IQ.Pilot Release Commit @ bec7652

artifacts/package_sources/panda/board/README.md

@@ -0,0 +1,20 @@
+## Programming
+
+```
+./flash.py        # flash application
+./recover.py      # flash bootstub
+```
+
+## Debugging
+
+To print out the serial console from the STM32, run `tests/debug_console.py`
+
+Troubleshooting
+----
+
+If your panda will not flash and green LED is on, use `recover.py`.
+If panda is blinking fast with green LED, use `flash.py`.
+
+Otherwise if LED is off and panda can't be seen with `lsusb` command, use [panda paw](https://comma.ai/shop/products/panda-paw) to go into DFU mode.
+
+If your device has an internal panda and none of the above works, try running `../scripts/reflash_internal_panda.py`.

artifacts/package_sources/panda/board/boards/board_declarations.h

@@ -0,0 +1,65 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+// ******************** Prototypes ********************
+typedef enum {
+  BOOT_STANDBY,
+  BOOT_BOOTKICK,
+  BOOT_RESET,
+} BootState;
+
+typedef void (*board_init)(void);
+typedef void (*board_init_bootloader)(void);
+typedef void (*board_enable_can_transceiver)(uint8_t transceiver, bool enabled);
+typedef void (*board_set_can_mode)(uint8_t mode);
+typedef uint32_t (*board_read_voltage_mV)(void);
+typedef uint32_t (*board_read_current_mA)(void);
+typedef void (*board_set_ir_power)(uint8_t percentage);
+typedef void (*board_set_fan_enabled)(bool enabled);
+typedef void (*board_set_siren)(bool enabled);
+typedef void (*board_set_bootkick)(BootState state);
+typedef bool (*board_read_som_gpio)(void);
+typedef void (*board_set_amp_enabled)(bool enabled);
+
+struct board {
+  harness_configuration *harness_config;
+  GPIO_TypeDef * const led_GPIO[3];
+  const uint8_t led_pin[3];
+  const uint8_t led_pwm_channels[3]; // leave at 0 to disable PWM
+  const bool has_spi;
+  const bool has_fan;
+  const uint16_t avdd_mV;
+  const uint8_t fan_enable_cooldown_time;
+  board_init init;
+  board_init_bootloader init_bootloader;
+  board_enable_can_transceiver enable_can_transceiver;
+  board_set_can_mode set_can_mode;
+  board_read_voltage_mV read_voltage_mV;
+  board_read_current_mA read_current_mA;
+  board_set_ir_power set_ir_power;
+  board_set_fan_enabled set_fan_enabled;
+  board_set_siren set_siren;
+  board_set_bootkick set_bootkick;
+  board_read_som_gpio read_som_gpio;
+  board_set_amp_enabled set_amp_enabled;
+};
+
+// ******************* Definitions ********************
+// These should match the enums in cereal/log.capnp and __init__.py
+#define HW_TYPE_UNKNOWN 0U
+#define HW_TYPE_DOS 6U
+#define HW_TYPE_RED_PANDA 7U
+#define HW_TYPE_RED_PANDA_V2 8U
+#define HW_TYPE_TRES 9U
+#define HW_TYPE_CUATRO 10U
+
+// CAN modes
+#define CAN_MODE_NORMAL 0U
+#define CAN_MODE_OBD_CAN2 1U
+
+extern struct board board_dos;
+extern struct board board_tres;
+extern struct board board_cuatro;
+extern struct board board_red;

artifacts/package_sources/panda/board/boards/cuatro.h

@@ -0,0 +1,135 @@
+#pragma once
+
+#include "board_declarations.h"
+
+// ////////////////////////// //
+// Cuatro (STM32H7) + Harness //
+// ////////////////////////// //
+
+static void cuatro_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver) {
+    case 1U:
+      set_gpio_output(GPIOB, 7, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOD, 8, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 11, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+static uint32_t cuatro_read_voltage_mV(void) {
+  return adc_get_mV(&(const adc_signal_t) ADC_CHANNEL_DEFAULT(ADC1, 8)) * 11U;
+}
+
+static uint32_t cuatro_read_current_mA(void) {
+  return adc_get_mV(&(const adc_signal_t) ADC_CHANNEL_DEFAULT(ADC1, 3)) * 2U;
+}
+
+static void cuatro_set_fan_enabled(bool enabled) {
+  set_gpio_output(GPIOD, 3, !enabled);
+}
+
+static void cuatro_set_bootkick(BootState state) {
+  set_gpio_output(GPIOA, 0, state != BOOT_BOOTKICK);
+}
+
+static void cuatro_set_amp_enabled(bool enabled) {
+  set_gpio_output(GPIOB, 0, enabled);
+}
+
+static void cuatro_init(void) {
+  common_init_gpio();
+
+  // open drain
+  set_gpio_output_type(GPIOD, 3, OUTPUT_TYPE_OPEN_DRAIN); // FAN_EN
+  set_gpio_output_type(GPIOC, 12, OUTPUT_TYPE_OPEN_DRAIN); // VBAT_EN
+
+  // Power readout
+  set_gpio_mode(GPIOC, 5, MODE_ANALOG);
+  set_gpio_mode(GPIOA, 6, MODE_ANALOG);
+
+  // CAN transceiver enables
+  set_gpio_pullup(GPIOB, 7, PULL_NONE);
+  set_gpio_mode(GPIOB, 7, MODE_OUTPUT);
+  set_gpio_pullup(GPIOD, 8, PULL_NONE);
+  set_gpio_mode(GPIOD, 8, MODE_OUTPUT);
+
+  // FDCAN3, different pins on this package than the rest of the reds
+  set_gpio_pullup(GPIOD, 12, PULL_NONE);
+  set_gpio_alternate(GPIOD, 12, GPIO_AF5_FDCAN3);
+  set_gpio_pullup(GPIOD, 13, PULL_NONE);
+  set_gpio_alternate(GPIOD, 13, GPIO_AF5_FDCAN3);
+
+  // C2: SOM GPIO used as input (fan control at boot)
+  set_gpio_mode(GPIOC, 2, MODE_INPUT);
+  set_gpio_pullup(GPIOC, 2, PULL_DOWN);
+
+  // SOM bootkick + reset lines
+  cuatro_set_bootkick(BOOT_BOOTKICK);
+
+  // SOM debugging UART
+  gpio_uart7_init();
+  uart_init(&uart_ring_som_debug, 115200);
+
+  // fan setup
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+  register_set_bits(&(GPIOC->OTYPER), GPIO_OTYPER_OT8); // open drain
+
+  // Clock source
+  clock_source_init(true);
+
+  // Sound codec
+  cuatro_set_amp_enabled(false);
+  set_gpio_alternate(GPIOA, 2, GPIO_AF8_SAI4);    // SAI4_SCK_B
+  set_gpio_alternate(GPIOC, 0, GPIO_AF8_SAI4);    // SAI4_FS_B
+  set_gpio_alternate(GPIOD, 11, GPIO_AF10_SAI4);  // SAI4_SD_A
+  set_gpio_alternate(GPIOE, 3, GPIO_AF8_SAI4);    // SAI4_SD_B
+  set_gpio_alternate(GPIOE, 4, GPIO_AF3_DFSDM1);  // DFSDM1_DATIN3
+  set_gpio_alternate(GPIOE, 9, GPIO_AF3_DFSDM1);  // DFSDM1_CKOUT
+  set_gpio_alternate(GPIOE, 6, GPIO_AF10_SAI4);   // SAI4_MCLK_B
+  sound_init();
+}
+
+static harness_configuration cuatro_harness_config = {
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOA,
+  .GPIO_relay_SBU1 = GPIOA,
+  .GPIO_relay_SBU2 = GPIOA,
+  .pin_SBU1 = 4,
+  .pin_SBU2 = 1,
+  .pin_relay_SBU1 = 9,
+  .pin_relay_SBU2 = 3,
+  .adc_signal_SBU1 = ADC_CHANNEL_DEFAULT(ADC1, 4),
+  .adc_signal_SBU2 = ADC_CHANNEL_DEFAULT(ADC1, 17)
+};
+
+board board_cuatro = {
+  .harness_config = &cuatro_harness_config,
+  .has_spi = true,
+  .has_fan = true,
+  .avdd_mV = 1800U,
+  .fan_enable_cooldown_time = 3U,
+  .init = cuatro_init,
+  .init_bootloader = unused_init_bootloader,
+  .enable_can_transceiver = cuatro_enable_can_transceiver,
+  .led_GPIO = {GPIOC, GPIOC, GPIOC},
+  .led_pin = {6, 7, 9},
+  .led_pwm_channels = {1, 2, 4},
+  .set_can_mode = tres_set_can_mode,
+  .read_voltage_mV = cuatro_read_voltage_mV,
+  .read_current_mA = cuatro_read_current_mA,
+  .set_fan_enabled = cuatro_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_siren = fake_siren_set,
+  .set_bootkick = cuatro_set_bootkick,
+  .read_som_gpio = tres_read_som_gpio,
+  .set_amp_enabled = cuatro_set_amp_enabled
+};

artifacts/package_sources/panda/board/boards/dos.h

@@ -0,0 +1,130 @@
+#pragma once
+
+#include "board_declarations.h"
+
+static void dos_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1U:
+      set_gpio_output(GPIOC, 1, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOC, 13, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOA, 0, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+static void dos_set_bootkick(BootState state) {
+  set_gpio_output(GPIOC, 4, state != BOOT_BOOTKICK);
+}
+
+static void dos_set_can_mode(uint8_t mode) {
+  dos_enable_can_transceiver(2U, false);
+  dos_enable_can_transceiver(4U, false);
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        set_gpio_mode(GPIOB, 12, MODE_INPUT);
+        set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+        dos_enable_can_transceiver(2U, true);
+      } else {
+        set_gpio_mode(GPIOB, 5, MODE_INPUT);
+        set_gpio_mode(GPIOB, 6, MODE_INPUT);
+
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_CAN2);
+        dos_enable_can_transceiver(4U, true);
+      }
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+static void dos_set_ir_power(uint8_t percentage){
+  pwm_set(TIM4, 2, percentage);
+}
+
+static void dos_set_fan_enabled(bool enabled){
+  set_gpio_output(GPIOA, 1, enabled);
+}
+
+static void dos_set_siren(bool enabled){
+  set_gpio_output(GPIOC, 12, enabled);
+}
+
+static uint32_t dos_read_voltage_mV(void){
+  return adc_get_mV(&(const adc_signal_t) ADC_CHANNEL_DEFAULT(ADC1, 12)) * 11U;
+}
+
+static bool dos_read_som_gpio(void){
+  return (get_gpio_input(GPIOC, 2) != 0);
+}
+
+static void dos_init(void) {
+  common_init_gpio();
+
+  set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+  set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+
+  set_gpio_mode(GPIOC, 2, MODE_INPUT);
+  set_gpio_pullup(GPIOC, 2, PULL_DOWN);
+
+  set_gpio_alternate(GPIOB, 7, GPIO_AF2_TIM4);
+  pwm_init(TIM4, 2);
+  dos_set_ir_power(0U);
+
+  dos_set_bootkick(true);
+
+  clock_source_init(false);
+}
+
+static harness_configuration dos_harness_config = {
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOC,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 0,
+  .pin_SBU2 = 3,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_signal_SBU1 = ADC_CHANNEL_DEFAULT(ADC1, 10),
+  .adc_signal_SBU2 = ADC_CHANNEL_DEFAULT(ADC1, 13),
+};
+
+board board_dos = {
+  .harness_config = &dos_harness_config,
+  .has_spi = false,
+  .has_fan = true,
+  .avdd_mV = 3300U,
+  .fan_enable_cooldown_time = 3U,
+  .init = dos_init,
+  .init_bootloader = unused_init_bootloader,
+  .enable_can_transceiver = dos_enable_can_transceiver,
+  .led_GPIO = {GPIOC, GPIOC, GPIOC},
+  .led_pin = {9, 7, 6},
+  .set_can_mode = dos_set_can_mode,
+  .read_voltage_mV = dos_read_voltage_mV,
+  .read_current_mA = unused_read_current,
+  .set_fan_enabled = dos_set_fan_enabled,
+  .set_ir_power = dos_set_ir_power,
+  .set_siren = dos_set_siren,
+  .set_bootkick = dos_set_bootkick,
+  .read_som_gpio = dos_read_som_gpio,
+  .set_amp_enabled = unused_set_amp_enabled
+};

artifacts/package_sources/panda/board/boards/red.h

@@ -0,0 +1,134 @@
+#pragma once
+
+#include "board_declarations.h"
+
+// ///////////////////////////// //
+// Red Panda (STM32H7) + Harness //
+// ///////////////////////////// //
+
+static void red_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver) {
+    case 1U:
+      set_gpio_output(GPIOG, 11, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 3, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOD, 7, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 4, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+static void red_set_can_mode(uint8_t mode) {
+  red_enable_can_transceiver(2U, false);
+  red_enable_can_transceiver(4U, false);
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable normal mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_mode(GPIOB, 12, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_mode(GPIOB, 13, MODE_ANALOG);
+
+        // B5,B6: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_FDCAN2);
+        red_enable_can_transceiver(2U, true);
+      } else {
+        // B5,B6: disable normal mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_mode(GPIOB, 5, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_mode(GPIOB, 6, MODE_ANALOG);
+        // B12,B13: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_FDCAN2);
+        red_enable_can_transceiver(4U, true);
+      }
+      break;
+    default:
+      break;
+  }
+}
+
+static uint32_t red_read_voltage_mV(void){
+  return adc_get_mV(&(const adc_signal_t) ADC_CHANNEL_DEFAULT(ADC1, 2)) * 11U;
+}
+
+static void red_init(void) {
+  common_init_gpio();
+
+  // G11,B3,D7,B4: transceiver enable
+  set_gpio_pullup(GPIOG, 11, PULL_NONE);
+  set_gpio_mode(GPIOG, 11, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 3, PULL_NONE);
+  set_gpio_mode(GPIOB, 3, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOD, 7, PULL_NONE);
+  set_gpio_mode(GPIOD, 7, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 4, PULL_NONE);
+  set_gpio_mode(GPIOB, 4, MODE_OUTPUT);
+
+  //B1: 5VOUT_S
+  set_gpio_pullup(GPIOB, 1, PULL_NONE);
+  set_gpio_mode(GPIOB, 1, MODE_ANALOG);
+
+  // B14: usb load switch, enabled by pull resistor on board, obsolete for red panda
+  set_gpio_output_type(GPIOB, 14, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOB, 14, PULL_UP);
+  set_gpio_mode(GPIOB, 14, MODE_OUTPUT);
+  set_gpio_output(GPIOB, 14, 1);
+}
+
+static harness_configuration red_harness_config = {
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOA,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 4,
+  .pin_SBU2 = 1,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_signal_SBU1 = ADC_CHANNEL_DEFAULT(ADC1, 4),
+  .adc_signal_SBU2 = ADC_CHANNEL_DEFAULT(ADC1, 17)
+};
+
+board board_red = {
+  .set_bootkick = unused_set_bootkick,
+  .harness_config = &red_harness_config,
+  .has_spi = false,
+  .has_fan = false,
+  .avdd_mV = 3300U,
+  .fan_enable_cooldown_time = 0U,
+  .init = red_init,
+  .init_bootloader = unused_init_bootloader,
+  .enable_can_transceiver = red_enable_can_transceiver,
+  .led_GPIO = {GPIOE, GPIOE, GPIOE},
+  .led_pin = {4, 3, 2},
+  .set_can_mode = red_set_can_mode,
+  .read_voltage_mV = red_read_voltage_mV,
+  .read_current_mA = unused_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio,
+  .set_amp_enabled = unused_set_amp_enabled
+};

artifacts/package_sources/panda/board/boards/tres.h

@@ -0,0 +1,175 @@
+#pragma once
+
+#include "board_declarations.h"
+
+// ///////////////////////////
+// Tres (STM32H7) + Harness //
+// ///////////////////////////
+
+static bool tres_ir_enabled;
+static bool tres_fan_enabled;
+static void tres_update_fan_ir_power(void) {
+  set_gpio_output(GPIOD, 3, tres_ir_enabled || tres_fan_enabled);
+}
+
+static void tres_set_ir_power(uint8_t percentage){
+  tres_ir_enabled = (percentage > 0U);
+  tres_update_fan_ir_power();
+  pwm_set(TIM3, 4, percentage);
+}
+
+static void tres_set_bootkick(BootState state) {
+  set_gpio_output(GPIOA, 0, state != BOOT_BOOTKICK);
+  set_gpio_output(GPIOC, 12, state != BOOT_RESET);
+}
+
+static void tres_set_fan_enabled(bool enabled) {
+  // NOTE: fan controller reset doesn't work on a tres if IR is enabled
+  tres_fan_enabled = enabled;
+  tres_update_fan_ir_power();
+}
+
+static void tres_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  static bool can0_enabled = false;
+  static bool can2_enabled = false;
+
+  switch (transceiver) {
+    case 1U:
+      can0_enabled = enabled;
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    case 3U:
+      can2_enabled = enabled;
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 11, !enabled);
+      break;
+    default:
+      break;
+  }
+
+  // CAN0 and 2 are tied, so enable both if either is enabled
+  set_gpio_output(GPIOG, 11, !(can0_enabled || can2_enabled));
+  set_gpio_output(GPIOD, 7, !(can0_enabled || can2_enabled));
+}
+
+static void tres_set_can_mode(uint8_t mode) {
+  current_board->enable_can_transceiver(2U, false);
+  current_board->enable_can_transceiver(4U, false);
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable normal mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_mode(GPIOB, 12, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_mode(GPIOB, 13, MODE_ANALOG);
+
+        // B5,B6: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_FDCAN2);
+        current_board->enable_can_transceiver(2U, true);
+      } else {
+        // B5,B6: disable normal mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_mode(GPIOB, 5, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_mode(GPIOB, 6, MODE_ANALOG);
+        // B12,B13: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_FDCAN2);
+        current_board->enable_can_transceiver(4U, true);
+      }
+      break;
+    default:
+      break;
+  }
+}
+
+static bool tres_read_som_gpio (void) {
+  return (get_gpio_input(GPIOC, 2) != 0);
+}
+
+static void tres_init(void) {
+  // Enable USB 3.3V LDO for USB block
+  register_set_bits(&(PWR->CR3), PWR_CR3_USBREGEN);
+  register_set_bits(&(PWR->CR3), PWR_CR3_USB33DEN);
+  while ((PWR->CR3 & PWR_CR3_USB33RDY) == 0U);
+
+  common_init_gpio();
+
+  // C2: SOM GPIO used as input (fan control at boot)
+  set_gpio_mode(GPIOC, 2, MODE_INPUT);
+  set_gpio_pullup(GPIOC, 2, PULL_DOWN);
+
+  // SOM bootkick + reset lines
+  // WARNING: make sure output state is set before configuring as output
+  tres_set_bootkick(BOOT_BOOTKICK);
+  set_gpio_mode(GPIOC, 12, MODE_OUTPUT);
+
+  // SOM debugging UART
+  gpio_uart7_init();
+  uart_init(&uart_ring_som_debug, 115200);
+
+  // fan setup
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+
+  // Initialize IR PWM and set to 0%
+  set_gpio_alternate(GPIOC, 9, GPIO_AF2_TIM3);
+  pwm_init(TIM3, 4);
+  tres_set_ir_power(0U);
+
+  // Fake siren
+  set_gpio_alternate(GPIOC, 10, GPIO_AF4_I2C5);
+  set_gpio_alternate(GPIOC, 11, GPIO_AF4_I2C5);
+  register_set_bits(&(GPIOC->OTYPER), GPIO_OTYPER_OT10 | GPIO_OTYPER_OT11); // open drain
+
+  // Clock source
+  clock_source_init(false);
+}
+
+static harness_configuration tres_harness_config = {
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOA,
+  .GPIO_relay_SBU1 = GPIOA,
+  .GPIO_relay_SBU2 = GPIOA,
+  .pin_SBU1 = 4,
+  .pin_SBU2 = 1,
+  .pin_relay_SBU1 = 8,
+  .pin_relay_SBU2 = 3,
+  .adc_signal_SBU1 = ADC_CHANNEL_DEFAULT(ADC1, 4),
+  .adc_signal_SBU2 = ADC_CHANNEL_DEFAULT(ADC1, 17)
+};
+
+board board_tres = {
+  .harness_config = &tres_harness_config,
+  .has_spi = true,
+  .has_fan = true,
+  .avdd_mV = 1800U,
+  .fan_enable_cooldown_time = 3U,
+  .init = tres_init,
+  .init_bootloader = unused_init_bootloader,
+  .enable_can_transceiver = tres_enable_can_transceiver,
+  .led_GPIO = {GPIOE, GPIOE, GPIOE},
+  .led_pin = {4, 3, 2},
+  .set_can_mode = tres_set_can_mode,
+  .read_voltage_mV = red_read_voltage_mV,
+  .read_current_mA = unused_read_current,
+  .set_fan_enabled = tres_set_fan_enabled,
+  .set_ir_power = tres_set_ir_power,
+  .set_siren = fake_i2c_siren_set,
+  .set_bootkick = tres_set_bootkick,
+  .read_som_gpio = tres_read_som_gpio,
+  .set_amp_enabled = unused_set_amp_enabled
+};

artifacts/package_sources/panda/board/boards/unused_funcs.h

@@ -0,0 +1,32 @@
+#pragma once
+
+void unused_init_bootloader(void) {
+}
+
+void unused_set_ir_power(uint8_t percentage) {
+  UNUSED(percentage);
+}
+
+void unused_set_fan_enabled(bool enabled) {
+  UNUSED(enabled);
+}
+
+void unused_set_siren(bool enabled) {
+  UNUSED(enabled);
+}
+
+uint32_t unused_read_current(void) {
+  return 0U;
+}
+
+void unused_set_bootkick(BootState state) {
+  UNUSED(state);
+}
+
+bool unused_read_som_gpio(void) {
+  return false;
+}
+
+void unused_set_amp_enabled(bool enabled) {
+  UNUSED(enabled);
+}

artifacts/package_sources/panda/board/body/__init__.py

@@ -0,0 +1,42 @@
+# python helpers for the body panda
+import struct
+
+from panda import Panda
+
+class PandaBody(Panda):
+
+  MOTOR_LEFT: int = 1
+  MOTOR_RIGHT: int = 2
+
+  # ****************** Motor Control *****************
+  @staticmethod
+  def _ensure_valid_motor(motor: int) -> None:
+    if motor not in (PandaBody.MOTOR_LEFT, PandaBody.MOTOR_RIGHT):
+      raise ValueError("motor must be MOTOR_LEFT or MOTOR_RIGHT")
+
+  def motor_set_speed(self, motor: int, speed: int) -> None:
+    self._ensure_valid_motor(motor)
+    assert -100 <= speed <= 100, "speed must be between -100 and 100"
+    speed_param = speed if speed >= 0 else (256 + speed)
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xe0, motor, speed_param, b'')
+
+  def motor_set_target_rpm(self, motor: int, rpm: float) -> None:
+    self._ensure_valid_motor(motor)
+    target_deci_rpm = int(round(rpm * 10.0))
+    assert -32768 <= target_deci_rpm <= 32767, "target rpm out of range (-3276.8 to 3276.7)"
+    target_param = target_deci_rpm if target_deci_rpm >= 0 else (target_deci_rpm + (1 << 16))
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xe4, motor, target_param, b'')
+
+  def motor_stop(self, motor: int) -> None:
+    self._ensure_valid_motor(motor)
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xe1, motor, 0, b'')
+
+  def motor_get_encoder_state(self, motor: int) -> tuple[int, float]:
+    self._ensure_valid_motor(motor)
+    dat = self._handle.controlRead(Panda.REQUEST_IN, 0xe2, motor, 0, 8)
+    position, rpm_milli = struct.unpack("<ii", dat)
+    return position, rpm_milli / 1000.0
+
+  def motor_reset_encoder(self, motor: int) -> None:
+    self._ensure_valid_motor(motor)
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xe3, motor, 0, b'')

artifacts/package_sources/panda/board/body/boards/board_body.h

@@ -0,0 +1,21 @@
+#include "board/body/motor_control.h"
+
+void board_body_init(void) {
+  motor_init();
+  motor_encoder_init();
+  motor_speed_controller_init();
+  motor_encoder_reset(1);
+  motor_encoder_reset(2);
+
+  // Initialize CAN pins
+  set_gpio_pullup(GPIOD, 0, PULL_NONE);
+  set_gpio_alternate(GPIOD, 0, GPIO_AF9_FDCAN1);
+  set_gpio_pullup(GPIOD, 1, PULL_NONE);
+  set_gpio_alternate(GPIOD, 1, GPIO_AF9_FDCAN1);
+}
+
+board board_body = {
+  .led_GPIO = {GPIOC, GPIOC, GPIOC},
+  .led_pin = {7, 7, 7},
+  .init = board_body_init,
+};

artifacts/package_sources/panda/board/body/boards/board_declarations.h

@@ -0,0 +1,21 @@
+#pragma once
+
+#include <stdint.h>
+#include <stdbool.h>
+
+// ******************** Prototypes ********************
+typedef void (*board_init)(void);
+typedef void (*board_init_bootloader)(void);
+typedef void (*board_enable_can_transceiver)(uint8_t transceiver, bool enabled);
+
+struct board {
+  GPIO_TypeDef * const led_GPIO[3];
+  const uint8_t led_pin[3];
+  const uint8_t led_pwm_channels[3]; // leave at 0 to disable PWM
+  board_init init;
+  board_init_bootloader init_bootloader;
+  const bool has_spi;
+};
+
+// ******************* Definitions ********************
+#define HW_TYPE_BODY 0xB1U

artifacts/package_sources/panda/board/body/can.h

@@ -0,0 +1,76 @@
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "board/can.h"
+#include "board/health.h"
+#include "board/body/motor_control.h"
+#include "board/drivers/can_common_declarations.h"
+#include "iqdbc/safety/declarations.h"
+
+#define BODY_CAN_ADDR_MOTOR_SPEED      0x201U
+#define BODY_CAN_MOTOR_SPEED_PERIOD_US 10000U
+#define BODY_BUS_NUMBER                 0U
+
+static struct {
+  bool pending;
+  int32_t left_target_deci_rpm;
+  int32_t right_target_deci_rpm;
+} body_can_command;
+
+void body_can_send_motor_speeds(uint8_t bus, float left_speed_rpm, float right_speed_rpm) {
+  CANPacket_t pkt;
+  pkt.bus = bus;
+  pkt.addr = BODY_CAN_ADDR_MOTOR_SPEED;
+  pkt.returned = 0;
+  pkt.rejected = 0;
+  pkt.extended = 0;
+  pkt.fd = 0;
+  pkt.data_len_code = 8;
+  int16_t left_speed_deci = left_speed_rpm * 10;
+  int16_t right_speed_deci = right_speed_rpm * 10;
+  pkt.data[0] = (uint8_t)((left_speed_deci >> 8) & 0xFFU);
+  pkt.data[1] = (uint8_t)(left_speed_deci & 0xFFU);
+  pkt.data[2] = (uint8_t)((right_speed_deci >> 8) & 0xFFU);
+  pkt.data[3] = (uint8_t)(right_speed_deci & 0xFFU);
+  pkt.data[4] = 0U;
+  pkt.data[5] = 0U;
+  pkt.data[6] = 0U;
+  pkt.data[7] = 0U;
+  can_set_checksum(&pkt);
+  can_send(&pkt, bus, true);
+}
+
+void body_can_process_target(int16_t left_target_deci_rpm, int16_t right_target_deci_rpm) {
+  body_can_command.left_target_deci_rpm = (int32_t)left_target_deci_rpm;
+  body_can_command.right_target_deci_rpm = (int32_t)right_target_deci_rpm;
+  body_can_command.pending = true;
+}
+
+void body_can_init(void) {
+  body_can_command.pending = false;
+  can_silent = false;
+  can_loopback = false;
+  (void)set_safety_hooks(SAFETY_BODY, 0U);
+  set_gpio_output(GPIOD, 2U, 0); // Enable CAN transceiver
+  can_init_all();
+}
+
+void body_can_periodic(uint32_t now) {
+  if (body_can_command.pending) {
+    body_can_command.pending = false;
+    float left_target_rpm = ((float)body_can_command.left_target_deci_rpm) * 0.1f;
+    float right_target_rpm = ((float)body_can_command.right_target_deci_rpm) * 0.1f;
+    motor_speed_controller_set_target_rpm(BODY_MOTOR_LEFT, left_target_rpm);
+    motor_speed_controller_set_target_rpm(BODY_MOTOR_RIGHT, right_target_rpm);
+  }
+
+  static uint32_t last_motor_speed_tx_us = 0;
+  if ((now - last_motor_speed_tx_us) >= BODY_CAN_MOTOR_SPEED_PERIOD_US) {
+    float left_speed_rpm = motor_encoder_get_speed_rpm(BODY_MOTOR_LEFT);
+    float right_speed_rpm = motor_encoder_get_speed_rpm(BODY_MOTOR_RIGHT);
+    body_can_send_motor_speeds(BODY_BUS_NUMBER, left_speed_rpm, right_speed_rpm);
+    last_motor_speed_tx_us = now;
+  }
+}

artifacts/package_sources/panda/board/body/flash.py

@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+import argparse
+import os
+import subprocess
+
+from panda import Panda
+
+BODY_DIR = os.path.dirname(os.path.realpath(__file__))
+BOARD_DIR = os.path.abspath(os.path.join(BODY_DIR, ".."))
+REPO_ROOT = os.path.abspath(os.path.join(BOARD_DIR, ".."))
+DEFAULT_FIRMWARE = os.path.join(BOARD_DIR, "obj", "body_h7.bin.signed")
+
+
+def build_body() -> None:
+  subprocess.check_call(
+    f"scons -C {REPO_ROOT} -j$(nproc) board/obj/body_h7.bin.signed",
+    shell=True,
+  )
+
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser()
+  parser.add_argument("firmware", nargs="?", help="Optional path to firmware binary to flash")
+  parser.add_argument("--all", action="store_true", help="Flash all Panda devices")
+  parser.add_argument(
+    "--wait-usb",
+    action="store_true",
+    help="Wait for the panda to reconnect over USB after flashing (defaults to skipping reconnect).",
+  )
+  args = parser.parse_args()
+
+  firmware_path = os.path.abspath(args.firmware) if args.firmware is not None else DEFAULT_FIRMWARE
+
+  build_body()
+
+  if not os.path.isfile(firmware_path):
+    parser.error(f"firmware file not found: {firmware_path}")
+
+  if args.all:
+    serials = Panda.list()
+    print(f"found {len(serials)} panda(s) - {serials}")
+  else:
+    serials = [None]
+
+  for s in serials:
+    with Panda(serial=s) as p:
+      print("flashing", p.get_usb_serial())
+      p.flash(firmware_path, reconnect=args.wait_usb)
+  exit(1 if len(serials) == 0 else 0)

artifacts/package_sources/panda/board/body/main.c

@@ -0,0 +1,81 @@
+#include <stdint.h>
+#include <stdbool.h>
+
+#include "board/config.h"
+#include "board/drivers/led.h"
+#include "board/drivers/pwm.h"
+#include "board/drivers/usb.h"
+#include "board/early_init.h"
+#include "board/obj/gitversion.h"
+#include "board/body/motor_control.h"
+#include "board/body/can.h"
+#include "iqdbc/safety/safety.h"
+#include "board/drivers/can_common.h"
+#include "board/drivers/fdcan.h"
+#include "board/can_comms.h"
+
+extern int _app_start[0xc000];
+
+#include "board/body/main_comms.h"
+
+void debug_ring_callback(uart_ring *ring) {
+  char rcv;
+  while (get_char(ring, &rcv)) {
+    (void)injectc(ring, rcv);
+  }
+}
+
+void __attribute__ ((noinline)) enable_fpu(void) {
+  SCB->CPACR |= ((3UL << (10U * 2U)) | (3UL << (11U * 2U)));
+}
+
+void __initialize_hardware_early(void) {
+  enable_fpu();
+  early_initialization();
+}
+
+volatile uint32_t tick_count = 0;
+
+void tick_handler(void) {
+  if (TICK_TIMER->SR != 0) {
+    if (can_health[0].transmit_error_cnt >= 128) {
+      (void)llcan_init(CANIF_FROM_CAN_NUM(0));
+    }
+    static bool led_on = false;
+    led_set(LED_RED, led_on);
+    led_on = !led_on;
+    tick_count++;
+  }
+  TICK_TIMER->SR = 0;
+}
+
+int main(void) {
+  disable_interrupts();
+  init_interrupts(true);
+
+  clock_init();
+  peripherals_init();
+
+  current_board = &board_body;
+  hw_type = HW_TYPE_BODY;
+
+  current_board->init();
+  
+  REGISTER_INTERRUPT(TICK_TIMER_IRQ, tick_handler, 10U, FAULT_INTERRUPT_RATE_TICK);
+
+  led_init();
+  microsecond_timer_init();
+  tick_timer_init();
+  usb_init();
+  body_can_init();
+
+  enable_interrupts();
+
+  while (true) {
+    uint32_t now = microsecond_timer_get();
+    motor_speed_controller_update(now);
+    body_can_periodic(now);
+  }
+
+  return 0;
+}

artifacts/package_sources/panda/board/body/main_comms.h

@@ -0,0 +1,105 @@
+void comms_endpoint2_write(const uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  unsigned int resp_len = 0;
+
+  switch (req->request) {
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      switch (req->param1) {
+        case 0:
+          print("-> entering bootloader\n");
+          enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        default:
+          print("Bootloader mode invalid\n");
+          break;
+      }
+      break;
+
+    // **** 0xd3/0xd4: signature bytes
+    case 0xd3:
+    case 0xd4: {
+      uint8_t offset = (req->request == 0xd3) ? 0U : 64U;
+      resp_len = 64U;
+      char *code = (char *)_app_start;
+      int code_len = _app_start[0];
+      (void)memcpy(resp, &code[code_len + offset], resp_len);
+      break;
+    }
+
+    // **** 0xd6: get version
+    case 0xd6:
+      (void)memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion) - 1U;
+      break;
+
+    // **** 0xd8: reset ST
+    case 0xd8:
+      NVIC_SystemReset();
+      break;
+
+    // **** 0xe0: set motor speed
+    case 0xe0:
+      motor_set_speed((uint8_t)req->param1, (int8_t)req->param2);
+      break;
+
+    // **** 0xe1: stop motor
+    case 0xe1:
+      motor_set_speed((uint8_t)req->param1, 0);
+      break;
+
+    // **** 0xe2: get motor encoder state
+    case 0xe2: {
+      uint8_t motor = (uint8_t)req->param1;
+      int32_t position = motor_encoder_get_position(motor);
+      float rpm = motor_encoder_get_speed_rpm(motor);
+      int32_t rpm_milli = (int32_t)(rpm * 1000.0f);
+      (void)memcpy(resp, &position, sizeof(position));
+      (void)memcpy(resp + sizeof(position), &rpm_milli, sizeof(rpm_milli));
+      resp_len = (uint8_t)(sizeof(position) + sizeof(rpm_milli));
+      break;
+    }
+
+    // **** 0xe3: reset encoder position
+    case 0xe3:
+      motor_encoder_reset((uint8_t)req->param1);
+      break;
+
+    // **** 0xe4: set motor target speed (rpm * 0.1)
+    case 0xe4: {
+      uint8_t motor = (uint8_t)req->param1;
+      float target_rpm = ((int16_t)req->param2) * 0.1f;
+      motor_speed_controller_set_target_rpm(motor, target_rpm);
+      break;
+    }
+
+    // **** 0xdd: get healthpacket and CANPacket versions
+    case 0xdd:
+      resp[0] = HEALTH_PACKET_VERSION;
+      resp[1] = CAN_PACKET_VERSION;
+      resp[2] = CAN_HEALTH_PACKET_VERSION;
+      resp_len = 3U;
+      break;
+
+    default:
+      // Ignore unhandled requests
+      break;
+  }
+  return resp_len;
+}

artifacts/package_sources/panda/board/body/motor_common.h

@@ -0,0 +1,15 @@
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#define BODY_MOTOR_COUNT 2U
+
+typedef enum {
+  BODY_MOTOR_LEFT = 1U,
+  BODY_MOTOR_RIGHT = 2U,
+} body_motor_id_e;
+
+static inline bool body_motor_is_valid(uint8_t motor) {
+  return (motor > 0U) && (motor <= BODY_MOTOR_COUNT);
+}

