Let the hacking begin... (Model S parts on the bench)

[S4WRXTTCS]

I hate to sound like a party pooper guys, but unless you think that your MS wifi issues are somehow related to rooting the Linux center console than might I suggest creating a different thread?

It's related to the operations of the center console, and it's sitting on WK057's bench. He is the one who let us know where the antenna was at, and is logically the one to ask what connector it uses (or a picture of it). So we could put a better antenna in its place.

His hacking is about more than rooting the Linux console. In fact I'm here for the CAN bus info, and all the info people have provided. So technically I'm getting in my own way, and aside from this post I'll leave the wifi stuff alone.

 

[dirkhh]

The Model S wifi sucks so bad because the antenna for the wifi is just a little wire that is barely outside the the *back* of the 17" screen near the bottom. So the antenna is buried deep inside the dash, and it's a crappy antenna.

Weird. And here I thought they had just improved it in the 2015 cars... apparently I just got lucky and the little wire that I have is GOOD wire

*whistles innocently...*

(yes I know the revision is displayed wrong... hehe)

Shiny. Is this a second car or did you upgrade the first one? Given the way you were talking about "the other project" I'm leaning towards thinking that you found another salvage car (since the insurance companies tend to declare a lot of Teslas complete losses I wouldn't be surprised if they are available at a decent price...).
I'm curious about the mismatched build number, though. That's odd... Hmm. Why would you get that if this car came with 7.0...?

 

[MDK]

I tried putting an extender in the garage, but that didn't work.
I can get the maximum bars, but then when I leave and come back I get 2 bars with it not reconnecting.
Short of giving up, and putting an access point in my garage I have no idea what to do.

I had a similar problem, then I noticed that my car would connect to the access point inside the house when I pulled into the driveway, and stayed connected to it even though the signal dropped so low no data would come through - and despite there being another access point on the same SSID inside the garage.

I created another SSID specific to the garage AP ("Mothership" seemed appropriate) and the car now connects with full signal every time. (reported as 99% signal by the AP)

Putting a dedicated AP rather than an extender will help fix your issue, but Tesla could also fix it with a firmware update by doing a re-scan if the signal drops below a usable level.

 

[obrien28]

It's related to the operations of the center console, and it's sitting on WK057's bench. He is the one who let us know where the antenna was at, and is logically the one to ask what connector it uses (or a picture of it). So we could put a better antenna in its place.

His hacking is about more than rooting the Linux console. In fact I'm here for the CAN bus info, and all the info people have provided. So technically I'm getting in my own way, and aside from this post I'll leave the wifi stuff alone.

Actually the antenna is not just a short wiring leading from the CID, there is a a real antenna embedded in the passenger side mirror, as documented here and by personal experience. I am aware that wk57 is doing more than just rooting the Linux console, the issue is the half a dozen posts about wifi issues that seemingly don't have anything to do with the CAN bus or ethernet networks, which is of the topic of this thread.

I'm not trying to single you out but I find posts on TMC tend to veer towards superficial issues with the Model S far too often.

 

[wk057]

There is no connection on the CID for an external WiFi antenna. There are external GSM antennas and a GPS antenna connected. The GSM antennas are in the mirrors.

 

[obrien28]

I would check again, connector reference #X804 media control unit RF WIFI it leads to the pass side door. What model is the car (dash?) you have on your test bench.

 

[S4WRXTTCS]

I would check again, connector reference #X804 media control unit RF WIFI it leads to the pass side door. What model is the car (dash?) you have on your test bench.

According to Undocumented | TeslaTap it's in the mirror. Did it change at some point? My build is 2015 so it's likely in the mirror. I'm pretty sure MDK is correct about the problem I'm experiencing, and it's the only viable solution for me.

 

[wk057]

I would check again, connector reference #X804 media control unit RF WIFI it leads to the pass side door. What model is the car (dash?) you have on your test bench.

I stand corrected. On the PCB the connector is labeled WiFi. On the outside metal the label wasn't legible and I thought it was something else. So the little antenna that is hanging out of the back of the unit must be extra, and is sufficient for picking up my home wifi AP about 20' away from the bench.

 

[thegruf]

I hate to sound like a party pooper guys, but unless you think that your MS wifi issues are somehow related to rooting the Linux center console than might I suggest creating a different thread?

upthread my original question was if WK could identify the gain settings for each the wifi bars on the display. Hopefully not unreasonable given the access he has, clearly lots of other priorities though.
Agree trhe thread should not be derailed by extensive wifi discussions, though even WK got a fragment of help back re identifying a connector and the location of the antenna.

so, WK how about a Model X for your next car?

... and if you can get a pic of a 3 then ... you probably best not print!

