-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
BTW Ingineer is right that Tesla does close everything that they hear about.
This is why if you want to help people in the long term, you are better off helping root cars for those that ask for it. That way people that seek this ability to control their car are happy and the ways stay available.
I know you think certain things are hard to impossible to fix, but that might have some limitations. And either way it's one thing to plug into onboard port and root the car and totally another is to extract the cid (quite a bit of work), then try to desolder components or try to operate on them by using exposed pads that connect to some useful chip pins...
I am not charging people for this and sure, in ideal world Tesla would allow all comers to have a root key to their car (all parts of the car!), but we don't live in that ideal world and as such secrecy still remains important at least to some degree.
Also there's another angle to this all - even Tesla cannot fix something n current hardware, they can improve their next revision. Do you want future Tesla cars to be totally impenetrable so everybody is locked out?
Do consider carefully what you share in the public...
JRP3
Hyperactive Member
You might need a certain number of posts before that is enabled.
Hello verygreen, I am familiar with your work and respect it. I know what aspects are sensitive in the way you describe of course. But please understand that it is naive to think that Tesla doesn't already have the work of commercial rooters. And I can think of ways that Tesla can make their systems uncrackable, and if I can, be assured that they have as well. It's just a question of priorities.
This is why I regard these cries for secrecy as false and disingenuous. I am on the fence about releasing these sensitive functions. Tesla can change and parry, but we have control of the hardware, and the gateway is stressed to the max in pre-Ap2.0 cars.
I find the Autopilot nags particularly objectionable, and this is what has driven me to learn this whole process. (No lectures) I am running a version of 8.1 where control over this setting has been moved to the gateway, and this is why I've had to learn rooting and have worked on the Fusee Gelee exploit, unsuccessfully so far. My intent is to modify the gateway RTOS (code-signing off) to periodically gig the steering position device slightly, providing the position error that the RTOS interprets as 'hands on wheel'. But I won't know the practicality of this until I get into it.
In reading the T3 Ref Manual, my interpretation is that the boot coprocessor can only be put in to RCM recovery mode by shorting certain pins (unknown, as we don't have the T3's pinout), or if it can not find the boot flash. So it seems that all that's necessary is to chip-disable the Spansion chip when the coprocessor is initializing. I have the datasheet for that. (Cypress)
But then (if I understand the T3 Ref Manual correctly), we must have access to T3 USB1 to inject the payload, not USB4 which is readily accessible on the back of the MCU. If so, I suspect that USB1 is connected to the USB-ethernet bridge, but haven't had a bad CID to trace that out. And no T3 pinout anyway.
I also suspect that the hole on the back of the MCU is to accept a pin-connector so that Tesla manufacturing can program and test the MCU. They must test the assembled MCU, and this seems the most obvious. So in that area must be the pads that enable all of this, but again I don't have the hardware to trace.
PS - If I disappear at some point, it's because I've been blocked. Not because I've absconded.
This is why I regard these cries for secrecy as false and disingenuous. I am on the fence about releasing these sensitive functions. Tesla can change and parry, but we have control of the hardware, and the gateway is stressed to the max in pre-Ap2.0 cars.
I find the Autopilot nags particularly objectionable, and this is what has driven me to learn this whole process. (No lectures) I am running a version of 8.1 where control over this setting has been moved to the gateway, and this is why I've had to learn rooting and have worked on the Fusee Gelee exploit, unsuccessfully so far. My intent is to modify the gateway RTOS (code-signing off) to periodically gig the steering position device slightly, providing the position error that the RTOS interprets as 'hands on wheel'. But I won't know the practicality of this until I get into it.
In reading the T3 Ref Manual, my interpretation is that the boot coprocessor can only be put in to RCM recovery mode by shorting certain pins (unknown, as we don't have the T3's pinout), or if it can not find the boot flash. So it seems that all that's necessary is to chip-disable the Spansion chip when the coprocessor is initializing. I have the datasheet for that. (Cypress)
But then (if I understand the T3 Ref Manual correctly), we must have access to T3 USB1 to inject the payload, not USB4 which is readily accessible on the back of the MCU. If so, I suspect that USB1 is connected to the USB-ethernet bridge, but haven't had a bad CID to trace that out. And no T3 pinout anyway.
I also suspect that the hole on the back of the MCU is to accept a pin-connector so that Tesla manufacturing can program and test the MCU. They must test the assembled MCU, and this seems the most obvious. So in that area must be the pads that enable all of this, but again I don't have the hardware to trace.
PS - If I disappear at some point, it's because I've been blocked. Not because I've absconded.
Last edited:
alecxander
Member
Hi, I have a mid-2016 90d, it is a salvage car with autopilot that is now fully working although I permanently have a DAS features unavailable message in the ic and the MCU is displaying an error "radc calib issue"
looking at the service manual I need to connect to tesla toolbox software to calibrate and clear these codes,
is anyone able to help me do this?
thanks,
Alexander
looking at the service manual I need to connect to tesla toolbox software to calibrate and clear these codes,
is anyone able to help me do this?
thanks,
Alexander
alecxander, once you calibrate the radar, the code should clear on its own after 150 miles or so.
Calibrating is not hard, it has X and Y screws. I used a square on its face and drew a string out about 15' to get it aimed exactly straight ahead and level.