artifacts/package_sources/panda/board/body/motor_control.h

@@ -0,0 +1,251 @@
+#pragma once
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "board/body/motor_common.h"
+#include "board/body/motor_encoder.h"
+
+// Motor pin map:
+// M1 drive: PB8 -> TIM16_CH1, PB9 -> TIM17_CH1, PE2/PE3 enables
+// M2 drive: PA2 -> TIM15_CH1, PA3 -> TIM15_CH2, PE8/PE9 enables
+
+#define PWM_TIMER_CLOCK_HZ 120000000U
+#define PWM_FREQUENCY_HZ 5000U
+#define PWM_PERCENT_MAX 100
+#define PWM_RELOAD_TICKS ((PWM_TIMER_CLOCK_HZ + (PWM_FREQUENCY_HZ / 2U)) / PWM_FREQUENCY_HZ)
+
+#define KP         0.25f
+#define KI         0.5f
+#define KD         0.008f
+#define KFF        0.9f
+#define MAX_RPM    100.0f
+#define OUTPUT_MAX 100.0f
+#define DEADBAND_RPM 1.0f
+#define UPDATE_PERIOD_US 1000U
+
+typedef struct {
+  TIM_TypeDef *forward_timer;
+  uint8_t forward_channel;
+  TIM_TypeDef *reverse_timer;
+  uint8_t reverse_channel;
+  GPIO_TypeDef *pwm_port[2];
+  uint8_t pwm_pin[2];
+  uint8_t pwm_af[2];
+  GPIO_TypeDef *enable_port[2];
+  uint8_t enable_pin[2];
+} motor_pwm_config_t;
+
+static const motor_pwm_config_t motor_pwm_config[BODY_MOTOR_COUNT] = {
+  [BODY_MOTOR_LEFT - 1U] = {
+    TIM16, 1U, TIM17, 1U,
+    {GPIOB, GPIOB}, {8U, 9U}, {GPIO_AF1_TIM16, GPIO_AF1_TIM17},
+    {GPIOE, GPIOE}, {2U, 3U},
+  },
+  [BODY_MOTOR_RIGHT - 1U] = {
+    TIM15, 2U, TIM15, 1U,
+    {GPIOA, GPIOA}, {2U, 3U}, {GPIO_AF4_TIM15, GPIO_AF4_TIM15},
+    {GPIOE, GPIOE}, {8U, 9U},
+  },
+};
+
+typedef struct {
+  bool active;
+  float target_rpm;
+  float integral;
+  float previous_error;
+  float last_output;
+  uint32_t last_update_us;
+} motor_speed_state_t;
+
+static inline float motor_absf(float value) {
+  return (value < 0.0f) ? -value : value;
+}
+
+static inline float motor_clampf(float value, float min_value, float max_value) {
+  if (value < min_value) {
+    return min_value;
+  }
+  if (value > max_value) {
+    return max_value;
+  }
+  return value;
+}
+
+static motor_speed_state_t motor_speed_states[BODY_MOTOR_COUNT];
+
+static inline void motor_pwm_write(TIM_TypeDef *timer, uint8_t channel, uint8_t percentage) {
+  uint32_t period = (timer->ARR != 0U) ? timer->ARR : PWM_RELOAD_TICKS;
+  uint16_t comp = (uint16_t)((period * (uint32_t)percentage) / 100U);
+  if (channel == 1U) {
+    register_set(&(timer->CCR1), comp, 0xFFFFU);
+  } else if (channel == 2U) {
+    register_set(&(timer->CCR2), comp, 0xFFFFU);
+  }
+}
+
+static inline motor_speed_state_t *motor_speed_state_get(uint8_t motor) {
+  return body_motor_is_valid(motor) ? &motor_speed_states[motor - 1U] : NULL;
+}
+
+static inline void motor_speed_state_reset(motor_speed_state_t *state) {
+  state->active = false;
+  state->target_rpm = 0.0f;
+  state->integral = 0.0f;
+  state->previous_error = 0.0f;
+  state->last_output = 0.0f;
+  state->last_update_us = 0U;
+}
+
+static void motor_speed_controller_init(void) {
+  for (uint8_t i = 0U; i < BODY_MOTOR_COUNT; i++) {
+    motor_speed_state_reset(&motor_speed_states[i]);
+  }
+}
+
+static void motor_speed_controller_disable(uint8_t motor) {
+  motor_speed_state_t *state = motor_speed_state_get(motor);
+  if (state == NULL) {
+    return;
+  }
+  motor_speed_state_reset(state);
+}
+
+static inline void motor_write_enable(uint8_t motor_index, bool enable) {
+  const motor_pwm_config_t *cfg = &motor_pwm_config[motor_index];
+  uint8_t level = enable ? 1U : 0U;
+  set_gpio_output(cfg->enable_port[0], cfg->enable_pin[0], level);
+  set_gpio_output(cfg->enable_port[1], cfg->enable_pin[1], level);
+}
+
+static void motor_init(void) {
+  register_set_bits(&(RCC->AHB4ENR), RCC_AHB4ENR_GPIOAEN | RCC_AHB4ENR_GPIOBEN | RCC_AHB4ENR_GPIOEEN);
+  register_set_bits(&(RCC->APB2ENR), RCC_APB2ENR_TIM16EN | RCC_APB2ENR_TIM17EN | RCC_APB2ENR_TIM15EN);
+
+  for (uint8_t i = 0U; i < BODY_MOTOR_COUNT; i++) {
+    const motor_pwm_config_t *cfg = &motor_pwm_config[i];
+    motor_write_enable(i, false);
+    set_gpio_alternate(cfg->pwm_port[0], cfg->pwm_pin[0], cfg->pwm_af[0]);
+    set_gpio_alternate(cfg->pwm_port[1], cfg->pwm_pin[1], cfg->pwm_af[1]);
+
+    pwm_init(cfg->forward_timer, cfg->forward_channel);
+    pwm_init(cfg->reverse_timer, cfg->reverse_channel);
+
+    TIM_TypeDef *forward_timer = cfg->forward_timer;
+    register_set(&(forward_timer->PSC), 0U, 0xFFFFU);
+    register_set(&(forward_timer->ARR), PWM_RELOAD_TICKS, 0xFFFFU);
+    forward_timer->EGR |= TIM_EGR_UG;
+    register_set(&(forward_timer->BDTR), TIM_BDTR_MOE, 0xFFFFU);
+
+    if (cfg->reverse_timer != cfg->forward_timer) {
+      TIM_TypeDef *reverse_timer = cfg->reverse_timer;
+      register_set(&(reverse_timer->PSC), 0U, 0xFFFFU);
+      register_set(&(reverse_timer->ARR), PWM_RELOAD_TICKS, 0xFFFFU);
+      reverse_timer->EGR |= TIM_EGR_UG;
+      register_set(&(reverse_timer->BDTR), TIM_BDTR_MOE, 0xFFFFU);
+    }
+  }
+}
+
+static void motor_apply_pwm(uint8_t motor, int32_t speed_command) {
+  if (!body_motor_is_valid(motor)) {
+    return;
+  }
+
+  int8_t speed = (int8_t)motor_clampf((float)speed_command, -(float)PWM_PERCENT_MAX, (float)PWM_PERCENT_MAX);
+  uint8_t pwm_value = (uint8_t)((speed < 0) ? -speed : speed);
+  uint8_t motor_index = motor - 1U;
+  motor_write_enable(motor_index, speed != 0);
+  const motor_pwm_config_t *cfg = &motor_pwm_config[motor_index];
+
+  if (speed > 0) {
+    motor_pwm_write(cfg->forward_timer, cfg->forward_channel, pwm_value);
+    motor_pwm_write(cfg->reverse_timer, cfg->reverse_channel, 0U);
+  } else if (speed < 0) {
+    motor_pwm_write(cfg->forward_timer, cfg->forward_channel, 0U);
+    motor_pwm_write(cfg->reverse_timer, cfg->reverse_channel, pwm_value);
+  } else {
+    motor_pwm_write(cfg->forward_timer, cfg->forward_channel, 0U);
+    motor_pwm_write(cfg->reverse_timer, cfg->reverse_channel, 0U);
+  }
+}
+
+static inline void motor_set_speed(uint8_t motor, int8_t speed) {
+  motor_speed_controller_disable(motor);
+  motor_apply_pwm(motor, (int32_t)speed);
+}
+
+static inline void motor_speed_controller_set_target_rpm(uint8_t motor, float target_rpm) {
+  motor_speed_state_t *state = motor_speed_state_get(motor);
+  if (state == NULL) {
+    return;
+  }
+
+  target_rpm = motor_clampf(target_rpm, -MAX_RPM, MAX_RPM);
+  if (motor_absf(target_rpm) <= DEADBAND_RPM) {
+    motor_speed_controller_disable(motor);
+    motor_apply_pwm(motor, 0);
+    return;
+  }
+
+  state->active = true;
+  state->target_rpm = target_rpm;
+  state->integral = 0.0f;
+  state->previous_error = target_rpm - motor_encoder_get_speed_rpm(motor);
+  state->last_output = 0.0f;
+  state->last_update_us = 0U;
+}
+
+static inline void motor_speed_controller_update(uint32_t now_us) {
+  for (uint8_t motor = BODY_MOTOR_LEFT; motor <= BODY_MOTOR_RIGHT; motor++) {
+    motor_speed_state_t *state = motor_speed_state_get(motor);
+    if (!state->active) {
+      continue;
+    }
+
+    bool first_update = (state->last_update_us == 0U);
+    uint32_t dt_us = first_update ? UPDATE_PERIOD_US : (now_us - state->last_update_us);
+    if (!first_update && (dt_us < UPDATE_PERIOD_US)) {
+      continue;
+    }
+
+    float measured_rpm = motor_encoder_get_speed_rpm(motor);
+    float error = state->target_rpm - measured_rpm;
+
+    if ((motor_absf(state->target_rpm) <= DEADBAND_RPM) && (motor_absf(error) <= DEADBAND_RPM) && (motor_absf(measured_rpm) <= DEADBAND_RPM)) {
+      motor_speed_controller_disable(motor);
+      motor_apply_pwm(motor, 0);
+      continue;
+    }
+
+    float dt_s = (float)dt_us * 1.0e-6f;
+    float control = KFF * state->target_rpm;
+
+    if (dt_s > 0.0f) {
+      state->integral += error * dt_s;
+      float derivative = first_update ? 0.0f : (error - state->previous_error) / dt_s;
+
+      control += (KP * error) + (KI * state->integral) + (KD * derivative);
+    } else {
+      state->integral = 0.0f;
+      control += KP * error;
+    }
+
+    if ((state->target_rpm > 0.0f) && (control < 0.0f)) {
+      control = 0.0f;
+      state->integral = 0.0f;
+    } else if ((state->target_rpm < 0.0f) && (control > 0.0f)) {
+      control = 0.0f;
+      state->integral = 0.0f;
+    }
+
+    control = motor_clampf(control, -OUTPUT_MAX, OUTPUT_MAX);
+
+    int32_t command = (control >= 0.0f) ? (int32_t)(control + 0.5f) : (int32_t)(control - 0.5f);
+    motor_apply_pwm(motor, command);
+
+    state->previous_error = error;
+    state->last_output = control;
+    state->last_update_us = now_us;
+  }
+}

artifacts/package_sources/panda/board/body/motor_encoder.h

@@ -0,0 +1,170 @@
+#pragma once
+
+#include <stdint.h>
+
+#include "board/body/motor_common.h"
+
+// Encoder pin map:
+// Left motor:  PB6 -> TIM4_CH1, PB7 -> TIM4_CH2
+// Right motor: PA6 -> TIM3_CH1, PA7 -> TIM3_CH2
+
+typedef struct {
+  TIM_TypeDef *timer;
+  GPIO_TypeDef *pin_a_port;
+  uint8_t pin_a;
+  uint8_t pin_a_af;
+  GPIO_TypeDef *pin_b_port;
+  uint8_t pin_b;
+  uint8_t pin_b_af;
+  int8_t direction;
+  uint32_t counts_per_output_rev;
+  uint32_t min_dt_us;
+  float speed_alpha;
+  uint32_t filter;
+} motor_encoder_config_t;
+
+typedef struct {
+  const motor_encoder_config_t *config;
+  uint16_t last_timer_count;
+  int32_t accumulated_count;
+  int32_t last_speed_count;
+  uint32_t last_speed_timestamp_us;
+  float cached_speed_rps;
+} motor_encoder_state_t;
+
+static const motor_encoder_config_t motor_encoder_config[BODY_MOTOR_COUNT] = {
+  [BODY_MOTOR_LEFT - 1U] = {
+    .timer = TIM4,
+    .pin_a_port = GPIOB, .pin_a = 6U, .pin_a_af = GPIO_AF2_TIM4,
+    .pin_b_port = GPIOB, .pin_b = 7U, .pin_b_af = GPIO_AF2_TIM4,
+    .direction = -1,
+    .counts_per_output_rev = 44U * 90U,
+    .min_dt_us = 250U,
+    .speed_alpha = 0.2f,
+    .filter = 3U,
+  },
+  [BODY_MOTOR_RIGHT - 1U] = {
+    .timer = TIM3,
+    .pin_a_port = GPIOA, .pin_a = 6U, .pin_a_af = GPIO_AF2_TIM3,
+    .pin_b_port = GPIOA, .pin_b = 7U, .pin_b_af = GPIO_AF2_TIM3,
+    .direction = 1,
+    .counts_per_output_rev = 44U * 90U,
+    .min_dt_us = 250U,
+    .speed_alpha = 0.2f,
+    .filter = 3U,
+  },
+};
+
+static motor_encoder_state_t motor_encoders[BODY_MOTOR_COUNT] = {
+  { .config = &motor_encoder_config[0] },
+  { .config = &motor_encoder_config[1] },
+};
+
+static void motor_encoder_configure_gpio(const motor_encoder_config_t *cfg) {
+  set_gpio_pullup(cfg->pin_a_port, cfg->pin_a, PULL_UP);
+  set_gpio_output_type(cfg->pin_a_port, cfg->pin_a, OUTPUT_TYPE_PUSH_PULL);
+  set_gpio_alternate(cfg->pin_a_port, cfg->pin_a, cfg->pin_a_af);
+
+  set_gpio_pullup(cfg->pin_b_port, cfg->pin_b, PULL_UP);
+  set_gpio_output_type(cfg->pin_b_port, cfg->pin_b, OUTPUT_TYPE_PUSH_PULL);
+  set_gpio_alternate(cfg->pin_b_port, cfg->pin_b, cfg->pin_b_af);
+}
+
+static void motor_encoder_configure_timer(motor_encoder_state_t *state) {
+  const motor_encoder_config_t *cfg = state->config;
+  TIM_TypeDef *timer = cfg->timer;
+  timer->CR1 = 0U;
+  timer->CR2 = 0U;
+  timer->SMCR = 0U;
+  timer->DIER = 0U;
+  timer->SR = 0U;
+  timer->CCMR1 = (TIM_CCMR1_CC1S_0) | (TIM_CCMR1_CC2S_0) | (cfg->filter << TIM_CCMR1_IC1F_Pos) | (cfg->filter << TIM_CCMR1_IC2F_Pos);
+  timer->CCER = TIM_CCER_CC1E | TIM_CCER_CC2E;
+  timer->PSC = 0U;
+  timer->ARR = 0xFFFFU;
+  timer->CNT = 0U;
+  state->last_timer_count = 0U;
+  state->accumulated_count = 0;
+  state->last_speed_count = 0;
+  state->cached_speed_rps = 0.0f;
+  timer->SMCR = (TIM_SMCR_SMS_0 | TIM_SMCR_SMS_1);
+  timer->CR1 = TIM_CR1_CEN;
+}
+
+static void motor_encoder_init(void) {
+  register_set_bits(&(RCC->APB1LENR), RCC_APB1LENR_TIM4EN | RCC_APB1LENR_TIM3EN);
+  register_set_bits(&(RCC->APB1LRSTR), RCC_APB1LRSTR_TIM4RST | RCC_APB1LRSTR_TIM3RST);
+  register_clear_bits(&(RCC->APB1LRSTR), RCC_APB1LRSTR_TIM4RST | RCC_APB1LRSTR_TIM3RST);
+
+  for (uint8_t i = 0U; i < BODY_MOTOR_COUNT; i++) {
+    motor_encoder_state_t *state = &motor_encoders[i];
+    const motor_encoder_config_t *cfg = state->config;
+    motor_encoder_configure_gpio(cfg);
+    motor_encoder_configure_timer(state);
+    state->last_speed_timestamp_us = 0U;
+  }
+}
+
+static inline int32_t motor_encoder_refresh(motor_encoder_state_t *state) {
+  const motor_encoder_config_t *cfg = state->config;
+  TIM_TypeDef *timer = cfg->timer;
+  uint16_t raw = (uint16_t)timer->CNT;
+  int32_t delta = (int16_t)(raw - state->last_timer_count);
+  delta *= cfg->direction;
+  state->last_timer_count = raw;
+  state->accumulated_count += delta;
+  return state->accumulated_count;
+}
+
+static inline int32_t motor_encoder_get_position(uint8_t motor) {
+  if (!body_motor_is_valid(motor)) {
+    return 0;
+  }
+  motor_encoder_state_t *state = &motor_encoders[motor - 1U];
+  return motor_encoder_refresh(state);
+}
+
+static void motor_encoder_reset(uint8_t motor) {
+  if (!body_motor_is_valid(motor)) {
+    return;
+  }
+  motor_encoder_state_t *state = &motor_encoders[motor - 1U];
+  state->config->timer->CNT = 0U;
+  state->last_timer_count = 0U;
+  state->accumulated_count = 0;
+  state->last_speed_count = 0;
+  state->last_speed_timestamp_us = 0U;
+  state->cached_speed_rps = 0.0f;
+}
+
+static float motor_encoder_get_speed_rpm(uint8_t motor) {
+  if (!body_motor_is_valid(motor)) {
+    return 0.0f;
+  }
+  motor_encoder_state_t *state = &motor_encoders[motor - 1U];
+
+  const motor_encoder_config_t *cfg = state->config;
+  motor_encoder_refresh(state);
+
+  uint32_t now = microsecond_timer_get();
+  if (state->last_speed_timestamp_us == 0U) {
+    state->last_speed_timestamp_us = now;
+    state->last_speed_count = state->accumulated_count;
+    state->cached_speed_rps = 0.0f;
+    return 0.0f;
+  }
+
+  uint32_t dt = now - state->last_speed_timestamp_us;
+  int32_t delta = state->accumulated_count - state->last_speed_count;
+  if ((dt < cfg->min_dt_us) || (delta == 0)) {
+    return state->cached_speed_rps * 60.0f;
+  }
+
+  state->last_speed_count = state->accumulated_count;
+  state->last_speed_timestamp_us = now;
+
+  float counts_per_second = ((float)delta * 1000000.0f) / (float)dt;
+  float new_speed_rps = (cfg->counts_per_output_rev != 0U) ? (counts_per_second / (float)cfg->counts_per_output_rev) : 0.0f;
+  state->cached_speed_rps += cfg->speed_alpha * (new_speed_rps - state->cached_speed_rps);
+  return state->cached_speed_rps * 60.0f;
+}

artifacts/package_sources/panda/board/body/stm32h7/board.h

@@ -0,0 +1,9 @@
+#include "board/body/boards/board_declarations.h"
+#include "board/body/boards/board_body.h"
+
+extern board *current_board;
+extern uint8_t hw_type;
+
+void detect_board_type(void) {
+  // Board type set explicitly in main()
+}

artifacts/package_sources/panda/board/bootstub.c

@@ -0,0 +1,85 @@
+#define VERS_TAG 0x53524556
+#define MIN_VERSION 2
+
+// ********************* Includes *********************
+#include "board/config.h"
+
+#include "board/drivers/led.h"
+#include "board/drivers/pwm.h"
+#include "board/drivers/usb.h"
+
+#include "board/early_init.h"
+#include "board/provision.h"
+
+#include "crypto/rsa.h"
+#include "crypto/sha.h"
+
+#include "board/obj/cert.h"
+#include "board/obj/gitversion.h"
+#include "board/flasher.h"
+
+// cppcheck-suppress unusedFunction ; used in headers not included in cppcheck
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+void fail(void) {
+  soft_flasher_start();
+}
+
+// know where to sig check
+extern void *_app_start[];
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  disable_interrupts();
+  clock_init();
+  detect_board_type();
+
+#ifdef PANDA_JUNGLE
+  current_board->set_panda_power(true);
+#endif
+
+  if (enter_bootloader_mode == ENTER_SOFTLOADER_MAGIC) {
+    enter_bootloader_mode = 0;
+    soft_flasher_start();
+  }
+
+  // validate length
+  int len = (int)_app_start[0];
+  if ((len < 8) || (len > (0x1000000 - 0x4000 - 4 - RSANUMBYTES))) goto fail;
+
+  // compute SHA hash
+  uint8_t digest[SHA_DIGEST_SIZE];
+  SHA_hash(&_app_start[1], len-4, digest);
+
+  // verify version, last bytes in the signed area
+  uint32_t vers[2] = {0};
+  memcpy(&vers, ((void*)&_app_start[0]) + len - sizeof(vers), sizeof(vers));
+  if (vers[0] != VERS_TAG || vers[1] < MIN_VERSION) {
+    goto fail;
+  }
+
+  // verify RSA signature
+  if (RSA_verify(&release_rsa_key, ((void*)&_app_start[0]) + len, RSANUMBYTES, digest, SHA_DIGEST_SIZE)) {
+    goto good;
+  }
+
+  // allow debug if built from source
+#ifdef ALLOW_DEBUG
+  if (RSA_verify(&debug_rsa_key, ((void*)&_app_start[0]) + len, RSANUMBYTES, digest, SHA_DIGEST_SIZE)) {
+    goto good;
+  }
+#endif
+
+// here is a failure
+fail:
+  fail();
+  return 0;
+good:
+  // jump to flash
+  ((void(*)(void)) _app_start[1])();
+  return 0;
+}

artifacts/package_sources/panda/board/bootstub_declarations.h

@@ -0,0 +1,18 @@
+// ******************** Prototypes ********************
+void print(const char *a){ UNUSED(a); }
+void puth(uint8_t i){ UNUSED(i); }
+void puth2(uint8_t i){ UNUSED(i); }
+void puth4(uint8_t i){ UNUSED(i); }
+void hexdump(const void *a, int l){ UNUSED(a); UNUSED(l); }
+typedef struct board board;
+typedef struct harness_configuration harness_configuration;
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel);
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage);
+// No UART support in bootloader
+typedef struct uart_ring {} uart_ring;
+uart_ring uart_ring_som_debug;
+void uart_init(uart_ring *q, int baud) { UNUSED(q); UNUSED(baud); }
+
+// ********************* Globals **********************
+uint8_t hw_type = 0;
+board *current_board;

artifacts/package_sources/panda/board/can.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#define PANDA_CAN_CNT 3U
+
+#include "iqdbc/safety/can.h"

artifacts/package_sources/panda/board/can_comms.h

@@ -0,0 +1,122 @@
+/*
+  CAN transactions to and from the host come in the form of
+  a certain number of CANPacket_t. The transaction is split
+  into multiple transfers or chunks.
+
+  * comms_can_read outputs this buffer in chunks of a specified length.
+    chunks are always the given length, except the last one.
+  * comms_can_write reads in this buffer in chunks.
+  * both functions maintain an overflow buffer for a partial CANPacket_t that
+    spans multiple transfers/chunks.
+  * the overflow buffers are reset by a dedicated control transfer handler,
+    which is sent by the host on each start of a connection.
+*/
+
+typedef struct {
+  uint32_t ptr;
+  uint32_t tail_size;
+  uint8_t data[72];
+} asm_buffer;
+
+static asm_buffer can_read_buffer = {.ptr = 0U, .tail_size = 0U};
+
+int comms_can_read(uint8_t *data, uint32_t max_len) {
+  uint32_t pos = 0U;
+
+  // Send tail of previous message if it is in buffer
+  if (can_read_buffer.ptr > 0U) {
+    uint32_t overflow_len = MIN(max_len - pos, can_read_buffer.ptr);
+    (void)memcpy(&data[pos], can_read_buffer.data, overflow_len);
+    pos += overflow_len;
+    (void)memcpy(can_read_buffer.data, &can_read_buffer.data[overflow_len], can_read_buffer.ptr - overflow_len);
+    can_read_buffer.ptr -= overflow_len;
+  }
+
+  if (can_read_buffer.ptr == 0U) {
+    // Fill rest of buffer with new data
+    CANPacket_t can_packet;
+    while ((pos < max_len) && can_pop(&can_rx_q, &can_packet)) {
+      uint32_t pckt_len = CANPACKET_HEAD_SIZE + dlc_to_len[can_packet.data_len_code];
+      if ((pos + pckt_len) <= max_len) {
+        (void)memcpy(&data[pos], (uint8_t*)&can_packet, pckt_len);
+        pos += pckt_len;
+      } else {
+        (void)memcpy(&data[pos], (uint8_t*)&can_packet, max_len - pos);
+        can_read_buffer.ptr += pckt_len - (max_len - pos);
+        // cppcheck-suppress objectIndex
+        (void)memcpy(can_read_buffer.data, &((uint8_t*)&can_packet)[(max_len - pos)], can_read_buffer.ptr);
+        pos = max_len;
+      }
+    }
+  }
+
+  return pos;
+}
+
+static asm_buffer can_write_buffer = {.ptr = 0U, .tail_size = 0U};
+
+// send on CAN
+void comms_can_write(const uint8_t *data, uint32_t len) {
+  uint32_t pos = 0U;
+
+  // Assembling can message with data from buffer
+  if (can_write_buffer.ptr != 0U) {
+    if (can_write_buffer.tail_size <= (len - pos)) {
+      // we have enough data to complete the buffer
+      CANPacket_t to_push = {0};
+      (void)memcpy(&can_write_buffer.data[can_write_buffer.ptr], &data[pos], can_write_buffer.tail_size);
+      can_write_buffer.ptr += can_write_buffer.tail_size;
+      pos += can_write_buffer.tail_size;
+
+      // send out
+      (void)memcpy((uint8_t*)&to_push, can_write_buffer.data, can_write_buffer.ptr);
+      can_send(&to_push, to_push.bus, false);
+
+      // reset overflow buffer
+      can_write_buffer.ptr = 0U;
+      can_write_buffer.tail_size = 0U;
+    } else {
+      // maybe next time
+      uint32_t data_size = len - pos;
+      (void) memcpy(&can_write_buffer.data[can_write_buffer.ptr], &data[pos], data_size);
+      can_write_buffer.tail_size -= data_size;
+      can_write_buffer.ptr += data_size;
+      pos += data_size;
+    }
+  }
+
+  // rest of the message
+  while (pos < len) {
+    uint32_t pckt_len = CANPACKET_HEAD_SIZE + dlc_to_len[(data[pos] >> 4U)];
+    if ((pos + pckt_len) <= len) {
+      CANPacket_t to_push = {0};
+      (void)memcpy((uint8_t*)&to_push, &data[pos], pckt_len);
+      can_send(&to_push, to_push.bus, false);
+      pos += pckt_len;
+    } else {
+      (void)memcpy(can_write_buffer.data, &data[pos], len - pos);
+      can_write_buffer.ptr = len - pos;
+      can_write_buffer.tail_size = pckt_len - can_write_buffer.ptr;
+      pos += can_write_buffer.ptr;
+    }
+  }
+
+  refresh_can_tx_slots_available();
+}
+
+void comms_can_reset(void) {
+  can_write_buffer.ptr = 0U;
+  can_write_buffer.tail_size = 0U;
+  can_read_buffer.ptr = 0U;
+  can_read_buffer.tail_size = 0U;
+}
+
+// TODO: make this more general!
+void refresh_can_tx_slots_available(void) {
+  if (can_tx_check_min_slots_free(MAX_CAN_MSGS_PER_USB_BULK_TRANSFER)) {
+    can_tx_comms_resume_usb();
+  }
+  if (can_tx_check_min_slots_free(MAX_CAN_MSGS_PER_SPI_BULK_TRANSFER)) {
+    can_tx_comms_resume_spi();
+  }
+}

artifacts/package_sources/panda/board/comms_definitions.h

@@ -0,0 +1,12 @@
+typedef struct {
+  uint8_t request;
+  uint16_t param1;
+  uint16_t param2;
+  uint16_t length;
+} __attribute__((packed)) ControlPacket_t;
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp);
+void comms_endpoint2_write(const uint8_t *data, uint32_t len);
+void comms_can_write(const uint8_t *data, uint32_t len);
+int comms_can_read(uint8_t *data, uint32_t max_len);
+void comms_can_reset(void);

artifacts/package_sources/panda/board/config.h

@@ -0,0 +1,44 @@
+#pragma once
+
+#include <stdbool.h>
+
+//#define DEBUG
+//#define DEBUG_UART
+//#define DEBUG_USB
+//#define DEBUG_SPI
+//#define DEBUG_FAULTS
+//#define DEBUG_COMMS
+//#define DEBUG_FAN
+
+#define CAN_INIT_TIMEOUT_MS 500U
+#define USBPACKET_MAX_SIZE 0x40U
+#define MAX_CAN_MSGS_PER_USB_BULK_TRANSFER 51U
+#define MAX_CAN_MSGS_PER_SPI_BULK_TRANSFER 170U
+
+// USB definitions
+#define USB_VID 0x3801U
+
+#ifdef PANDA_JUNGLE
+  #ifdef BOOTSTUB
+    #define USB_PID 0xDDEFU
+  #else
+    #define USB_PID 0xDDCFU
+  #endif
+#else
+  #ifdef BOOTSTUB
+    #define USB_PID 0xDDEEU
+  #else
+    #define USB_PID 0xDDCCU
+  #endif
+#endif
+
+// platform includes
+#ifdef STM32H7
+  #include "board/stm32h7/stm32h7_config.h"
+#elif defined(STM32F4)
+  #include "board/stm32f4/stm32f4_config.h"
+#else
+  // TODO: uncomment this, cppcheck complains
+  // building for tests
+  //#include "fake_stm.h"
+#endif

artifacts/package_sources/panda/board/crc.h

@@ -0,0 +1,19 @@
+#pragma once
+
+uint8_t crc_checksum(const uint8_t *dat, int len, const uint8_t poly) {
+  uint8_t crc = 0xFFU;
+  int i;
+  int j;
+  for (i = len - 1; i >= 0; i--) {
+    crc ^= dat[i];
+    for (j = 0; j < 8; j++) {
+      if ((crc & 0x80U) != 0U) {
+        crc = (uint8_t)((crc << 1) ^ poly);
+      }
+      else {
+        crc <<= 1;
+      }
+    }
+  }
+  return crc;
+}

artifacts/package_sources/panda/board/critical.h

@@ -0,0 +1,16 @@
+#include "critical_declarations.h"
+
+// ********************* Critical section helpers *********************
+uint8_t global_critical_depth = 0U;
+
+static volatile bool interrupts_enabled = false;
+
+void enable_interrupts(void) {
+  interrupts_enabled = true;
+  __enable_irq();
+}
+
+void disable_interrupts(void) {
+  interrupts_enabled = false;
+  __disable_irq();
+}

artifacts/package_sources/panda/board/critical_declarations.h

@@ -0,0 +1,17 @@
+#pragma once
+
+// ********************* Critical section helpers *********************
+void enable_interrupts(void);
+void disable_interrupts(void);
+
+extern uint8_t global_critical_depth;
+
+#define ENTER_CRITICAL()                                      \
+  __disable_irq();                                            \
+  global_critical_depth += 1U;
+
+#define EXIT_CRITICAL()                                       \
+  global_critical_depth -= 1U;                                \
+  if ((global_critical_depth == 0U) && interrupts_enabled) {  \
+    __enable_irq();                                           \
+  }

artifacts/package_sources/panda/board/debug/README.md

@@ -0,0 +1,24 @@
+# In-circuit debugging using openocd and gdb
+
+## Hardware
+Connect an ST-Link V2 programmer to the SWD pins on the board. The pins that need to be connected are:
+- GND
+- VTref
+- SWDIO
+- SWCLK
+- NRST
+
+Make sure you're using a genuine one for boards that do not have a 3.3V panda power rail. For example, the tres runs at 1.8V, which is not supported by the clones.
+
+## Openocd
+Install openocd. For Ubuntu 24.04, the one in the package manager works fine: `sudo apt install openocd`.
+
+## GDB
+You need `gdb-multiarch`.
+
+Once openocd is running, you can connect from gdb as follows:
+```
+$ gdb-multiarch
+(gdb) target ext :3333
+```
+To reset and break, use `monitor reset halt`.

artifacts/package_sources/panda/board/debug/debug_h7.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -e
+
+sudo openocd -f "interface/stlink.cfg" -c "transport select hla_swd" -f "target/stm32h7x.cfg" -c "init"

artifacts/package_sources/panda/board/debug/dfu_util_h7.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -e
+
+DFU_UTIL="dfu-util"
+
+scons -u -j$(nproc)
+
+PYTHONPATH=.. python3 -c "from python import Panda; Panda().reset(enter_bootstub=True); Panda().reset(enter_bootloader=True)" || true
+sleep 1
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08020000 -D obj/panda_h7.bin.signed
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08000000:leave -D obj/bootstub.panda_h7.bin

artifacts/package_sources/panda/board/debug/gdb.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+gdb-multiarch  --eval-command="target extended-remote localhost:3333"

artifacts/package_sources/panda/board/drivers/bootkick.h

@@ -0,0 +1,68 @@
+#include "bootkick_declarations.h"
+
+bool bootkick_reset_triggered = false;
+
+void bootkick_tick(bool ignition, bool recent_heartbeat) {
+  static uint16_t bootkick_last_serial_ptr = 0;
+  static uint8_t waiting_to_boot_countdown = 0;
+  static uint8_t boot_reset_countdown = 0;
+  static uint8_t bootkick_harness_status_prev = HARNESS_STATUS_NC;
+  static bool bootkick_ign_prev = false;
+  static BootState boot_state = BOOT_BOOTKICK;
+  BootState boot_state_prev = boot_state;
+  const bool harness_inserted = (harness.status != bootkick_harness_status_prev) && (harness.status != HARNESS_STATUS_NC);
+
+  if ((ignition && !bootkick_ign_prev) || harness_inserted) {
+    // bootkick on rising edge of ignition or harness insertion
+    boot_state = BOOT_BOOTKICK;
+  } else if (recent_heartbeat) {
+    // disable bootkick once openpilot is up
+    boot_state = BOOT_STANDBY;
+  } else {
+
+  }
+
+  /*
+    Ensure SOM boots in case it goes into QDL mode. Reset behavior:
+    * shouldn't trigger on the first boot after power-on
+    * only try reset once per bootkick, i.e. don't keep trying until booted
+    * only try once per panda boot, since openpilot will reset panda on startup
+    * once BOOT_RESET is triggered, it stays until countdown is finished
+  */
+  if (!bootkick_reset_triggered && (boot_state == BOOT_BOOTKICK) && (boot_state_prev == BOOT_STANDBY)) {
+    waiting_to_boot_countdown = 20U;
+  }
+  if (waiting_to_boot_countdown > 0U) {
+    bool serial_activity = uart_ring_som_debug.w_ptr_tx != bootkick_last_serial_ptr;
+    if (serial_activity || current_board->read_som_gpio() || (boot_state != BOOT_BOOTKICK)) {
+      waiting_to_boot_countdown = 0U;
+    } else {
+      // try a reset
+      if (waiting_to_boot_countdown == 1U) {
+        boot_reset_countdown = 5U;
+      }
+    }
+  }
+
+  // handle reset state
+  if (boot_reset_countdown > 0U) {
+    boot_state = BOOT_RESET;
+    bootkick_reset_triggered = true;
+  } else {
+    if (boot_state == BOOT_RESET) {
+      boot_state = BOOT_BOOTKICK;
+    }
+  }
+
+  // update state
+  bootkick_ign_prev = ignition;
+  bootkick_harness_status_prev = harness.status;
+  bootkick_last_serial_ptr = uart_ring_som_debug.w_ptr_tx;
+  if (waiting_to_boot_countdown > 0U) {
+    waiting_to_boot_countdown--;
+  }
+  if (boot_reset_countdown > 0U) {
+    boot_reset_countdown--;
+  }
+  current_board->set_bootkick(boot_state);
+}

artifacts/package_sources/panda/board/drivers/bootkick_declarations.h

@@ -0,0 +1,5 @@
+#pragma once
+
+extern bool bootkick_reset_triggered;
+
+void bootkick_tick(bool ignition, bool recent_heartbeat);

artifacts/package_sources/panda/board/drivers/bxcan.h

@@ -0,0 +1,219 @@
+#include "bxcan_declarations.h"
+
+// IRQs: CAN1_TX, CAN1_RX0, CAN1_SCE
+//       CAN2_TX, CAN2_RX0, CAN2_SCE
+//       CAN3_TX, CAN3_RX0, CAN3_SCE
+
+CAN_TypeDef *cans[PANDA_CAN_CNT] = {CAN1, CAN2, CAN3};
+uint8_t can_irq_number[CAN_IRQS_ARRAY_SIZE][CAN_IRQS_ARRAY_SIZE] = {
+  { CAN1_TX_IRQn, CAN1_RX0_IRQn, CAN1_SCE_IRQn },
+  { CAN2_TX_IRQn, CAN2_RX0_IRQn, CAN2_SCE_IRQn },
+  { CAN3_TX_IRQn, CAN3_RX0_IRQn, CAN3_SCE_IRQn },
+};
+
+bool can_set_speed(uint8_t can_number) {
+  bool ret = true;
+  CAN_TypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  ret &= llcan_set_speed(
+    CANx,
+    bus_config[bus_number].can_speed,
+    can_loopback,
+    can_silent
+  );
+  return ret;
+}
+
+void can_clear_send(CAN_TypeDef *CANx, uint8_t can_number) {
+  can_health[can_number].can_core_reset_cnt += 1U;
+  llcan_clear_send(CANx);
+}
+
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg) {
+  CAN_TypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint32_t esr_reg = CANx->ESR;
+
+  can_health[can_number].bus_off = ((esr_reg & CAN_ESR_BOFF) >> CAN_ESR_BOFF_Pos);
+  can_health[can_number].bus_off_cnt += can_health[can_number].bus_off;
+  can_health[can_number].error_warning = ((esr_reg & CAN_ESR_EWGF) >> CAN_ESR_EWGF_Pos);
+  can_health[can_number].error_passive = ((esr_reg & CAN_ESR_EPVF) >> CAN_ESR_EPVF_Pos);
+
+  can_health[can_number].last_error = ((esr_reg & CAN_ESR_LEC) >> CAN_ESR_LEC_Pos);
+  if ((can_health[can_number].last_error != 0U) && (can_health[can_number].last_error != 7U)) {
+    can_health[can_number].last_stored_error = can_health[can_number].last_error;
+  }
+
+  can_health[can_number].receive_error_cnt = ((esr_reg & CAN_ESR_REC) >> CAN_ESR_REC_Pos);
+  can_health[can_number].transmit_error_cnt = ((esr_reg & CAN_ESR_TEC) >> CAN_ESR_TEC_Pos);
+
+  can_health[can_number].irq0_call_rate = interrupts[can_irq_number[can_number][0]].call_rate;
+  can_health[can_number].irq1_call_rate = interrupts[can_irq_number[can_number][1]].call_rate;
+  can_health[can_number].irq2_call_rate = interrupts[can_irq_number[can_number][2]].call_rate;
+
+  if (ir_reg != 0U) {
+    can_health[can_number].total_error_cnt += 1U;
+
+    // RX message lost due to FIFO overrun
+    if ((CANx->RF0R & (CAN_RF0R_FOVR0)) != 0U) {
+      can_health[can_number].total_rx_lost_cnt += 1U;
+      CANx->RF0R &= ~(CAN_RF0R_FOVR0);
+    }
+    can_clear_send(CANx, can_number);
+  }
+}
+
+// ***************************** CAN *****************************
+// CANx_SCE IRQ Handler
+static void can_sce(uint8_t can_number) {
+  update_can_health_pkt(can_number, 1U);
+}
+
+// CANx_TX IRQ Handler
+void process_can(uint8_t can_number) {
+  if (can_number != 0xffU) {
+
+    ENTER_CRITICAL();
+
+    CAN_TypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+    uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+    // check for empty mailbox
+    CANPacket_t to_send;
+    if ((CANx->TSR & (CAN_TSR_TERR0 | CAN_TSR_ALST0)) != 0U) { // last TX failed due to error arbitration lost
+      can_health[can_number].total_tx_lost_cnt += 1U;
+      CANx->TSR |= (CAN_TSR_TERR0 | CAN_TSR_ALST0);
+    }
+    if ((CANx->TSR & CAN_TSR_TME0) == CAN_TSR_TME0) {
+      // add successfully transmitted message to my fifo
+      if ((CANx->TSR & CAN_TSR_RQCP0) == CAN_TSR_RQCP0) {
+        if ((CANx->TSR & CAN_TSR_TXOK0) == CAN_TSR_TXOK0) {
+          CANPacket_t to_push;
+          to_push.fd = 0U;
+          to_push.returned = 1U;
+          to_push.rejected = 0U;
+          to_push.extended = (CANx->sTxMailBox[0].TIR >> 2) & 0x1U;
+          to_push.addr = (to_push.extended != 0U) ? (CANx->sTxMailBox[0].TIR >> 3) : (CANx->sTxMailBox[0].TIR >> 21);
+          to_push.data_len_code = CANx->sTxMailBox[0].TDTR & 0xFU;
+          to_push.bus = bus_number;
+          WORD_TO_BYTE_ARRAY(&to_push.data[0], CANx->sTxMailBox[0].TDLR);
+          WORD_TO_BYTE_ARRAY(&to_push.data[4], CANx->sTxMailBox[0].TDHR);
+          can_set_checksum(&to_push);
+
+          rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+        }
+
+        // clear interrupt
+        // careful, this can also be cleared by requesting a transmission
+        CANx->TSR |= CAN_TSR_RQCP0;
+      }
+
+      if (can_pop(can_queues[bus_number], &to_send)) {
+        if (can_check_checksum(&to_send)) {
+          can_health[can_number].total_tx_cnt += 1U;
+          // only send if we have received a packet
+          CANx->sTxMailBox[0].TIR = ((to_send.extended != 0U) ? (to_send.addr << 3) : (to_send.addr << 21)) | (to_send.extended << 2);
+          CANx->sTxMailBox[0].TDTR = to_send.data_len_code;
+          BYTE_ARRAY_TO_WORD(CANx->sTxMailBox[0].TDLR, &to_send.data[0]);
+          BYTE_ARRAY_TO_WORD(CANx->sTxMailBox[0].TDHR, &to_send.data[4]);
+          // Send request TXRQ
+          CANx->sTxMailBox[0].TIR |= 0x1U;
+        } else {
+          can_health[can_number].total_tx_checksum_error_cnt += 1U;
+        }
+
+        refresh_can_tx_slots_available();
+      }
+    }
+
+    EXIT_CRITICAL();
+  }
+}
+
+// CANx_RX0 IRQ Handler
+// blink blue when we are receiving CAN messages
+void can_rx(uint8_t can_number) {
+  CAN_TypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  while ((CANx->RF0R & CAN_RF0R_FMP0) != 0U) {
+    can_health[can_number].total_rx_cnt += 1U;
+
+    // add to my fifo
+    CANPacket_t to_push;
+
+    to_push.fd = 0U;
+    to_push.returned = 0U;
+    to_push.rejected = 0U;
+    to_push.extended = (CANx->sFIFOMailBox[0].RIR >> 2) & 0x1U;
+    to_push.addr = (to_push.extended != 0U) ? (CANx->sFIFOMailBox[0].RIR >> 3) : (CANx->sFIFOMailBox[0].RIR >> 21);
+    to_push.data_len_code = CANx->sFIFOMailBox[0].RDTR & 0xFU;
+    to_push.bus = bus_number;
+    WORD_TO_BYTE_ARRAY(&to_push.data[0], CANx->sFIFOMailBox[0].RDLR);
+    WORD_TO_BYTE_ARRAY(&to_push.data[4], CANx->sFIFOMailBox[0].RDHR);
+    can_set_checksum(&to_push);
+
+    // forwarding (panda only)
+    int bus_fwd_num = safety_fwd_hook(bus_number, to_push.addr);
+    if (bus_fwd_num != -1) {
+      CANPacket_t to_send;
+
+      to_send.fd = 0U;
+      to_send.returned = 0U;
+      to_send.rejected = 0U;
+      to_send.extended = to_push.extended; // TXRQ
+      to_send.addr = to_push.addr;
+      to_send.bus = to_push.bus;
+      to_send.data_len_code = to_push.data_len_code;
+      (void)memcpy(to_send.data, to_push.data, dlc_to_len[to_push.data_len_code]);
+      can_set_checksum(&to_send);
+
+      can_send(&to_send, bus_fwd_num, true);
+      can_health[can_number].total_fwd_cnt += 1U;
+    }
+
+    safety_rx_invalid += safety_rx_hook(&to_push) ? 0U : 1U;
+    ignition_can_hook(&to_push);
+
+    led_set(LED_BLUE, true);
+    rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+
+    // next
+    CANx->RF0R |= CAN_RF0R_RFOM0;
+  }
+}
+
+static void CAN1_TX_IRQ_Handler(void) { process_can(0); }
+static void CAN1_RX0_IRQ_Handler(void) { can_rx(0); }
+static void CAN1_SCE_IRQ_Handler(void) { can_sce(0); }
+
+static void CAN2_TX_IRQ_Handler(void) { process_can(1); }
+static void CAN2_RX0_IRQ_Handler(void) { can_rx(1); }
+static void CAN2_SCE_IRQ_Handler(void) { can_sce(1); }
+
+static void CAN3_TX_IRQ_Handler(void) { process_can(2); }
+static void CAN3_RX0_IRQ_Handler(void) { can_rx(2); }
+static void CAN3_SCE_IRQ_Handler(void) { can_sce(2); }
+
+bool can_init(uint8_t can_number) {
+  bool ret = false;
+
+  REGISTER_INTERRUPT(CAN1_TX_IRQn, CAN1_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_RX0_IRQn, CAN1_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_SCE_IRQn, CAN1_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN2_TX_IRQn, CAN2_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN2_RX0_IRQn, CAN2_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN2_SCE_IRQn, CAN2_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN3_TX_IRQn, CAN3_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(CAN3_RX0_IRQn, CAN3_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(CAN3_SCE_IRQn, CAN3_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+
+  if (can_number != 0xffU) {
+    CAN_TypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+    ret &= can_set_speed(can_number);
+    ret &= llcan_init(CANx);
+    // in case there are queued up messages
+    process_can(can_number);
+  }
+  return ret;
+}