 

[S4WRXTTCS]

I stand corrected. On the PCB the connector is labeled WiFi. On the outside metal the label wasn't legible and I thought it was something else. So the little antenna that is hanging out of the back of the unit must be extra, and is sufficient for picking up my home wifi AP about 20' away from the bench.

Is there a separate antenna for bluetooth?

In my own hobby projects I don't even need an antenna to get my AP to connect as long as it's just 10-20ft or so.

- - - Updated - - -

Actually the antenna is not just a short wiring leading from the CID, there is a a real antenna embedded in the passenger side mirror, as documented here and by personal experience. I am aware that wk57 is doing more than just rooting the Linux console, the issue is the half a dozen posts about wifi issues that seemingly don't have anything to do with the CAN bus or ethernet networks, which is of the topic of this thread.

I'm not trying to single you out but I find posts on TMC tend to veer towards superficial issues with the Model S far too often.

I was trying to keep it more on the technical side of things WK057 could see on his bench, and plus I knew the smart people were watching. So it was kinda like a two for one deal.
But, I can definitely see where you're coming from. Sometimes it's worse than that. Right now in the V7.1 thread they're talking about burger joints.

 

[andrewket]

I had a similar problem, then I noticed that my car would connect to the access point inside the house when I pulled into the driveway, and stayed connected to it even though the signal dropped so low no data would come through - and despite there being another access point on the same SSID inside the garage.

I created another SSID specific to the garage AP ("Mothership" seemed appropriate) and the car now connects with full signal every time. (reported as 99% signal by the AP)

Putting a dedicated AP rather than an extender will help fix your issue, but Tesla could also fix it with a firmware update by doing a re-scan if the signal drops below a usable level.

I have an SSID for my garage for the same reason. It also makes it easier to monitor traffic from the Teslas, and detect things like software updates.

 

[Andyw2100]

Sometimes it's worse than that. Right now in the V7.1 thread they're talking about burger joints.

And take-out sushi. Don't leave out the take-out sushi.

If you're in the mood for dessert, the Supercharger thread is talking about donut shops.

 

[andrewket]

And take-out sushi. Don't leave out the take-out sushi.

If you're in the mood for dessert, the Supercharger thread is talking about donut shops.

I'm a primary contributor to both the burger joint and sushi threads. I find the discussion about firmware and superchargers very distracting.

 

[obrien28]

And... we are officially off topic folks, I probably should have kept my mouth shut to begin with **facepalm**

@S4WRXTTCS
Glad you can see where I'm coming from, it's hard enough to get a thread that is actually on a technical topic (I saw one yesterday complaining about the feel of the plastic dead pedal), then you throw in trying to actually keep it on topic and you have yourself an uphill battle.

To those reviewing take-away places: I have nothing against burger or sushi places (I really like both) but we do have an off topic sub-forum for this kind of stuff.

@wk057 Glad I could help, I thought antenna locations were common knowledge, given Tesla Taps rundown (which has been out for ages and was pre service manual stuff), learn something new everyday

 

[Ingineer]

WiFi connection on the back of the MCU:

WiFi Antenna found in right mirror:

Besides that, I'd also like to point out that Tesla could obviate all our decoding efforts with one firmware release. They could add some encryption, or even just scramble the CAN frames every software release so that we'd have to spend a lot of time re-mapping them.

This is unlike any CAN project I've ever attempted, so unless you have an unsupported (read: no updates) car, then you could find all our efforts wasted once they decide to make it hard for us. Not trying to say we shouldn't do it, but be warned.

Wk, the little wire-glob is an external Bluetooth antenna. The early MCUs had the antenna on the PCB INSIDE the metal cage! So some time in 2013, they added that external BT antenna to make it work (!) better.

 

[obrien28]

@Ingineer Thanks for the picture Phil, where did you procure your bench setup from, a part out or salvage car?

 

[jrickard]

@lolachampcar

Would it not be better to reuse the OVMS hardware (that has internet connectivity)? or is this dongle just for reverse engineering. It seems like everybody goes about creating a new device every week when there is already a plethora of hardware options that can handle the bus load: teensy 3.1, CANdue, CANtact, OVMS, or the Kvaser Leaf Light on the professional end of things (I got mine for a good deal on eBay). As many in silicon valley would say, this is a software problem, everything that's out there is either closed source, garbage, or both. With the notable exception of SavvyCAN by Collin Kidder (free, cross platform, and fairly capable) and perhaps Busmaster, there aren't many good pieces of software out there, that's really where the effort is needed.