Calibrating is not hard, it has X and Y screws. I used a square on its face and drew a string out about 15' to get it aimed exactly straight ahead and level.
alecxander
Member
thanks, ill give that a try and report back, i didnt know it cleared automatically!
alecxander
Member
I also have another facelift 90d, I have installed a p90d rear motor from a car of the same age and have changed the HV wiring harness to one that has the correct connectors for the large drive unit and also the rear subframe harness, I have also changed the pyrofuse in the battery to a p90d one, is there any other hardware I am missing to make the car a p90d?
I was also wondering if anyone can help me reprogram the car to p90d software?
thanks!
I was also wondering if anyone can help me reprogram the car to p90d software?
thanks!
Packfuse or pyrofuse? You need to flash the firmware on the inverter with that of a p90d. I also believe you need to change the performance flag to 2 on the mcu . Or 1 can’t remember
alecxander
Member
the pack fuse is from the same early 2017 p90d the large rear motor is from, the front motor is the stock 90d motor that came with the car, but they all seem to bee the same. so you think all I need to do is change the performance flag on the mcu?
robby
Member
@rooter covered the gist of it, but if you want a photo reference and a little more detail, this might help you: Front Radar Calibration
Hello everybody,
Thanks to the great forum and its users.
Short to me I'm Martin from Germany (Baden Württemberg)
I drive since 2014 electrically (Renault ZOE).
My dream has always been to buy a Model S as an accident wagon and repair it myself. Actually a P 85D but the prices were too high for me.
So it became a salvage S 70 11/15 from California, he is now already with me in Germany.
Now I have some problems with the junction box.
With us in Germany I can load three phases and the charging port is also different.
So I had the EU Junction Box and the charging port built in, but after that I had a Software Update Required, unable to start.
Then I rebuilt to US Junction Box and the Tesla let start again.
Now a question for you, does anyone of you have any diagnostic software or tips?
Many Greetings
Martin
Thanks to the great forum and its users.
Short to me I'm Martin from Germany (Baden Württemberg)
I drive since 2014 electrically (Renault ZOE).
My dream has always been to buy a Model S as an accident wagon and repair it myself. Actually a P 85D but the prices were too high for me.
So it became a salvage S 70 11/15 from California, he is now already with me in Germany.
Now I have some problems with the junction box.
With us in Germany I can load three phases and the charging port is also different.
So I had the EU Junction Box and the charging port built in, but after that I had a Software Update Required, unable to start.
Then I rebuilt to US Junction Box and the Tesla let start again.
Now a question for you, does anyone of you have any diagnostic software or tips?
Many Greetings
Martin
Hallo Martin, Ich habe drei Jahre mit dem Amerikanischen Nachrichtendienst in Deutschland gelebt. (Börfink, Rhineland-Palatinate)
GeorgeCM (Romania) also has a US car and is presently working on this problem. He can charge one phase, but wants to use all three. He's experimenting with three US chargers (which worries me) but so far hasn't gotten them cooperating.
All 16 or so ECUs (computers) must be running the same version of firmware, due to code-signing. If they are not they will not start.
You should be able to fix this by redeploying the firmware (rewriting it to all controllers). But to do this you must first root your car. I've posted half of one method above but there are at least three others. ce2078 may be willing to help if you kick some his way for his time.
GeorgeCM (Romania) also has a US car and is presently working on this problem. He can charge one phase, but wants to use all three. He's experimenting with three US chargers (which worries me) but so far hasn't gotten them cooperating.
All 16 or so ECUs (computers) must be running the same version of firmware, due to code-signing. If they are not they will not start.
You should be able to fix this by redeploying the firmware (rewriting it to all controllers). But to do this you must first root your car. I've posted half of one method above but there are at least three others. ce2078 may be willing to help if you kick some his way for his time.
Last edited:
Updating my status.
I fixed my MCU last week. Was not able to read any data from dead memory chip so I cloned IC emmc chip, first two partitions I left as is and the rest left empty. Also increased the size of /home partition. For some reason it was not able to boot'up normally. Then I changed the owner of /home/tesla directory and big T showed up.
Big thanks to everybody. Seems like easy steps, but still, it wouldn't be possible to do it alone.
I fixed my MCU last week. Was not able to read any data from dead memory chip so I cloned IC emmc chip, first two partitions I left as is and the rest left empty. Also increased the size of /home partition. For some reason it was not able to boot'up normally. Then I changed the owner of /home/tesla directory and big T showed up.
Big thanks to everybody. Seems like easy steps, but still, it wouldn't be possible to do it alone.
That's just a display configuration I believe (KW meter, for example), I cant remember what needs to be flashed specifically, I believe it is the inverter. But something specific on the motor/DU/inverter needs to have its firmware changed to a "P" configuration
alecxander
Member
Do a CSV search for performanceaddon and performance:
# curl -s "http://localhost:4035/get_data_values?format=csv&show_invalid=true" | grep performance
VAPI_performanceAddOn,Standard
VAPI_performanceConfig,P2
Then set them like mine:
# curl -s "http://192.16.90.100:4035/set_data_value?name=VAPI_performanceAddOn&value=Standard"
# curl -s "http://192.16.90.100:4035/set_data_value?name=VAPI_performanceConfig&value=P2"
And redeploy.