artifacts/package_sources/panda/board/drivers/bxcan_declarations.h

@@ -0,0 +1,21 @@
+#pragma once
+
+// IRQs: CAN1_TX, CAN1_RX0, CAN1_SCE
+//       CAN2_TX, CAN2_RX0, CAN2_SCE
+//       CAN3_TX, CAN3_RX0, CAN3_SCE
+
+#define CAN_IRQS_ARRAY_SIZE 3
+extern CAN_TypeDef *cans[PANDA_CAN_CNT];
+extern uint8_t can_irq_number[CAN_IRQS_ARRAY_SIZE][CAN_IRQS_ARRAY_SIZE];
+
+bool can_set_speed(uint8_t can_number);
+void can_clear_send(CAN_TypeDef *CANx, uint8_t can_number);
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg);
+
+// ***************************** CAN *****************************
+// CANx_TX IRQ Handler
+void process_can(uint8_t can_number);
+// CANx_RX0 IRQ Handler
+// blink blue when we are receiving CAN messages
+void can_rx(uint8_t can_number);
+bool can_init(uint8_t can_number);

artifacts/package_sources/panda/board/drivers/can_common.h

@@ -0,0 +1,378 @@
+#include "can_common_declarations.h"
+
+uint32_t safety_tx_blocked = 0;
+uint32_t safety_rx_invalid = 0;
+uint32_t tx_buffer_overflow = 0;
+uint32_t rx_buffer_overflow = 0;
+
+can_health_t can_health[PANDA_CAN_CNT] = {{0}, {0}, {0}};
+
+// Ignition detected from CAN meessages
+bool ignition_can = false;
+uint32_t ignition_can_cnt = 0U;
+
+// set only once a Toyota SecOC hybrid gear source is positively identified: those cars keep
+// the harness ignition line live in Park, so the reported line has to follow the gear instead
+bool ignition_can_gates_line = false;
+
+bool can_silent = true;
+bool can_loopback = false;
+
+// ********************* instantiate queues *********************
+#define can_buffer(x, size) \
+  static CANPacket_t elems_##x[size]; \
+  extern can_ring can_##x; \
+  can_ring can_##x = { .w_ptr = 0, .r_ptr = 0, .fifo_size = (size), .elems = (CANPacket_t *)&(elems_##x) };
+
+#ifdef STM32H7
+  #define CAN_RX_BUFFER_SIZE 4096U
+  #define CAN_TX_BUFFER_SIZE 416U
+// ITCM RAM and DTCM RAM are the fastest for Cortex-M7 core access
+__attribute__((section(".axisram"))) can_buffer(rx_q, CAN_RX_BUFFER_SIZE)
+__attribute__((section(".itcmram"))) can_buffer(tx1_q, CAN_TX_BUFFER_SIZE)
+__attribute__((section(".itcmram"))) can_buffer(tx2_q, CAN_TX_BUFFER_SIZE)
+#else
+  #define CAN_RX_BUFFER_SIZE 512U
+  #define CAN_TX_BUFFER_SIZE 52U
+can_buffer(rx_q, CAN_RX_BUFFER_SIZE)
+can_buffer(tx1_q, CAN_TX_BUFFER_SIZE)
+can_buffer(tx2_q, CAN_TX_BUFFER_SIZE)
+#endif
+can_buffer(tx3_q, CAN_TX_BUFFER_SIZE)
+
+// FIXME:
+// cppcheck-suppress misra-c2012-9.3
+can_ring *can_queues[PANDA_CAN_CNT] = {&can_tx1_q, &can_tx2_q, &can_tx3_q};
+
+// ********************* interrupt safe queue *********************
+bool can_pop(can_ring *q, CANPacket_t *elem) {
+  bool ret = 0;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr != q->r_ptr) {
+    *elem = q->elems[q->r_ptr];
+    if ((q->r_ptr + 1U) == q->fifo_size) {
+      q->r_ptr = 0;
+    } else {
+      q->r_ptr += 1U;
+    }
+    ret = 1;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool can_push(can_ring *q, const CANPacket_t *elem) {
+  bool ret = false;
+  uint32_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  if ((q->w_ptr + 1U) == q->fifo_size) {
+    next_w_ptr = 0;
+  } else {
+    next_w_ptr = q->w_ptr + 1U;
+  }
+  if (next_w_ptr != q->r_ptr) {
+    q->elems[q->w_ptr] = *elem;
+    q->w_ptr = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+  if (!ret) {
+    #ifdef DEBUG
+      print("can_push to ");
+      if (q == &can_rx_q) {
+        print("can_rx_q");
+      } else if (q == &can_tx1_q) {
+        print("can_tx1_q");
+      } else if (q == &can_tx2_q) {
+        print("can_tx2_q");
+      } else if (q == &can_tx3_q) {
+        print("can_tx3_q");
+      } else {
+        print("unknown");
+      }
+      print(" failed!\n");
+    #endif
+  }
+  return ret;
+}
+
+uint32_t can_slots_empty(const can_ring *q) {
+  uint32_t ret = 0;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr >= q->r_ptr) {
+    ret = q->fifo_size - 1U - q->w_ptr + q->r_ptr;
+  } else {
+    ret = q->r_ptr - q->w_ptr - 1U;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+void can_clear(can_ring *q) {
+  ENTER_CRITICAL();
+  q->w_ptr = 0;
+  q->r_ptr = 0;
+  EXIT_CRITICAL();
+  // handle TX buffer full with zero ECUs awake on the bus
+  refresh_can_tx_slots_available();
+}
+
+// assign CAN numbering
+// bus num: CAN Bus numbers in panda, sent to/from USB
+//    Min: 0; Max: 127; Bit 7 marks message as receipt (bus 129 is receipt for but 1)
+// cans: Look up MCU can interface from bus number
+// can number: numeric lookup for MCU CAN interfaces (0 = CAN1, 1 = CAN2, etc);
+// bus_lookup: Translates from 'can number' to 'bus number'.
+// can_num_lookup: Translates from 'bus number' to 'can number'.
+// forwarding bus: If >= 0, forward all messages from this bus to the specified bus.
+
+// Helpers
+// Panda:       Bus 0=CAN1   Bus 1=CAN2   Bus 2=CAN3
+bus_config_t bus_config[PANDA_CAN_CNT] = {
+  { .bus_lookup = 0U, .can_num_lookup = 0U, .forwarding_bus = -1, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_auto = false, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+  { .bus_lookup = 1U, .can_num_lookup = 1U, .forwarding_bus = -1, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_auto = false, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+  { .bus_lookup = 2U, .can_num_lookup = 2U, .forwarding_bus = -1, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_auto = false, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+};
+
+void can_init_all(void) {
+  for (uint8_t i=0U; i < PANDA_CAN_CNT; i++) {
+    bus_config[i].canfd_enabled = false;
+    // NOTE: do NOT reset can_data_speed here. Matching stock panda, can_init_all() only clears
+    // canfd_enabled (re-discovered on RX via canfd_auto). The old "#ifndef CANFD: can_data_speed = 0U"
+    // fired on every board because CANFD is never defined, zeroing the FD data-phase bitrate on every
+    // set_safety_model() -> CAN-FD frames then failed with form/stuff errors and never re-enabled,
+    // breaking all CAN-FD cars (e.g. Kia EV6) after fingerprinting. can_data_speed is only used by fdcan.
+    can_clear(can_queues[i]);
+    (void)can_init(i);
+  }
+}
+
+void can_set_orientation(bool flipped) {
+  bus_config[0].bus_lookup = flipped ? 2U : 0U;
+  bus_config[0].can_num_lookup = flipped ? 2U : 0U;
+  bus_config[2].bus_lookup = flipped ? 0U : 2U;
+  bus_config[2].can_num_lookup = flipped ? 0U : 2U;
+}
+
+#ifdef PANDA_JUNGLE
+void can_set_forwarding(uint8_t from, uint8_t to) {
+  bus_config[from].forwarding_bus = to;
+}
+#endif
+
+// same checksum Toyota's safety mode validates: folds in the address and the length, so a
+// same-addressed frame from another brand does not satisfy it
+static bool toyota_hybrid_gear_checksum_valid(const CANPacket_t *msg, int len) {
+  uint8_t checksum = (uint8_t)(msg->addr) + (uint8_t)((unsigned int)(msg->addr) >> 8U) + (uint8_t)(len);
+  for (int i = 0; i < (len - 1); i++) {
+    checksum += (uint8_t)msg->data[i];
+  }
+  return checksum == (uint8_t)msg->data[len - 1];
+}
+
+void ignition_can_hook(CANPacket_t *msg) {
+  if (msg->bus == 0U) {
+    int len = GET_LEN(msg);
+    const int TESLA_DI_GEAR_P = 1;
+    const int TOYOTA_GEAR_P = 32;
+    const int TOYOTA_HYBRID_GEAR_P = 0;
+    const uint32_t TOYOTA_HYBRID_GEAR_LOCK = 20U;
+    static uint32_t toyota_hybrid_gear_lock_cnt = 0U;
+    static uint8_t toyota_hybrid_gear_last_ck = 0U;
+    static bool toyota_hybrid_gear_ck_varied = false;
+    static bool toyota_secoc_seen = false;
+    static bool tesla_gear_seen = false;
+    static int tesla_gear = TESLA_DI_GEAR_P;
+    static int toyota_gear = TOYOTA_GEAR_P;
+    static int toyota_hybrid_gear = TOYOTA_HYBRID_GEAR_P;
+    static bool toyota_hybrid_gear_seen = false;
+    static bool vw_meb_seen = false;
+    static bool vw_meb_getriebe_out_of_p = false;
+    static bool vw_meb_gateway_out_of_p = false;
+    static int prev_counter_vw_meb = -1;
+
+    // GM exception
+    if ((msg->addr == 0x1F1U) && (len == 8)) {
+      // SystemPowerMode (2=Run, 3=Crank Request)
+      ignition_can = (msg->data[0] & 0x2U) != 0U;
+      ignition_can_cnt = 0U;
+    }
+
+    // Rivian R1S/T GEN1 exception
+    if ((msg->addr == 0x152U) && (len == 8)) {
+      // 0x152 overlaps with Subaru pre-global which has this bit as the high beam
+      int counter = msg->data[1] & 0xFU;  // max is only 14
+
+      static int prev_counter_rivian = -1;
+      if ((counter == ((prev_counter_rivian + 1) % 15)) && (prev_counter_rivian != -1)) {
+        // VDM_OutputSignals->VDM_EpasPowerMode
+        ignition_can = ((msg->data[7] >> 4U) & 0x3U) == 1U;  // VDM_EpasPowerMode_Drive_On=1
+        ignition_can_cnt = 0U;
+      }
+      prev_counter_rivian = counter;
+    }
+
+    // Tesla Model 3/Y exception
+    if ((msg->addr == 0x221U) && (len == 8)) {
+      // 0x221 overlaps with Rivian which has random data on byte 0
+      int counter = msg->data[6] >> 4;
+
+      static int prev_counter_tesla = -1;
+      if ((counter == ((prev_counter_tesla + 1) % 16)) && (prev_counter_tesla != -1)) {
+        // VCFRONT_LVPowerState->VCFRONT_vehiclePowerState
+        int power_state = (msg->data[0] >> 5U) & 0x3U;
+        bool tesla_in_park = !tesla_gear_seen || (tesla_gear == TESLA_DI_GEAR_P);
+        ignition_can = (power_state == 0x3) && !tesla_in_park;  // VEHICLE_POWER_STATE_DRIVE=3
+        ignition_can_cnt = 0U;
+      }
+      prev_counter_tesla = counter;
+    }
+
+    if ((msg->addr == 0x118U) && (len == 8)) {
+      tesla_gear = (msg->data[2] >> 5) & 0x7;
+      tesla_gear_seen = true;
+    }
+
+    // Mazda exception
+    if ((msg->addr == 0x9EU) && (len == 8)) {
+      ignition_can = (msg->data[0] >> 5) == 0x6U;
+      ignition_can_cnt = 0U;
+    }
+
+    // Toyota/Lexus exception. SecOC hybrids (e.g. Sienna 4th gen) report gear on
+    // GEAR_PACKET_HYBRID (0x127); their GEAR_PACKET (0x3BC) does not read Park, so once
+    // the hybrid gear packet is seen, don't let 0x3BC override it (Park -> ignition off).
+    if ((msg->addr == 0x3BCU) && (len == 8) && !toyota_hybrid_gear_seen) {
+      int gear = msg->data[1] & 0x3FU;
+      if ((gear == 0) || (gear == 1) || (gear == 8) || (gear == 16) || (gear == 32)) {
+        toyota_gear = gear;
+        ignition_can = toyota_gear != TOYOTA_GEAR_P;
+        ignition_can_cnt = 0U;
+      }
+    }
+
+    // GEAR_PACKET_HYBRID is in four Toyota DBCs, so 0x127 alone would gate every Toyota hybrid.
+    // SECOC_SYNCHRONIZATION is broadcast only by the SecOC cars, which are the only ones whose
+    // gear is read off 0x127 at all. This narrows the gate, it can never widen it.
+    if ((msg->addr == 0xFU) && (len == 8)) {
+      toyota_secoc_seen = true;
+    }
+
+    // 0x127 is not Toyota exclusive on bus 0: Subaru global hybrid Transmission and Ford CADS
+    // MRR_Detection_008 are both 8 byte 0x127, and Subaru carries its gear in the same nibble.
+    // Only trust the gear on frames that validate against Toyota's checksum, and only let it
+    // gate the harness ignition line after it has held for TOYOTA_HYBRID_GEAR_LOCK frames.
+    if ((msg->addr == 0x127U) && (len == 8)) {
+      if (toyota_hybrid_gear_checksum_valid(msg, len)) {
+        int gear = (msg->data[5] >> 4U) & 0xFU;
+        if (gear <= 4) {
+          toyota_hybrid_gear_seen = true;
+          toyota_hybrid_gear = gear;
+          ignition_can = toyota_hybrid_gear != TOYOTA_HYBRID_GEAR_P;
+          ignition_can_cnt = 0U;
+
+          // a frame whose payload never moves could satisfy the checksum by coincidence, a live
+          // gear source cannot: require the checksum byte to change before trusting the gate
+          if ((toyota_hybrid_gear_lock_cnt > 0U) && (msg->data[len - 1] != toyota_hybrid_gear_last_ck)) {
+            toyota_hybrid_gear_ck_varied = true;
+          }
+          toyota_hybrid_gear_last_ck = msg->data[len - 1];
+
+          if (toyota_hybrid_gear_lock_cnt < TOYOTA_HYBRID_GEAR_LOCK) {
+            toyota_hybrid_gear_lock_cnt += 1U;
+          } else if (toyota_hybrid_gear_ck_varied && toyota_secoc_seen) {
+            ignition_can_gates_line = true;
+          } else {
+            // hold until the payload moves
+          }
+        }
+      } else {
+        toyota_hybrid_gear_lock_cnt = 0U;
+        toyota_hybrid_gear_ck_varied = false;
+      }
+    }
+
+    if ((msg->addr == 0xADU) && (len == 8)) {
+      int fahrstufe = (msg->data[5] >> 2) & 0xFU;
+      vw_meb_getriebe_out_of_p = (fahrstufe >= 6) && (fahrstufe <= 14);
+    }
+
+    if ((msg->addr == 0x3DCU) && (len == 8)) {
+      int fahrstufe = msg->data[5] & 0xFU;
+      vw_meb_gateway_out_of_p = (fahrstufe >= 6) && (fahrstufe <= 14);
+    }
+
+    if ((msg->addr == 0x13DU) && (len == 32)) {
+      vw_meb_seen = true;
+    }
+
+    if ((msg->addr == 0x3C0U) && (len == 4) && vw_meb_seen) {
+      int counter = msg->data[1] & 0xFU;
+      if ((counter == ((prev_counter_vw_meb + 1) % 16)) && (prev_counter_vw_meb != -1)) {
+        bool vw_meb_out_of_park = vw_meb_getriebe_out_of_p || vw_meb_gateway_out_of_p;
+        ignition_can = (((msg->data[2] >> 1) & 1U) != 0U) && vw_meb_out_of_park;
+        ignition_can_cnt = 0U;
+        ignition_can_gates_line = true;
+      }
+      prev_counter_vw_meb = counter;
+    }
+
+  }
+}
+
+bool can_tx_check_min_slots_free(uint32_t min) {
+  return
+    (can_slots_empty(&can_tx1_q) >= min) &&
+    (can_slots_empty(&can_tx2_q) >= min) &&
+    (can_slots_empty(&can_tx3_q) >= min);
+}
+
+uint8_t calculate_checksum(const uint8_t *dat, uint32_t len) {
+  uint8_t checksum = 0U;
+  for (uint32_t i = 0U; i < len; i++) {
+    checksum ^= dat[i];
+  }
+  return checksum;
+}
+
+void can_set_checksum(CANPacket_t *packet) {
+  packet->checksum = 0U;
+  packet->checksum = calculate_checksum((uint8_t *) packet, CANPACKET_HEAD_SIZE + GET_LEN(packet));
+}
+
+bool can_check_checksum(CANPacket_t *packet) {
+  return (calculate_checksum((uint8_t *) packet, CANPACKET_HEAD_SIZE + GET_LEN(packet)) == 0U);
+}
+
+void can_send(CANPacket_t *to_push, uint8_t bus_number, bool skip_tx_hook) {
+  if (skip_tx_hook || safety_tx_hook(to_push) != 0) {
+    if (bus_number < PANDA_CAN_CNT) {
+      // add CAN packet to send queue
+      tx_buffer_overflow += can_push(can_queues[bus_number], to_push) ? 0U : 1U;
+      process_can(CAN_NUM_FROM_BUS_NUM(bus_number));
+    }
+  } else {
+    safety_tx_blocked += 1U;
+    to_push->returned = 0U;
+    to_push->rejected = 1U;
+
+    // data changed
+    can_set_checksum(to_push);
+    rx_buffer_overflow += can_push(&can_rx_q, to_push) ? 0U : 1U;
+  }
+}
+
+bool is_speed_valid(uint32_t speed, const uint32_t *all_speeds, uint8_t len) {
+  bool ret = false;
+  for (uint8_t i = 0U; i < len; i++) {
+    if (all_speeds[i] == speed) {
+      ret = true;
+    }
+  }
+  return ret;
+}

artifacts/package_sources/panda/board/drivers/can_common_declarations.h

@@ -0,0 +1,71 @@
+#pragma once
+
+#include "board/can.h"
+
+typedef struct {
+  volatile uint32_t w_ptr;
+  volatile uint32_t r_ptr;
+  uint32_t fifo_size;
+  CANPacket_t *elems;
+} can_ring;
+
+typedef struct {
+  uint8_t bus_lookup;
+  uint8_t can_num_lookup;
+  int8_t forwarding_bus;
+  uint32_t can_speed;
+  uint32_t can_data_speed;
+  bool canfd_auto;
+  bool canfd_enabled;
+  bool brs_enabled;
+  bool canfd_non_iso;
+} bus_config_t;
+
+extern uint32_t safety_tx_blocked;
+extern uint32_t safety_rx_invalid;
+extern uint32_t tx_buffer_overflow;
+extern uint32_t rx_buffer_overflow;
+
+extern can_health_t can_health[PANDA_CAN_CNT];
+
+// Ignition detected from CAN meessages
+extern bool ignition_can;
+extern uint32_t ignition_can_cnt;
+extern bool ignition_can_gates_line;
+
+extern bool can_silent;
+extern bool can_loopback;
+
+// ******************* functions prototypes *********************
+bool can_init(uint8_t can_number);
+void process_can(uint8_t can_number);
+
+// ********************* instantiate queues *********************
+extern can_ring *can_queues[PANDA_CAN_CNT];
+
+// helpers
+#define WORD_TO_BYTE_ARRAY(dst8, src32) 0[dst8] = ((src32) & 0xFFU); 1[dst8] = (((src32) >> 8U) & 0xFFU); 2[dst8] = (((src32) >> 16U) & 0xFFU); 3[dst8] = (((src32) >> 24U) & 0xFFU)
+#define BYTE_ARRAY_TO_WORD(dst32, src8) ((dst32) = 0[src8] | (1[src8] << 8U) | (2[src8] << 16U) | (3[src8] << 24U))
+
+// ********************* interrupt safe queue *********************
+bool can_pop(can_ring *q, CANPacket_t *elem);
+bool can_push(can_ring *q, const CANPacket_t *elem);
+uint32_t can_slots_empty(const can_ring *q);
+extern bus_config_t bus_config[PANDA_CAN_CNT];
+
+#define CANIF_FROM_CAN_NUM(num) (cans[num])
+#define BUS_NUM_FROM_CAN_NUM(num) (bus_config[num].bus_lookup)
+#define CAN_NUM_FROM_BUS_NUM(num) (bus_config[num].can_num_lookup)
+
+void can_init_all(void);
+void can_set_orientation(bool flipped);
+#ifdef PANDA_JUNGLE
+void can_set_forwarding(uint8_t from, uint8_t to);
+#endif
+void ignition_can_hook(CANPacket_t *to_push);
+bool can_tx_check_min_slots_free(uint32_t min);
+uint8_t calculate_checksum(const uint8_t *dat, uint32_t len);
+void can_set_checksum(CANPacket_t *packet);
+bool can_check_checksum(CANPacket_t *packet);
+void can_send(CANPacket_t *to_push, uint8_t bus_number, bool skip_tx_hook);
+bool is_speed_valid(uint32_t speed, const uint32_t *all_speeds, uint8_t len);

artifacts/package_sources/panda/board/drivers/clock_source.h

@@ -0,0 +1,44 @@
+#include "clock_source_declarations.h"
+
+void clock_source_set_timer_params(uint16_t param1, uint16_t param2) {
+  // Pulse length of each channel
+  register_set(&(TIM1->CCR1), (((param1 & 0xFF00U) >> 8U)*10U), 0xFFFFU);
+  register_set(&(TIM1->CCR2), ((param1 & 0x00FFU)*10U), 0xFFFFU);
+  register_set(&(TIM1->CCR3), (((param2 & 0xFF00U) >> 8U)*10U), 0xFFFFU);
+  // Timer period
+  register_set(&(TIM1->ARR),  (((param2 & 0x00FFU)*10U) - 1U), 0xFFFFU);
+}
+
+void clock_source_init(bool enable_channel1) {
+  // Setup timer
+  register_set(&(TIM1->PSC), ((APB2_TIMER_FREQ*100U)-1U), 0xFFFFU);           // Tick on 0.1 ms
+  register_set(&(TIM1->ARR), ((CLOCK_SOURCE_PERIOD_MS*10U) - 1U), 0xFFFFU);   // Period
+  register_set(&(TIM1->CCMR1), 0U, 0xFFFFU);                                  // No output on compare
+  register_set(&(TIM1->CCER), TIM_CCER_CC1E, 0xFFFFU);                        // Enable compare 1
+  register_set(&(TIM1->CCR1), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set(&(TIM1->CCR2), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set(&(TIM1->CCR3), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set_bits(&(TIM1->DIER), TIM_DIER_UIE | TIM_DIER_CC1IE);            // Enable interrupts
+  register_set(&(TIM1->CR1), TIM_CR1_CEN, 0x3FU);                             // Enable timer
+
+  // No interrupts
+  NVIC_DisableIRQ(TIM1_UP_TIM10_IRQn);
+  NVIC_DisableIRQ(TIM1_CC_IRQn);
+
+  // Set GPIO as timer channels
+  if (enable_channel1) {
+    set_gpio_alternate(GPIOA, 8, GPIO_AF1_TIM1);
+  }
+  set_gpio_alternate(GPIOB, 14, GPIO_AF1_TIM1);
+  set_gpio_alternate(GPIOB, 15, GPIO_AF1_TIM1);
+
+  // Set PWM mode
+  register_set(&(TIM1->CCMR1), (0b110UL << TIM_CCMR1_OC1M_Pos) | (0b110UL << TIM_CCMR1_OC2M_Pos), 0xFFFFU);
+  register_set(&(TIM1->CCMR2), (0b110UL << TIM_CCMR2_OC3M_Pos), 0xFFFFU);
+
+  // Enable output
+  register_set(&(TIM1->BDTR), TIM_BDTR_MOE, 0xFFFFU);
+
+  // Enable complementary compares
+  register_set_bits(&(TIM1->CCER), TIM_CCER_CC2NE | TIM_CCER_CC3NE);
+}

artifacts/package_sources/panda/board/drivers/clock_source_declarations.h

@@ -0,0 +1,7 @@
+#pragma once
+
+#define CLOCK_SOURCE_PERIOD_MS           50U
+#define CLOCK_SOURCE_PULSE_LEN_MS        2U
+
+void clock_source_set_timer_params(uint16_t param1, uint16_t param2);
+void clock_source_init(bool enable_channel1);

artifacts/package_sources/panda/board/drivers/fake_siren.h

@@ -0,0 +1,115 @@
+#include "board/stm32h7/lli2c.h"
+
+#define CODEC_I2C_ADDR 0x10
+
+void siren_tim7_init(void) {
+  // Init trigger timer (around 2.5kHz)
+  register_set(&TIM7->PSC, 0U, 0xFFFFU);
+  register_set(&TIM7->ARR, 133U, 0xFFFFU);
+  register_set(&TIM7->CR2, (0b10U << TIM_CR2_MMS_Pos), TIM_CR2_MMS_Msk);
+  register_set(&TIM7->CR1, TIM_CR1_ARPE | TIM_CR1_URS, 0x088EU);
+  TIM7->SR = 0U;
+  TIM7->CR1 |= TIM_CR1_CEN;
+}
+
+void siren_dac_init(void) {
+  DAC1->DHR8R1 = (1U << 7);
+  DAC1->DHR8R2 = (1U << 7);
+  register_set(&DAC1->MCR, 0U, 0xFFFFFFFFU);
+  register_set(&DAC1->CR, DAC_CR_TEN1 | (6U << DAC_CR_TSEL1_Pos) | DAC_CR_DMAEN1, 0xFFFFFFFFU);
+  register_set_bits(&DAC1->CR, DAC_CR_EN1 | DAC_CR_EN2);
+}
+
+void siren_dma_init(void) {
+  // 1Vpp sine wave with 1V offset
+  static const uint8_t fake_siren_lut[360] = { 134U, 135U, 137U, 138U, 139U, 140U, 141U, 143U, 144U, 145U, 146U, 148U, 149U, 150U, 151U, 152U, 154U, 155U, 156U, 157U, 158U, 159U, 160U, 162U, 163U, 164U, 165U, 166U, 167U, 168U, 169U, 170U, 171U, 172U, 174U, 175U, 176U, 177U, 177U, 178U, 179U, 180U, 181U, 182U, 183U, 184U, 185U, 186U, 186U, 187U, 188U, 189U, 190U, 190U, 191U, 192U, 193U, 193U, 194U, 195U, 195U, 196U, 196U, 197U, 197U, 198U, 199U, 199U, 199U, 200U, 200U, 201U, 201U, 202U, 202U, 202U, 203U, 203U, 203U, 203U, 204U, 204U, 204U, 204U, 204U, 204U, 204U, 205U, 205U, 205U, 205U, 205U, 205U, 205U, 204U, 204U, 204U, 204U, 204U, 204U, 204U, 203U, 203U, 203U, 203U, 202U, 202U, 202U, 201U, 201U, 200U, 200U, 199U, 199U, 199U, 198U, 197U, 197U, 196U, 196U, 195U, 195U, 194U, 193U, 193U, 192U, 191U, 190U, 190U, 189U, 188U, 187U, 186U, 186U, 185U, 184U, 183U, 182U, 181U, 180U, 179U, 178U, 177U, 177U, 176U, 175U, 174U, 172U, 171U, 170U, 169U, 168U, 167U, 166U, 165U, 164U, 163U, 162U, 160U, 159U, 158U, 157U, 156U, 155U, 154U, 152U, 151U, 150U, 149U, 148U, 146U, 145U, 144U, 143U, 141U, 140U, 139U, 138U, 137U, 135U, 134U, 133U, 132U, 130U, 129U, 128U, 127U, 125U, 124U, 123U, 122U, 121U, 119U, 118U, 117U, 116U, 115U, 113U, 112U, 111U, 110U, 109U, 108U, 106U, 105U, 104U, 103U, 102U, 101U, 100U, 99U, 98U, 97U, 96U, 95U, 94U, 93U, 92U, 91U, 90U, 89U, 88U, 87U, 86U, 85U, 84U, 83U, 82U, 82U, 81U, 80U, 79U, 78U, 78U, 77U, 76U, 76U, 75U, 74U, 74U, 73U, 72U, 72U, 71U, 71U, 70U, 70U, 69U, 69U, 68U, 68U, 67U, 67U, 67U, 66U, 66U, 66U, 65U, 65U, 65U, 65U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 63U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 65U, 65U, 65U, 65U, 66U, 66U, 66U, 67U, 67U, 67U, 68U, 68U, 69U, 69U, 70U, 70U, 71U, 71U, 72U, 72U, 73U, 74U, 74U, 75U, 76U, 76U, 77U, 78U, 78U, 79U, 80U, 81U, 82U, 82U, 83U, 84U, 85U, 86U, 87U, 88U, 89U, 90U, 91U, 92U, 93U, 94U, 95U, 96U, 97U, 98U, 99U, 100U, 101U, 102U, 103U, 104U, 105U, 106U, 108U, 109U, 110U, 111U, 112U, 113U, 115U, 116U, 117U, 118U, 119U, 121U, 122U, 123U, 124U, 125U, 127U, 128U, 129U, 130U, 132U, 133U };
+  // Setup DMAMUX (DAC_CH1_DMA as input)
+  register_set(&DMAMUX1_Channel1->CCR, 67U, DMAMUX_CxCR_DMAREQ_ID_Msk);
+  register_set(&DMA1_Stream1->PAR, (uint32_t)&(DAC1->DHR8R1), 0xFFFFFFFFU);
+  // Setup DMA
+  register_set(&DMA1_Stream1->M0AR, (uint32_t)fake_siren_lut, 0xFFFFFFFFU);
+  register_set(&DMA1_Stream1->FCR, 0U, 0x00000083U);
+  DMA1_Stream1->NDTR = sizeof(fake_siren_lut);
+  DMA1_Stream1->CR = (0b11UL << DMA_SxCR_PL_Pos) | DMA_SxCR_MINC | DMA_SxCR_CIRC | (1U << DMA_SxCR_DIR_Pos);
+}
+
+void fake_siren_codec_enable(bool enabled) {
+  if (enabled) {
+    bool success = true;
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x2B, (1U << 1)); // Left speaker mix from INA1
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x2C, (1U << 1)); // Right speaker mix from INA1
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x3D, 0x17, 0b11111); // Left speaker volume
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x3E, 0x17, 0b11111); // Right speaker volume
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x37, 0b101, 0b111); // INA gain
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x4C, (1U << 7)); // Enable INA
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x51, (1U << 7)); // Disable global shutdown
+    if (!success) {
+      print("Siren codec enable failed\n");
+      fault_occurred(FAULT_SIREN_MALFUNCTION);
+    }
+  } else {
+    // Disable INA input. Make sure to retry a few times if the I2C bus is busy.
+    for (uint8_t i=0U; i<10U; i++) {
+      if (i2c_clear_reg_bits(I2C5, CODEC_I2C_ADDR, 0x4C, (1U << 7))) {
+        break;
+      }
+    }
+  }
+}
+
+static void fake_i2c_siren_init(void) {
+  siren_dac_init();
+  siren_dma_init();
+  siren_tim7_init();
+  // Enable the I2C to the codec
+  i2c_init(I2C5);
+  fake_siren_codec_enable(false);
+}
+
+void fake_i2c_siren_set(bool enabled) {
+  static bool initialized = false;
+  static bool fake_siren_enabled = false;
+
+  if (!initialized) {
+    fake_i2c_siren_init();
+    initialized = true;
+  }
+
+  if (enabled != fake_siren_enabled) {
+    fake_siren_codec_enable(enabled);
+  }
+
+  if (enabled) {
+    register_set_bits(&DMA1_Stream1->CR, DMA_SxCR_EN);
+  } else {
+    register_clear_bits(&DMA1_Stream1->CR, DMA_SxCR_EN);
+  }
+  fake_siren_enabled = enabled;
+}
+
+void fake_siren_set(bool enabled) {
+  static bool initialized = false;
+  static bool fake_siren_enabled = false;
+
+  if (!initialized) {
+    siren_tim7_init();
+    initialized = true;
+  }
+
+  if (enabled != fake_siren_enabled) {
+    if (enabled) {
+      sound_stop_dac();
+      siren_dac_init();
+      siren_dma_init();
+      current_board->set_amp_enabled(true);
+      register_set_bits(&DMA1_Stream1->CR, DMA_SxCR_EN);
+    } else {
+      current_board->set_amp_enabled(false);
+      // Stop modified 8-bit DAC and start normal 12-bit DAC
+      sound_stop_dac();
+      sound_init_dac();
+      register_set_bits(&BDMA_Channel0->CCR, BDMA_CCR_EN);
+    }
+    fake_siren_enabled = enabled;
+  }
+}

artifacts/package_sources/panda/board/drivers/fan.h

@@ -0,0 +1,48 @@
+#include "fan_declarations.h"
+
+struct fan_state_t fan_state;
+
+static const uint8_t FAN_TICK_FREQ = 8U;
+
+void fan_set_power(uint8_t percentage) {
+  if (percentage > 0U) {
+    fan_state.power = CLAMP(percentage, 20U, 100U);
+  } else {
+    fan_state.power = 0U;
+  }
+}
+
+void fan_init(void) {
+  fan_state.cooldown_counter = current_board->fan_enable_cooldown_time * FAN_TICK_FREQ;
+  llfan_init();
+}
+
+// Call this at FAN_TICK_FREQ
+void fan_tick(void) {
+  if (current_board->has_fan) {
+    // Measure fan RPM
+    uint16_t fan_rpm_fast = fan_state.tach_counter * (60U * FAN_TICK_FREQ / 4U);   // 4 interrupts per rotation
+    fan_state.tach_counter = 0U;
+    fan_state.rpm = (fan_rpm_fast + (3U * fan_state.rpm)) / 4U;
+
+    #ifdef DEBUG_FAN
+      puth(fan_state.target_rpm);
+      print(" "); puth(fan_rpm_fast);
+      print(" "); puth(fan_state.power);
+      print("\n");
+    #endif
+
+    // Cooldown counter to prevent noise on tachometer line.
+    if (fan_state.power > 0U) {
+      fan_state.cooldown_counter = current_board->fan_enable_cooldown_time * FAN_TICK_FREQ;
+    } else {
+      if (fan_state.cooldown_counter > 0U) {
+        fan_state.cooldown_counter--;
+      }
+    }
+
+    // Set PWM and enable line
+    pwm_set(TIM3, 3, fan_state.power);
+    current_board->set_fan_enabled((fan_state.power > 0U) || (fan_state.cooldown_counter > 0U));
+  }
+}

artifacts/package_sources/panda/board/drivers/fan_declarations.h

@@ -0,0 +1,16 @@
+#pragma once
+
+struct fan_state_t {
+  uint16_t tach_counter;
+  uint16_t rpm;
+  uint8_t power;
+  float error_integral;
+  uint8_t cooldown_counter;
+};
+extern struct fan_state_t fan_state;
+
+void fan_set_power(uint8_t percentage);
+void llfan_init(void);
+void fan_init(void);
+// Call this at FAN_TICK_FREQ
+void fan_tick(void);

