + is_lkas_ready = true; + } else { + counter_speed_spoofed = counter_speed_spoofed + 1; + } } else if (steer_type == 1) { if (actual_speed < lkas_enable_speed) { eps_cutoff_speed = lkas_enable_speed >> 8 | ((lkas_enable_speed << 8) & 0xFFFF); //65kph with 128 factor } counter_speed_spoofed = counter_speed_spoofed + 1; + if (!is_lkas_ready && counter_speed_spoofed >= speed_spoofed_threshold) { + is_lkas_ready = true; + } } else { if (actual_speed < lkas_enable_speed) { + is_lkas_ready = false; counter_speed_spoofed = 0; + if (actual_speed < 5 * kph_factor) { + speed_spoofed_threshold = 50; + } else if (actual_speed < 15 * kph_factor) { + speed_spoofed_threshold = 25; + } else if (actual_speed < 25 * kph_factor) { + speed_spoofed_threshold = 10; + } else { + speed_spoofed_threshold = 5; + } } else { - counter_speed_spoofed = counter_speed_spoofed + 1; + is_lkas_ready = true; } } @@ -125,8 +142,9 @@ static void send_apa_signature(CAN_FIFOMailBox_TypeDef *to_fwd){ static void send_lkas_command(CAN_FIFOMailBox_TypeDef *to_fwd){ int crc; + bool lkas_active = (GET_BYTE(to_fwd, 0) >> 4) & 0x1; - if ((steer_type == 1) && is_op_active && counter_speed_spoofed < 5) { + if (lkas_active && !is_lkas_ready) { to_fwd->RDLR &= 0x00000000; // clear everything for new lkas command to_fwd->RDLR |= 0x00000004; // make sure torque highest bit is 1 to_fwd->RDHR &= 0x000000FF; // clear everything except counter diff --git a/board/safety_declarations.h b/board/safety_declarations.h index 392dc6c8050..cee81e47dba 100644 --- a/board/safety_declarations.h +++ b/board/safety_declarations.h @@ -108,6 +108,8 @@ bool is_op_active = false; int lkas_torq = 1024; int steer_type = 3; uint32_t counter_speed_spoofed = 0; +uint32_t speed_spoofed_threshold = 5; +bool is_lkas_ready = false; bool is_oplong_enabled = false; int acc_set_speed_kph = 255; From 910fed9e9b23fe03bcd18437f5153bec56ee587e Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Fri, 1 Mar 2024 09:57:14 -0800 Subject: [PATCH 09/10] Fine tune the delay at various speeds <5kph, delay 0.7s <10kph, delay 0.6s <15kph, delay 0.4s <25kph, delay 0.2s <65kph, delay 0.1s --- board/safety/safety_defaults.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index dd86d814588..964b50f512f 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -66,9 +66,11 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ is_lkas_ready = false; counter_speed_spoofed = 0; if (actual_speed < 5 * kph_factor) { - speed_spoofed_threshold = 50; + speed_spoofed_threshold = 35; + } else if (actual_speed < 10 * kph_factor) { + speed_spoofed_threshold = 30; } else if (actual_speed < 15 * kph_factor) { - speed_spoofed_threshold = 25; + speed_spoofed_threshold = 20; } else if (actual_speed < 25 * kph_factor) { speed_spoofed_threshold = 10; } else { From a8c1ddfb34c2713d883dcd1300f43d4412d10f43 Mon Sep 17 00:00:00 2001 From: Qi Liu Date: Tue, 5 Mar 2024 11:28:34 -0800 Subject: [PATCH 10/10] Avoid LKAS fault at 10mph. <5kph, delay 0.7s <10kph, delay 0.6s <15kph, delay 0.4s <20kph, delay 0.3s <25kph, delay 0.2s <65kph, delay 0.1s --- board/safety/safety_defaults.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/board/safety/safety_defaults.h b/board/safety/safety_defaults.h index 964b50f512f..f900ae9a119 100644 --- a/board/safety/safety_defaults.h +++ b/board/safety/safety_defaults.h @@ -71,6 +71,8 @@ static void send_steer_enable_speed(CAN_FIFOMailBox_TypeDef *to_fwd){ speed_spoofed_threshold = 30; } else if (actual_speed < 15 * kph_factor) { speed_spoofed_threshold = 20; + } else if (actual_speed < 20 * kph_factor) { + speed_spoofed_threshold = 15; } else if (actual_speed < 25 * kph_factor) { speed_spoofed_threshold = 10; } else {