Just my 2cents

Well yes, that's rather the issue. The dongle doesn't matter as long as it works. Unfortunatelyl, the Tesla does some higher packet loads than like a VOlt or a Leaf so you need something moderately quick. But after that it is a software game. I don't think anything can touch Collin's SavvyCAN effort this side of Vector which well get you to $10,000 worth of software rather quickly.

we just did a little thing for fun that I posted in Batteries and Chargers. Arthur Hebert originally roughed out the pattern in 6F2 listing all the battery voltages and battery temperature sensor data. Collin and I kind of worked out how to do the bit pattern and wrote a very tiny little program to monitor the bus, snag 6F2s, and put ASCII out the USB port with all the battery voltages and temperatures.

You can download the source at http://media3.ev-tv.me/TeslaModelSPackVoltages.ziphttp://media3.ev-tv.me/TeslaModelSPackVoltages.zip

 

[wk057]

WiFi connection on the back of the MCU:

WiFi Antenna found in right mirror:

Besides that, I'd also like to point out that Tesla could obviate all our decoding efforts with one firmware release. They could add some encryption, or even just scramble the CAN frames every software release so that we'd have to spend a lot of time re-mapping them.

This is unlike any CAN project I've ever attempted, so unless you have an unsupported (read: no updates) car, then you could find all our efforts wasted once they decide to make it hard for us. Not trying to say we shouldn't do it, but be warned.

Wk, the little wire-glob is an external Bluetooth antenna. The early MCUs had the antenna on the PCB INSIDE the metal cage! So some time in 2013, they added that external BT antenna to make it work (!) better.

I agree they *could* make things difficult... but I doubt they will. Doing so adds complexity on their end as well. Almost certainly not worth the effort. Also would potentially cause issues with module swaps and such. *shrugs*

As mentioned up-thread a bit, I was definitely a bit off on the WiFi antenna matter. The little wire on the back goes to the WiFi module, which happens to also be the Bluetooth module. Add to that the fact that the metal insert on mine doesn't have readable stamping for camera and wifi. I only knew the camera one was the camera because of the connector. So I'm hoping I wouldn't have been alone in my confusion. That said... with a WiFi antenna in the mirror.... why the heck is WiFi reception so bad!? lol

So, I'll note that the image up thread of the IC of a partly dismantled P85D is um... my P85D. hehe.

The CID screenshot of my sweet signature red P85D is my bench running a hacked together copy of the 7.0 firmware copied from my real P85D. The release number is wrong because I didn't change it. Purpose being is that the v6.1 I have on my bench normally is pretty out dated. A lot of the CAN stuff has changed slightly since then, such as the BMS power number scaling and such. So, having the 7.0 diagnostic screen is worthwhile to have working on my bench.

In other news, I won a nice bounty from Tesla's bug bounty program for reporting and detailing an exploit I mentioned briefly earlier in this thread regarding the WiFi module.

- - - Updated - - -

Well yes, that's rather the issue. The dongle doesn't matter as long as it works. Unfortunatelyl, the Tesla does some higher packet loads than like a VOlt or a Leaf so you need something moderately quick. But after that it is a software game. I don't think anything can touch Collin's SavvyCAN effort this side of Vector which well get you to $10,000 worth of software rather quickly.

we just did a little thing for fun that I posted in Batteries and Chargers. Arthur Hebert originally roughed out the pattern in 6F2 listing all the battery voltages and battery temperature sensor data. Collin and I kind of worked out how to do the bit pattern and wrote a very tiny little program to monitor the bus, snag 6F2s, and put ASCII out the USB port with all the battery voltages and temperatures.


You can download the source at http://media3.ev-tv.me/TeslaModelSPackVoltages.ziphttp://media3.ev-tv.me/TeslaModelSPackVoltages.zip

Nice, Jack!

I was working a bit of 6F2, but I hadn't gotten everything situated yet. I knew what data was in which message... it sends 4 cell voltages or 4 temperatures per message, starting with cell 0, then the 32 temperatures. The temperatures are pairs of inlet/outlet temperatures for each module, 2 modules per message. I believe these are physically reversed depending on which side of the pack the module is on, too.

 

[Ingineer]

All they'd have to do is encrypt some of the critical frames. Even something relatively simple that a low-power microcontroller can handle, such as DES.

Module swaps always require a firmware update anyway, so as long as the bootloader and flashing process are consistent, then swapping modules isn't going to cause any issues. Swap the module, then update the firmware.

 

[jrickard]

Yah. It's 24 messages with four battery voltages in each, followed by 8 with temp sensors. The first byte is an index so you know where in the pack you are.

The other 7bytes are a 56 bit packed array with each value being 13 bits and a trailing flag noting whether it is voltage or temperature. Tesla has this 13-bit thing on the brain. Apparently someone deep in teh company just can't count to 16. They give out about 13. So we have run into a lot of 13 bit numbers.

Jack