artifacts/package_sources/panda/board/drivers/fdcan.h

@@ -0,0 +1,269 @@
+#include "fdcan_declarations.h"
+
+FDCAN_GlobalTypeDef *cans[PANDA_CAN_CNT] = {FDCAN1, FDCAN2, FDCAN3};
+
+static bool can_set_speed(uint8_t can_number) {
+  bool ret = true;
+  FDCAN_GlobalTypeDef *FDCANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  ret &= llcan_set_speed(
+    FDCANx,
+    bus_config[bus_number].can_speed,
+    bus_config[bus_number].can_data_speed,
+    bus_config[bus_number].canfd_non_iso,
+    can_loopback,
+    can_silent
+  );
+  return ret;
+}
+
+void can_clear_send(FDCAN_GlobalTypeDef *FDCANx, uint8_t can_number) {
+  static uint32_t last_reset = 0U;
+  uint32_t time = microsecond_timer_get();
+
+  // Resetting CAN core is a slow blocking operation, limit frequency
+  if (get_ts_elapsed(time, last_reset) > 100000U) {  // 10 Hz
+    can_health[can_number].can_core_reset_cnt += 1U;
+    can_health[can_number].total_tx_lost_cnt += (FDCAN_TX_FIFO_EL_CNT - (FDCANx->TXFQS & FDCAN_TXFQS_TFFL)); // TX FIFO msgs will be lost after reset
+    llcan_clear_send(FDCANx);
+    last_reset = time;
+  }
+}
+
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg) {
+  uint8_t can_irq_number[PANDA_CAN_CNT][2] = {
+    { FDCAN1_IT0_IRQn, FDCAN1_IT1_IRQn },
+    { FDCAN2_IT0_IRQn, FDCAN2_IT1_IRQn },
+    { FDCAN3_IT0_IRQn, FDCAN3_IT1_IRQn },
+  };
+
+  FDCAN_GlobalTypeDef *FDCANx = CANIF_FROM_CAN_NUM(can_number);
+  uint32_t psr_reg = FDCANx->PSR;
+  uint32_t ecr_reg = FDCANx->ECR;
+
+  can_health[can_number].bus_off = ((psr_reg & FDCAN_PSR_BO) >> FDCAN_PSR_BO_Pos);
+  can_health[can_number].bus_off_cnt += can_health[can_number].bus_off;
+  can_health[can_number].error_warning = ((psr_reg & FDCAN_PSR_EW) >> FDCAN_PSR_EW_Pos);
+  can_health[can_number].error_passive = ((psr_reg & FDCAN_PSR_EP) >> FDCAN_PSR_EP_Pos);
+
+  can_health[can_number].last_error = ((psr_reg & FDCAN_PSR_LEC) >> FDCAN_PSR_LEC_Pos);
+  if ((can_health[can_number].last_error != 0U) && (can_health[can_number].last_error != 7U)) {
+    can_health[can_number].last_stored_error = can_health[can_number].last_error;
+  }
+
+  can_health[can_number].last_data_error = ((psr_reg & FDCAN_PSR_DLEC) >> FDCAN_PSR_DLEC_Pos);
+  if ((can_health[can_number].last_data_error != 0U) && (can_health[can_number].last_data_error != 7U)) {
+    can_health[can_number].last_data_stored_error = can_health[can_number].last_data_error;
+  }
+
+  can_health[can_number].receive_error_cnt = ((ecr_reg & FDCAN_ECR_REC) >> FDCAN_ECR_REC_Pos);
+  can_health[can_number].transmit_error_cnt = ((ecr_reg & FDCAN_ECR_TEC) >> FDCAN_ECR_TEC_Pos);
+
+  can_health[can_number].irq0_call_rate = interrupts[can_irq_number[can_number][0]].call_rate;
+  can_health[can_number].irq1_call_rate = interrupts[can_irq_number[can_number][1]].call_rate;
+
+  if (ir_reg != 0U) {
+    // Clear error interrupts
+    FDCANx->IR |= (FDCAN_IR_PED | FDCAN_IR_PEA | FDCAN_IR_EP | FDCAN_IR_BO | FDCAN_IR_RF0L);
+    can_health[can_number].total_error_cnt += 1U;
+    // Check for RX FIFO overflow
+    if ((ir_reg & (FDCAN_IR_RF0L)) != 0U) {
+      can_health[can_number].total_rx_lost_cnt += 1U;
+    }
+    // Cases:
+    // 1. while multiplexing between buses 1 and 3 we are getting ACK errors that overwhelm CAN core, by resetting it recovers faster
+    // 2. H7 gets stuck in bus off recovery state indefinitely
+    if ((((can_health[can_number].last_error == CAN_ACK_ERROR) || (can_health[can_number].last_data_error == CAN_ACK_ERROR)) && (can_health[can_number].transmit_error_cnt > 127U)) ||
+     ((ir_reg & FDCAN_IR_BO) != 0U)) {
+      can_clear_send(FDCANx, can_number);
+    }
+  }
+}
+
+// ***************************** CAN *****************************
+// FDFDCANx_IT1 IRQ Handler (TX)
+void process_can(uint8_t can_number) {
+  if (can_number != 0xffU) {
+    ENTER_CRITICAL();
+
+    FDCAN_GlobalTypeDef *FDCANx = CANIF_FROM_CAN_NUM(can_number);
+    uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+    FDCANx->IR |= FDCAN_IR_TFE; // Clear Tx FIFO Empty flag
+
+    if ((FDCANx->TXFQS & FDCAN_TXFQS_TFQF) == 0U) {
+      CANPacket_t to_send;
+      if (can_pop(can_queues[bus_number], &to_send)) {
+        if (can_check_checksum(&to_send)) {
+          can_health[can_number].total_tx_cnt += 1U;
+
+          uint32_t TxFIFOSA = FDCAN_START_ADDRESS + (can_number * FDCAN_OFFSET) + (FDCAN_RX_FIFO_0_EL_CNT * FDCAN_RX_FIFO_0_EL_SIZE);
+          // get the index of the next TX FIFO element (0 to FDCAN_TX_FIFO_EL_CNT - 1)
+          uint32_t tx_index = (FDCANx->TXFQS >> FDCAN_TXFQS_TFQPI_Pos) & 0x1FU;
+          // only send if we have received a packet
+          canfd_fifo *fifo;
+          fifo = (canfd_fifo *)(TxFIFOSA + (tx_index * FDCAN_TX_FIFO_EL_SIZE));
+
+          fifo->header[0] = (to_send.extended << 30) | ((to_send.extended != 0U) ? (to_send.addr) : (to_send.addr << 18));
+
+          // If canfd_auto is set, outgoing packets will be automatically sent as CAN-FD if an incoming CAN-FD packet was seen
+          bool fd = bus_config[can_number].canfd_auto ? bus_config[can_number].canfd_enabled : (bool)(to_send.fd > 0U);
+          uint32_t canfd_enabled_header = fd ? (1UL << 21) : 0UL;
+
+          uint32_t brs_enabled_header = bus_config[can_number].brs_enabled ? (1UL << 20) : 0UL;
+          fifo->header[1] = (to_send.data_len_code << 16) | canfd_enabled_header | brs_enabled_header;
+
+          uint8_t data_len_w = (dlc_to_len[to_send.data_len_code] / 4U);
+          data_len_w += ((dlc_to_len[to_send.data_len_code] % 4U) > 0U) ? 1U : 0U;
+          for (unsigned int i = 0; i < data_len_w; i++) {
+            BYTE_ARRAY_TO_WORD(fifo->data_word[i], &to_send.data[i*4U]);
+          }
+
+          FDCANx->TXBAR = (1UL << tx_index);
+
+          // Send back to USB
+          CANPacket_t to_push;
+
+          to_push.fd = fd;
+          to_push.returned = 1U;
+          to_push.rejected = 0U;
+          to_push.extended = to_send.extended;
+          to_push.addr = to_send.addr;
+          to_push.bus = bus_number;
+          to_push.data_len_code = to_send.data_len_code;
+          (void)memcpy(to_push.data, to_send.data, dlc_to_len[to_push.data_len_code]);
+          can_set_checksum(&to_push);
+
+          rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+        } else {
+          can_health[can_number].total_tx_checksum_error_cnt += 1U;
+        }
+
+        refresh_can_tx_slots_available();
+      }
+    }
+    EXIT_CRITICAL();
+  }
+}
+
+// FDFDCANx_IT0 IRQ Handler (RX and errors)
+// blink blue when we are receiving CAN messages
+void can_rx(uint8_t can_number) {
+  FDCAN_GlobalTypeDef *FDCANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  uint32_t ir_reg = FDCANx->IR;
+
+  // Clear all new messages from Rx FIFO 0
+  FDCANx->IR |= FDCAN_IR_RF0N;
+  while ((FDCANx->RXF0S & FDCAN_RXF0S_F0FL) != 0U) {
+    can_health[can_number].total_rx_cnt += 1U;
+    // get the index of the next RX FIFO element (0 to FDCAN_RX_FIFO_0_EL_CNT - 1)
+    uint32_t rx_fifo_idx = (uint8_t)((FDCANx->RXF0S >> FDCAN_RXF0S_F0GI_Pos) & 0x3FU);
+
+    // Recommended to offset get index by at least +1 if RX FIFO is in overwrite mode and full (datasheet)
+    if ((FDCANx->RXF0S & FDCAN_RXF0S_F0F) == FDCAN_RXF0S_F0F) {
+      rx_fifo_idx = ((rx_fifo_idx + 1U) >= FDCAN_RX_FIFO_0_EL_CNT) ? 0U : (rx_fifo_idx + 1U);
+      can_health[can_number].total_rx_lost_cnt += 1U; // At least one message was lost
+    }
+
+    uint32_t RxFIFO0SA = FDCAN_START_ADDRESS + (can_number * FDCAN_OFFSET);
+    CANPacket_t to_push;
+    canfd_fifo *fifo;
+
+    // getting address
+    fifo = (canfd_fifo *)(RxFIFO0SA + (rx_fifo_idx * FDCAN_RX_FIFO_0_EL_SIZE));
+
+    bool canfd_frame = ((fifo->header[1] >> 21) & 0x1U);
+    bool brs_frame = ((fifo->header[1] >> 20) & 0x1U);
+
+    to_push.fd = canfd_frame;
+    to_push.returned = 0U;
+    to_push.rejected = 0U;
+    to_push.extended = (fifo->header[0] >> 30) & 0x1U;
+    to_push.addr = ((to_push.extended != 0U) ? (fifo->header[0] & 0x1FFFFFFFU) : ((fifo->header[0] >> 18) & 0x7FFU));
+    to_push.bus = bus_number;
+    to_push.data_len_code = ((fifo->header[1] >> 16) & 0xFU);
+
+    uint8_t data_len_w = (dlc_to_len[to_push.data_len_code] / 4U);
+    data_len_w += ((dlc_to_len[to_push.data_len_code] % 4U) > 0U) ? 1U : 0U;
+    for (unsigned int i = 0; i < data_len_w; i++) {
+      WORD_TO_BYTE_ARRAY(&to_push.data[i*4U], fifo->data_word[i]);
+    }
+    can_set_checksum(&to_push);
+
+    // forwarding (panda only)
+    int bus_fwd_num = safety_fwd_hook(bus_number, to_push.addr);
+    if (bus_fwd_num < 0) {
+      bus_fwd_num = bus_config[can_number].forwarding_bus;
+    }
+    if (bus_fwd_num != -1) {
+      CANPacket_t to_send;
+
+      to_send.fd = to_push.fd;
+      to_send.returned = 0U;
+      to_send.rejected = 0U;
+      to_send.extended = to_push.extended;
+      to_send.addr = to_push.addr;
+      to_send.bus = to_push.bus;
+      to_send.data_len_code = to_push.data_len_code;
+      (void)memcpy(to_send.data, to_push.data, dlc_to_len[to_push.data_len_code]);
+      can_set_checksum(&to_send);
+
+      can_send(&to_send, bus_fwd_num, true);
+      can_health[can_number].total_fwd_cnt += 1U;
+    }
+
+    safety_rx_invalid += safety_rx_hook(&to_push) ? 0U : 1U;
+    ignition_can_hook(&to_push);
+
+    led_set(LED_BLUE, true);
+    rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+
+    // Enable CAN FD and BRS if CAN FD message was received
+    if (!(bus_config[can_number].canfd_enabled) && (canfd_frame)) {
+      bus_config[can_number].canfd_enabled = true;
+    }
+    if (!(bus_config[can_number].brs_enabled) && (brs_frame)) {
+      bus_config[can_number].brs_enabled = true;
+    }
+
+    // update read index
+    FDCANx->RXF0A = rx_fifo_idx;
+  }
+
+  // Error handling
+  if ((ir_reg & (FDCAN_IR_PED | FDCAN_IR_PEA | FDCAN_IR_EP | FDCAN_IR_BO | FDCAN_IR_RF0L)) != 0U) {
+    update_can_health_pkt(can_number, ir_reg);
+  }
+}
+
+static void FDCAN1_IT0_IRQ_Handler(void) { can_rx(0); }
+static void FDCAN1_IT1_IRQ_Handler(void) { process_can(0); }
+
+static void FDCAN2_IT0_IRQ_Handler(void) { can_rx(1); }
+static void FDCAN2_IT1_IRQ_Handler(void) { process_can(1); }
+
+static void FDCAN3_IT0_IRQ_Handler(void) { can_rx(2);  }
+static void FDCAN3_IT1_IRQ_Handler(void) { process_can(2); }
+
+bool can_init(uint8_t can_number) {
+  bool ret = false;
+
+  REGISTER_INTERRUPT(FDCAN1_IT0_IRQn, FDCAN1_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(FDCAN1_IT1_IRQn, FDCAN1_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(FDCAN2_IT0_IRQn, FDCAN2_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(FDCAN2_IT1_IRQn, FDCAN2_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(FDCAN3_IT0_IRQn, FDCAN3_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(FDCAN3_IT1_IRQn, FDCAN3_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+
+  if (can_number != 0xffU) {
+    FDCAN_GlobalTypeDef *FDCANx = CANIF_FROM_CAN_NUM(can_number);
+    ret &= can_set_speed(can_number);
+    ret &= llcan_init(FDCANx);
+    // in case there are queued up messages
+    process_can(can_number);
+  }
+  return ret;
+}

artifacts/package_sources/panda/board/drivers/fdcan_declarations.h

@@ -0,0 +1,19 @@
+#pragma once
+
+#include "board/can.h"
+
+typedef struct {
+  volatile uint32_t header[2];
+  volatile uint32_t data_word[CANPACKET_DATA_SIZE_MAX/4U];
+} canfd_fifo;
+
+extern FDCAN_GlobalTypeDef *cans[PANDA_CAN_CNT];
+
+#define CAN_ACK_ERROR 3U
+
+void can_clear_send(FDCAN_GlobalTypeDef *FDCANx, uint8_t can_number);
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg);
+
+void process_can(uint8_t can_number);
+void can_rx(uint8_t can_number);
+bool can_init(uint8_t can_number);

artifacts/package_sources/panda/board/drivers/gpio.h

@@ -0,0 +1,94 @@
+#define MODE_INPUT 0
+#define MODE_OUTPUT 1
+#define MODE_ALTERNATE 2
+#define MODE_ANALOG 3
+
+#define PULL_NONE 0
+#define PULL_UP 1
+#define PULL_DOWN 2
+
+#define OUTPUT_TYPE_PUSH_PULL 0U
+#define OUTPUT_TYPE_OPEN_DRAIN 1U
+
+void set_gpio_mode(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->MODER;
+  tmp &= ~(3U << (pin * 2U));
+  tmp |= (mode << (pin * 2U));
+  register_set(&(GPIO->MODER), tmp, 0xFFFFFFFFU);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_output(GPIO_TypeDef *GPIO, unsigned int pin, bool enabled) {
+  ENTER_CRITICAL();
+  if (enabled) {
+    register_set_bits(&(GPIO->ODR), (1UL << pin));
+  } else {
+    register_clear_bits(&(GPIO->ODR), (1UL << pin));
+  }
+  set_gpio_mode(GPIO, pin, MODE_OUTPUT);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_output_type(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int output_type){
+  ENTER_CRITICAL();
+  if(output_type == OUTPUT_TYPE_OPEN_DRAIN) {
+    register_set_bits(&(GPIO->OTYPER), (1UL << pin));
+  } else {
+    register_clear_bits(&(GPIO->OTYPER), (1U << pin));
+  }
+  EXIT_CRITICAL();
+}
+
+void set_gpio_alternate(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->AFR[pin >> 3U];
+  tmp &= ~(0xFU << ((pin & 7U) * 4U));
+  tmp |= mode << ((pin & 7U) * 4U);
+  register_set(&(GPIO->AFR[pin >> 3]), tmp, 0xFFFFFFFFU);
+  set_gpio_mode(GPIO, pin, MODE_ALTERNATE);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_pullup(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->PUPDR;
+  tmp &= ~(3U << (pin * 2U));
+  tmp |= (mode << (pin * 2U));
+  register_set(&(GPIO->PUPDR), tmp, 0xFFFFFFFFU);
+  EXIT_CRITICAL();
+}
+
+int get_gpio_input(const GPIO_TypeDef *GPIO, unsigned int pin) {
+  return (GPIO->IDR & (1UL << pin)) == (1UL << pin);
+}
+
+#ifdef PANDA_JUNGLE
+typedef struct {
+  GPIO_TypeDef * const bank;
+  uint8_t pin;
+} gpio_t;
+
+void gpio_set_all_output(gpio_t *pins, uint8_t num_pins, bool enabled) {
+  for (uint8_t i = 0; i < num_pins; i++) {
+    set_gpio_output(pins[i].bank, pins[i].pin, enabled);
+  }
+}
+
+void gpio_set_bitmask(gpio_t *pins, uint8_t num_pins, uint32_t bitmask) {
+  for (uint8_t i = 0; i < num_pins; i++) {
+    set_gpio_output(pins[i].bank, pins[i].pin, (bitmask >> i) & 1U);
+  }
+}
+#endif
+
+// Detection with internal pullup
+#define PULL_EFFECTIVE_DELAY 4096
+bool detect_with_pull(GPIO_TypeDef *GPIO, int pin, int mode) {
+  set_gpio_mode(GPIO, pin, MODE_INPUT);
+  set_gpio_pullup(GPIO, pin, mode);
+  for (volatile int i=0; i<PULL_EFFECTIVE_DELAY; i++);
+  bool ret = get_gpio_input(GPIO, pin);
+  set_gpio_pullup(GPIO, pin, PULL_NONE);
+  return ret;
+}

artifacts/package_sources/panda/board/drivers/harness.h

@@ -0,0 +1,119 @@
+#include "harness_declarations.h"
+
+struct harness_t harness;
+
+// The ignition relay is only used for testing purposes
+void set_intercept_relay(bool intercept, bool ignition_relay) {
+  bool drive_relay = intercept;
+  if (harness.status == HARNESS_STATUS_NC) {
+    // no harness, no relay to drive
+    drive_relay = false;
+  }
+
+  if (drive_relay || ignition_relay) {
+    harness.relay_driven = true;
+  }
+
+  // The relay pins are separate from the SBU sense pins, so no need to wait for
+  // orientation sampling: it runs in thread context, sees relay_driven set, and
+  // discards its result. Spinning on sbu_adc_lock here would deadlock when called
+  // from interrupt context while thread-context sampling holds the lock.
+
+  if (harness.status == HARNESS_STATUS_NORMAL) {
+    set_gpio_output(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, !ignition_relay);
+    set_gpio_output(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, !drive_relay);
+  } else {
+    set_gpio_output(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, !drive_relay);
+    set_gpio_output(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, !ignition_relay);
+  }
+
+  if (!(drive_relay || ignition_relay)) {
+    harness.relay_driven = false;
+  }
+}
+
+bool harness_check_ignition(void) {
+  // The SBU pins are in analog mode while orientation sampling is in flight
+  // (thread context), so a digital read would return 0. Return the last good
+  // value instead of spinning: this is called from interrupt context, where
+  // waiting for preempted thread-context sampling to finish would deadlock.
+  bool ret = harness.ignition_line;
+
+  if (!harness.sbu_adc_lock) {
+    switch(harness.status){
+      case HARNESS_STATUS_NORMAL:
+        ret = !get_gpio_input(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1);
+        break;
+      case HARNESS_STATUS_FLIPPED:
+        ret = !get_gpio_input(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2);
+        break;
+      default:
+        ret = false;
+        break;
+    }
+    harness.ignition_line = ret;
+  }
+  return ret;
+}
+
+static uint8_t harness_detect_orientation(void) {
+  uint8_t ret = harness.status;
+
+  #ifndef BOOTSTUB
+  // We can't detect orientation if the relay is being driven
+  if (!harness.relay_driven) {
+    harness.sbu_adc_lock = true;
+    set_gpio_mode(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1, MODE_ANALOG);
+    set_gpio_mode(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2, MODE_ANALOG);
+
+    harness.sbu1_voltage_mV = adc_get_mV(&current_board->harness_config->adc_signal_SBU1);
+    harness.sbu2_voltage_mV = adc_get_mV(&current_board->harness_config->adc_signal_SBU2);
+    uint16_t detection_threshold = current_board->avdd_mV / 2U;
+
+    // Detect connection and orientation
+    if((harness.sbu1_voltage_mV < detection_threshold) || (harness.sbu2_voltage_mV < detection_threshold)){
+      if (harness.sbu1_voltage_mV < harness.sbu2_voltage_mV) {
+        // orientation flipped (PANDA_SBU1->HARNESS_SBU1(relay), PANDA_SBU2->HARNESS_SBU2(ign))
+        ret = HARNESS_STATUS_FLIPPED;
+      } else {
+        // orientation normal (PANDA_SBU2->HARNESS_SBU1(relay), PANDA_SBU1->HARNESS_SBU2(ign))
+        // (SBU1->SBU2 is the normal orientation connection per USB-C cable spec)
+        ret = HARNESS_STATUS_NORMAL;
+      }
+    } else {
+      ret = HARNESS_STATUS_NC;
+    }
+
+    // Pins are not 5V tolerant in ADC mode
+    set_gpio_mode(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1, MODE_INPUT);
+    set_gpio_mode(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2, MODE_INPUT);
+    harness.sbu_adc_lock = false;
+
+    // This runs in thread context and can be preempted by an interrupt driving
+    // the relay mid-sample, which changes the SBU line voltages; discard
+    if (harness.relay_driven) {
+      ret = harness.status;
+    }
+  }
+  #endif
+
+  return ret;
+}
+
+void harness_tick(void) {
+  harness.status = harness_detect_orientation();
+}
+
+void harness_init(void) {
+  // init OBD_SBUx_RELAY
+  set_gpio_output_type(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output_type(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, 1);
+  set_gpio_output(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, 1);
+
+  // detect initial orientation
+  harness.status = harness_detect_orientation();
+
+  // keep buses connected by default
+  set_intercept_relay(false, false);
+}

artifacts/package_sources/panda/board/drivers/harness_declarations.h

@@ -0,0 +1,36 @@
+#pragma once
+
+#define HARNESS_STATUS_NC 0U
+#define HARNESS_STATUS_NORMAL 1U
+#define HARNESS_STATUS_FLIPPED 2U
+
+// orientation sampling runs in thread context and shares this state with
+// interrupt handlers, so the fields are volatile
+struct harness_t {
+  volatile uint8_t status;
+  volatile uint16_t sbu1_voltage_mV;
+  volatile uint16_t sbu2_voltage_mV;
+  volatile bool ignition_line;
+  volatile bool relay_driven;
+  volatile bool sbu_adc_lock;
+};
+extern struct harness_t harness;
+
+struct harness_configuration {
+  GPIO_TypeDef * const GPIO_SBU1;
+  GPIO_TypeDef * const GPIO_SBU2;
+  GPIO_TypeDef * const GPIO_relay_SBU1;
+  GPIO_TypeDef * const GPIO_relay_SBU2;
+  const uint8_t pin_SBU1;
+  const uint8_t pin_SBU2;
+  const uint8_t pin_relay_SBU1;
+  const uint8_t pin_relay_SBU2;
+  const adc_signal_t adc_signal_SBU1;
+  const adc_signal_t adc_signal_SBU2;
+};
+
+// The ignition relay is only used for testing purposes
+void set_intercept_relay(bool intercept, bool ignition_relay);
+bool harness_check_ignition(void);
+void harness_tick(void);
+void harness_init(void);

artifacts/package_sources/panda/board/drivers/interrupts.h

@@ -0,0 +1,85 @@
+#include "interrupts_declarations.h"
+
+void unused_interrupt_handler(void) {
+  // Something is wrong if this handler is called!
+  print("Unused interrupt handler called!\n");
+  fault_occurred(FAULT_UNUSED_INTERRUPT_HANDLED);
+}
+
+interrupt interrupts[NUM_INTERRUPTS];
+
+static bool check_interrupt_rate = false;
+
+static uint32_t idle_time = 0U;
+static uint32_t busy_time = 0U;
+float interrupt_load = 0.0f;
+
+void handle_interrupt(IRQn_Type irq_type){
+  static uint8_t interrupt_depth = 0U;
+  static uint32_t last_time = 0U;
+  ENTER_CRITICAL();
+  if (interrupt_depth == 0U) {
+    uint32_t time = microsecond_timer_get();
+    idle_time += get_ts_elapsed(time, last_time);
+    last_time = time;
+  }
+  interrupt_depth += 1U;
+  EXIT_CRITICAL();
+
+  interrupts[irq_type].call_counter++;
+  interrupts[irq_type].handler();
+
+  // Check that the interrupts don't fire too often
+  if (check_interrupt_rate && (interrupts[irq_type].call_counter > interrupts[irq_type].max_call_rate)) {
+    fault_occurred(interrupts[irq_type].call_rate_fault);
+  }
+
+  ENTER_CRITICAL();
+  interrupt_depth -= 1U;
+  if (interrupt_depth == 0U) {
+    uint32_t time = microsecond_timer_get();
+    busy_time += get_ts_elapsed(time, last_time);
+    last_time = time;
+  }
+  EXIT_CRITICAL();
+}
+
+// Every second
+void interrupt_timer_handler(void) {
+  if (INTERRUPT_TIMER->SR != 0U) {
+    for (uint16_t i = 0U; i < NUM_INTERRUPTS; i++) {
+      // Log IRQ call rate faults
+      if (check_interrupt_rate && (interrupts[i].call_counter > interrupts[i].max_call_rate)) {
+        print("Interrupt 0x"); puth(i); print(" fired too often (0x"); puth(interrupts[i].call_counter); print("/s)!\n");
+      }
+
+      // Reset interrupt counters
+      interrupts[i].call_rate = interrupts[i].call_counter;
+      interrupts[i].call_counter = 0U;
+    }
+
+    // Calculate interrupt load
+    // The bootstub does not have the FPU enabled, so can't do float operations.
+#if !defined(BOOTSTUB)
+    interrupt_load = ((busy_time + idle_time) > 0U) ? ((float) (((float) busy_time) / (busy_time + idle_time))) : 0.0f;
+#endif
+    idle_time = 0U;
+    busy_time = 0U;
+  }
+  INTERRUPT_TIMER->SR = 0;
+}
+
+void init_interrupts(bool check_rate_limit){
+  check_interrupt_rate = check_rate_limit;
+
+  for(uint16_t i=0U; i<NUM_INTERRUPTS; i++){
+    interrupts[i].handler = unused_interrupt_handler;
+    // Default priority, lowered so the comms link can preempt everything else and
+    // re-arm its DMA (see IRQ_PRIORITY_COMMS). Shared state is guarded by
+    // ENTER_CRITICAL, which masks all interrupts regardless of priority.
+    NVIC_SetPriority((IRQn_Type)i, IRQ_PRIORITY_DEFAULT);
+  }
+
+  // Init interrupt timer for a 1s interval
+  interrupt_timer_init();
+}

artifacts/package_sources/panda/board/drivers/interrupts_declarations.h

@@ -0,0 +1,38 @@
+#pragma once
+
+// The SPI slave must re-arm its RX DMA at every protocol turnaround before the
+// master clocks the next phase. Without preemption that re-arm waits behind any
+// in-flight handler (CAN RX under bus load), the master clocks into an unarmed
+// peripheral, and the transfer fails its checksum -> NACK retry storms.
+#define IRQ_PRIORITY_COMMS 0U
+#define IRQ_PRIORITY_DEFAULT 2U
+
+typedef struct interrupt {
+  IRQn_Type irq_type;
+  void (*handler)(void);
+  uint32_t call_counter;
+  uint32_t call_rate;
+  uint32_t max_call_rate;   // Call rate is defined as the amount of calls each second
+  uint32_t call_rate_fault;
+} interrupt;
+
+void interrupt_timer_init(void);
+uint32_t microsecond_timer_get(void);
+void unused_interrupt_handler(void);
+
+extern interrupt interrupts[NUM_INTERRUPTS];
+
+#define REGISTER_INTERRUPT(irq_num, func_ptr, call_rate_max, rate_fault) \
+  interrupts[irq_num].irq_type = (irq_num); \
+  interrupts[irq_num].handler = (func_ptr);  \
+  interrupts[irq_num].call_counter = 0U;   \
+  interrupts[irq_num].call_rate = 0U;   \
+  interrupts[irq_num].max_call_rate = (call_rate_max); \
+  interrupts[irq_num].call_rate_fault = (rate_fault);
+
+extern float interrupt_load;
+
+void handle_interrupt(IRQn_Type irq_type);
+// Every second
+void interrupt_timer_handler(void);
+void init_interrupts(bool check_rate_limit);

artifacts/package_sources/panda/board/drivers/led.h

@@ -0,0 +1,32 @@
+
+#define LED_RED 0U
+#define LED_GREEN 1U
+#define LED_BLUE 2U
+
+#define LED_PWM_POWER 2U
+
+void led_set(uint8_t color, bool enabled) {
+  if (color < 3U) {
+    if (current_board->led_pwm_channels[color] != 0U) {
+      pwm_set(TIM3, current_board->led_pwm_channels[color], 100U - (enabled ? LED_PWM_POWER : 0U));
+    } else {
+      set_gpio_output(current_board->led_GPIO[color], current_board->led_pin[color], !enabled);
+    }
+  }
+}
+
+void led_init(void) {
+  for (uint8_t i = 0U; i<3U; i++){
+    set_gpio_pullup(current_board->led_GPIO[i], current_board->led_pin[i], PULL_NONE);
+    set_gpio_output_type(current_board->led_GPIO[i], current_board->led_pin[i], OUTPUT_TYPE_OPEN_DRAIN);
+
+    if (current_board->led_pwm_channels[i] != 0U) {
+      set_gpio_alternate(current_board->led_GPIO[i], current_board->led_pin[i], GPIO_AF2_TIM3);
+      pwm_init(TIM3, current_board->led_pwm_channels[i]);
+    } else {
+      set_gpio_mode(current_board->led_GPIO[i], current_board->led_pin[i], MODE_OUTPUT);
+    }
+
+    led_set(i, false);
+  }
+}

artifacts/package_sources/panda/board/drivers/pwm.h

@@ -0,0 +1,56 @@
+#define PWM_COUNTER_OVERFLOW 4800U // To get ~25kHz
+
+// TODO: Implement for 32-bit timers
+
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel){
+  // Enable timer and auto-reload
+  register_set(&(TIM->CR1), TIM_CR1_CEN | TIM_CR1_ARPE, 0x3FU);
+
+  // Set channel as PWM mode 1 and enable output
+  switch(channel){
+    case 1U:
+      register_set_bits(&(TIM->CCMR1), (TIM_CCMR1_OC1M_2 | TIM_CCMR1_OC1M_1 | TIM_CCMR1_OC1PE));
+      register_set_bits(&(TIM->CCER), TIM_CCER_CC1E);
+      break;
+    case 2U:
+      register_set_bits(&(TIM->CCMR1), (TIM_CCMR1_OC2M_2 | TIM_CCMR1_OC2M_1 | TIM_CCMR1_OC2PE));
+      register_set_bits(&(TIM->CCER), TIM_CCER_CC2E);
+      break;
+    case 3U:
+      register_set_bits(&(TIM->CCMR2), (TIM_CCMR2_OC3M_2 | TIM_CCMR2_OC3M_1 | TIM_CCMR2_OC3PE));
+      register_set_bits(&(TIM->CCER), TIM_CCER_CC3E);
+      break;
+    case 4U:
+      register_set_bits(&(TIM->CCMR2), (TIM_CCMR2_OC4M_2 | TIM_CCMR2_OC4M_1 | TIM_CCMR2_OC4PE));
+      register_set_bits(&(TIM->CCER), TIM_CCER_CC4E);
+      break;
+    default:
+      break;
+  }
+
+  // Set max counter value
+  register_set(&(TIM->ARR), PWM_COUNTER_OVERFLOW, 0xFFFFU);
+
+  // Update registers and clear counter
+  TIM->EGR |= TIM_EGR_UG;
+}
+
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage){
+  uint16_t comp_value = (((uint16_t) percentage * PWM_COUNTER_OVERFLOW) / 100U);
+  switch(channel){
+    case 1U:
+      register_set(&(TIM->CCR1), comp_value, 0xFFFFU);
+      break;
+    case 2U:
+      register_set(&(TIM->CCR2), comp_value, 0xFFFFU);
+      break;
+    case 3U:
+      register_set(&(TIM->CCR3), comp_value, 0xFFFFU);
+      break;
+    case 4U:
+      register_set(&(TIM->CCR4), comp_value, 0xFFFFU);
+      break;
+    default:
+      break;
+  }
+}

artifacts/package_sources/panda/board/drivers/registers.h

@@ -0,0 +1,71 @@
+#include "registers_declarations.h"
+
+static reg register_map[REGISTER_MAP_SIZE];
+
+// Hash spread in first and second iterations seems to be reasonable.
+// See: tests/development/register_hashmap_spread.py
+// Also, check the collision warnings in the debug output, and minimize those.
+static uint16_t hash_addr(uint32_t input){
+  return (((input >> 16U) ^ ((((input + 1U) & 0xFFFFU) * HASHING_PRIME) & 0xFFFFU)) & REGISTER_MAP_SIZE);
+}
+
+// Do not put bits in the check mask that get changed by the hardware
+void register_set(volatile uint32_t *addr, uint32_t val, uint32_t mask){
+  ENTER_CRITICAL()
+  // Set bits in register that are also in the mask
+  (*addr) = ((*addr) & (~mask)) | (val & mask);
+
+  // Add these values to the map
+  uint16_t hash = hash_addr((uint32_t) addr);
+  uint16_t tries = REGISTER_MAP_SIZE;
+  while(CHECK_COLLISION(hash, addr) && (tries > 0U)) { hash = hash_addr((uint32_t) hash); tries--;}
+  if (tries != 0U){
+    register_map[hash].address = addr;
+    register_map[hash].value = (register_map[hash].value & (~mask)) | (val & mask);
+    register_map[hash].check_mask |= mask;
+  } else {
+    #ifdef DEBUG_FAULTS
+      print("Hash collision: address 0x"); puth((uint32_t) addr); print("!\n");
+    #endif
+  }
+  EXIT_CRITICAL()
+}
+
+// Set individual bits. Also add them to the check_mask.
+// Do not use this to change bits that get reset by the hardware
+void register_set_bits(volatile uint32_t *addr, uint32_t val) {
+  register_set(addr, val, val);
+}
+
+// Clear individual bits. Also add them to the check_mask.
+// Do not use this to clear bits that get set by the hardware
+void register_clear_bits(volatile uint32_t *addr, uint32_t val) {
+  register_set(addr, (~val), val);
+}
+
+// To be called periodically
+void check_registers(void){
+  for(uint16_t i=0U; i<REGISTER_MAP_SIZE; i++){
+    if((uint32_t) register_map[i].address != 0U){
+      ENTER_CRITICAL()
+      if((*(register_map[i].address) & register_map[i].check_mask) != (register_map[i].value & register_map[i].check_mask)){
+        #ifdef DEBUG_FAULTS
+          print("Register at address 0x"); puth((uint32_t) register_map[i].address); print(" is divergent!");
+          print("   Map: 0x"); puth(register_map[i].value);
+          print("   Register: 0x"); puth(*(register_map[i].address));
+          print("   Mask: 0x"); puth(register_map[i].check_mask);
+          print("\n");
+        #endif
+        fault_occurred(FAULT_REGISTER_DIVERGENT);
+      }
+      EXIT_CRITICAL()
+    }
+  }
+}
+
+void init_registers(void) {
+  for(uint16_t i=0U; i<REGISTER_MAP_SIZE; i++){
+    register_map[i].address = (volatile uint32_t *) 0U;
+    register_map[i].check_mask = 0U;
+  }
+}

artifacts/package_sources/panda/board/drivers/registers_declarations.h

@@ -0,0 +1,24 @@
+#pragma once
+
+typedef struct reg {
+  volatile uint32_t *address;
+  uint32_t value;
+  uint32_t check_mask;
+} reg;
+
+// 10 bit hash with 23 as a prime
+#define REGISTER_MAP_SIZE 0x3FFU
+#define HASHING_PRIME 23U
+#define CHECK_COLLISION(hash, addr) (((uint32_t) register_map[hash].address != 0U) && (register_map[hash].address != (addr)))
+
+// Do not put bits in the check mask that get changed by the hardware
+void register_set(volatile uint32_t *addr, uint32_t val, uint32_t mask);
+// Set individual bits. Also add them to the check_mask.
+// Do not use this to change bits that get reset by the hardware
+void register_set_bits(volatile uint32_t *addr, uint32_t val);
+// Clear individual bits. Also add them to the check_mask.
+// Do not use this to clear bits that get set by the hardware
+void register_clear_bits(volatile uint32_t *addr, uint32_t val);
+// To be called periodically
+void check_registers(void);
+void init_registers(void);

artifacts/package_sources/panda/board/drivers/simple_watchdog.h

@@ -0,0 +1,21 @@
+#include "simple_watchdog_declarations.h"
+
+static simple_watchdog_state_t wd_state;
+
+void simple_watchdog_kick(void) {
+  uint32_t ts = microsecond_timer_get();
+
+  uint32_t et = get_ts_elapsed(ts, wd_state.last_ts);
+  if (et > wd_state.threshold) {
+    print("WD timeout 0x"); puth(et); print("\n");
+    fault_occurred(wd_state.fault);
+  }
+
+  wd_state.last_ts = ts;
+}
+
+void simple_watchdog_init(uint32_t fault, uint32_t threshold) {
+  wd_state.fault = fault;
+  wd_state.threshold = threshold;
+  wd_state.last_ts = microsecond_timer_get();
+}

artifacts/package_sources/panda/board/drivers/simple_watchdog_declarations.h

@@ -0,0 +1,10 @@
+#pragma once
+
+typedef struct simple_watchdog_state_t {
+  uint32_t fault;
+  uint32_t last_ts;
+  uint32_t threshold;
+} simple_watchdog_state_t;
+
+void simple_watchdog_kick(void);
+void simple_watchdog_init(uint32_t fault, uint32_t threshold);

