IQ.Pilot Release Commit @ 0798119

panda/board/drivers/interrupts.h

@@ -74,6 +74,10 @@ void init_interrupts(bool check_rate_limit){
 
   for(uint16_t i=0U; i<NUM_INTERRUPTS; i++){
     interrupts[i].handler = unused_interrupt_handler;
+    // Default priority, lowered so the comms link can preempt everything else and
+    // re-arm its DMA (see IRQ_PRIORITY_COMMS). Shared state is guarded by
+    // ENTER_CRITICAL, which masks all interrupts regardless of priority.
+    NVIC_SetPriority((IRQn_Type)i, IRQ_PRIORITY_DEFAULT);
   }
 
   // Init interrupt timer for a 1s interval

panda/board/drivers/interrupts_declarations.h

@@ -1,5 +1,12 @@
 #pragma once
 
+// The SPI slave must re-arm its RX DMA at every protocol turnaround before the
+// master clocks the next phase. Without preemption that re-arm waits behind any
+// in-flight handler (CAN RX under bus load), the master clocks into an unarmed
+// peripheral, and the transfer fails its checksum -> NACK retry storms.
+#define IRQ_PRIORITY_COMMS 0U
+#define IRQ_PRIORITY_DEFAULT 2U
+
 typedef struct interrupt {
   IRQn_Type irq_type;
   void (*handler)(void);

panda/board/stm32h7/llspi.h

@@ -101,6 +101,12 @@ void llspi_init(void) {
   register_set(&(SPI4->CR1), SPI_CR1_SPE, 0xFFFFU);
   register_set(&(SPI4->CR2), 0, 0xFFFFU);
 
+  // preempt other handlers so the RX DMA is re-armed before the master clocks
+  // the next phase of a transfer
+  NVIC_SetPriority(DMA2_Stream2_IRQn, IRQ_PRIORITY_COMMS);
+  NVIC_SetPriority(DMA2_Stream3_IRQn, IRQ_PRIORITY_COMMS);
+  NVIC_SetPriority(SPI4_IRQn, IRQ_PRIORITY_COMMS);
+
   NVIC_EnableIRQ(DMA2_Stream2_IRQn);
   NVIC_EnableIRQ(DMA2_Stream3_IRQn);
   NVIC_EnableIRQ(SPI4_IRQn);