artifacts/package_sources/panda/board/drivers/spi.h

@@ -0,0 +1,230 @@
+#pragma once
+
+#include "board/drivers/spi_declarations.h"
+#include "board/crc.h"
+
+uint8_t spi_buf_rx[SPI_BUF_SIZE];
+uint8_t spi_buf_tx[SPI_BUF_SIZE];
+
+uint16_t spi_error_count = 0;
+
+static uint8_t spi_state = SPI_STATE_HEADER;
+static uint16_t spi_data_len_mosi;
+static bool spi_can_tx_ready = false;
+static const unsigned char version_text[] = "VERSION";
+
+static uint16_t spi_version_packet(uint8_t *out) {
+  // this protocol version request is a stable portion of
+  // the panda's SPI protocol. its contents match that of the
+  // panda USB descriptors and are sufficent to list/enumerate
+  // a panda, determine panda type, and bootstub status.
+
+  // the response is:
+  // VERSION + 2 byte data length + data + CRC8
+
+  // echo "VERSION"
+  (void)memcpy(out, version_text, 7);
+
+  // write response
+  uint16_t data_len = 0;
+  uint16_t data_pos = 7U + 2U;
+
+  // write serial
+  (void)memcpy(&out[data_pos], ((uint8_t *)UID_BASE), 12);
+  data_len += 12U;
+
+  // HW type
+  out[data_pos + data_len] = hw_type;
+  data_len += 1U;
+
+  // bootstub
+  out[data_pos + data_len] = USB_PID & 0xFFU;
+  data_len += 1U;
+
+  // SPI protocol version
+  out[data_pos + data_len] = 0x2;
+  data_len += 1U;
+
+  // data length
+  out[7] = data_len & 0xFFU;
+  out[8] = (data_len >> 8) & 0xFFU;
+
+  // CRC8
+  uint16_t resp_len = data_pos + data_len;
+  out[resp_len] = crc_checksum(out, resp_len, 0xD5U);
+  resp_len += 1U;
+
+  return resp_len;
+}
+
+void spi_init(void) {
+  // platform init
+  llspi_init();
+
+  // Start the first packet!
+  spi_state = SPI_STATE_HEADER;
+  llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+}
+
+static bool validate_checksum(const uint8_t *data, uint16_t len) {
+  // TODO: can speed this up by casting the bulk to uint32_t and xor-ing the bytes afterwards
+  uint8_t checksum = SPI_CHECKSUM_START;
+  for(uint16_t i = 0U; i < len; i++){
+    checksum ^= data[i];
+  }
+  return checksum == 0U;
+}
+
+void spi_rx_done(void) {
+  uint16_t response_len = 0U;
+  uint8_t next_rx_state = SPI_STATE_HEADER_NACK;
+  bool checksum_valid = false;
+  static uint8_t spi_endpoint;
+  static uint16_t spi_data_len_miso;
+
+  // parse header
+  spi_endpoint = spi_buf_rx[1];
+  spi_data_len_mosi = (spi_buf_rx[3] << 8) | spi_buf_rx[2];
+  spi_data_len_miso = (spi_buf_rx[5] << 8) | spi_buf_rx[4];
+
+  if (memcmp(spi_buf_rx, version_text, 7) == 0) {
+    response_len = spi_version_packet(spi_buf_tx);
+    next_rx_state = SPI_STATE_HEADER_NACK;;
+  } else if (spi_state == SPI_STATE_HEADER) {
+    checksum_valid = validate_checksum(spi_buf_rx, SPI_HEADER_SIZE);
+    if ((spi_buf_rx[0] == SPI_SYNC_BYTE) && checksum_valid) {
+      // response: ACK and start receiving data portion
+      spi_buf_tx[0] = SPI_HACK;
+      next_rx_state = SPI_STATE_HEADER_ACK;
+      response_len = 1U;
+    } else {
+      // response: NACK and reset state machine
+      #ifdef DEBUG_SPI
+        print("- incorrect header sync or checksum "); hexdump(spi_buf_rx, SPI_HEADER_SIZE);
+      #endif
+      spi_buf_tx[0] = SPI_NACK;
+      next_rx_state = SPI_STATE_HEADER_NACK;
+      response_len = 1U;
+    }
+  } else if (spi_state == SPI_STATE_DATA_RX) {
+    // We got everything! Based on the endpoint specified, call the appropriate handler
+    bool response_ack = false;
+    checksum_valid = validate_checksum(&(spi_buf_rx[SPI_HEADER_SIZE]), spi_data_len_mosi + 1U);
+    if (checksum_valid) {
+      if (spi_endpoint == 0U) {
+        if (spi_data_len_mosi >= sizeof(ControlPacket_t)) {
+          ControlPacket_t ctrl = {0};
+          (void)memcpy((uint8_t*)&ctrl, &spi_buf_rx[SPI_HEADER_SIZE], sizeof(ControlPacket_t));
+          response_len = comms_control_handler(&ctrl, &spi_buf_tx[3]);
+          response_ack = true;
+        } else {
+          print("SPI: insufficient data for control handler\n");
+        }
+      } else if ((spi_endpoint == 1U) || (spi_endpoint == 0x81U)) {
+        if (spi_data_len_mosi == 0U) {
+          response_len = comms_can_read(&(spi_buf_tx[3]), spi_data_len_miso);
+          response_ack = true;
+        } else {
+          print("SPI: did not expect data for can_read\n");
+        }
+      } else if (spi_endpoint == 2U) {
+        comms_endpoint2_write(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi);
+        response_ack = true;
+      } else if (spi_endpoint == 3U) {
+        if (spi_data_len_mosi > 0U) {
+          if (spi_can_tx_ready) {
+            spi_can_tx_ready = false;
+            comms_can_write(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi);
+            response_ack = true;
+          } else {
+            response_ack = false;
+            print("SPI: CAN NACK\n");
+          }
+        } else {
+          print("SPI: did expect data for can_write\n");
+        }
+      } else if (spi_endpoint == 0xABU) {
+        // test endpoint: mimics panda -> device transfer
+        response_len = spi_data_len_miso;
+        response_ack = true;
+      } else if (spi_endpoint == 0xACU) {
+        // test endpoint: mimics device -> panda transfer (with NACK)
+        response_ack = false;
+      } else {
+        print("SPI: unexpected endpoint"); puth(spi_endpoint); print("\n");
+      }
+    } else {
+      // Checksum was incorrect
+      response_ack = false;
+      #ifdef DEBUG_SPI
+        print("- incorrect data checksum ");
+        puth4(spi_data_len_mosi);
+        print("\n");
+        hexdump(spi_buf_rx, SPI_HEADER_SIZE);
+        hexdump(&(spi_buf_rx[SPI_HEADER_SIZE]), MIN(spi_data_len_mosi, 64));
+        print("\n");
+      #endif
+    }
+
+    if (!response_ack) {
+      spi_buf_tx[0] = SPI_NACK;
+      next_rx_state = SPI_STATE_HEADER_NACK;
+      response_len = 1U;
+    } else {
+      // Setup response header
+      spi_buf_tx[0] = SPI_DACK;
+      spi_buf_tx[1] = response_len & 0xFFU;
+      spi_buf_tx[2] = (response_len >> 8) & 0xFFU;
+
+      // Add checksum
+      uint8_t checksum = SPI_CHECKSUM_START;
+      for(uint16_t i = 0U; i < (response_len + 3U); i++) {
+        checksum ^= spi_buf_tx[i];
+      }
+      spi_buf_tx[response_len + 3U] = checksum;
+      response_len += 4U;
+
+      next_rx_state = SPI_STATE_DATA_TX;
+    }
+  } else {
+    print("SPI: RX unexpected state: "); puth(spi_state); print("\n");
+  }
+
+  // send out response
+  if (response_len == 0U) {
+    print("SPI: no response\n");
+    spi_buf_tx[0] = SPI_NACK;
+    spi_state = SPI_STATE_HEADER_NACK;
+    response_len = 1U;
+  }
+  llspi_miso_dma(spi_buf_tx, response_len);
+
+  spi_state = next_rx_state;
+  if (!checksum_valid) {
+    spi_error_count += 1U;
+  }
+}
+
+void spi_tx_done(bool reset) {
+  if ((spi_state == SPI_STATE_HEADER_NACK) || reset) {
+    // Reset state
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+  } else if (spi_state == SPI_STATE_HEADER_ACK) {
+    // ACK was sent, queue up the RX buf for the data + checksum
+    spi_state = SPI_STATE_DATA_RX;
+    llspi_mosi_dma(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi + 1U);
+  } else if (spi_state == SPI_STATE_DATA_TX) {
+    // Reset state
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+  } else {
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+    print("SPI: TX unexpected state: "); puth(spi_state); print("\n");
+  }
+}
+
+void can_tx_comms_resume_spi(void) {
+  spi_can_tx_ready = true;
+}

artifacts/package_sources/panda/board/drivers/spi_declarations.h

@@ -0,0 +1,44 @@
+#pragma once
+
+#include "board/crc.h"
+
+#define SPI_TIMEOUT_US 10000U
+
+// got max rate from hitting a non-existent endpoint
+// in a tight loop, plus some buffer
+#define SPI_IRQ_RATE  16000U
+
+#define SPI_BUF_SIZE 4096U
+// H7 DMA2 located in D2 domain, so we need to use SRAM1/SRAM2
+__attribute__((section(".sram12"))) extern uint8_t spi_buf_rx[SPI_BUF_SIZE];
+__attribute__((section(".sram12"))) extern uint8_t spi_buf_tx[SPI_BUF_SIZE];
+
+#define SPI_CHECKSUM_START 0xABU
+#define SPI_SYNC_BYTE 0x5AU
+#define SPI_HACK 0x79U
+#define SPI_DACK 0x85U
+#define SPI_NACK 0x1FU
+
+// SPI states
+enum {
+  SPI_STATE_HEADER,
+  SPI_STATE_HEADER_ACK,
+  SPI_STATE_HEADER_NACK,
+  SPI_STATE_DATA_RX,
+  SPI_STATE_DATA_RX_ACK,
+  SPI_STATE_DATA_TX
+};
+
+extern uint16_t spi_error_count;
+
+#define SPI_HEADER_SIZE 7U
+
+// low level SPI prototypes
+void llspi_init(void);
+void llspi_mosi_dma(uint8_t *addr, int len);
+void llspi_miso_dma(uint8_t *addr, int len);
+
+void can_tx_comms_resume_spi(void);
+void spi_init(void);
+void spi_rx_done(void);
+void spi_tx_done(bool reset);

artifacts/package_sources/panda/board/drivers/timers.h

@@ -0,0 +1,31 @@
+static void timer_init(TIM_TypeDef *TIM, int psc) {
+  register_set(&(TIM->PSC), (psc-1), 0xFFFFU);
+  register_set(&(TIM->DIER), TIM_DIER_UIE, 0x5F5FU);
+  register_set(&(TIM->CR1), TIM_CR1_CEN, 0x3FU);
+  TIM->SR = 0;
+}
+
+void microsecond_timer_init(void) {
+  MICROSECOND_TIMER->PSC = (APB1_TIMER_FREQ - 1U);
+  MICROSECOND_TIMER->CR1 = TIM_CR1_CEN;
+  MICROSECOND_TIMER->EGR = TIM_EGR_UG;
+}
+
+uint32_t microsecond_timer_get(void) {
+  return MICROSECOND_TIMER->CNT;
+}
+
+void interrupt_timer_init(void) {
+  enable_interrupt_timer();
+  REGISTER_INTERRUPT(INTERRUPT_TIMER_IRQ, interrupt_timer_handler, 2U, FAULT_INTERRUPT_RATE_INTERRUPTS)
+  register_set(&(INTERRUPT_TIMER->PSC), ((uint16_t)(15.25*APB1_TIMER_FREQ)-1U), 0xFFFFU);
+  register_set(&(INTERRUPT_TIMER->DIER), TIM_DIER_UIE, 0x5F5FU);
+  register_set(&(INTERRUPT_TIMER->CR1), TIM_CR1_CEN, 0x3FU);
+  INTERRUPT_TIMER->SR = 0;
+  NVIC_EnableIRQ(INTERRUPT_TIMER_IRQ);
+}
+
+void tick_timer_init(void) {
+  timer_init(TICK_TIMER, (uint16_t)((15.25*APB2_TIMER_FREQ)/8U));
+  NVIC_EnableIRQ(TICK_TIMER_IRQ);
+}

artifacts/package_sources/panda/board/drivers/uart.h

@@ -0,0 +1,149 @@
+#include "uart_declarations.h"
+
+// ***************************** Definitions *****************************
+
+#define UART_BUFFER(x, size_rx, size_tx, uart_ptr, callback_ptr, overwrite_mode) \
+  static uint8_t elems_rx_##x[size_rx]; \
+  static uint8_t elems_tx_##x[size_tx]; \
+  extern uart_ring uart_ring_##x; \
+  uart_ring uart_ring_##x = {  \
+    .w_ptr_tx = 0, \
+    .r_ptr_tx = 0, \
+    .elems_tx = ((uint8_t *)&(elems_tx_##x)), \
+    .tx_fifo_size = (size_tx), \
+    .w_ptr_rx = 0, \
+    .r_ptr_rx = 0, \
+    .elems_rx = ((uint8_t *)&(elems_rx_##x)), \
+    .rx_fifo_size = (size_rx), \
+    .uart = (uart_ptr), \
+    .callback = (callback_ptr), \
+    .overwrite = (overwrite_mode) \
+  };
+
+// ******************************** UART buffers ********************************
+
+// debug = USART2
+UART_BUFFER(debug, FIFO_SIZE_INT, FIFO_SIZE_INT, USART2, debug_ring_callback, true)
+
+// SOM debug = UART7
+UART_BUFFER(som_debug, FIFO_SIZE_INT, FIFO_SIZE_INT, UART7, NULL, true)
+
+uart_ring *get_ring_by_number(int a) {
+  uart_ring *ring = NULL;
+  switch(a) {
+    case 0:
+      ring = &uart_ring_debug;
+      break;
+    case 4:
+      ring = &uart_ring_som_debug;
+      break;
+    default:
+      ring = NULL;
+      break;
+  }
+  return ring;
+}
+
+// ************************* Low-level buffer functions *************************
+bool get_char(uart_ring *q, char *elem) {
+  bool ret = false;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr_rx != q->r_ptr_rx) {
+    if (elem != NULL) *elem = q->elems_rx[q->r_ptr_rx];
+    q->r_ptr_rx = (q->r_ptr_rx + 1U) % q->rx_fifo_size;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool injectc(uart_ring *q, char elem) {
+  int ret = false;
+  uint16_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  next_w_ptr = (q->w_ptr_rx + 1U) % q->rx_fifo_size;
+
+  if ((next_w_ptr == q->r_ptr_rx) && q->overwrite) {
+    // overwrite mode: drop oldest byte
+    q->r_ptr_rx = (q->r_ptr_rx + 1U) % q->rx_fifo_size;
+  }
+
+  if (next_w_ptr != q->r_ptr_rx) {
+    q->elems_rx[q->w_ptr_rx] = elem;
+    q->w_ptr_rx = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool put_char(uart_ring *q, char elem) {
+  bool ret = false;
+  uint16_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  next_w_ptr = (q->w_ptr_tx + 1U) % q->tx_fifo_size;
+
+  if ((next_w_ptr == q->r_ptr_tx) && q->overwrite) {
+    // overwrite mode: drop oldest byte
+    q->r_ptr_tx = (q->r_ptr_tx + 1U) % q->tx_fifo_size;
+  }
+
+  if (next_w_ptr != q->r_ptr_tx) {
+    q->elems_tx[q->w_ptr_tx] = elem;
+    q->w_ptr_tx = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  uart_tx_ring(q);
+
+  return ret;
+}
+
+// ************************ High-level debug functions **********************
+void putch(const char a) {
+  // misra-c2012-17.7: serial debug function, ok to ignore output
+  (void)injectc(&uart_ring_debug, a);
+}
+
+void print(const char *a) {
+  for (const char *in = a; *in; in++) {
+    if (*in == '\n') putch('\r');
+    putch(*in);
+  }
+}
+
+void puthx(uint32_t i, uint8_t len) {
+  const char c[] = "0123456789abcdef";
+  for (int pos = ((int)len * 4) - 4; pos > -4; pos -= 4) {
+    putch(c[(i >> (unsigned int)(pos)) & 0xFU]);
+  }
+}
+
+void puth(unsigned int i) {
+  puthx(i, 8U);
+}
+
+#if defined(DEBUG_SPI) || defined(BOOTSTUB) || defined(DEBUG)
+static void puth4(unsigned int i) {
+  puthx(i, 4U);
+}
+#endif
+
+#if defined(DEBUG_SPI) || defined(BOOTSTUB) || defined(DEBUG_USB) || defined(DEBUG_COMMS)
+static void hexdump(const void *a, int l) {
+  if (a != NULL) {
+    for (int i=0; i < l; i++) {
+      if ((i != 0) && ((i & 0xf) == 0)) print("\n");
+      puthx(((const unsigned char*)a)[i], 2U);
+      print(" ");
+    }
+  }
+  print("\n");
+}
+#endif

artifacts/package_sources/panda/board/drivers/uart_declarations.h

@@ -0,0 +1,43 @@
+#pragma once
+
+// ***************************** Definitions *****************************
+#ifdef STM32H7
+#define FIFO_SIZE_INT 0x400U
+#else
+#define FIFO_SIZE_INT 0x200U
+#endif
+
+typedef struct uart_ring {
+  volatile uint16_t w_ptr_tx;
+  volatile uint16_t r_ptr_tx;
+  uint8_t *elems_tx;
+  uint32_t tx_fifo_size;
+  volatile uint16_t w_ptr_rx;
+  volatile uint16_t r_ptr_rx;
+  uint8_t *elems_rx;
+  uint32_t rx_fifo_size;
+  USART_TypeDef *uart;
+  void (*callback)(struct uart_ring*);
+  bool overwrite;
+} uart_ring;
+
+// ***************************** Function prototypes *****************************
+void debug_ring_callback(uart_ring *ring);
+void uart_tx_ring(uart_ring *q);
+uart_ring *get_ring_by_number(int a);
+// ************************* Low-level buffer functions *************************
+bool get_char(uart_ring *q, char *elem);
+bool injectc(uart_ring *q, char elem);
+bool put_char(uart_ring *q, char elem);
+void clear_uart_buff(uart_ring *q);
+// ************************ High-level debug functions **********************
+void putch(const char a);
+void print(const char *a);
+void puthx(uint32_t i, uint8_t len);
+void puth(unsigned int i);
+#if defined(DEBUG_SPI) || defined(BOOTSTUB) || defined(DEBUG)
+static void puth4(unsigned int i);
+#endif
+#if defined(DEBUG_SPI) || defined(DEBUG_USB) || defined(DEBUG_COMMS)
+static void hexdump(const void *a, int l);
+#endif

artifacts/package_sources/panda/board/drivers/usb.h

@@ -0,0 +1,795 @@
+#include "usb_declarations.h"
+
+static uint8_t response[USBPACKET_MAX_SIZE];
+
+// current packet
+static USB_Setup_TypeDef setup;
+static uint8_t* ep0_txdata = NULL;
+static uint16_t ep0_txlen = 0;
+static bool outep3_processing = false;
+
+// Store the current interface alt setting.
+static int current_int0_alt_setting = 0;
+
+// packet read and write
+
+static void *USB_ReadPacket(void *dest, uint16_t len) {
+  uint32_t *dest_copy = (uint32_t *)dest;
+  uint32_t count32b = ((uint32_t)len + 3U) / 4U;
+
+  for (uint32_t i = 0; i < count32b; i++) {
+    *dest_copy = USBx_DFIFO(0U);
+    dest_copy++;
+  }
+  return ((void *)dest_copy);
+}
+
+static void USB_WritePacket(const void *src, uint16_t len, uint32_t ep) {
+  #ifdef DEBUG_USB
+  print("writing ");
+  hexdump(src, len);
+  #endif
+
+  uint32_t numpacket = ((uint32_t)len + (USBPACKET_MAX_SIZE - 1U)) / USBPACKET_MAX_SIZE;
+  uint32_t count32b = 0;
+  count32b = ((uint32_t)len + 3U) / 4U;
+
+  // TODO: revisit this
+  USBx_INEP(ep)->DIEPTSIZ = ((numpacket << 19) & USB_OTG_DIEPTSIZ_PKTCNT) |
+                            (len               & USB_OTG_DIEPTSIZ_XFRSIZ);
+  USBx_INEP(ep)->DIEPCTL |= (USB_OTG_DIEPCTL_CNAK | USB_OTG_DIEPCTL_EPENA);
+
+  // load the FIFO
+  if (src != NULL) {
+    const uint32_t *src_copy = (const uint32_t *)src;
+    for (uint32_t i = 0; i < count32b; i++) {
+      USBx_DFIFO(ep) = *src_copy;
+      src_copy++;
+    }
+  }
+}
+
+// IN EP 0 TX FIFO has a max size of 127 bytes (much smaller than the rest)
+// so use TX FIFO empty interrupt to send larger amounts of data
+static void USB_WritePacket_EP0(uint8_t *src, uint16_t len) {
+  #ifdef DEBUG_USB
+  print("writing ");
+  hexdump(src, len);
+  #endif
+
+  uint16_t wplen = MIN(len, 0x40);
+  USB_WritePacket(src, wplen, 0);
+
+  if (wplen < len) {
+    ep0_txdata = &src[wplen];
+    ep0_txlen = len - wplen;
+    USBx_DEVICE->DIEPEMPMSK |= 1;
+  } else {
+    USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+  }
+}
+
+static void usb_reset(void) {
+  // unmask endpoint interrupts, so many sets
+  USBx_DEVICE->DAINT = 0xFFFFFFFFU;
+  USBx_DEVICE->DAINTMSK = 0xFFFFFFFFU;
+  //USBx_DEVICE->DOEPMSK = (USB_OTG_DOEPMSK_STUPM | USB_OTG_DOEPMSK_XFRCM | USB_OTG_DOEPMSK_EPDM);
+  //USBx_DEVICE->DIEPMSK = (USB_OTG_DIEPMSK_TOM | USB_OTG_DIEPMSK_XFRCM | USB_OTG_DIEPMSK_EPDM | USB_OTG_DIEPMSK_ITTXFEMSK);
+  //USBx_DEVICE->DIEPMSK = (USB_OTG_DIEPMSK_TOM | USB_OTG_DIEPMSK_XFRCM | USB_OTG_DIEPMSK_EPDM);
+
+  // all interrupts for debugging
+  USBx_DEVICE->DIEPMSK = 0xFFFFFFFFU;
+  USBx_DEVICE->DOEPMSK = 0xFFFFFFFFU;
+
+  // clear interrupts
+  USBx_INEP(0U)->DIEPINT = 0xFF;
+  USBx_OUTEP(0U)->DOEPINT = 0xFF;
+
+  // unset the address
+  USBx_DEVICE->DCFG &= ~USB_OTG_DCFG_DAD;
+
+  // set up USB FIFOs
+  // RX start address is fixed to 0
+  USBx->GRXFSIZ = 0x40;
+
+  // 0x100 to offset past GRXFSIZ
+  USBx->DIEPTXF0_HNPTXFSIZ = (0x40UL << 16) | 0x40U;
+
+  // EP1, massive
+  USBx->DIEPTXF[0] = (0x40UL << 16) | 0x80U;
+
+  // flush TX fifo
+  USBx->GRSTCTL = USB_OTG_GRSTCTL_TXFFLSH | USB_OTG_GRSTCTL_TXFNUM_4;
+  while ((USBx->GRSTCTL & USB_OTG_GRSTCTL_TXFFLSH) == USB_OTG_GRSTCTL_TXFFLSH);
+  // flush RX FIFO
+  USBx->GRSTCTL = USB_OTG_GRSTCTL_RXFFLSH;
+  while ((USBx->GRSTCTL & USB_OTG_GRSTCTL_RXFFLSH) == USB_OTG_GRSTCTL_RXFFLSH);
+
+  // no global NAK
+  USBx_DEVICE->DCTL |= USB_OTG_DCTL_CGINAK;
+
+  // ready to receive setup packets
+  USBx_OUTEP(0U)->DOEPTSIZ = USB_OTG_DOEPTSIZ_STUPCNT | (USB_OTG_DOEPTSIZ_PKTCNT & (1UL << 19)) | (3U << 3);
+}
+
+static char to_hex_char(uint8_t a) {
+  char ret;
+  if (a < 10U) {
+    ret = '0' + a;
+  } else {
+    ret = 'a' + (a - 10U);
+  }
+  return ret;
+}
+
+static void usb_setup(void) {
+  static uint8_t device_desc[] = {
+    DSCR_DEVICE_LEN, USB_DESC_TYPE_DEVICE, //Length, Type
+    0x10, 0x02, // bcdUSB max version of USB supported (2.1)
+    0xFF, 0xFF, 0xFF, 0x40, // Class, Subclass, Protocol, Max Packet Size
+    TOUSBORDER(USB_VID), // idVendor
+    TOUSBORDER(USB_PID), // idProduct
+    0x00, 0x00, // bcdDevice
+    0x01, 0x02, // Manufacturer, Product
+    0x03, 0x01 // Serial Number, Num Configurations
+  };
+
+  static uint8_t device_qualifier[] = {
+    0x0a, USB_DESC_TYPE_DEVICE_QUALIFIER, //Length, Type
+    0x10, 0x02, // bcdUSB max version of USB supported (2.1)
+    0xFF, 0xFF, 0xFF, 0x40, // bDeviceClass, bDeviceSubClass, bDeviceProtocol, bMaxPacketSize0
+    0x01, 0x00 // bNumConfigurations, bReserved
+  };
+
+  static uint8_t configuration_desc[] = {
+    DSCR_CONFIG_LEN, USB_DESC_TYPE_CONFIGURATION, // Length, Type,
+    TOUSBORDER(0x0045U), // Total Len (uint16)
+    0x01, 0x01, STRING_OFFSET_ICONFIGURATION, // Num Interface, Config Value, Configuration
+    0xc0, 0x32, // Attributes, Max Power
+    // interface 0 ALT 0
+    DSCR_INTERFACE_LEN, USB_DESC_TYPE_INTERFACE, // Length, Type
+    0x00, 0x00, 0x03, // Index, Alt Index idx, Endpoint count
+    0XFF, 0xFF, 0xFF, // Class, Subclass, Protocol
+    0x00, // Interface
+      // endpoint 1, read CAN
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_RCV | 1, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x00, // Polling Interval (NA)
+      // endpoint 2, send serial
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_SND | 2, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x00, // Polling Interval
+      // endpoint 3, send CAN
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_SND | 3, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x00, // Polling Interval
+    // interface 0 ALT 1
+    DSCR_INTERFACE_LEN, USB_DESC_TYPE_INTERFACE, // Length, Type
+    0x00, 0x01, 0x03, // Index, Alt Index idx, Endpoint count
+    0XFF, 0xFF, 0xFF, // Class, Subclass, Protocol
+    0x00, // Interface
+      // endpoint 1, read CAN
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_RCV | 1, ENDPOINT_TYPE_INT, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x05, // Polling Interval (5 frames)
+      // endpoint 2, send serial
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_SND | 2, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x00, // Polling Interval
+      // endpoint 3, send CAN
+      DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+      ENDPOINT_SND | 3, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+      TOUSBORDER(0x0040U), // Max Packet (0x0040)
+      0x00, // Polling Interval
+  };
+
+  // STRING_DESCRIPTOR_HEADER is for uint16 string descriptors
+  // it takes in a string length, which is bytes/2 because unicode
+  static uint16_t string_language_desc[] = {
+    STRING_DESCRIPTOR_HEADER(1),
+    0x0409 // american english
+  };
+
+  // these strings are all uint16's so that we don't need to spam ,0 after every character
+  static uint16_t string_manufacturer_desc[] = {
+    STRING_DESCRIPTOR_HEADER(8),
+    'c', 'o', 'm', 'm', 'a', '.', 'a', 'i'
+  };
+
+  static uint16_t string_product_desc[] = {
+    STRING_DESCRIPTOR_HEADER(5),
+    'p', 'a', 'n', 'd', 'a'
+  };
+
+  // a string containing the default configuration index
+  static uint16_t string_configuration_desc[] = {
+    STRING_DESCRIPTOR_HEADER(2),
+    '0', '1' // "01"
+  };
+
+  // WCID (auto install WinUSB driver)
+  // https://github.com/pbatard/libwdi/wiki/WCID-Devices
+  // https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/winusb-installation#automatic-installation-of--winusb-without-an-inf-file
+  // WinUSB 1.0 descriptors, this is mostly used by Windows XP
+  static uint8_t string_238_desc[] = {
+    0x12, USB_DESC_TYPE_STRING, // bLength, bDescriptorType
+    'M',0, 'S',0, 'F',0, 'T',0, '1',0, '0',0, '0',0, // qwSignature (MSFT100)
+    MS_VENDOR_CODE, 0x00 // bMS_VendorCode, bPad
+  };
+
+  static uint8_t winusb_ext_compatid_os_desc[] = {
+    0x28, 0x00, 0x00, 0x00, // dwLength
+    0x00, 0x01, // bcdVersion
+    0x04, 0x00, // wIndex
+    0x01, // bCount
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Reserved
+    0x00, // bFirstInterfaceNumber
+    0x00, // Reserved
+    'W', 'I', 'N', 'U', 'S', 'B', 0x00, 0x00, // compatible ID (WINUSB)
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // subcompatible ID (none)
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // Reserved
+  };
+
+  static uint8_t winusb_ext_prop_os_desc[] = {
+    0x8e, 0x00, 0x00, 0x00, // dwLength
+    0x00, 0x01, // bcdVersion
+    0x05, 0x00, // wIndex
+    0x01, 0x00, // wCount
+    // first property
+    0x84, 0x00, 0x00, 0x00, // dwSize
+    0x01, 0x00, 0x00, 0x00, // dwPropertyDataType
+    0x28, 0x00, // wPropertyNameLength
+    'D',0, 'e',0, 'v',0, 'i',0, 'c',0, 'e',0, 'I',0, 'n',0, 't',0, 'e',0, 'r',0, 'f',0, 'a',0, 'c',0, 'e',0, 'G',0, 'U',0, 'I',0, 'D',0, 0, 0, // bPropertyName (DeviceInterfaceGUID)
+    0x4e, 0x00, 0x00, 0x00, // dwPropertyDataLength
+    '{',0, 'c',0, 'c',0, 'e',0, '5',0, '2',0, '9',0, '1',0, 'c',0, '-',0, 'a',0, '6',0, '9',0, 'f',0, '-',0, '4',0 ,'9',0 ,'9',0 ,'5',0 ,'-',0, 'a',0, '4',0, 'c',0, '2',0, '-',0, '2',0, 'a',0, 'e',0, '5',0, '7',0, 'a',0, '5',0, '1',0, 'a',0, 'd',0, 'e',0, '9',0, '}',0, 0, 0, // bPropertyData ({CCE5291C-A69F-4995-A4C2-2AE57A51ADE9})
+  };
+
+  /*
+  Binary Object Store descriptor used to expose WebUSB (and more WinUSB) metadata
+  comments are from the wicg spec
+  References used:
+    https://wicg.github.io/webusb/#webusb-platform-capability-descriptor
+    https://github.com/sowbug/weblight/blob/192ad7a0e903542e2aa28c607d98254a12a6399d/firmware/webusb.c
+    https://os.mbed.com/users/larsgk/code/USBDevice_WebUSB/file/1d8a6665d607/WebUSBDevice/
+  */
+  static uint8_t binary_object_store_desc[] = {
+    // BOS header
+    BINARY_OBJECT_STORE_DESCRIPTOR_LENGTH, // bLength, this is only the length of the header
+    BINARY_OBJECT_STORE_DESCRIPTOR, // bDescriptorType
+    0x39, 0x00, // wTotalLength (LSB, MSB)
+    0x02, // bNumDeviceCaps (WebUSB + WinUSB)
+
+    // -------------------------------------------------
+    // WebUSB descriptor
+    // header
+      0x18, // bLength, Size of this descriptor. Must be set to 24.
+      0x10, // bDescriptorType, DEVICE CAPABILITY descriptor
+      0x05, // bDevCapabilityType, PLATFORM capability
+      0x00, // bReserved, This field is reserved and shall be set to zero.
+
+    // PlatformCapabilityUUID, Must be set to {3408b638-09a9-47a0-8bfd-a0768815b665}.
+      0x38, 0xB6, 0x08, 0x34,
+      0xA9, 0x09, 0xA0, 0x47,
+      0x8B, 0xFD, 0xA0, 0x76,
+      0x88, 0x15, 0xB6, 0x65,
+    // </PlatformCapabilityUUID>
+
+    0x00, 0x01, // bcdVersion, Protocol version supported. Must be set to 0x0100.
+    WEBUSB_VENDOR_CODE, // bVendorCode, bRequest value used for issuing WebUSB requests.
+    // there used to be a concept of "allowed origins", but it was removed from the spec
+    // it was intended to be a security feature, but then the entire security model relies on domain ownership
+    // https://github.com/WICG/webusb/issues/49
+    // other implementations use various other indexed to leverate this no-longer-valid feature. we wont.
+    // the spec says we *must* reply to index 0x03 with the url, so we'll hint that that's the right index
+    0x03, // iLandingPage, URL descriptor index of the device’s landing page.
+
+    // -------------------------------------------------
+    // WinUSB descriptor
+    // header
+      0x1C, // Descriptor size (28 bytes)
+      0x10, // Descriptor type (Device Capability)
+      0x05, // Capability type (Platform)
+      0x00, // Reserved
+
+    // MS OS 2.0 Platform Capability ID (D8DD60DF-4589-4CC7-9CD2-659D9E648A9F)
+    // Indicates the device supports the Microsoft OS 2.0 descriptor
+      0xDF, 0x60, 0xDD, 0xD8,
+      0x89, 0x45, 0xC7, 0x4C,
+      0x9C, 0xD2, 0x65, 0x9D,
+      0x9E, 0x64, 0x8A, 0x9F,
+
+    0x00, 0x00, 0x03, 0x06, // Windows version, currently set to 8.1 (0x06030000)
+
+    WINUSB_PLATFORM_DESCRIPTOR_LENGTH, 0x00, // MS OS 2.0 descriptor size (word)
+    MS_VENDOR_CODE, 0x00 // vendor code, no alternate enumeration
+  };
+
+  // WinUSB 2.0 descriptor. This is what modern systems use
+  // https://github.com/sowbug/weblight/blob/192ad7a0e903542e2aa28c607d98254a12a6399d/firmware/webusb.c
+  // http://janaxelson.com/files/ms_os_20_descriptors.c
+  // https://books.google.com/books?id=pkefBgAAQBAJ&pg=PA353&lpg=PA353
+  static uint8_t winusb_20_desc[WINUSB_PLATFORM_DESCRIPTOR_LENGTH] = {
+    // Microsoft OS 2.0 descriptor set header (table 10)
+    0x0A, 0x00, // Descriptor size (10 bytes)
+    0x00, 0x00, // MS OS 2.0 descriptor set header
+
+    0x00, 0x00, 0x03, 0x06, // Windows version (8.1) (0x06030000)
+    WINUSB_PLATFORM_DESCRIPTOR_LENGTH, 0x00, // Total size of MS OS 2.0 descriptor set
+
+    // Microsoft OS 2.0 compatible ID descriptor
+      0x14, 0x00, // Descriptor size (20 bytes)
+      0x03, 0x00, // MS OS 2.0 compatible ID descriptor
+      'W', 'I', 'N', 'U', 'S', 'B', 0x00, 0x00, // compatible ID (WINUSB)
+      0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     // Sub-compatible ID
+
+    // Registry property descriptor
+    0x80, 0x00, // Descriptor size (130 bytes)
+    0x04, 0x00, // Registry Property descriptor
+    0x01, 0x00, // Strings are null-terminated Unicode
+    0x28, 0x00, // Size of Property Name (40 bytes) "DeviceInterfaceGUID"
+
+    // bPropertyName (DeviceInterfaceGUID)
+      'D', 0x00, 'e', 0x00, 'v', 0x00, 'i', 0x00, 'c', 0x00, 'e', 0x00, 'I', 0x00, 'n', 0x00,
+      't', 0x00, 'e', 0x00, 'r', 0x00, 'f', 0x00, 'a', 0x00, 'c', 0x00, 'e', 0x00, 'G', 0x00,
+      'U', 0x00, 'I', 0x00, 'D', 0x00, 0x00, 0x00,
+
+    0x4E, 0x00, // Size of Property Data (78 bytes)
+
+    // Vendor-defined property data: {CCE5291C-A69F-4995-A4C2-2AE57A51ADE9}
+      '{', 0x00, 'c', 0x00, 'c', 0x00, 'e', 0x00, '5', 0x00, '2', 0x00, '9', 0x00, '1', 0x00, // 16
+      'c', 0x00, '-', 0x00, 'a', 0x00, '6', 0x00, '9', 0x00, 'f', 0x00, '-', 0x00, '4', 0x00, // 32
+      '9', 0x00, '9', 0x00, '5', 0x00, '-', 0x00, 'a', 0x00, '4', 0x00, 'c', 0x00, '2', 0x00, // 48
+      '-', 0x00, '2', 0x00, 'a', 0x00, 'e', 0x00, '5', 0x00, '7', 0x00, 'a', 0x00, '5', 0x00, // 64
+      '1', 0x00, 'a', 0x00, 'd', 0x00, 'e', 0x00, '9', 0x00, '}', 0x00, 0x00, 0x00 // 78 bytes
+  };
+
+  int resp_len;
+  ControlPacket_t control_req;
+
+  // setup packet is ready
+  switch (setup.b.bRequest) {
+    case USB_REQ_SET_CONFIGURATION:
+      // enable other endpoints, has to be here?
+      USBx_INEP(1U)->DIEPCTL = (0x40U & USB_OTG_DIEPCTL_MPSIZ) | (2UL << 18) | (1UL << 22) |
+                              USB_OTG_DIEPCTL_SD0PID_SEVNFRM | USB_OTG_DIEPCTL_USBAEP;
+      USBx_INEP(1U)->DIEPINT = 0xFF;
+
+      USBx_OUTEP(2U)->DOEPTSIZ = (1UL << 19) | 0x40U;
+      USBx_OUTEP(2U)->DOEPCTL = (0x40U & USB_OTG_DOEPCTL_MPSIZ) | (2UL << 18) |
+                               USB_OTG_DOEPCTL_SD0PID_SEVNFRM | USB_OTG_DOEPCTL_USBAEP;
+      USBx_OUTEP(2U)->DOEPINT = 0xFF;
+
+      USBx_OUTEP(3U)->DOEPTSIZ = (32UL << 19) | 0x800U;
+      USBx_OUTEP(3U)->DOEPCTL = (0x40U & USB_OTG_DOEPCTL_MPSIZ) | (2UL << 18) |
+                               USB_OTG_DOEPCTL_SD0PID_SEVNFRM | USB_OTG_DOEPCTL_USBAEP;
+      USBx_OUTEP(3U)->DOEPINT = 0xFF;
+
+      // mark ready to receive
+      USBx_OUTEP(2U)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+      USBx_OUTEP(3U)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case USB_REQ_SET_ADDRESS:
+      // set now?
+      USBx_DEVICE->DCFG |= ((setup.b.wValue.w & 0x7fU) << 4);
+
+      #ifdef DEBUG_USB
+        print(" set address\n");
+      #endif
+
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+
+      break;
+    case USB_REQ_GET_DESCRIPTOR:
+      switch (setup.b.wValue.bw.lsb) {
+        case USB_DESC_TYPE_DEVICE:
+          //print("    writing device descriptor\n");
+
+          // set bcdDevice to hardware type
+          device_desc[13] = hw_type;
+          // setup transfer
+          USB_WritePacket(device_desc, MIN(sizeof(device_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+
+          //print("D");
+          break;
+        case USB_DESC_TYPE_CONFIGURATION:
+          USB_WritePacket(configuration_desc, MIN(sizeof(configuration_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_DEVICE_QUALIFIER:
+          USB_WritePacket(device_qualifier, MIN(sizeof(device_qualifier), setup.b.wLength.w), 0);
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_STRING:
+          switch (setup.b.wValue.bw.msb) {
+            case STRING_OFFSET_LANGID:
+              USB_WritePacket((uint8_t*)string_language_desc, MIN(sizeof(string_language_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_IMANUFACTURER:
+              USB_WritePacket((uint8_t*)string_manufacturer_desc, MIN(sizeof(string_manufacturer_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_IPRODUCT:
+              USB_WritePacket((uint8_t*)string_product_desc, MIN(sizeof(string_product_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_ISERIAL:
+              response[0] = 0x02 + (12 * 4);
+              response[1] = 0x03;
+
+              // 96 bits = 12 bytes
+              for (int i = 0; i < 12; i++){
+                uint8_t cc = ((uint8_t *)UID_BASE)[i];
+                response[2 + (i * 4)] = to_hex_char((cc >> 4) & 0xFU);
+                response[2 + (i * 4) + 1] = '\0';
+                response[2 + (i * 4) + 2] = to_hex_char((cc >> 0) & 0xFU);
+                response[2 + (i * 4) + 3] = '\0';
+              }
+
+              USB_WritePacket(response, MIN(response[0], setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_ICONFIGURATION:
+              USB_WritePacket((uint8_t*)string_configuration_desc, MIN(sizeof(string_configuration_desc), setup.b.wLength.w), 0);
+              break;
+            case 238:
+              USB_WritePacket((uint8_t*)string_238_desc, MIN(sizeof(string_238_desc), setup.b.wLength.w), 0);
+              break;
+            default:
+              // nothing
+              USB_WritePacket(0, 0, 0);
+              break;
+          }
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_BINARY_OBJECT_STORE:
+          USB_WritePacket(binary_object_store_desc, MIN(sizeof(binary_object_store_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        default:
+          // nothing here?
+          USB_WritePacket(0, 0, 0);
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+      }
+      break;
+    case USB_REQ_GET_STATUS:
+      // empty response?
+      response[0] = 0;
+      response[1] = 0;
+      USB_WritePacket((void*)&response, 2, 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case USB_REQ_SET_INTERFACE:
+      // Store the alt setting number for IN EP behavior.
+      current_int0_alt_setting = setup.b.wValue.w;
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case WEBUSB_VENDOR_CODE:
+      // probably asking for allowed origins, which was removed from the spec
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case MS_VENDOR_CODE:
+      switch (setup.b.wIndex.w) {
+        // winusb 2.0 descriptor from BOS
+        case WINUSB_REQ_GET_DESCRIPTOR:
+          USB_WritePacket_EP0((uint8_t*)winusb_20_desc, MIN(sizeof(winusb_20_desc), setup.b.wLength.w));
+          break;
+        // Extended Compat ID OS Descriptor
+        case WINUSB_REQ_GET_COMPATID_DESCRIPTOR:
+          USB_WritePacket_EP0((uint8_t*)winusb_ext_compatid_os_desc, MIN(sizeof(winusb_ext_compatid_os_desc), setup.b.wLength.w));
+          break;
+        // Extended Properties OS Descriptor
+        case WINUSB_REQ_GET_EXT_PROPS_OS:
+          USB_WritePacket_EP0((uint8_t*)winusb_ext_prop_os_desc, MIN(sizeof(winusb_ext_prop_os_desc), setup.b.wLength.w));
+          break;
+        default:
+          USB_WritePacket_EP0(0, 0);
+      }
+      break;
+    default:
+      control_req.request = setup.b.bRequest;
+      control_req.param1 = setup.b.wValue.w;
+      control_req.param2 = setup.b.wIndex.w;
+      control_req.length = setup.b.wLength.w;
+
+      resp_len = comms_control_handler(&control_req, response);
+      USB_WritePacket(response, MIN(resp_len, setup.b.wLength.w), 0);
+      USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+  }
+}
+
+
+
+// ***************************** USB port *****************************
+
+void usb_irqhandler(void) {
+  //USBx->GINTMSK = 0;
+  static uint8_t usbdata[0x100] __attribute__((aligned(4)));
+  unsigned int gintsts = USBx->GINTSTS;
+  unsigned int gotgint = USBx->GOTGINT;
+  unsigned int daint = USBx_DEVICE->DAINT;
+
+  // gintsts SUSPEND? 04008428
+  #ifdef DEBUG_USB
+    puth(gintsts);
+    print(" ");
+    /*puth(USBx->GCCFG);
+    print(" ");*/
+    puth(gotgint);
+    print(" ep ");
+    puth(daint);
+    print(" USB interrupt!\n");
+  #endif
+
+  if ((gintsts & USB_OTG_GINTSTS_CIDSCHG) != 0U) {
+    print("connector ID status change\n");
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_USBRST) != 0U) {
+    #ifdef DEBUG_USB
+      print("USB reset\n");
+    #endif
+    usb_reset();
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_ENUMDNE) != 0U) {
+    #ifdef DEBUG_USB
+      print("enumeration done\n");
+    #endif
+    // Full speed, ENUMSPD
+    //puth(USBx_DEVICE->DSTS);
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_OTGINT) != 0U) {
+    #ifdef DEBUG_USB
+      print("OTG int:");
+      puth(USBx->GOTGINT);
+      print("\n");
+    #endif
+
+    // getting ADTOCHG
+    //USBx->GOTGINT = USBx->GOTGINT;
+  }
+
+  // RX FIFO first
+  if ((gintsts & USB_OTG_GINTSTS_RXFLVL) != 0U) {
+    // 1. Read the Receive status pop register
+    volatile unsigned int rxst = USBx->GRXSTSP;
+    int status = (rxst & USB_OTG_GRXSTSP_PKTSTS) >> 17;
+
+    #ifdef DEBUG_USB
+      print(" RX FIFO:");
+      puth(rxst);
+      print(" status: ");
+      puth(status);
+      print(" len: ");
+      puth((rxst & USB_OTG_GRXSTSP_BCNT) >> 4);
+      print("\n");
+    #endif
+
+    if (status == STS_DATA_UPDT) {
+      int endpoint = (rxst & USB_OTG_GRXSTSP_EPNUM);
+      int len = (rxst & USB_OTG_GRXSTSP_BCNT) >> 4;
+      (void)USB_ReadPacket(&usbdata, len);
+      #ifdef DEBUG_USB
+        print("  data ");
+        puth(len);
+        print("\n");
+        hexdump(&usbdata, len);
+      #endif
+
+      if (endpoint == 2) {
+        comms_endpoint2_write((uint8_t *) usbdata, len);
+      }
+
+      if (endpoint == 3) {
+        outep3_processing = true;
+        comms_can_write(usbdata, len);
+      }
+    } else if (status == STS_SETUP_UPDT) {
+      (void)USB_ReadPacket(&setup, 8);
+      #ifdef DEBUG_USB
+        print("  setup ");
+        hexdump(&setup, 8);
+        print("\n");
+      #endif
+    } else {
+      // status is neither STS_DATA_UPDT or STS_SETUP_UPDT, skip
+    }
+  }
+
+  /*if (gintsts & USB_OTG_GINTSTS_HPRTINT) {
+    // host
+    print("HPRT:");
+    puth(USBx_HOST_PORT->HPRT);
+    print("\n");
+    if (USBx_HOST_PORT->HPRT & USB_OTG_HPRT_PCDET) {
+      USBx_HOST_PORT->HPRT |= USB_OTG_HPRT_PRST;
+      USBx_HOST_PORT->HPRT |= USB_OTG_HPRT_PCDET;
+    }
+
+  }*/
+
+  if ((gintsts & USB_OTG_GINTSTS_BOUTNAKEFF) || (gintsts & USB_OTG_GINTSTS_GINAKEFF)) {
+    // no global NAK, why is this getting set?
+    #ifdef DEBUG_USB
+      print("GLOBAL NAK\n");
+    #endif
+    USBx_DEVICE->DCTL |= USB_OTG_DCTL_CGONAK | USB_OTG_DCTL_CGINAK;
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_SRQINT) != 0U) {
+    // we want to do "A-device host negotiation protocol" since we are the A-device
+    /*print("start request\n");
+    puth(USBx->GOTGCTL);
+    print("\n");*/
+    //USBx->GUSBCFG |= USB_OTG_GUSBCFG_FDMOD;
+    //USBx_HOST_PORT->HPRT = USB_OTG_HPRT_PPWR | USB_OTG_HPRT_PENA;
+    //USBx->GOTGCTL |= USB_OTG_GOTGCTL_SRQ;
+  }
+
+  // out endpoint hit
+  if ((gintsts & USB_OTG_GINTSTS_OEPINT) != 0U) {
+    #ifdef DEBUG_USB
+      print("  0:");
+      puth(USBx_OUTEP(0U)->DOEPINT);
+      print(" 2:");
+      puth(USBx_OUTEP(2U)->DOEPINT);
+      print(" 3:");
+      puth(USBx_OUTEP(3U)->DOEPINT);
+      print(" ");
+      puth(USBx_OUTEP(3U)->DOEPCTL);
+      print(" 4:");
+      puth(USBx_OUTEP(4)->DOEPINT);
+      print(" OUT ENDPOINT\n");
+    #endif
+
+    if ((USBx_OUTEP(2U)->DOEPINT & USB_OTG_DOEPINT_XFRC) != 0U) {
+      #ifdef DEBUG_USB
+        print("  OUT2 PACKET XFRC\n");
+      #endif
+      USBx_OUTEP(2U)->DOEPTSIZ = (1UL << 19) | 0x40U;
+      USBx_OUTEP(2U)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+    }
+
+    if ((USBx_OUTEP(3U)->DOEPINT & USB_OTG_DOEPINT_XFRC) != 0U) {
+      #ifdef DEBUG_USB
+        print("  OUT3 PACKET XFRC\n");
+      #endif
+      // NAK cleared by process_can (if tx buffers have room)
+      outep3_processing = false;
+      refresh_can_tx_slots_available();
+    } else if ((USBx_OUTEP(3U)->DOEPINT & 0x2000U) != 0U) {
+      #ifdef DEBUG_USB
+        print("  OUT3 PACKET WTF\n");
+      #endif
+      // if NAK was set trigger this, unknown interrupt
+      // TODO: why was this here? fires when TX buffers when we can't clear NAK
+      // USBx_OUTEP(3U)->DOEPTSIZ = (1U << 19) | 0x40U;
+      // USBx_OUTEP(3U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+    } else if ((USBx_OUTEP(3U)->DOEPINT) != 0U) {
+      #ifdef DEBUG_USB
+        print("OUTEP3 error ");
+        puth(USBx_OUTEP(3U)->DOEPINT);
+        print("\n");
+      #endif
+    } else {
+      // USBx_OUTEP(3U)->DOEPINT is 0, ok to skip
+    }
+
+    if ((USBx_OUTEP(0U)->DOEPINT & USB_OTG_DIEPINT_XFRC) != 0U) {
+      // ready for next packet
+      USBx_OUTEP(0U)->DOEPTSIZ = USB_OTG_DOEPTSIZ_STUPCNT | (USB_OTG_DOEPTSIZ_PKTCNT & (1UL << 19)) | (1U << 3);
+    }
+
+    // respond to setup packets
+    if ((USBx_OUTEP(0U)->DOEPINT & USB_OTG_DOEPINT_STUP) != 0U) {
+      usb_setup();
+    }
+
+    USBx_OUTEP(0U)->DOEPINT = USBx_OUTEP(0U)->DOEPINT;
+    USBx_OUTEP(2U)->DOEPINT = USBx_OUTEP(2U)->DOEPINT;
+    USBx_OUTEP(3U)->DOEPINT = USBx_OUTEP(3U)->DOEPINT;
+  }
+
+  // interrupt endpoint hit (Page 1221)
+  if ((gintsts & USB_OTG_GINTSTS_IEPINT) != 0U) {
+    #ifdef DEBUG_USB
+      print("  ");
+      puth(USBx_INEP(0U)->DIEPINT);
+      print(" ");
+      puth(USBx_INEP(1U)->DIEPINT);
+      print(" IN ENDPOINT\n");
+    #endif
+
+    // Should likely check the EP of the IN request even if there is
+    // only one IN endpoint.
+
+    // No need to set NAK in OTG_DIEPCTL0 when nothing to send,
+    // Appears USB core automatically sets NAK. WritePacket clears it.
+
+    // Handle the two interface alternate settings. Setting 0 has EP1
+    // as bulk. Setting 1 has EP1 as interrupt. The code to handle
+    // these two EP variations are very similar and can be
+    // restructured for smaller code footprint. Keeping split out for
+    // now for clarity.
+
+    //TODO add default case. Should it NAK?
+    switch (current_int0_alt_setting) {
+      case 0: ////// Bulk config
+        // *** IN token received when TxFIFO is empty
+        if ((USBx_INEP(1U)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0U) {
+          #ifdef DEBUG_USB
+          print("  IN PACKET QUEUE\n");
+          #endif
+          // TODO: always assuming max len, can we get the length?
+          USB_WritePacket((void *)response, comms_can_read(response, 0x40), 1);
+        }
+        break;
+
+      case 1: ////// Interrupt config
+        // *** IN token received when TxFIFO is empty
+        if ((USBx_INEP(1U)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0U) {
+          #ifdef DEBUG_USB
+          print("  IN PACKET QUEUE\n");
+          #endif
+          // TODO: always assuming max len, can we get the length?
+          int len = comms_can_read(response, 0x40);
+          if (len > 0) {
+            USB_WritePacket((void *)response, len, 1);
+          }
+        }
+        break;
+      default:
+        print("current_int0_alt_setting value invalid\n");
+        break;
+    }
+
+    if ((USBx_INEP(0U)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0U) {
+      #ifdef DEBUG_USB
+      print("  IN PACKET QUEUE\n");
+      #endif
+
+      if ((ep0_txlen != 0U) && ((USBx_INEP(0U)->DTXFSTS & USB_OTG_DTXFSTS_INEPTFSAV) >= 0x40U)) {
+        uint16_t len = MIN(ep0_txlen, 0x40);
+        USB_WritePacket(ep0_txdata, len, 0);
+        ep0_txdata = &ep0_txdata[len];
+        ep0_txlen -= len;
+        if (ep0_txlen == 0U) {
+          ep0_txdata = NULL;
+          USBx_DEVICE->DIEPEMPMSK &= ~1;
+          USBx_OUTEP(0U)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+        }
+      }
+    }
+
+    // clear interrupts
+    USBx_INEP(0U)->DIEPINT = USBx_INEP(0U)->DIEPINT; // Why ep0?
+    USBx_INEP(1U)->DIEPINT = USBx_INEP(1U)->DIEPINT;
+  }
+
+  // clear all interrupts we handled
+  USBx_DEVICE->DAINT = daint;
+  USBx->GOTGINT = gotgint;
+  USBx->GINTSTS = gintsts;
+
+  //USBx->GINTMSK = 0xFFFFFFFF & ~(USB_OTG_GINTMSK_NPTXFEM | USB_OTG_GINTMSK_PTXFEM | USB_OTG_GINTSTS_SOF | USB_OTG_GINTSTS_EOPF);
+}
+
+void can_tx_comms_resume_usb(void) {
+  ENTER_CRITICAL();
+  if (!outep3_processing && (USBx_OUTEP(3U)->DOEPCTL & USB_OTG_DOEPCTL_NAKSTS) != 0U) {
+    USBx_OUTEP(3U)->DOEPTSIZ = (32UL << 19) | 0x800U;
+    USBx_OUTEP(3U)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+  }
+  EXIT_CRITICAL();
+}

artifacts/package_sources/panda/board/drivers/usb_declarations.h

@@ -0,0 +1,111 @@
+#pragma once
+
+// IRQs: OTG_FS
+
+typedef union {
+  uint16_t w;
+  struct BW {
+    uint8_t msb;
+    uint8_t lsb;
+  }
+  bw;
+} uint16_t_uint8_t;
+
+typedef union _USB_Setup {
+  uint32_t d8[2];
+  struct _SetupPkt_Struc
+  {
+    uint8_t           bmRequestType;
+    uint8_t           bRequest;
+    uint16_t_uint8_t  wValue;
+    uint16_t_uint8_t  wIndex;
+    uint16_t_uint8_t  wLength;
+  } b;
+} USB_Setup_TypeDef;
+
+void usb_init(void);
+void refresh_can_tx_slots_available(void);
+
+// **** supporting defines ****
+#define  USB_REQ_GET_STATUS                             0x00
+#define  USB_REQ_CLEAR_FEATURE                          0x01
+#define  USB_REQ_SET_FEATURE                            0x03
+#define  USB_REQ_SET_ADDRESS                            0x05
+#define  USB_REQ_GET_DESCRIPTOR                         0x06
+#define  USB_REQ_SET_DESCRIPTOR                         0x07
+#define  USB_REQ_GET_CONFIGURATION                      0x08
+#define  USB_REQ_SET_CONFIGURATION                      0x09
+#define  USB_REQ_GET_INTERFACE                          0x0A
+#define  USB_REQ_SET_INTERFACE                          0x0B
+#define  USB_REQ_SYNCH_FRAME                            0x0C
+
+#define  USB_DESC_TYPE_DEVICE                           0x01
+#define  USB_DESC_TYPE_CONFIGURATION                    0x02
+#define  USB_DESC_TYPE_STRING                           0x03
+#define  USB_DESC_TYPE_INTERFACE                        0x04
+#define  USB_DESC_TYPE_ENDPOINT                         0x05
+#define  USB_DESC_TYPE_DEVICE_QUALIFIER                 0x06
+#define  USB_DESC_TYPE_OTHER_SPEED_CONFIGURATION        0x07
+#define  USB_DESC_TYPE_BINARY_OBJECT_STORE              0x0f
+
+// offsets for configuration strings
+#define  STRING_OFFSET_LANGID                           0x00
+#define  STRING_OFFSET_IMANUFACTURER                    0x01
+#define  STRING_OFFSET_IPRODUCT                         0x02
+#define  STRING_OFFSET_ISERIAL                          0x03
+#define  STRING_OFFSET_ICONFIGURATION                   0x04
+#define  STRING_OFFSET_IINTERFACE                       0x05
+
+// WebUSB requests
+#define  WEBUSB_REQ_GET_URL                             0x02
+
+// WebUSB types
+#define  WEBUSB_DESC_TYPE_URL                           0x03
+#define  WEBUSB_URL_SCHEME_HTTPS                        0x01
+#define  WEBUSB_URL_SCHEME_HTTP                         0x00
+
+// WinUSB requests
+#define  WINUSB_REQ_GET_COMPATID_DESCRIPTOR             0x04
+#define  WINUSB_REQ_GET_EXT_PROPS_OS                    0x05
+#define  WINUSB_REQ_GET_DESCRIPTOR                      0x07
+
+#define STS_GOUT_NAK                           1
+#define STS_DATA_UPDT                          2
+#define STS_XFER_COMP                          3
+#define STS_SETUP_COMP                         4
+#define STS_SETUP_UPDT                         6
+
+// for the repeating interfaces
+#define DSCR_INTERFACE_LEN 9
+#define DSCR_ENDPOINT_LEN 7
+#define DSCR_CONFIG_LEN 9
+#define DSCR_DEVICE_LEN 18
+
+// endpoint types
+#define ENDPOINT_TYPE_CONTROL 0
+#define ENDPOINT_TYPE_ISO 1
+#define ENDPOINT_TYPE_BULK 2
+#define ENDPOINT_TYPE_INT 3
+
+// These are arbitrary values used in bRequest
+#define  MS_VENDOR_CODE 0x20
+#define  WEBUSB_VENDOR_CODE 0x30
+
+// BOS constants
+#define BINARY_OBJECT_STORE_DESCRIPTOR_LENGTH   0x05
+#define BINARY_OBJECT_STORE_DESCRIPTOR          0x0F
+#define WINUSB_PLATFORM_DESCRIPTOR_LENGTH       0x9E
+
+// Convert machine byte order to USB byte order
+#define TOUSBORDER(num)\
+  ((num) & 0xFFU), (((uint16_t)(num) >> 8) & 0xFFU)
+
+// take in string length and return the first 2 bytes of a string descriptor
+#define STRING_DESCRIPTOR_HEADER(size)\
+  (((((size) * 2) + 2) & 0xFF) | 0x0300)
+
+#define ENDPOINT_RCV 0x80
+#define ENDPOINT_SND 0x00
+
+// ***************************** USB port *****************************
+void can_tx_comms_resume_usb(void);

artifacts/package_sources/panda/board/early_init.h

@@ -0,0 +1,64 @@
+// Early bringup
+#define ENTER_BOOTLOADER_MAGIC 0xdeadbeefU
+#define ENTER_SOFTLOADER_MAGIC 0xdeadc0deU
+#define BOOT_NORMAL 0xdeadb111U
+
+extern void *g_pfnVectors;
+extern uint32_t enter_bootloader_mode;
+
+typedef void (*bootloader_fcn)(void);
+typedef bootloader_fcn *bootloader_fcn_ptr;
+
+static void jump_to_bootloader(void) {
+  // do enter bootloader
+  enter_bootloader_mode = 0;
+
+  bootloader_fcn_ptr bootloader_ptr = (bootloader_fcn_ptr)BOOTLOADER_ADDRESS;
+  bootloader_fcn bootloader = *bootloader_ptr;
+
+  // jump to bootloader
+  enable_interrupts();
+  bootloader();
+
+  // reset on exit
+  enter_bootloader_mode = BOOT_NORMAL;
+  NVIC_SystemReset();
+}
+
+void early_initialization(void) {
+  // Reset global critical depth
+  disable_interrupts();
+  global_critical_depth = 0;
+
+  // Init register and interrupt tables
+  init_registers();
+
+  // after it's been in the bootloader, things are initted differently, so we reset
+  if ((enter_bootloader_mode != BOOT_NORMAL) &&
+      (enter_bootloader_mode != ENTER_BOOTLOADER_MAGIC) &&
+      (enter_bootloader_mode != ENTER_SOFTLOADER_MAGIC)) {
+    enter_bootloader_mode = BOOT_NORMAL;
+    NVIC_SystemReset();
+  }
+
+  // if wrong chip, reboot
+  volatile unsigned int id = DBGMCU->IDCODE;
+  if ((id & 0xFFFU) != MCU_IDCODE) {
+    enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+  }
+
+  // setup interrupt table
+  SCB->VTOR = (uint32_t)&g_pfnVectors;
+
+  // early GPIOs float everything
+  early_gpio_float();
+
+  detect_board_type();
+
+  if (enter_bootloader_mode == ENTER_BOOTLOADER_MAGIC) {
+    led_init();
+    current_board->init_bootloader();
+    led_set(LED_GREEN, 1);
+    jump_to_bootloader();
+  }
+}

artifacts/package_sources/panda/board/fake_stm.h

@@ -0,0 +1,33 @@
+// minimal code to fake a panda for tests
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+
+#include "utils.h"
+
+#define ALLOW_DEBUG
+
+#define ENTER_CRITICAL() 0
+#define EXIT_CRITICAL() 0
+
+void print(const char *a) {
+  printf("%s", a);
+}
+
+void puth(unsigned int i) {
+  printf("%u", i);
+}
+
+typedef struct {
+  uint32_t CNT;
+} TIM_TypeDef;
+
+TIM_TypeDef timer;
+TIM_TypeDef *MICROSECOND_TIMER = &timer;
+uint32_t microsecond_timer_get(void);
+
+uint32_t microsecond_timer_get(void) {
+  return MICROSECOND_TIMER->CNT;
+}
+
+typedef uint32_t GPIO_TypeDef;

artifacts/package_sources/panda/board/faults.h

@@ -0,0 +1,25 @@
+#include "faults_declarations.h"
+
+uint8_t fault_status = FAULT_STATUS_NONE;
+uint32_t faults = 0U;
+
+void fault_occurred(uint32_t fault) {
+  if ((faults & fault) == 0U) {
+    if ((PERMANENT_FAULTS & fault) != 0U) {
+      print("Permanent fault occurred: 0x"); puth(fault); print("\n");
+      fault_status = FAULT_STATUS_PERMANENT;
+    } else {
+      print("Temporary fault occurred: 0x"); puth(fault); print("\n");
+      fault_status = FAULT_STATUS_TEMPORARY;
+    }
+  }
+  faults |= fault;
+}
+
+void fault_recovered(uint32_t fault) {
+  if ((PERMANENT_FAULTS & fault) == 0U) {
+    faults &= ~fault;
+  } else {
+    print("Cannot recover from a permanent fault!\n");
+  }
+}

artifacts/package_sources/panda/board/faults_declarations.h

@@ -0,0 +1,34 @@
+#pragma once
+
+#define FAULT_STATUS_NONE 0U
+#define FAULT_STATUS_TEMPORARY 1U
+#define FAULT_STATUS_PERMANENT 2U
+
+// Fault types, matches cereal.log.PandaState.FaultType
+#define FAULT_RELAY_MALFUNCTION             (1UL << 0)
+#define FAULT_UNUSED_INTERRUPT_HANDLED      (1UL << 1)
+#define FAULT_INTERRUPT_RATE_CAN_1          (1UL << 2)
+#define FAULT_INTERRUPT_RATE_CAN_2          (1UL << 3)
+#define FAULT_INTERRUPT_RATE_CAN_3          (1UL << 4)
+#define FAULT_INTERRUPT_RATE_TACH           (1UL << 5)
+#define FAULT_INTERRUPT_RATE_INTERRUPTS     (1UL << 7)
+#define FAULT_INTERRUPT_RATE_SPI_DMA        (1UL << 8)
+#define FAULT_INTERRUPT_RATE_USB            (1UL << 15)
+#define FAULT_REGISTER_DIVERGENT            (1UL << 18)
+#define FAULT_INTERRUPT_RATE_CLOCK_SOURCE   (1UL << 20)
+#define FAULT_INTERRUPT_RATE_TICK           (1UL << 21)
+#define FAULT_INTERRUPT_RATE_EXTI           (1UL << 22)
+#define FAULT_INTERRUPT_RATE_SPI            (1UL << 23)
+#define FAULT_INTERRUPT_RATE_UART_7         (1UL << 24)
+#define FAULT_SIREN_MALFUNCTION             (1UL << 25)
+#define FAULT_HEARTBEAT_LOOP_WATCHDOG       (1UL << 26)
+#define FAULT_INTERRUPT_RATE_SOUND_DMA      (1UL << 27)
+
+// Permanent faults
+#define PERMANENT_FAULTS 0U
+
+extern uint8_t fault_status;
+extern uint32_t faults;
+
+void fault_occurred(uint32_t fault);
+void fault_recovered(uint32_t fault);

artifacts/package_sources/panda/board/flash.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+import argparse
+
+from panda import Panda
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--all", action="store_true", help="Recover all Panda devices")
+  args = parser.parse_args()
+
+  subprocess.check_call(f"scons -C {board_path}/.. -j$(nproc) {board_path}", shell=True)
+
+  if args.all:
+    serials = Panda.list()
+    print(f"found {len(serials)} panda(s) - {serials}")
+  else:
+    serials = [None]
+
+  for s in serials:
+    with Panda(serial=s) as p:
+      print("flashing", p.get_usb_serial())
+      p.flash()
+  exit(1 if len(serials) == 0 else 0)

artifacts/package_sources/panda/board/flasher.h

@@ -0,0 +1,156 @@
+// from the linker script
+#ifdef STM32H7
+  #define APP_START_ADDRESS 0x8020000U
+#else
+  #define APP_START_ADDRESS 0x8004000U
+#endif
+
+// flasher state variables
+uint32_t *prog_ptr = NULL;
+bool unlocked = false;
+
+void spi_init(void);
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  int resp_len = 0;
+
+  // flasher machine
+  memset(resp, 0, 4);
+  memcpy(resp+4, "\xde\xad\xd0\x0d", 4);
+  resp[0] = 0xff;
+  resp[2] = req->request;
+  resp[3] = ~req->request;
+  *((uint32_t **)&resp[8]) = prog_ptr;
+  resp_len = 0xc;
+
+  int sec;
+  switch (req->request) {
+    // **** 0xb0: flasher echo
+    case 0xb0:
+      resp[1] = 0xff;
+      break;
+    // **** 0xb1: unlock flash
+    case 0xb1:
+      if (flash_is_locked()) {
+        flash_unlock();
+        resp[1] = 0xff;
+      }
+      led_set(LED_GREEN, 1);
+      unlocked = true;
+      prog_ptr = (uint32_t *)APP_START_ADDRESS;
+      break;
+    // **** 0xb2: erase sector
+    case 0xb2:
+      sec = req->param1;
+      if (flash_erase_sector(sec, unlocked)) {
+        resp[1] = 0xff;
+      }
+      break;
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xc3: fetch MCU UID
+    case 0xc3:
+      (void)memcpy(resp, ((uint8_t *)UID_BASE), 12);
+      resp_len = 12;
+      break;
+    // **** 0xd0: fetch serial number
+    case 0xd0:
+      // addresses are OTP
+      if (req->param1 == 1) {
+        memcpy(resp, (void *)DEVICE_SERIAL_NUMBER_ADDRESS, 0x10);
+        resp_len = 0x10;
+      } else {
+        get_provision_chunk(resp);
+        resp_len = PROVISION_CHUNK_LEN;
+      }
+      break;
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      // this allows reflashing of the bootstub
+      switch (req->param1) {
+        case 0:
+          print("-> entering bootloader\n");
+          enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+      }
+      break;
+    // **** 0xd6: get version
+    case 0xd6:
+      COMPILE_TIME_ASSERT(sizeof(gitversion) <= USBPACKET_MAX_SIZE);
+      memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion) - 1U;
+      break;
+    // **** 0xd8: reset ST
+    case 0xd8:
+      flush_write_buffer();
+      NVIC_SystemReset();
+      break;
+  }
+  return resp_len;
+}
+
+void comms_can_write(const uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+
+int comms_can_read(uint8_t *data, uint32_t max_len) {
+  UNUSED(data);
+  UNUSED(max_len);
+  return 0;
+}
+
+void refresh_can_tx_slots_available(void) {}
+
+void comms_endpoint2_write(const uint8_t *data, uint32_t len) {
+  led_set(LED_RED, 0);
+  for (uint32_t i = 0; i < len/4; i++) {
+    flash_write_word(prog_ptr, *(uint32_t*)(data+(i*4)));
+
+    //*(uint64_t*)(&spi_tx_buf[0x30+(i*4)]) = *prog_ptr;
+    prog_ptr++;
+  }
+  led_set(LED_RED, 1);
+}
+
+
+void soft_flasher_start(void) {
+  print("\n\n\n************************ FLASHER START ************************\n");
+
+  enter_bootloader_mode = 0;
+
+  flasher_peripherals_init();
+
+  gpio_usart2_init();
+  gpio_usb_init();
+  led_init();
+
+  // enable comms
+  usb_init();
+  if (current_board->has_spi) {
+    gpio_spi_init();
+    spi_init();
+  }
+
+  // green LED on for flashing
+  led_set(LED_GREEN, 1);
+
+  enable_interrupts();
+
+  for (;;) {
+    // blink the green LED fast
+    led_set(LED_GREEN, 0);
+    delay(500000);
+    led_set(LED_GREEN, 1);
+    delay(500000);
+  }
+}

artifacts/package_sources/panda/board/health.h

@@ -0,0 +1,60 @@
+// When changing these structs, python/__init__.py needs to be kept up to date!
+
+#define HEALTH_PACKET_VERSION 17
+struct __attribute__((packed)) health_t {
+  uint32_t uptime_pkt;
+  uint32_t voltage_pkt;
+  uint32_t current_pkt;
+  uint32_t safety_tx_blocked_pkt;
+  uint32_t safety_rx_invalid_pkt;
+  uint32_t tx_buffer_overflow_pkt;
+  uint32_t rx_buffer_overflow_pkt;
+  uint32_t faults_pkt;
+  uint8_t ignition_line_pkt;
+  uint8_t ignition_can_pkt;
+  uint8_t controls_allowed_pkt;
+  uint8_t car_harness_status_pkt;
+  uint8_t safety_mode_pkt;
+  uint16_t safety_param_pkt;
+  uint8_t fault_status_pkt;
+  uint8_t power_save_enabled_pkt;
+  uint8_t heartbeat_lost_pkt;
+  uint16_t alternative_experience_pkt;
+  float interrupt_load_pkt;
+  uint8_t fan_power;
+  uint8_t safety_rx_checks_invalid_pkt;
+  uint16_t spi_error_count_pkt;
+  uint16_t sbu1_voltage_mV;
+  uint16_t sbu2_voltage_mV;
+  uint8_t som_reset_triggered;
+};
+
+#define CAN_HEALTH_PACKET_VERSION 5
+typedef struct __attribute__((packed)) {
+  uint8_t bus_off;
+  uint32_t bus_off_cnt;
+  uint8_t error_warning;
+  uint8_t error_passive;
+  uint8_t last_error; // real time LEC value
+  uint8_t last_stored_error; // last LEC positive error code stored
+  uint8_t last_data_error; // DLEC (for CANFD only)
+  uint8_t last_data_stored_error; // last DLEC positive error code stored (for CANFD only)
+  uint8_t receive_error_cnt; // Actual state of the receive error counter, values between 0 and 127. FDCAN_ECR.REC
+  uint8_t transmit_error_cnt; // Actual state of the transmit error counter, values between 0 and 255. FDCAN_ECR.TEC
+  uint32_t total_error_cnt; // How many times any error interrupt was invoked
+  uint32_t total_tx_lost_cnt; // Tx event FIFO element lost
+  uint32_t total_rx_lost_cnt; // Rx FIFO 0 message lost due to FIFO full condition
+  uint32_t total_tx_cnt;
+  uint32_t total_rx_cnt;
+  uint32_t total_fwd_cnt; // Messages forwarded from one bus to another
+  uint32_t total_tx_checksum_error_cnt;
+  uint16_t can_speed;
+  uint16_t can_data_speed;
+  uint8_t canfd_enabled;
+  uint8_t brs_enabled;
+  uint8_t canfd_non_iso;
+  uint32_t irq0_call_rate;
+  uint32_t irq1_call_rate;
+  uint32_t irq2_call_rate;
+  uint32_t can_core_reset_cnt;
+} can_health_t;

artifacts/package_sources/panda/board/jungle/README.md

@@ -0,0 +1,26 @@
+Welcome to the jungle
+======
+
+Firmware for the Panda Jungle testing board.
+Available for purchase at the [comma shop](https://comma.ai/shop/panda-jungle).
+
+## udev rules
+
+To make the jungle usable without root permissions, you might need to setup udev rules for it.
+On ubuntu, this should do the trick:
+``` bash
+sudo tee /etc/udev/rules.d/12-panda_jungle.rules <<EOF
+SUBSYSTEM=="usb", ATTRS{idVendor}=="3801", ATTRS{idProduct}=="ddcf", MODE="0666"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="3801", ATTRS{idProduct}=="ddef", MODE="0666"
+EOF
+sudo udevadm control --reload-rules && sudo udevadm trigger
+```
+
+## updating the firmware
+Updating the firmware is easy! In the `board/jungle/` folder, run:
+``` bash
+./flash.py
+```
+
+If you somehow bricked your jungle, you'll need a [comma key](https://comma.ai/shop/products/comma-key) to put the microcontroller in DFU mode for the V1.
+For V2, the onboard button serves this purpose. When powered on while holding the button to put it in DFU mode, running `./recover.sh` in `board/` should unbrick it.

artifacts/package_sources/panda/board/jungle/__init__.py

@@ -0,0 +1,159 @@
+# python library to interface with panda
+import os
+import struct
+from functools import wraps
+
+from panda import Panda, PandaDFU
+from panda.python.constants import McuType
+
+BASEDIR = os.path.dirname(os.path.realpath(__file__))
+FW_PATH = os.path.join(BASEDIR, "../obj/")
+
+
+def ensure_jungle_health_packet_version(fn):
+  @wraps(fn)
+  def wrapper(self, *args, **kwargs):
+    if self.health_version != self.HEALTH_PACKET_VERSION:
+      raise RuntimeError(f"Jungle firmware ({self.health_version}) doesn't match the \
+                           library's health packet version ({self.HEALTH_PACKET_VERSION}). \
+                           Reflash jungle.")
+    return fn(self, *args, **kwargs)
+  return wrapper
+
+
+class PandaJungleDFU(PandaDFU):
+  def recover(self):
+    fn = os.path.join(FW_PATH, self._mcu_type.config.bootstub_fn.replace("panda", "panda_jungle"))
+    with open(fn, "rb") as f:
+      code = f.read()
+    self.program_bootstub(code)
+    self.reset()
+
+
+class PandaJungle(Panda):
+  USB_PIDS = (0xddef, 0xddcf)
+
+  HW_TYPE_UNKNOWN = b'\x00'
+  HW_TYPE_V2 = b'\x02'
+
+  H7_DEVICES = [HW_TYPE_V2, ]
+  SUPPORTED_DEVICES = H7_DEVICES
+
+  HEALTH_PACKET_VERSION = 1
+  HEALTH_STRUCT = struct.Struct("<IffffffHHHHHHHHHHHH")
+
+  HARNESS_ORIENTATION_NONE = 0
+  HARNESS_ORIENTATION_1 = 1
+  HARNESS_ORIENTATION_2 = 2
+
+  @classmethod
+  def spi_connect(cls, serial, ignore_version=False):
+    return None, None, None, None
+
+  def flash(self, fn=None, code=None, reconnect=True):
+    if not fn:
+      fn = os.path.join(FW_PATH, self._mcu_type.config.app_fn.replace("panda", "panda_jungle"))
+    super().flash(fn=fn, code=code, reconnect=reconnect)
+
+  def recover(self, timeout: int | None = 60, reset: bool = True) -> bool:
+    dfu_serial = self.get_dfu_serial()
+
+    if reset:
+      self.reset(enter_bootstub=True)
+      self.reset(enter_bootloader=True)
+
+    if not self.wait_for_dfu(dfu_serial, timeout=timeout):
+      return False
+
+    dfu = PandaJungleDFU(dfu_serial)
+    dfu.recover()
+
+    # reflash after recover
+    self.connect(True, True)
+    self.flash()
+    return True
+
+  def get_mcu_type(self) -> McuType:
+    hw_type = self.get_type()
+    if hw_type in PandaJungle.H7_DEVICES:
+      return McuType.H7
+    raise ValueError(f"unknown HW type: {hw_type}")
+
+  def up_to_date(self, fn=None) -> bool:
+    if fn is None:
+      fn = os.path.join(FW_PATH, self.get_mcu_type().config.app_fn.replace("panda", "panda_jungle"))
+    return super().up_to_date(fn=fn)
+
+  # ******************* health *******************
+
+  @ensure_jungle_health_packet_version
+  def health(self):
+    dat = self._handle.controlRead(PandaJungle.REQUEST_IN, 0xd2, 0, 0, self.HEALTH_STRUCT.size)
+    a = self.HEALTH_STRUCT.unpack(dat)
+    return {
+      "uptime": a[0],
+      "ch1_power": a[1],
+      "ch2_power": a[2],
+      "ch3_power": a[3],
+      "ch4_power": a[4],
+      "ch5_power": a[5],
+      "ch6_power": a[6],
+      "ch1_sbu1_voltage": a[7] / 1000.0,
+      "ch1_sbu2_voltage": a[8] / 1000.0,
+      "ch2_sbu1_voltage": a[9] / 1000.0,
+      "ch2_sbu2_voltage": a[10] / 1000.0,
+      "ch3_sbu1_voltage": a[11] / 1000.0,
+      "ch3_sbu2_voltage": a[12] / 1000.0,
+      "ch4_sbu1_voltage": a[13] / 1000.0,
+      "ch4_sbu2_voltage": a[14] / 1000.0,
+      "ch5_sbu1_voltage": a[15] / 1000.0,
+      "ch5_sbu2_voltage": a[16] / 1000.0,
+      "ch6_sbu1_voltage": a[17] / 1000.0,
+      "ch6_sbu2_voltage": a[18] / 1000.0,
+    }
+
+  # ******************* control *******************
+
+  # Returns tuple with health packet version and CAN packet/USB packet version
+  def get_packets_versions(self):
+    dat = self._handle.controlRead(PandaJungle.REQUEST_IN, 0xdd, 0, 0, 3)
+    if dat and len(dat) == 3:
+      a = struct.unpack("BBB", dat)
+      return (a[0], a[1], a[2])
+    return (-1, -1, -1)
+
+  # ******************* jungle stuff *******************
+
+  def set_panda_power(self, enabled):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xa0, int(enabled), 0, b'')
+
+  def set_panda_individual_power(self, port, enabled):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xa3, int(port), int(enabled), b'')
+
+  def set_harness_orientation(self, mode):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xa1, int(mode), 0, b'')
+
+  def set_ignition(self, enabled):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xa2, int(enabled), 0, b'')
+
+  def set_can_silent(self, silent):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xf5, int(silent), 0, b'')
+
+  def set_generated_can(self, enabled):
+    self._handle.controlWrite(PandaJungle.REQUEST_OUT, 0xa4, int(enabled), 0, b'')
+
+  # ******************* serial *******************
+
+  def debug_read(self):
+    ret = []
+    while 1:
+      lret = bytes(self._handle.controlRead(PandaJungle.REQUEST_IN, 0xe0, 0, 0, 0x40))
+      if len(lret) == 0:
+        break
+      ret.append(lret)
+    return b''.join(ret)
+
+  # ******************* header pins *******************
+
+  def set_header_pin(self, pin_num, enabled):
+    self._handle.controlWrite(Panda.REQUEST_OUT, 0xf7, int(pin_num), int(enabled), b'')

artifacts/package_sources/panda/board/jungle/boards/board_declarations.h

@@ -0,0 +1,60 @@
+// ******************** Prototypes ********************
+typedef void (*board_init)(void);
+typedef void (*board_board_tick)(void);
+typedef bool (*board_get_button)(void);
+typedef void (*board_init_bootloader)(void);
+typedef void (*board_set_panda_power)(bool enabled);
+typedef void (*board_set_panda_individual_power)(uint8_t port_num, bool enabled);
+typedef void (*board_set_ignition)(bool enabled);
+typedef void (*board_set_individual_ignition)(uint8_t bitmask);
+typedef void (*board_set_harness_orientation)(uint8_t orientation);
+typedef void (*board_set_can_mode)(uint8_t mode);
+typedef void (*board_enable_can_transceiver)(uint8_t transceiver, bool enabled);
+typedef void (*board_enable_header_pin)(uint8_t pin_num, bool enabled);
+typedef float (*board_get_channel_power)(uint8_t channel);
+typedef uint16_t (*board_get_sbu_mV)(uint8_t channel, uint8_t sbu);
+
+struct board {
+  GPIO_TypeDef * const led_GPIO[3];
+  const uint8_t led_pin[3];
+  const uint8_t led_pwm_channels[3]; // leave at 0 to disable PWM
+  const uint16_t avdd_mV;
+  board_init init;
+  board_board_tick board_tick;
+  board_get_button get_button;
+  board_init_bootloader init_bootloader;
+  board_set_panda_power set_panda_power;
+  board_set_panda_individual_power set_panda_individual_power;
+  board_set_ignition set_ignition;
+  board_set_individual_ignition set_individual_ignition;
+  board_set_harness_orientation set_harness_orientation;
+  board_set_can_mode set_can_mode;
+  board_enable_can_transceiver enable_can_transceiver;
+  board_enable_header_pin enable_header_pin;
+  board_get_channel_power get_channel_power;
+  board_get_sbu_mV get_sbu_mV;
+
+  // TODO: shouldn't need these
+  bool has_spi;
+};
+
+// ******************* Definitions ********************
+#define HW_TYPE_UNKNOWN 0U
+#define HW_TYPE_V2 2U
+
+// CAN modes
+#define CAN_MODE_NORMAL 0U
+#define CAN_MODE_OBD_CAN2 3U
+
+// Harness states
+#define HARNESS_ORIENTATION_NONE 0U
+#define HARNESS_ORIENTATION_1 1U
+#define HARNESS_ORIENTATION_2 2U
+
+#define SBU1 0U
+#define SBU2 1U
+
+// ********************* Globals **********************
+uint8_t harness_orientation = HARNESS_ORIENTATION_NONE;
+uint8_t can_mode = CAN_MODE_NORMAL;
+uint8_t ignition = 0U;

artifacts/package_sources/panda/board/jungle/boards/board_v2.h

@@ -0,0 +1,308 @@
+// ///////////////////////// //
+// Jungle board v2 (STM32H7) //
+// ///////////////////////// //
+
+#define ADC_CHANNEL(a, c) {.adc = (a), .channel = (c), .sample_time = SAMPLETIME_810_CYCLES, .oversampling = OVERSAMPLING_1}
+
+gpio_t power_pins[] = {
+  {.bank = GPIOA, .pin = 0},
+  {.bank = GPIOA, .pin = 1},
+  {.bank = GPIOF, .pin = 12},
+  {.bank = GPIOA, .pin = 5},
+  {.bank = GPIOC, .pin = 5},
+  {.bank = GPIOB, .pin = 2},
+};
+
+gpio_t sbu1_ignition_pins[] = {
+  {.bank = GPIOD, .pin = 0},
+  {.bank = GPIOD, .pin = 5},
+  {.bank = GPIOD, .pin = 12},
+  {.bank = GPIOD, .pin = 14},
+  {.bank = GPIOE, .pin = 5},
+  {.bank = GPIOE, .pin = 9},
+};
+
+gpio_t sbu1_relay_pins[] = {
+  {.bank = GPIOD, .pin = 1},
+  {.bank = GPIOD, .pin = 6},
+  {.bank = GPIOD, .pin = 11},
+  {.bank = GPIOD, .pin = 15},
+  {.bank = GPIOE, .pin = 6},
+  {.bank = GPIOE, .pin = 10},
+};
+
+gpio_t sbu2_ignition_pins[] = {
+  {.bank = GPIOD, .pin = 3},
+  {.bank = GPIOD, .pin = 8},
+  {.bank = GPIOD, .pin = 9},
+  {.bank = GPIOE, .pin = 0},
+  {.bank = GPIOE, .pin = 7},
+  {.bank = GPIOE, .pin = 11},
+};
+
+gpio_t sbu2_relay_pins[] = {
+  {.bank = GPIOD, .pin = 4},
+  {.bank = GPIOD, .pin = 10},
+  {.bank = GPIOD, .pin = 13},
+  {.bank = GPIOE, .pin = 1},
+  {.bank = GPIOE, .pin = 8},
+  {.bank = GPIOE, .pin = 12},
+};
+
+const adc_signal_t sbu1_channels[] = {
+  ADC_CHANNEL(ADC3, 12),
+  ADC_CHANNEL(ADC3, 2),
+  ADC_CHANNEL(ADC3, 4),
+  ADC_CHANNEL(ADC3, 6),
+  ADC_CHANNEL(ADC3, 8),
+  ADC_CHANNEL(ADC3, 10),
+};
+
+const adc_signal_t sbu2_channels[] = {
+  ADC_CHANNEL(ADC1, 13),
+  ADC_CHANNEL(ADC3, 3),
+  ADC_CHANNEL(ADC3, 5),
+  ADC_CHANNEL(ADC3, 7),
+  ADC_CHANNEL(ADC3, 9),
+  ADC_CHANNEL(ADC3, 11),
+};
+
+void board_v2_set_harness_orientation(uint8_t orientation) {
+  switch (orientation) {
+    case HARNESS_ORIENTATION_NONE:
+      gpio_set_all_output(sbu1_ignition_pins, sizeof(sbu1_ignition_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu1_relay_pins, sizeof(sbu1_relay_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu2_ignition_pins, sizeof(sbu2_ignition_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu2_relay_pins, sizeof(sbu2_relay_pins) / sizeof(gpio_t), false);
+      harness_orientation = orientation;
+      break;
+    case HARNESS_ORIENTATION_1:
+      gpio_set_all_output(sbu1_ignition_pins, sizeof(sbu1_ignition_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu1_relay_pins, sizeof(sbu1_relay_pins) / sizeof(gpio_t), true);
+      gpio_set_bitmask(sbu2_ignition_pins, sizeof(sbu2_ignition_pins) / sizeof(gpio_t), ignition);
+      gpio_set_all_output(sbu2_relay_pins, sizeof(sbu2_relay_pins) / sizeof(gpio_t), false);
+      harness_orientation = orientation;
+      break;
+    case HARNESS_ORIENTATION_2:
+      gpio_set_bitmask(sbu1_ignition_pins, sizeof(sbu1_ignition_pins) / sizeof(gpio_t), ignition);
+      gpio_set_all_output(sbu1_relay_pins, sizeof(sbu1_relay_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu2_ignition_pins, sizeof(sbu2_ignition_pins) / sizeof(gpio_t), false);
+      gpio_set_all_output(sbu2_relay_pins, sizeof(sbu2_relay_pins) / sizeof(gpio_t), true);
+      harness_orientation = orientation;
+      break;
+    default:
+      print("Tried to set an unsupported harness orientation: "); puth(orientation); print("\n");
+      break;
+  }
+}
+
+void board_v2_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver) {
+    case 1U:
+      set_gpio_output(GPIOG, 11, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 3, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOD, 7, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 4, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void board_v2_enable_header_pin(uint8_t pin_num, bool enabled) {
+  if (pin_num < 8U) {
+    set_gpio_output(GPIOG, pin_num, enabled);
+  } else {
+    print("Invalid pin number ("); puth(pin_num); print("): enabling failed\n");
+  }
+}
+
+void board_v2_set_can_mode(uint8_t mode) {
+  board_v2_enable_can_transceiver(2U, false);
+  board_v2_enable_can_transceiver(4U, false);
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+      // B12,B13: disable normal mode
+      set_gpio_pullup(GPIOB, 12, PULL_NONE);
+      set_gpio_mode(GPIOB, 12, MODE_ANALOG);
+
+      set_gpio_pullup(GPIOB, 13, PULL_NONE);
+      set_gpio_mode(GPIOB, 13, MODE_ANALOG);
+
+      // B5,B6: FDCAN2 mode
+      set_gpio_pullup(GPIOB, 5, PULL_NONE);
+      set_gpio_alternate(GPIOB, 5, GPIO_AF9_FDCAN2);
+
+      set_gpio_pullup(GPIOB, 6, PULL_NONE);
+      set_gpio_alternate(GPIOB, 6, GPIO_AF9_FDCAN2);
+      can_mode = CAN_MODE_NORMAL;
+      board_v2_enable_can_transceiver(2U, true);
+      break;
+    case CAN_MODE_OBD_CAN2:
+      // B5,B6: disable normal mode
+      set_gpio_pullup(GPIOB, 5, PULL_NONE);
+      set_gpio_mode(GPIOB, 5, MODE_ANALOG);
+
+      set_gpio_pullup(GPIOB, 6, PULL_NONE);
+      set_gpio_mode(GPIOB, 6, MODE_ANALOG);
+      // B12,B13: FDCAN2 mode
+      set_gpio_pullup(GPIOB, 12, PULL_NONE);
+      set_gpio_alternate(GPIOB, 12, GPIO_AF9_FDCAN2);
+
+      set_gpio_pullup(GPIOB, 13, PULL_NONE);
+      set_gpio_alternate(GPIOB, 13, GPIO_AF9_FDCAN2);
+      can_mode = CAN_MODE_OBD_CAN2;
+      board_v2_enable_can_transceiver(4U, true);
+      break;
+    default:
+      break;
+  }
+}
+
+bool panda_power = false;
+uint8_t panda_power_bitmask = 0U;
+void board_v2_set_panda_power(bool enable) {
+  panda_power = enable;
+  gpio_set_all_output(power_pins, sizeof(power_pins) / sizeof(gpio_t), enable);
+  if (enable) {
+    panda_power_bitmask = 0xFFU;
+  } else {
+    panda_power_bitmask = 0U;
+  }
+}
+
+void board_v2_set_panda_individual_power(uint8_t port_num, bool enable) {
+  port_num -= 1U;
+  if (port_num < 6U) {
+    panda_power_bitmask &= ~(1U << port_num);
+    panda_power_bitmask |= (enable ? 1U : 0U) << port_num;
+  } else {
+    print("Invalid port number ("); puth(port_num); print("): enabling failed\n");
+  }
+  gpio_set_bitmask(power_pins, sizeof(power_pins) / sizeof(gpio_t), (uint32_t)panda_power_bitmask);
+}
+
+bool board_v2_get_button(void) {
+  return get_gpio_input(GPIOG, 15);
+}
+
+void board_v2_set_ignition(bool enabled) {
+  ignition = enabled ? 0xFFU : 0U;
+  board_v2_set_harness_orientation(harness_orientation);
+}
+
+void board_v2_set_individual_ignition(uint8_t bitmask) {
+  ignition = bitmask;
+  board_v2_set_harness_orientation(harness_orientation);
+}
+
+float board_v2_get_channel_power(uint8_t channel) {
+  float ret = 0.0f;
+  if ((channel >= 1U) && (channel <= 6U)) {
+    uint16_t readout = adc_get_mV(&(const adc_signal_t) ADC_CHANNEL(ADC1, channel - 1U)); // these are mapped nicely in hardware
+    ret = (((float) readout / 33e6) - 0.8e-6) / 52e-6 * 12.0f;
+  } else {
+    print("Invalid channel ("); puth(channel); print(")\n");
+  }
+  return ret;
+}
+
+uint16_t board_v2_get_sbu_mV(uint8_t channel, uint8_t sbu) {
+  uint16_t ret = 0U;
+  if ((channel >= 1U) && (channel <= 6U)) {
+    switch(sbu){
+      case SBU1:
+        ret = adc_get_mV(&sbu1_channels[channel - 1U]);
+        break;
+      case SBU2:
+        ret = adc_get_mV(&sbu2_channels[channel - 1U]);
+        break;
+      default:
+        print("Invalid SBU ("); puth(sbu); print(")\n");
+        break;
+    }
+  } else {
+    print("Invalid channel ("); puth(channel); print(")\n");
+  }
+  return ret;
+}
+
+void board_v2_init(void) {
+  common_init_gpio();
+
+  // Normal CAN mode
+  board_v2_set_can_mode(CAN_MODE_NORMAL);
+
+  // Enable CAN transceivers
+  for(uint8_t i = 1; i <= 4; i++) {
+    board_v2_enable_can_transceiver(i, true);
+  }
+
+  // Set to no harness orientation
+  board_v2_set_harness_orientation(HARNESS_ORIENTATION_NONE);
+
+  // Enable panda power by default
+  board_v2_set_panda_power(true);
+
+  // Current monitor channels
+  adc_init(ADC1);
+  register_set_bits(&SYSCFG->PMCR, SYSCFG_PMCR_PA0SO | SYSCFG_PMCR_PA1SO); // open up analog switches for PA0_C and PA1_C
+  set_gpio_mode(GPIOF, 11, MODE_ANALOG);
+  set_gpio_mode(GPIOA, 6, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 4, MODE_ANALOG);
+  set_gpio_mode(GPIOB, 1, MODE_ANALOG);
+
+  // SBU channels
+  adc_init(ADC3);
+  set_gpio_mode(GPIOC, 2, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 3, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 9, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 7, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 5, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 3, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 10, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 8, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 6, MODE_ANALOG);
+  set_gpio_mode(GPIOF, 4, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 0, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 1, MODE_ANALOG);
+
+  // Header pins
+  set_gpio_mode(GPIOG, 0, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 1, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 2, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 3, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 4, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 5, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 6, MODE_OUTPUT);
+  set_gpio_mode(GPIOG, 7, MODE_OUTPUT);
+}
+
+void board_v2_tick(void) {}
+
+board board_v2 = {
+  .avdd_mV = 3300U,
+  .init = &board_v2_init,
+  .init_bootloader = &board_v2_tick,
+  .led_GPIO = {GPIOE, GPIOE, GPIOE},
+  .led_pin = {4, 3, 2},
+  .board_tick = &board_v2_tick,
+  .get_button = &board_v2_get_button,
+  .set_panda_power = &board_v2_set_panda_power,
+  .set_panda_individual_power = &board_v2_set_panda_individual_power,
+  .set_ignition = &board_v2_set_ignition,
+  .set_individual_ignition = &board_v2_set_individual_ignition,
+  .set_harness_orientation = &board_v2_set_harness_orientation,
+  .set_can_mode = &board_v2_set_can_mode,
+  .enable_can_transceiver = &board_v2_enable_can_transceiver,
+  .enable_header_pin = &board_v2_enable_header_pin,
+  .get_channel_power = &board_v2_get_channel_power,
+  .get_sbu_mV = &board_v2_get_sbu_mV,
+};

artifacts/package_sources/panda/board/jungle/flash.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+import argparse
+
+from panda import PandaJungle
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--all", action="store_true", help="Recover all panda jungle devices")
+  args = parser.parse_args()
+
+  subprocess.check_call(f"scons -C {board_path}/.. -u -j$(nproc) .", shell=True)
+
+  if args.all:
+    serials = PandaJungle.list()
+    print(f"found {len(serials)} panda jungles(s) - {serials}")
+  else:
+    serials = [None]
+
+  for s in serials:
+    with PandaJungle(serial=s) as p:
+      print("flashing", p.get_usb_serial())
+      p.flash()
+  exit(1 if len(serials) == 0 else 0)

artifacts/package_sources/panda/board/jungle/jungle_health.h

@@ -0,0 +1,24 @@
+// When changing these structs, python/__init__.py needs to be kept up to date!
+
+#define JUNGLE_HEALTH_PACKET_VERSION 1
+struct __attribute__((packed)) jungle_health_t {
+  uint32_t uptime_pkt;
+  float ch1_power;
+  float ch2_power;
+  float ch3_power;
+  float ch4_power;
+  float ch5_power;
+  float ch6_power;
+  uint16_t ch1_sbu1_mV;
+  uint16_t ch1_sbu2_mV;
+  uint16_t ch2_sbu1_mV;
+  uint16_t ch2_sbu2_mV;
+  uint16_t ch3_sbu1_mV;
+  uint16_t ch3_sbu2_mV;
+  uint16_t ch4_sbu1_mV;
+  uint16_t ch4_sbu2_mV;
+  uint16_t ch5_sbu1_mV;
+  uint16_t ch5_sbu2_mV;
+  uint16_t ch6_sbu1_mV;
+  uint16_t ch6_sbu2_mV;
+};

artifacts/package_sources/panda/board/jungle/main.c

@@ -0,0 +1,234 @@
+// ********************* Includes *********************
+#include "board/config.h"
+
+#include "iqdbc/safety/safety.h"
+
+#include "board/drivers/led.h"
+#include "board/drivers/pwm.h"
+#include "board/drivers/usb.h"
+
+#include "board/early_init.h"
+#include "board/provision.h"
+
+#include "board/health.h"
+#include "board/jungle/jungle_health.h"
+
+#include "board/drivers/can_common.h"
+
+#include "board/drivers/fdcan.h"
+
+#include "board/obj/gitversion.h"
+
+#include "board/can_comms.h"
+#include "board/jungle/main_comms.h"
+
+
+// ********************* Serial debugging *********************
+
+void debug_ring_callback(uart_ring *ring) {
+  char rcv;
+  while (get_char(ring, &rcv)) {
+    (void)injectc(ring, rcv);
+  }
+}
+
+// ***************************** main code *****************************
+
+// cppcheck-suppress unusedFunction ; used in headers not included in cppcheck
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+void __attribute__ ((noinline)) enable_fpu(void) {
+  // enable the FPU
+  SCB->CPACR |= ((3UL << (10U * 2U)) | (3UL << (11U * 2U)));
+}
+
+// called at 8Hz
+uint32_t loop_counter = 0U;
+uint16_t button_press_cnt = 0U;
+void tick_handler(void) {
+  if (TICK_TIMER->SR != 0) {
+    if (generated_can_traffic) {
+      for (int i = 0; i < 3; i++) {
+        if (can_health[i].transmit_error_cnt >= 128) {
+          (void)llcan_init(CANIF_FROM_CAN_NUM(i));
+        }
+      }
+    }
+
+    // decimated to 1Hz
+    if ((loop_counter % 8) == 0U) {
+      #ifdef DEBUG
+        print("** blink ");
+        print("rx:"); puth4(can_rx_q.r_ptr); print("-"); puth4(can_rx_q.w_ptr); print("  ");
+        print("tx1:"); puth4(can_tx1_q.r_ptr); print("-"); puth4(can_tx1_q.w_ptr); print("  ");
+        print("tx2:"); puth4(can_tx2_q.r_ptr); print("-"); puth4(can_tx2_q.w_ptr); print("  ");
+        print("tx3:"); puth4(can_tx3_q.r_ptr); print("-"); puth4(can_tx3_q.w_ptr); print("\n");
+      #endif
+
+      current_board->board_tick();
+
+      // check registers
+      check_registers();
+
+      // turn off the blue LED, turned on by CAN
+      led_set(LED_BLUE, false);
+
+      // Blink and OBD CAN
+#ifdef FINAL_PROVISIONING
+      current_board->set_can_mode(can_mode == CAN_MODE_NORMAL ? CAN_MODE_OBD_CAN2 : CAN_MODE_NORMAL);
+#endif
+
+      // on to the next one
+      uptime_cnt += 1U;
+    }
+
+    // Check on button
+    bool current_button_status = current_board->get_button();
+
+    if (current_button_status && button_press_cnt == 10) {
+      current_board->set_panda_power(!panda_power);
+    }
+
+#ifdef FINAL_PROVISIONING
+    // Ignition blinking
+    uint8_t ignition_bitmask = 0U;
+    for (uint8_t i = 0U; i < 6U; i++) {
+      ignition_bitmask |= ((loop_counter % 12U) < ((uint32_t) i + 2U)) << i;
+    }
+    current_board->set_individual_ignition(ignition_bitmask);
+
+    // SBU voltage reporting
+    for (uint8_t i = 0U; i < 6U; i++) {
+      CANPacket_t pkt = { 0 };
+      pkt.data_len_code = 8U;
+      pkt.addr = 0x100U + i;
+      *(uint16_t *) &pkt.data[0] = current_board->get_sbu_mV(i + 1U, SBU1);
+      *(uint16_t *) &pkt.data[2] = current_board->get_sbu_mV(i + 1U, SBU2);
+      pkt.data[4] = (ignition_bitmask >> i) & 1U;
+      can_set_checksum(&pkt);
+      can_send(&pkt, 0U, false);
+    }
+#else
+    // toggle ignition on button press
+    static bool prev_button_status = false;
+    if (!current_button_status && prev_button_status && button_press_cnt < 10){
+      current_board->set_ignition(!ignition);
+    }
+    prev_button_status = current_button_status;
+#endif
+
+    button_press_cnt = current_button_status ? button_press_cnt + 1 : 0;
+
+    loop_counter++;
+  }
+  TICK_TIMER->SR = 0;
+}
+
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  // shouldn't have interrupts here, but just in case
+  disable_interrupts();
+
+  // init early devices
+  clock_init();
+  peripherals_init();
+  detect_board_type();
+  // red+green leds enabled until succesful USB init, as a debug indicator
+  led_set(LED_RED, true);
+  led_set(LED_GREEN, true);
+
+  // print hello
+  print("\n\n\n************************ MAIN START ************************\n");
+
+  // check for non-supported board types
+  assert_fatal(hw_type != HW_TYPE_UNKNOWN, "Unsupported board type\n");
+
+  print("Config:\n");
+  print("  Board type: 0x"); puth(hw_type); print("\n");
+
+  // init board
+  current_board->init();
+
+  // we have an FPU, let's use it!
+  enable_fpu();
+
+  microsecond_timer_init();
+
+  // 8Hz timer
+  REGISTER_INTERRUPT(TICK_TIMER_IRQ, tick_handler, 10U, FAULT_INTERRUPT_RATE_TICK)
+  tick_timer_init();
+
+#ifdef DEBUG
+  print("DEBUG ENABLED\n");
+#endif
+  // enable USB (right before interrupts or enum can fail!)
+  usb_init();
+
+  led_set(LED_RED, false);
+  led_set(LED_GREEN, false);
+
+  print("**** INTERRUPTS ON ****\n");
+  enable_interrupts();
+
+  can_silent = false;
+  set_safety_hooks(SAFETY_ALLOUTPUT, 0U);
+
+  can_init_all();
+  current_board->set_harness_orientation(HARNESS_ORIENTATION_1);
+
+#ifdef FINAL_PROVISIONING
+  print("---- FINAL PROVISIONING BUILD ---- \n");
+  can_set_forwarding(0, 2);
+  can_set_forwarding(1, 2);
+#endif
+
+  // LED should keep on blinking all the time
+  uint32_t cnt = 0;
+  for (cnt=0;;cnt++) {
+    if (generated_can_traffic) {
+      // fill up all the queues
+      can_ring *qs[] = {&can_tx1_q, &can_tx2_q, &can_tx3_q};
+      for (int j = 0; j < 3; j++) {
+        for (uint16_t n = 0U; n < can_slots_empty(qs[j]); n++) {
+          uint16_t i = cnt % 100U;
+          CANPacket_t to_send;
+          to_send.returned = 0U;
+          to_send.rejected = 0U;
+          to_send.extended = 0U;
+          to_send.addr = 0x200U + i;
+          to_send.bus = i % 3U;
+          to_send.data_len_code = i % 8U;
+          (void)memcpy(to_send.data, "\xff\xff\xff\xff\xff\xff\xff\xff", dlc_to_len[to_send.data_len_code]);
+          can_set_checksum(&to_send);
+
+          can_send(&to_send, to_send.bus, true);
+        }
+      }
+
+      delay(1000);
+      continue;
+    }
+
+    // useful for debugging, fade breaks = panda is overloaded
+    for (uint32_t fade = 0U; fade < MAX_LED_FADE; fade += 1U) {
+      led_set(LED_RED, true);
+      delay(fade >> 4);
+      led_set(LED_RED, false);
+      delay((MAX_LED_FADE - fade) >> 4);
+    }
+
+    for (uint32_t fade = MAX_LED_FADE; fade > 0U; fade -= 1U) {
+      led_set(LED_RED, true);
+      delay(fade >> 4);
+      led_set(LED_RED, false);
+      delay((MAX_LED_FADE - fade) >> 4);
+    }
+  }
+
+  return 0;
+}

artifacts/package_sources/panda/board/jungle/main_comms.h

@@ -0,0 +1,261 @@
+extern int _app_start[0xc000]; // Only first 3 sectors of size 0x4000 are used
+
+bool generated_can_traffic = false;
+
+int get_jungle_health_pkt(void *dat) {
+  COMPILE_TIME_ASSERT(sizeof(struct jungle_health_t) <= USBPACKET_MAX_SIZE);
+  struct jungle_health_t * health = (struct jungle_health_t*)dat;
+
+  health->uptime_pkt = uptime_cnt;
+  health->ch1_power = current_board->get_channel_power(1U);
+  health->ch2_power = current_board->get_channel_power(2U);
+  health->ch3_power = current_board->get_channel_power(3U);
+  health->ch4_power = current_board->get_channel_power(4U);
+  health->ch5_power = current_board->get_channel_power(5U);
+  health->ch6_power = current_board->get_channel_power(6U);
+
+  health->ch1_sbu1_mV = current_board->get_sbu_mV(1U, SBU1);
+  health->ch1_sbu2_mV = current_board->get_sbu_mV(1U, SBU2);
+  health->ch2_sbu1_mV = current_board->get_sbu_mV(2U, SBU1);
+  health->ch2_sbu2_mV = current_board->get_sbu_mV(2U, SBU2);
+  health->ch3_sbu1_mV = current_board->get_sbu_mV(3U, SBU1);
+  health->ch3_sbu2_mV = current_board->get_sbu_mV(3U, SBU2);
+  health->ch4_sbu1_mV = current_board->get_sbu_mV(4U, SBU1);
+  health->ch4_sbu2_mV = current_board->get_sbu_mV(4U, SBU2);
+  health->ch5_sbu1_mV = current_board->get_sbu_mV(5U, SBU1);
+  health->ch5_sbu2_mV = current_board->get_sbu_mV(5U, SBU2);
+  health->ch6_sbu1_mV = current_board->get_sbu_mV(6U, SBU1);
+  health->ch6_sbu2_mV = current_board->get_sbu_mV(6U, SBU2);
+
+  return sizeof(*health);
+}
+
+// send on serial, first byte to select the ring
+void comms_endpoint2_write(const uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  unsigned int resp_len = 0;
+  uint32_t time;
+
+#ifdef DEBUG_COMMS
+  print("raw control request: "); hexdump(req, sizeof(ControlPacket_t)); print("\n");
+  print("- request "); puth(req->request); print("\n");
+  print("- param1 "); puth(req->param1); print("\n");
+  print("- param2 "); puth(req->param2); print("\n");
+#endif
+
+  switch (req->request) {
+    // **** 0xa0: Set panda power.
+    case 0xa0:
+      current_board->set_panda_power((req->param1 == 1U));
+      break;
+    // **** 0xa1: Set harness orientation.
+    case 0xa1:
+      current_board->set_harness_orientation(req->param1);
+      break;
+    // **** 0xa2: Set ignition.
+    case 0xa2:
+      current_board->set_ignition((req->param1 == 1U));
+      break;
+    // **** 0xa3: Set panda power per channel by bitmask.
+    case 0xa3:
+      current_board->set_panda_individual_power(req->param1, (req->param2 > 0U));
+      break;
+    // **** 0xa4: Enable generated CAN traffic.
+    case 0xa4:
+      generated_can_traffic = (req->param1 > 0U);
+      break;
+    // **** 0xa8: get microsecond timer
+    case 0xa8:
+      time = microsecond_timer_get();
+      resp[0] = (time & 0x000000FFU);
+      resp[1] = ((time & 0x0000FF00U) >> 8U);
+      resp[2] = ((time & 0x00FF0000U) >> 16U);
+      resp[3] = ((time & 0xFF000000U) >> 24U);
+      resp_len = 4U;
+      break;
+    // **** 0xc0: reset communications
+    case 0xc0:
+      comms_can_reset();
+      break;
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xc2: CAN health stats
+    case 0xc2:
+      COMPILE_TIME_ASSERT(sizeof(can_health_t) <= USBPACKET_MAX_SIZE);
+      if (req->param1 < 3U) {
+        update_can_health_pkt(req->param1, 0U);
+        can_health[req->param1].can_speed = (bus_config[req->param1].can_speed / 10U);
+        can_health[req->param1].can_data_speed = (bus_config[req->param1].can_data_speed / 10U);
+        can_health[req->param1].canfd_enabled = bus_config[req->param1].canfd_enabled;
+        can_health[req->param1].brs_enabled = bus_config[req->param1].brs_enabled;
+        can_health[req->param1].canfd_non_iso = bus_config[req->param1].canfd_non_iso;
+        resp_len = sizeof(can_health[req->param1]);
+        (void)memcpy(resp, &can_health[req->param1], resp_len);
+      }
+      break;
+    // **** 0xc3: fetch MCU UID
+    case 0xc3:
+      (void)memcpy(resp, ((uint8_t *)UID_BASE), 12);
+      resp_len = 12;
+      break;
+    // **** 0xd0: fetch serial (aka the provisioned dongle ID)
+    case 0xd0:
+      // addresses are OTP
+      if (req->param1 == 1U) {
+        (void)memcpy(resp, (uint8_t *)DEVICE_SERIAL_NUMBER_ADDRESS, 0x10);
+        resp_len = 0x10;
+      } else {
+        get_provision_chunk(resp);
+        resp_len = PROVISION_CHUNK_LEN;
+      }
+      break;
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      // this allows reflashing of the bootstub
+      switch (req->param1) {
+        case 0:
+          // only allow bootloader entry on debug builds
+          #ifdef ALLOW_DEBUG
+            print("-> entering bootloader\n");
+            enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+            NVIC_SystemReset();
+          #endif
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        default:
+          print("Bootloader mode invalid\n");
+          break;
+      }
+      break;
+    // **** 0xd2: get health packet
+    case 0xd2:
+      resp_len = get_jungle_health_pkt(resp);
+      break;
+    // **** 0xd3: get first 64 bytes of signature
+    case 0xd3:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len], resp_len);
+      }
+      break;
+    // **** 0xd4: get second 64 bytes of signature
+    case 0xd4:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len + 64], resp_len);
+      }
+      break;
+    // **** 0xd6: get version
+    case 0xd6:
+      COMPILE_TIME_ASSERT(sizeof(gitversion) <= USBPACKET_MAX_SIZE);
+      (void)memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion) - 1U;
+      break;
+    // **** 0xd8: reset ST
+    case 0xd8:
+      NVIC_SystemReset();
+      break;
+    // **** 0xdb: set OBD CAN multiplexing mode
+    case 0xdb:
+      if (req->param1 == 1U) {
+        // Enable OBD CAN
+        current_board->set_can_mode(CAN_MODE_OBD_CAN2);
+      } else {
+        // Disable OBD CAN
+        current_board->set_can_mode(CAN_MODE_NORMAL);
+      }
+      break;
+    // **** 0xdd: get healthpacket and CANPacket versions
+    case 0xdd:
+      resp[0] = JUNGLE_HEALTH_PACKET_VERSION;
+      resp[1] = CAN_PACKET_VERSION;
+      resp[2] = CAN_HEALTH_PACKET_VERSION;
+      resp_len = 3;
+      break;
+    // **** 0xde: set can bitrate
+    case 0xde:
+      if ((req->param1 < PANDA_CAN_CNT) && is_speed_valid(req->param2, speeds, sizeof(speeds)/sizeof(speeds[0]))) {
+        bus_config[req->param1].can_speed = req->param2;
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xe0: debug read
+    case 0xe0:
+      // read
+      while ((resp_len < MIN(req->length, USBPACKET_MAX_SIZE)) && get_char(get_ring_by_number(0), (char*)&resp[resp_len])) {
+        ++resp_len;
+      }
+      break;
+    // **** 0xe5: set CAN loopback (for testing)
+    case 0xe5:
+      can_loopback = (req->param1 > 0U);
+      can_init_all();
+      break;
+    // **** 0xf1: Clear CAN ring buffer.
+    case 0xf1:
+      if (req->param1 == 0xFFFFU) {
+        print("Clearing CAN Rx queue\n");
+        can_clear(&can_rx_q);
+      } else if (req->param1 < PANDA_CAN_CNT) {
+        print("Clearing CAN Tx queue\n");
+        can_clear(can_queues[req->param1]);
+      } else {
+        print("Clearing CAN CAN ring buffer failed: wrong bus number\n");
+      }
+      break;
+    // **** 0xf4: Set CAN transceiver enable pin
+    case 0xf4:
+      current_board->enable_can_transceiver(req->param1, req->param2 > 0U);
+      break;
+    // **** 0xf5: Set CAN silent mode
+    case 0xf5:
+      can_silent = (req->param1 > 0U);
+      can_init_all();
+      break;
+    // **** 0xf7: enable/disable header pin by number
+    case 0xf7:
+      current_board->enable_header_pin(req->param1, req->param2 > 0U);
+      break;
+    // **** 0xf9: set CAN FD data bitrate
+    case 0xf9:
+      if ((req->param1 < PANDA_CAN_CNT) &&
+           is_speed_valid(req->param2, data_speeds, sizeof(data_speeds)/sizeof(data_speeds[0]))) {
+        bus_config[req->param1].can_data_speed = req->param2;
+        bus_config[req->param1].canfd_enabled = (req->param2 >= bus_config[req->param1].can_speed);
+        bus_config[req->param1].brs_enabled = (req->param2 > bus_config[req->param1].can_speed);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xfc: set CAN FD non-ISO mode
+    case 0xfc:
+      if (req->param1 < PANDA_CAN_CNT) {
+        bus_config[req->param1].canfd_non_iso = (req->param2 != 0U);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    default:
+      print("NO HANDLER ");
+      puth(req->request);
+      print("\n");
+      break;
+  }
+  return resp_len;
+}

artifacts/package_sources/panda/board/jungle/recover.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+import os
+import time
+import subprocess
+import argparse
+
+from panda import PandaJungle, PandaJungleDFU
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  parser = argparse.ArgumentParser()
+  parser.add_argument("--all", action="store_true", help="Recover all panda jungle devices")
+  args = parser.parse_args()
+
+  subprocess.check_call(f"scons -C {board_path}/.. -u -j$(nproc) .", shell=True)
+
+  serials = PandaJungle.list() if args.all else [None]
+  for s in serials:
+    with PandaJungle(serial=s) as p:
+      print(f"putting {p.get_usb_serial()} in DFU mode")
+      p.reset(enter_bootstub=True)
+      p.reset(enter_bootloader=True)
+
+  # wait for reset panda jungles to come back up
+  time.sleep(1)
+
+  dfu_serials = PandaJungleDFU.list()
+  print(f"found {len(dfu_serials)} panda jungle(s) in DFU - {dfu_serials}")
+  for s in dfu_serials:
+    print("flashing", s)
+    PandaJungleDFU(s).recover()
+  exit(1 if len(dfu_serials) == 0 else 0)

artifacts/package_sources/panda/board/jungle/scripts/can_health.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import time
+import re
+from panda import PandaJungle
+
+RED = '\033[91m'
+GREEN = '\033[92m'
+
+def colorize_errors(value):
+  if isinstance(value, str):
+    if re.search(r'(?i)No error', value):
+      return f'{GREEN}{value}\033[0m'
+    elif re.search(r'(?i)(?<!No error\s)(err|error)', value):
+      return f'{RED}{value}\033[0m'
+  return str(value)
+
+if __name__ == "__main__":
+  jungle = PandaJungle()
+
+  while True:
+    print(chr(27) + "[2J") # clear screen
+    print("Connected to " + ("internal panda" if jungle.is_internal() else "External panda") + f" id: {jungle.get_serial()[0]}: {jungle.get_version()}")
+    for bus in range(3):
+      print(f"\nBus {bus}:")
+      health = jungle.can_health(bus)
+      for key, value in health.items():
+        print(f"{key}: {colorize_errors(value)}  ", end=" ")
+    print()
+    time.sleep(1)

artifacts/package_sources/panda/board/jungle/scripts/can_printer.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python3
+import os
+import time
+from collections import defaultdict
+import binascii
+
+from panda import PandaJungle
+
+# fake
+def sec_since_boot():
+  return time.time()
+
+def can_printer():
+  p = PandaJungle()
+  print(f"Connected to: {p._serial}: {p.get_version()}")
+  time.sleep(1)
+
+  p.can_clear(0xFFFF)
+
+  start = sec_since_boot()
+  lp = sec_since_boot()
+  all_msgs = defaultdict(list)
+
+  canbus = os.getenv("CAN")
+  if canbus == "3":
+    p.set_obd(True)
+    canbus = "1"
+
+  while True:
+    can_recv = p.can_recv()
+    for addr, dat, bus in can_recv:
+      if canbus is None or str(bus) == canbus:
+        all_msgs[(addr, bus)].append((dat))
+
+    if sec_since_boot() - lp > 0.1:
+      dd = chr(27) + "[2J"
+      dd += "%5.2f\n" % (sec_since_boot() - start)
+      for (addr, bus), dat_log in sorted(all_msgs.items()):
+        dd += "%d: %s(%6d): %s\n" % (bus, "%04X(%4d)" % (addr, addr), len(dat_log), binascii.hexlify(dat_log[-1]).decode())
+      print(dd)
+      lp = sec_since_boot()
+
+if __name__ == "__main__":
+  can_printer()

artifacts/package_sources/panda/board/jungle/scripts/debug_console.py

@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+import os
+import sys
+import time
+
+from panda import PandaJungle
+
+setcolor = ["\033[1;32;40m", "\033[1;31;40m"]
+unsetcolor = "\033[00m"
+
+if __name__ == "__main__":
+  while True:
+    try:
+      claim = os.getenv("CLAIM") is not None
+
+      serials = PandaJungle.list()
+      if os.getenv("SERIAL"):
+        serials = [x for x in serials if x==os.getenv("SERIAL")]
+
+      panda_jungles = [PandaJungle(x, claim=claim) for x in serials]
+
+      if not len(panda_jungles):
+        sys.exit("no panda jungles found")
+
+      while True:
+        for i, panda_jungle in enumerate(panda_jungles):
+          while True:
+            ret = panda_jungle.debug_read()
+            if len(ret) > 0:
+              sys.stdout.write(setcolor[i] + ret.decode('ascii') + unsetcolor)
+              sys.stdout.flush()
+            else:
+              break
+          time.sleep(0.01)
+    except Exception as e:
+      print(e)
+      print("panda jungle disconnected!")
+      time.sleep(0.5)

artifacts/package_sources/panda/board/jungle/scripts/echo_loopback_test.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+import os
+import time
+import contextlib
+import random
+from termcolor import cprint
+
+from panda import PandaJungle
+
+# This script is intended to be used in conjunction with the echo.py test script from panda.
+# It sends messages on bus 0, 1, 2 and checks for a reversed response to be sent back.
+
+#################################################################
+############################# UTILS #############################
+#################################################################
+def print_colored(text, color):
+  cprint(text + " "*40, color, end="\r")
+
+def get_test_string():
+  return b"test"+os.urandom(4)
+
+#################################################################
+############################# TEST ##############################
+#################################################################
+
+def test_loopback():
+  for bus in range(3):
+    # Clear can
+    jungle.can_clear(bus)
+    # Send a random message
+    address = random.randint(1, 2000)
+    data = get_test_string()
+    jungle.can_send(address, data, bus)
+    time.sleep(0.1)
+
+    # Make sure it comes back reversed
+    incoming = jungle.can_recv()
+    found = False
+    for message in incoming:
+      incomingAddress, incomingData, incomingBus = message
+      if incomingAddress == address and incomingData == data[::-1] and incomingBus == bus:
+        found = True
+        break
+    if not found:
+      cprint("\nFAILED", "red")
+      raise AssertionError
+
+#################################################################
+############################# MAIN ##############################
+#################################################################
+jungle = None
+counter = 0
+
+if __name__ == "__main__":
+  # Connect to jungle silently
+  print_colored("Connecting to jungle", "blue")
+  with open(os.devnull, "w") as devnull:
+    with contextlib.redirect_stdout(devnull):
+      jungle = PandaJungle()
+  jungle.set_panda_power(True)
+  jungle.set_ignition(False)
+
+  # Run test
+  while True:
+    jungle.can_clear(0xFFFF)
+    test_loopback()
+    counter += 1
+    print_colored(str(counter) + " loopback cycles complete", "blue")

artifacts/package_sources/panda/board/jungle/scripts/get_version.py

@@ -0,0 +1,9 @@
+#!/usr/bin/env python3
+from panda import PandaJungle
+
+if __name__ == "__main__":
+  for p in PandaJungle.list():
+    pp = PandaJungle(p)
+    print(f"{pp.get_serial()[0]}: {pp.get_version()}")
+
+

artifacts/package_sources/panda/board/jungle/scripts/health_test.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+import time
+from pprint import pprint
+
+from panda import PandaJungle
+
+if __name__ == "__main__":
+  i = 0
+  pi = 0
+
+  pj = PandaJungle()
+  while True:
+    st = time.monotonic()
+    while time.monotonic() - st < 1:
+      pj.health()
+      pj.can_health(0)
+      i += 1
+    pprint(pj.health())
+    print(f"Speed: {i - pi}Hz")
+    pi = i
+

artifacts/package_sources/panda/board/jungle/scripts/loopback_test.py

@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+import os
+import time
+import contextlib
+import random
+from termcolor import cprint
+
+from iqdbc.car.structs import CarParams
+from panda import Panda, PandaJungle
+
+NUM_PANDAS_PER_TEST = 1
+FOR_RELEASE_BUILDS = os.getenv("RELEASE") is not None       # Release builds do not have ALLOUTPUT mode
+
+BUS_SPEEDS = [125, 500, 1000]
+
+#################################################################
+############################# UTILS #############################
+#################################################################
+# To suppress the connection text
+def silent_panda_connect(serial):
+  with open(os.devnull, "w") as devnull:
+    with contextlib.redirect_stdout(devnull):
+      panda = Panda(serial)
+  return panda
+
+def print_colored(text, color):
+  cprint(text + " "*40, color, end="\r")
+
+def connect_to_pandas():
+  print_colored("Connecting to pandas", "blue")
+  # Connect to pandas
+  pandas = []
+  for serial in panda_serials:
+    pandas.append(silent_panda_connect(serial))
+  print_colored("Connected", "blue")
+
+def start_with_orientation(orientation):
+  print_colored("Restarting pandas with orientation " + str(orientation), "blue")
+  jungle.set_panda_power(False)
+  jungle.set_harness_orientation(orientation)
+  time.sleep(4)
+  jungle.set_panda_power(True)
+  time.sleep(2)
+  connect_to_pandas()
+
+def can_loopback(sender):
+  receivers = list(filter((lambda p: (p != sender)), [jungle] + pandas))
+
+  for bus in range(4):
+    obd = False
+    if bus == 3:
+      obd = True
+      bus = 1
+
+    # Clear buses
+    for receiver in receivers:
+      receiver.set_obd(obd)
+      receiver.can_clear(bus)     # TX
+      receiver.can_clear(0xFFFF)  # RX
+
+    # Send a random string
+    addr = 0x18DB33F1 if FOR_RELEASE_BUILDS else random.randint(1, 2000)
+    string = b"test"+os.urandom(4)
+    sender.set_obd(obd)
+    time.sleep(0.2)
+    sender.can_send(addr, string, bus)
+    time.sleep(0.2)
+
+    # Check if all receivers have indeed received them in their receiving buffers
+    for receiver in receivers:
+      content = receiver.can_recv()
+
+      # Check amount of messages
+      if len(content) != 1:
+        raise Exception("Amount of received CAN messages (" + str(len(content)) + ") does not equal 1. Bus: " + str(bus) +" OBD: " + str(obd))
+
+      # Check content
+      if content[0][0] != addr or content[0][1] != string:
+        raise Exception("Received CAN message content or address does not match")
+
+      # Check bus
+      if content[0][2] != bus:
+        raise Exception("Received CAN message bus does not match")
+
+#################################################################
+############################# TEST ##############################
+#################################################################
+
+def test_loopback():
+  # disable safety modes
+  for panda in pandas:
+    panda.set_safety_mode(CarParams.SafetyModel.elm327 if FOR_RELEASE_BUILDS else CarParams.SafetyModel.allOutput)
+
+  # perform loopback with jungle as a sender
+  can_loopback(jungle)
+
+  # perform loopback with each possible panda as a sender
+  for panda in pandas:
+    can_loopback(panda)
+
+  # enable safety modes
+  for panda in pandas:
+    panda.set_safety_mode(CarParams.SafetyModel.silent)
+
+#################################################################
+############################# MAIN ##############################
+#################################################################
+jungle = None
+pandas = []  # type: ignore
+panda_serials = []
+counter = 0
+
+if __name__ == "__main__":
+  # Connect to jungle silently
+  print_colored("Connecting to jungle", "blue")
+  with open(os.devnull, "w") as devnull:
+    with contextlib.redirect_stdout(devnull):
+      jungle = PandaJungle()
+  jungle.set_panda_power(True)
+  jungle.set_ignition(False)
+
+  # Connect to <NUM_PANDAS_PER_TEST> new pandas before starting tests
+  print_colored("Waiting for " + str(NUM_PANDAS_PER_TEST) + " pandas to be connected", "yellow")
+  while True:
+    connected_serials = Panda.list()
+    if len(connected_serials) == NUM_PANDAS_PER_TEST:
+      panda_serials = connected_serials
+      break
+
+  start_with_orientation(PandaJungle.HARNESS_ORIENTATION_1)
+
+  # Set bus speeds
+  for device in pandas + [jungle]:
+    for bus in range(len(BUS_SPEEDS)):
+      device.set_can_speed_kbps(bus, BUS_SPEEDS[bus])
+
+  # Run test
+  while True:
+    test_loopback()
+    counter += 1
+    print_colored(str(counter) + " loopback cycles complete", "blue")

artifacts/package_sources/panda/board/jungle/scripts/spam_can.py

@@ -0,0 +1,21 @@
+#!/usr/bin/env python3
+import os
+import random
+from iqdbc.car.structs import CarParams
+from panda import PandaJungle
+
+def get_test_string():
+  return b"test" + os.urandom(10)
+
+if __name__ == "__main__":
+  p = PandaJungle()
+
+  p.set_safety_mode(CarParams.SafetyModel.allOutput)
+
+  print("Spamming all buses...")
+  while True:
+    at = random.randint(1, 2000)
+    st = get_test_string()[0:8]
+    bus = random.randint(0, 2)
+    p.can_send(at, st, bus)
+    # print("Sent message on bus: ", bus)

artifacts/package_sources/panda/board/jungle/scripts/start.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+import sys
+
+from panda import PandaJungle
+
+if __name__ == "__main__":
+  jungle = PandaJungle()
+
+  # If first argument specified, it sets the ignition (0 or 1)
+  if len(sys.argv) > 1:
+    if sys.argv[1] == '1':
+      jungle.set_ignition(True)
+    else:
+      jungle.set_ignition(False)
+  jungle.set_harness_orientation(1)
+  jungle.set_panda_power(True)
+
+

artifacts/package_sources/panda/board/jungle/stm32h7/board.h

@@ -0,0 +1,9 @@
+#include "board/jungle/boards/board_declarations.h"
+
+#include "board/stm32h7/lladc.h"
+#include "board/jungle/boards/board_v2.h"
+
+void detect_board_type(void) {
+  hw_type = HW_TYPE_V2;
+  current_board = &board_v2;
+}

artifacts/package_sources/panda/board/libc.h

@@ -0,0 +1,79 @@
+// **** libc ****
+
+__attribute__((aligned(32), noinline)) void delay(uint32_t a) {
+  // loop is 2.6x faster when 32-byte aligned (ART accelerator prefetches flash in 32-byte chunks)
+  volatile uint32_t i;
+  uint32_t n = a * 13U / 5U;
+  for (i = 0; i < n; i++) {}
+}
+
+void assert_fatal(bool condition, const char *msg) {
+  if (!condition) {
+    print("ASSERT FAILED\n");
+    print(msg);
+    while (1) {
+      // hang
+    }
+  }
+}
+
+// cppcheck-suppress misra-c2012-21.2
+void *memset(void *str, int c, unsigned int n) {
+  uint8_t *s = str;
+  for (unsigned int i = 0; i < n; i++) {
+    *s = c;
+    s++;
+  }
+  return str;
+}
+
+#define UNALIGNED(X, Y) \
+  (((uint32_t)(X) & (sizeof(uint32_t) - 1U)) | ((uint32_t)(Y) & (sizeof(uint32_t) - 1U)))
+
+// cppcheck-suppress misra-c2012-21.2
+void *memcpy(void *dest, const void *src, unsigned int len) {
+  unsigned int n = len;
+  uint8_t *d8 = dest;
+  const uint8_t *s8 = src;
+
+  if ((n >= 4U) && !UNALIGNED(s8, d8)) {
+    uint32_t *d32 = (uint32_t *)d8; // cppcheck-suppress misra-c2012-11.3 ; already checked that it's properly aligned
+    const uint32_t *s32 = (const uint32_t *)s8; // cppcheck-suppress misra-c2012-11.3 ; already checked that it's properly aligned
+
+    while(n >= 16U) {
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      n -= 16U;
+    }
+
+    while(n >= 4U) {
+      *d32 = *s32; d32++; s32++;
+      n -= 4U;
+    }
+
+    d8 = (uint8_t *)d32;
+    s8 = (const uint8_t *)s32;
+  }
+  while (n-- > 0U) {
+    *d8 = *s8; d8++; s8++;
+  }
+  return dest;
+}
+
+// cppcheck-suppress misra-c2012-21.2
+int memcmp(const void * ptr1, const void * ptr2, unsigned int num) {
+  int ret = 0;
+  const uint8_t *p1 = ptr1;
+  const uint8_t *p2 = ptr2;
+  for (unsigned int i = 0; i < num; i++) {
+    if (*p1 != *p2) {
+      ret = -1;
+      break;
+    }
+    p1++;
+    p2++;
+  }
+  return ret;
+}

artifacts/package_sources/panda/board/main.c

@@ -0,0 +1,407 @@
+// ********************* Includes *********************
+#include "board/config.h"
+
+#include "board/drivers/led.h"
+#include "board/drivers/pwm.h"
+#include "board/drivers/usb.h"
+#include "board/drivers/simple_watchdog.h"
+#include "board/drivers/bootkick.h"
+
+#include "board/early_init.h"
+#include "board/provision.h"
+
+#include "iqdbc/safety/safety.h"
+
+#include "board/health.h"
+
+#include "board/drivers/can_common.h"
+
+#ifdef STM32H7
+  #include "board/drivers/fdcan.h"
+#else
+  #include "board/drivers/bxcan.h"
+#endif
+
+#include "board/power_saving.h"
+
+#include "board/obj/gitversion.h"
+
+#include "board/can_comms.h"
+#include "board/main_comms.h"
+
+
+// ********************* Serial debugging ********************
+
+void debug_ring_callback(uart_ring *ring) {
+  char rcv;
+  while (get_char(ring, &rcv)) {
+    (void)put_char(ring, rcv);  // misra-c2012-17.7: cast to void is ok: debug function
+  }
+}
+
+// ****************************** safety mode ******************************
+
+// this is the only way to leave silent mode
+void set_safety_mode(uint16_t mode, uint16_t param) {
+  uint16_t mode_copy = mode;
+  int err = set_safety_hooks(mode_copy, param);
+  if (err == -1) {
+    print("Error: safety set mode failed. Falling back to SILENT\n");
+    mode_copy = SAFETY_SILENT;
+    err = set_safety_hooks(mode_copy, 0U);
+    // TERMINAL ERROR: we can't continue if SILENT safety mode isn't successfully set
+    assert_fatal(err == 0, "Error: Failed setting SILENT mode. Hanging\n");
+  }
+  safety_tx_blocked = 0;
+  safety_rx_invalid = 0;
+
+  switch (mode_copy) {
+    case SAFETY_SILENT:
+      set_intercept_relay(false, false);
+      current_board->set_can_mode(CAN_MODE_NORMAL);
+      can_silent = true;
+      break;
+    case SAFETY_NOOUTPUT:
+      set_intercept_relay(false, false);
+      current_board->set_can_mode(CAN_MODE_NORMAL);
+      can_silent = false;
+      break;
+    case SAFETY_ELM327:
+      set_intercept_relay(false, false);
+      heartbeat_counter = 0U;
+      heartbeat_lost = false;
+
+      // Clear any pending messages in the can core (i.e. sending while comma power is unplugged)
+      // TODO: rewrite using hardware queues rather than fifo to cancel specific messages
+      can_clear_send(CANIF_FROM_CAN_NUM(1), 1);
+      if (param == 0U) {
+        current_board->set_can_mode(CAN_MODE_OBD_CAN2);
+      } else {
+        current_board->set_can_mode(CAN_MODE_NORMAL);
+      }
+      can_silent = false;
+      break;
+    default:
+      set_intercept_relay(true, false);
+      heartbeat_counter = 0U;
+      heartbeat_lost = false;
+      current_board->set_can_mode(CAN_MODE_NORMAL);
+      can_silent = false;
+      break;
+  }
+  can_init_all();
+}
+
+bool is_car_safety_mode(uint16_t mode) {
+  return (mode != SAFETY_SILENT) &&
+         (mode != SAFETY_NOOUTPUT) &&
+         (mode != SAFETY_ALLOUTPUT) &&
+         (mode != SAFETY_ELM327);
+}
+
+// ***************************** main code *****************************
+
+// cppcheck-suppress unusedFunction ; used in headers not included in cppcheck
+// cppcheck-suppress misra-c2012-8.4
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+static void __attribute__ ((noinline)) enable_fpu(void) {
+  // enable the FPU
+  SCB->CPACR |= ((3UL << (10U * 2U)) | (3UL << (11U * 2U)));
+}
+
+// go into SILENT when heartbeat isn't received for this amount of seconds.
+#define HEARTBEAT_IGNITION_CNT_ON 5U
+#define HEARTBEAT_IGNITION_CNT_OFF 2U
+
+// called at 8Hz
+static volatile bool tick_sample_pending = false;
+
+// All runtime ADC sampling runs here, in thread context. ADC conversions
+// busy-wait for tens to hundreds of microseconds, and all interrupts share one
+// NVIC priority: sampling in the 8Hz tick interrupt delayed the SPI slave's
+// RX DMA re-arm long enough for the host to clock into an unarmed peripheral
+// (checksum failures -> NACK retry storms -> multi-second CAN blackouts).
+static void tick_sample_poll(void) {
+  if (tick_sample_pending) {
+    tick_sample_pending = false;
+    harness_tick();
+    voltage_mV = current_board->read_voltage_mV();
+    current_mA = current_board->read_current_mA();
+  }
+}
+
+static void tick_handler(void) {
+  static uint32_t siren_countdown = 0; // siren plays while countdown > 0
+  static uint32_t controls_allowed_countdown = 0;
+  static uint8_t prev_harness_status = HARNESS_STATUS_NC;
+  static uint8_t loop_counter = 0U;
+  static bool relay_malfunction_prev = false;
+
+  if (TICK_TIMER->SR != 0U) {
+
+    // siren
+    current_board->set_siren((loop_counter & 1U) && (siren_enabled || (siren_countdown > 0U)));
+
+    // tick drivers at 8Hz
+    fan_tick();
+    tick_sample_pending = true;  // ADC sampling deferred to thread context (see tick_sample_poll)
+    simple_watchdog_kick();
+    sound_tick();
+
+    if (relay_malfunction_prev != relay_malfunction) {
+      if (relay_malfunction) {
+        fault_occurred(FAULT_RELAY_MALFUNCTION);
+      } else {
+        fault_recovered(FAULT_RELAY_MALFUNCTION);
+      }
+    }
+    relay_malfunction_prev = relay_malfunction;
+
+    // re-init everything that uses harness status
+    if (harness.status != prev_harness_status) {
+      prev_harness_status = harness.status;
+      can_set_orientation(harness.status == HARNESS_STATUS_FLIPPED);
+
+      // re-init everything that uses harness status
+      can_init_all();
+      set_safety_mode(current_safety_mode, current_safety_param);
+      set_power_save_state(power_save_status);
+    }
+
+    // decimated to 1Hz
+    if (loop_counter == 0U) {
+      //puth(usart1_dma); print(" "); puth(DMA2_Stream5->M0AR); print(" "); puth(DMA2_Stream5->NDTR); print("\n");
+      #ifdef DEBUG
+        print("** blink ");
+        print("rx:"); puth4(can_rx_q.r_ptr); print("-"); puth4(can_rx_q.w_ptr); print("  ");
+        print("tx1:"); puth4(can_tx1_q.r_ptr); print("-"); puth4(can_tx1_q.w_ptr); print("  ");
+        print("tx2:"); puth4(can_tx2_q.r_ptr); print("-"); puth4(can_tx2_q.w_ptr); print("  ");
+        print("tx3:"); puth4(can_tx3_q.r_ptr); print("-"); puth4(can_tx3_q.w_ptr); print("\n");
+      #endif
+
+      // set green LED to be controls allowed.
+      led_set(LED_GREEN, controls_allowed);
+
+      // turn off the blue LED, turned on by CAN
+      // unless we are in power saving mode
+      led_set(LED_BLUE, (uptime_cnt & 1U) && (power_save_status == POWER_SAVE_STATUS_ENABLED));
+
+      const bool recent_heartbeat = heartbeat_counter == 0U;
+
+      // tick drivers at 1Hz
+      bool started = harness_check_ignition() || ignition_can;
+      bootkick_tick(started, recent_heartbeat);
+
+      // increase heartbeat counter and cap it at the uint32 limit
+      if (heartbeat_counter < UINT32_MAX) {
+        heartbeat_counter += 1U;
+      }
+
+      // disabling heartbeat not allowed while in safety mode
+      if (is_car_safety_mode(current_safety_mode)) {
+        heartbeat_disabled = false;
+      }
+
+      if (siren_countdown > 0U) {
+        siren_countdown -= 1U;
+      }
+
+      if (controls_allowed || heartbeat_engaged) {
+        controls_allowed_countdown = 5U;
+      } else if (controls_allowed_countdown > 0U) {
+        controls_allowed_countdown -= 1U;
+      } else {
+
+      }
+
+      // exit controls allowed if unused by openpilot for a few seconds
+      if (controls_allowed && !heartbeat_engaged) {
+        heartbeat_engaged_mismatches += 1U;
+        if (heartbeat_engaged_mismatches >= 3U) {
+          controls_allowed = false;
+        }
+      } else {
+        heartbeat_engaged_mismatches = 0U;
+      }
+
+      aol_heartbeat_engaged_check();
+
+      if (!heartbeat_disabled) {
+        // if the heartbeat has been gone for a while, go to SILENT safety mode and enter power save
+        if (heartbeat_counter >= (started ? HEARTBEAT_IGNITION_CNT_ON : HEARTBEAT_IGNITION_CNT_OFF)) {
+          print("device hasn't sent a heartbeat for 0x");
+          puth(heartbeat_counter);
+          print(" seconds. Safety is set to SILENT mode.\n");
+
+          if (controls_allowed_countdown > 0U) {
+            siren_countdown = 3U;
+            controls_allowed_countdown = 0U;
+          }
+
+          // set flag to indicate the heartbeat was lost
+          if (is_car_safety_mode(current_safety_mode)) {
+            heartbeat_lost = true;
+          }
+
+          // clear heartbeat engaged state
+          heartbeat_engaged = false;
+
+          if (current_safety_mode != SAFETY_SILENT) {
+            set_safety_mode(SAFETY_SILENT, 0U);
+          }
+
+          if (power_save_status != POWER_SAVE_STATUS_ENABLED) {
+            set_power_save_state(POWER_SAVE_STATUS_ENABLED);
+          }
+
+          // Also disable IR when the heartbeat goes missing
+          current_board->set_ir_power(0U);
+
+          // Run fan when device is up but not talking to us.
+          // The bootloader enables the SOM GPIO on boot.
+          fan_set_power(current_board->read_som_gpio() ? 30U : 0U);
+        }
+      }
+
+      // check registers
+      check_registers();
+
+      // set ignition_can to false after 2s of no CAN seen
+      if (ignition_can_cnt > 2U) {
+        ignition_can = false;
+      }
+
+      // on to the next one
+      uptime_cnt += 1U;
+      safety_mode_cnt += 1U;
+      ignition_can_cnt += 1U;
+
+      // synchronous safety check
+      safety_tick(&current_safety_config);
+    }
+
+    loop_counter++;
+    loop_counter %= 8U;
+  }
+  TICK_TIMER->SR = 0;
+}
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  // shouldn't have interrupts here, but just in case
+  disable_interrupts();
+
+  // init early devices
+  clock_init();
+  peripherals_init();
+  detect_board_type();
+  led_init();
+  // red+green leds enabled until succesful USB/SPI init, as a debug indicator
+  led_set(LED_RED, true);
+  led_set(LED_GREEN, true);
+  adc_init(ADC1);
+
+  // print hello
+  print("\n\n\n************************ MAIN START ************************\n");
+
+  // check for non-supported board types
+  assert_fatal(hw_type != HW_TYPE_UNKNOWN, "Unsupported board type");
+
+  print("Config:\n");
+  print("  Board type: 0x"); puth(hw_type); print("\n");
+
+  // init board
+  current_board->init();
+  current_board->set_can_mode(CAN_MODE_NORMAL);
+  harness_init();
+
+  // seed the ADC caches before interrupts are live
+  voltage_mV = current_board->read_voltage_mV();
+  current_mA = current_board->read_current_mA();
+
+  // panda has an FPU, let's use it!
+  enable_fpu();
+
+  microsecond_timer_init();
+
+  current_board->set_siren(false);
+  if (current_board->has_fan) {
+    fan_init();
+  }
+
+  // init to SILENT and can silent
+  set_safety_mode(SAFETY_SILENT, 0U);
+
+  // enable CAN TXs
+  enable_can_transceivers(true);
+
+  // init watchdog for heartbeat loop, fed at 8Hz
+  simple_watchdog_init(FAULT_HEARTBEAT_LOOP_WATCHDOG, (3U * 1000000U / 8U));
+
+  // 8Hz timer
+  REGISTER_INTERRUPT(TICK_TIMER_IRQ, tick_handler, 10U, FAULT_INTERRUPT_RATE_TICK)
+  tick_timer_init();
+
+#ifdef DEBUG
+  print("DEBUG ENABLED\n");
+#endif
+  // enable USB (right before interrupts or enum can fail!)
+  usb_init();
+
+  if (current_board->has_spi) {
+    gpio_spi_init();
+    spi_init();
+  }
+
+  led_set(LED_RED, false);
+  led_set(LED_GREEN, false);
+  led_set(LED_BLUE, false);
+
+  print("**** INTERRUPTS ON ****\n");
+  enable_interrupts();
+
+  // LED should keep on blinking all the time
+  while (true) {
+    tick_sample_poll();
+    if (power_save_status == POWER_SAVE_STATUS_DISABLED) {
+      #ifdef DEBUG_FAULTS
+      if (fault_status == FAULT_STATUS_NONE) {
+      #endif
+        // useful for debugging, fade breaks = panda is overloaded
+        for (uint32_t fade = 0U; fade < MAX_LED_FADE; fade += 1U) {
+          led_set(LED_RED, true);
+          delay(fade >> 4);
+          led_set(LED_RED, false);
+          delay((MAX_LED_FADE - fade) >> 4);
+          tick_sample_poll();
+        }
+
+        for (uint32_t fade = MAX_LED_FADE; fade > 0U; fade -= 1U) {
+          led_set(LED_RED, true);
+          delay(fade >> 4);
+          led_set(LED_RED, false);
+          delay((MAX_LED_FADE - fade) >> 4);
+          tick_sample_poll();
+        }
+
+      #ifdef DEBUG_FAULTS
+      } else {
+          led_set(LED_RED, 1);
+          delay(512000U);
+          led_set(LED_RED, 0);
+          delay(512000U);
+        }
+      #endif
+    } else {
+      __WFI();
+      SCB->SCR &= ~SCB_SCR_SLEEPDEEP_Msk;
+    }
+  }
+
+  return 0;
+}

artifacts/package_sources/panda/board/main_comms.h

@@ -0,0 +1,343 @@
+extern int _app_start[0xc000]; // Only first 3 sectors of size 0x4000 are used
+
+// Prototypes
+void set_safety_mode(uint16_t mode, uint16_t param);
+bool is_car_safety_mode(uint16_t mode);
+
+static int get_health_pkt(void *dat) {
+  COMPILE_TIME_ASSERT(sizeof(struct health_t) <= USBPACKET_MAX_SIZE);
+  struct health_t * health = (struct health_t*)dat;
+
+  health->uptime_pkt = uptime_cnt;
+  // cached values sampled in thread context (see tick_sample_poll in main.c);
+  // reading the ADC here would busy-wait in interrupt context
+  health->voltage_pkt = voltage_mV;
+  health->current_pkt = current_mA;
+
+  // Toyota SecOC hybrids keep the harness ignition line live in every gear, so reporting it
+  // raw would mask the gear gated CAN ignition (Park would still read as ignition on). main.c
+  // deliberately keeps bootkicking off the raw line, so the device still wakes up in Park.
+  bool ignition_line = harness_check_ignition();
+  if (ignition_can_gates_line && !ignition_can) {
+    ignition_line = false;
+  }
+  health->ignition_line_pkt = ignition_line;
+  health->ignition_can_pkt = ignition_can;
+
+  health->controls_allowed_pkt = controls_allowed;
+  health->safety_tx_blocked_pkt = safety_tx_blocked;
+  health->safety_rx_invalid_pkt = safety_rx_invalid;
+  health->tx_buffer_overflow_pkt = tx_buffer_overflow;
+  health->rx_buffer_overflow_pkt = rx_buffer_overflow;
+  health->car_harness_status_pkt = harness.status;
+  health->safety_mode_pkt = (uint8_t)(current_safety_mode);
+  health->safety_param_pkt = current_safety_param;
+  health->alternative_experience_pkt = alternative_experience;
+  health->power_save_enabled_pkt = power_save_status == POWER_SAVE_STATUS_ENABLED;
+  health->heartbeat_lost_pkt = heartbeat_lost;
+  health->safety_rx_checks_invalid_pkt = safety_rx_checks_invalid;
+
+  #ifndef STM32F4
+    health->spi_error_count_pkt = spi_error_count;
+  #endif
+
+  health->fault_status_pkt = fault_status;
+  health->faults_pkt = faults;
+
+  health->interrupt_load_pkt = interrupt_load;
+
+  health->fan_power = fan_state.power;
+
+  health->sbu1_voltage_mV = harness.sbu1_voltage_mV;
+  health->sbu2_voltage_mV = harness.sbu2_voltage_mV;
+
+  health->som_reset_triggered = bootkick_reset_triggered;
+
+  return sizeof(*health);
+}
+
+// send on serial, first byte to select the ring
+void comms_endpoint2_write(const uint8_t *data, uint32_t len) {
+  uart_ring *ur = get_ring_by_number(data[0]);
+  if ((len != 0U) && (ur != NULL)) {
+    if ((data[0] < 2U) || (data[0] >= 4U)) {
+      for (uint32_t i = 1; i < len; i++) {
+        while (!put_char(ur, data[i])) {
+          // wait
+        }
+      }
+    }
+  }
+}
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  unsigned int resp_len = 0;
+  uart_ring *ur = NULL;
+  uint32_t time;
+
+#ifdef DEBUG_COMMS
+  print("raw control request: "); hexdump(req, sizeof(ControlPacket_t)); print("\n");
+  print("- request "); puth(req->request); print("\n");
+  print("- param1 "); puth(req->param1); print("\n");
+  print("- param2 "); puth(req->param2); print("\n");
+#endif
+
+  switch (req->request) {
+    // **** 0xa8: get microsecond timer
+    case 0xa8:
+      time = microsecond_timer_get();
+      resp[0] = (time & 0x000000FFU);
+      resp[1] = ((time & 0x0000FF00U) >> 8U);
+      resp[2] = ((time & 0x00FF0000U) >> 16U);
+      resp[3] = ((time & 0xFF000000U) >> 24U);
+      resp_len = 4U;
+      break;
+    // **** 0xb0: set IR power
+    case 0xb0:
+      current_board->set_ir_power(req->param1);
+      break;
+    // **** 0xb1: set fan power
+    case 0xb1:
+      fan_set_power(req->param1);
+      break;
+    // **** 0xb2: get fan rpm
+    case 0xb2:
+      resp[0] = (fan_state.rpm & 0x00FFU);
+      resp[1] = ((fan_state.rpm & 0xFF00U) >> 8U);
+      resp_len = 2;
+      break;
+    // **** 0xc0: reset communications state
+    case 0xc0:
+      comms_can_reset();
+      break;
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xc2: CAN health stats
+    case 0xc2:
+      COMPILE_TIME_ASSERT(sizeof(can_health_t) <= USBPACKET_MAX_SIZE);
+      if (req->param1 < 3U) {
+        update_can_health_pkt(req->param1, 0U);
+        can_health[req->param1].can_speed = (bus_config[req->param1].can_speed / 10U);
+        can_health[req->param1].can_data_speed = (bus_config[req->param1].can_data_speed / 10U);
+        can_health[req->param1].canfd_enabled = bus_config[req->param1].canfd_enabled;
+        can_health[req->param1].brs_enabled = bus_config[req->param1].brs_enabled;
+        can_health[req->param1].canfd_non_iso = bus_config[req->param1].canfd_non_iso;
+        resp_len = sizeof(can_health[req->param1]);
+        (void)memcpy(resp, (uint8_t*)(&can_health[req->param1]), resp_len);
+      }
+      break;
+    // **** 0xc3: fetch MCU UID
+    case 0xc3:
+      (void)memcpy(resp, ((uint8_t *)UID_BASE), 12);
+      resp_len = 12;
+      break;
+    // **** 0xc4: get interrupt call rate
+    case 0xc4:
+      if (req->param1 < NUM_INTERRUPTS) {
+        uint32_t load = interrupts[req->param1].call_rate;
+        resp[0] = (load & 0x000000FFU);
+        resp[1] = ((load & 0x0000FF00U) >> 8U);
+        resp[2] = ((load & 0x00FF0000U) >> 16U);
+        resp[3] = ((load & 0xFF000000U) >> 24U);
+        resp_len = 4U;
+      }
+      break;
+    // **** 0xc5: DEBUG: drive relay
+    case 0xc5:
+      set_intercept_relay((req->param1 & 0x1U), (req->param1 & 0x2U));
+      break;
+    // **** 0xc6: DEBUG: read SOM GPIO
+    case 0xc6:
+      resp[0] = current_board->read_som_gpio();
+      resp_len = 1;
+      break;
+    // **** 0xd0: fetch serial (aka the provisioned dongle ID)
+    case 0xd0:
+      // addresses are OTP
+      if (req->param1 == 1U) {
+        (void)memcpy(resp, (uint8_t *)DEVICE_SERIAL_NUMBER_ADDRESS, 0x10);
+        resp_len = 0x10;
+      } else {
+        get_provision_chunk(resp);
+        resp_len = PROVISION_CHUNK_LEN;
+      }
+      break;
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      // this allows reflashing of the bootstub
+      switch (req->param1) {
+        case 0:
+          // only allow bootloader entry on debug builds
+          #ifdef ALLOW_DEBUG
+            print("-> entering bootloader\n");
+            enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+            NVIC_SystemReset();
+          #endif
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        default:
+          print("Bootloader mode invalid\n");
+          break;
+      }
+      break;
+    // **** 0xd2: get health packet
+    case 0xd2:
+      resp_len = get_health_pkt(resp);
+      break;
+    // **** 0xd3: get first 64 bytes of signature
+    case 0xd3:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len], resp_len);
+      }
+      break;
+    // **** 0xd4: get second 64 bytes of signature
+    case 0xd4:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len + 64], resp_len);
+      }
+      break;
+    // **** 0xd6: get version
+    case 0xd6:
+      COMPILE_TIME_ASSERT(sizeof(gitversion) <= USBPACKET_MAX_SIZE);
+      (void)memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion) - 1U;
+      break;
+    // **** 0xd8: reset ST
+    case 0xd8:
+      NVIC_SystemReset();
+      break;
+    // **** 0xdb: set OBD CAN multiplexing mode
+    case 0xdb:
+      current_board->set_can_mode((req->param1 == 1U) ? CAN_MODE_OBD_CAN2 : CAN_MODE_NORMAL);
+      break;
+    // **** 0xdc: set safety mode
+    case 0xdc:
+      set_safety_mode(req->param1, (uint16_t)req->param2);
+      break;
+    // **** 0xdd: get healthpacket and CANPacket versions
+    case 0xdd:
+      resp[0] = HEALTH_PACKET_VERSION;
+      resp[1] = CAN_PACKET_VERSION;
+      resp[2] = CAN_HEALTH_PACKET_VERSION;
+      resp_len = 3;
+      break;
+    // **** 0xde: set can bitrate
+    case 0xde:
+      if ((req->param1 < PANDA_CAN_CNT) && is_speed_valid(req->param2, speeds, sizeof(speeds)/sizeof(speeds[0]))) {
+        bus_config[req->param1].can_speed = req->param2;
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xdf: set alternative experience
+    case 0xdf:
+      // you can only set this if you are in a non car safety mode
+      if (!is_car_safety_mode(current_safety_mode)) {
+        alternative_experience = req->param1;
+        current_safety_param_iq = req->param2;
+        aol_set_alternative_experience(&alternative_experience);
+      }
+      break;
+    // **** 0xe0: uart read
+    case 0xe0:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+
+      // read
+      uint16_t req_length = MIN(req->length, USBPACKET_MAX_SIZE);
+      while ((resp_len < req_length) &&
+                         get_char(ur, (char*)&resp[resp_len])) {
+        ++resp_len;
+      }
+      break;
+    // **** 0xe5: set CAN loopback (for testing)
+    case 0xe5:
+      can_loopback = req->param1 > 0U;
+      can_init_all();
+      break;
+    // **** 0xe6: set custom clock source period and pulse length
+    case 0xe6:
+      clock_source_set_timer_params(req->param1, req->param2);
+      break;
+    // **** 0xe7: set power save state
+    case 0xe7:
+      set_power_save_state(req->param1);
+      break;
+    // **** 0xe8: set can-fd auto swithing mode
+    case 0xe8:
+      bus_config[req->param1].canfd_auto = req->param2 > 0U;
+      break;
+    // **** 0xf1: Clear CAN ring buffer.
+    case 0xf1:
+      if (req->param1 == 0xFFFFU) {
+        print("Clearing CAN Rx queue\n");
+        can_clear(&can_rx_q);
+      } else if (req->param1 < PANDA_CAN_CNT) {
+        print("Clearing CAN Tx queue\n");
+        can_clear(can_queues[req->param1]);
+      } else {
+        print("Clearing CAN CAN ring buffer failed: wrong bus number\n");
+      }
+      break;
+    // **** 0xf3: Heartbeat. Resets heartbeat counter.
+    case 0xf3:
+      {
+        heartbeat_counter = 0U;
+        heartbeat_lost = false;
+        heartbeat_disabled = false;
+        heartbeat_engaged = (req->param1 == 1U);
+        heartbeat_engaged_aol = (req->param2 == 1U);  // AOL heartbeat engagement flag from IQ.Pilot heartbeat
+        break;
+      }
+    // **** 0xf6: set siren enabled
+    case 0xf6:
+      siren_enabled = (req->param1 != 0U);
+      break;
+    // **** 0xf8: disable heartbeat checks
+    case 0xf8:
+      if (!is_car_safety_mode(current_safety_mode)) {
+        heartbeat_disabled = true;
+      }
+      break;
+    // **** 0xf9: set CAN FD data bitrate
+    case 0xf9:
+      if ((req->param1 < PANDA_CAN_CNT) &&
+           is_speed_valid(req->param2, data_speeds, sizeof(data_speeds)/sizeof(data_speeds[0]))) {
+        bus_config[req->param1].can_data_speed = req->param2;
+        bus_config[req->param1].canfd_enabled = (req->param2 >= bus_config[req->param1].can_speed);
+        bus_config[req->param1].brs_enabled = (req->param2 > bus_config[req->param1].can_speed);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xfc: set CAN FD non-ISO mode
+    case 0xfc:
+      if (req->param1 < PANDA_CAN_CNT) {
+        bus_config[req->param1].canfd_non_iso = (req->param2 != 0U);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    default:
+      print("NO HANDLER ");
+      puth(req->request);
+      print("\n");
+      break;
+  }
+  return resp_len;
+}

artifacts/package_sources/panda/board/main_declarations.h

@@ -0,0 +1,26 @@
+#pragma once
+
+// ******************** Prototypes ********************
+void print(const char *a);
+void puth(unsigned int i);
+typedef struct board board;
+typedef struct harness_configuration harness_configuration;
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel);
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage);
+
+// ********************* Globals **********************
+extern uint8_t hw_type;
+extern board *current_board;
+extern uint32_t uptime_cnt;
+
+// ADC results, sampled in thread context (see tick_sample_poll in main.c)
+extern uint32_t voltage_mV;
+extern uint32_t current_mA;
+
+// heartbeat state
+extern uint32_t heartbeat_counter;
+extern bool heartbeat_lost;
+extern bool heartbeat_disabled;
+
+// siren state
+extern bool siren_enabled;

artifacts/package_sources/panda/board/main_definitions.h

@@ -0,0 +1,18 @@
+#include "main_declarations.h"
+
+// ********************* Globals **********************
+uint8_t hw_type = 0;
+board *current_board;
+uint32_t uptime_cnt = 0;
+
+// ADC results, sampled in thread context (see tick_sample_poll in main.c)
+uint32_t voltage_mV = 0;
+uint32_t current_mA = 0;
+
+// heartbeat state
+uint32_t heartbeat_counter = 0;
+bool heartbeat_lost = false;
+bool heartbeat_disabled = false;            // set over USB
+
+// siren state
+bool siren_enabled = false;

artifacts/package_sources/panda/board/power_saving.h

@@ -0,0 +1,52 @@
+#include "power_saving_declarations.h"
+
+// WARNING: To stay in compliance with the SIL2 rules laid out in STM UM1840, we should never implement any of the available hardware low power modes.
+// See rule: CoU_3
+
+int power_save_status = POWER_SAVE_STATUS_DISABLED;
+
+void enable_can_transceivers(bool enabled) {
+  // Leave main CAN always on for CAN-based ignition detection
+  uint8_t main_bus = (harness.status == HARNESS_STATUS_FLIPPED) ? 3U : 1U;
+  for(uint8_t i=1U; i<=4U; i++){
+    current_board->enable_can_transceiver(i, (i == main_bus) || enabled);
+  }
+}
+
+void set_power_save_state(int state) {
+  bool is_valid_state = (state == POWER_SAVE_STATUS_ENABLED) || (state == POWER_SAVE_STATUS_DISABLED);
+  if (is_valid_state && (state != power_save_status)) {
+    bool enable = false;
+    if (state == POWER_SAVE_STATUS_ENABLED) {
+      print("enable power savings\n");
+
+      // Disable CAN interrupts
+      if (harness.status == HARNESS_STATUS_FLIPPED) {
+        llcan_irq_disable(cans[0]);
+      } else {
+        llcan_irq_disable(cans[2]);
+      }
+      llcan_irq_disable(cans[1]);
+    } else {
+      print("disable power savings\n");
+
+      if (harness.status == HARNESS_STATUS_FLIPPED) {
+        llcan_irq_enable(cans[0]);
+      } else {
+        llcan_irq_enable(cans[2]);
+      }
+      llcan_irq_enable(cans[1]);
+
+      enable = true;
+    }
+
+    enable_can_transceivers(enable);
+
+    // Switch off IR when in power saving
+    if(!enable){
+      current_board->set_ir_power(0U);
+    }
+
+    power_save_status = state;
+  }
+}

artifacts/package_sources/panda/board/power_saving_declarations.h

@@ -0,0 +1,11 @@
+#pragma once
+
+// WARNING: To stay in compliance with the SIL2 rules laid out in STM UM1840, we should never implement any of the available hardware low power modes.
+// See rule: CoU_3
+
+#define POWER_SAVE_STATUS_DISABLED 0
+#define POWER_SAVE_STATUS_ENABLED 1
+
+extern int power_save_status;
+
+void set_power_save_state(int state);

artifacts/package_sources/panda/board/provision.h

@@ -0,0 +1,13 @@
+// this is where we manage the dongle ID assigned during our
+// manufacturing. aside from this, there's a UID for the MCU
+
+#define PROVISION_CHUNK_LEN 0x20
+
+void get_provision_chunk(uint8_t *resp) {
+  const unsigned char unprovisioned_text[] = "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff";
+
+  (void)memcpy(resp, (uint8_t *)PROVISION_CHUNK_ADDRESS, PROVISION_CHUNK_LEN);
+  if (memcmp(resp, unprovisioned_text, 0x20) == 0) {
+    (void)memcpy(resp, "unprovisioned\x00\x00\x00testing123\x00\x00\xa3\xa6\x99\xec", 0x20);
+  }
+}

artifacts/package_sources/panda/board/recover.py

@@ -0,0 +1,27 @@
+#!/usr/bin/env python3
+import os
+import time
+import subprocess
+
+from panda import Panda, PandaDFU
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  subprocess.check_call(f"scons -C {board_path}/.. -j$(nproc) {board_path}", shell=True)
+
+  for s in Panda.list():
+    with Panda(serial=s) as p:
+      print(f"putting {p.get_usb_serial()} in DFU mode")
+      p.reset(enter_bootstub=True)
+      p.reset(enter_bootloader=True)
+
+  # wait for reset pandas to come back up
+  time.sleep(1)
+
+  dfu_serials = PandaDFU.list()
+  print(f"found {len(dfu_serials)} panda(s) in DFU - {dfu_serials}")
+  for s in dfu_serials:
+    print("flashing", s)
+    PandaDFU(s).recover()
+  exit(1 if len(dfu_serials) == 0 else 0)

artifacts/package_sources/panda/board/stm32f4/board.h

@@ -0,0 +1,28 @@
+// ///////////////////////////////////////////////////////////// //
+// Hardware abstraction layer for all different supported boards //
+// ///////////////////////////////////////////////////////////// //
+#include "board/boards/board_declarations.h"
+#include "board/boards/unused_funcs.h"
+
+// ///// Board definition and detection ///// //
+#include "board/stm32f4/lladc.h"
+#include "board/drivers/harness.h"
+#include "board/drivers/fan.h"
+#include "board/stm32f4/llfan.h"
+#include "board/drivers/clock_source.h"
+#include "board/boards/dos.h"
+
+void detect_board_type(void) {
+  set_gpio_output(GPIOC, 14, 1);
+  set_gpio_output(GPIOC, 5, 1);
+  if (!detect_with_pull(GPIOB, 1, PULL_UP) && !detect_with_pull(GPIOB, 7, PULL_UP)) {
+    hw_type = HW_TYPE_DOS;
+    current_board = &board_dos;
+  } else if (!detect_with_pull(GPIOB, 15, PULL_UP)) {
+    hw_type = HW_TYPE_DOS;
+    current_board = &board_dos;
+  }
+
+  // Return A13 to the alt mode to fix SWD
+  set_gpio_alternate(GPIOA, 13, GPIO_AF0_SWJ);
+}