openpilot v0.9.4 release

date: 2023-07-27T18:38:32
master commit: fa310d9e25

panda/.gitignore

@@ -0,0 +1,24 @@
+*.tmp
+*.pyc
+.*.swp
+.*.swo
+*.o
+*.so
+*.os
+*.d
+*.dump
+a.out
+*~
+.#*
+dist/
+pandacan.egg-info/
+board/obj/
+examples/output.csv
+.DS_Store
+.vscode*
+nosetests.xml
+.mypy_cache/
+.sconsign.dblite
+
+# CTU info files generated by Cppcheck
+*.*.ctu-info

panda/SConscript

@@ -0,0 +1,6 @@
+# panda fw
+SConscript('board/SConscript')
+
+# test files
+if GetOption('test'):
+  SConscript('tests/libpanda/SConscript')

panda/__init__.py

@@ -0,0 +1,6 @@
+from .python.constants import McuType, BASEDIR, FW_PATH, USBPACKET_MAX_SIZE  # noqa: F401
+from .python.spi import PandaSpiException, PandaProtocolMismatch  # noqa: F401
+from .python.serial import PandaSerial  # noqa: F401
+from .python import (Panda, PandaDFU, # noqa: F401
+                     pack_can_buffer, unpack_can_buffer, calculate_checksum, unpack_log,
+                     DLC_TO_LEN, LEN_TO_DLC, ALTERNATIVE_EXPERIENCE, CANPACKET_HEAD_SIZE)

panda/board/README.md

@@ -0,0 +1,20 @@
+Programming
+----
+
+**Panda**
+
+```
+./flash.py        # flash application
+./recover.py      # flash bootstub
+```
+
+Troubleshooting
+----
+
+If your panda will not flash and green LED is on, use `recover.py`.
+If panda is blinking fast with green LED, use `flash.py`.
+
+Otherwise if LED is off and panda can't be seen with `lsusb` command, use [panda paw](https://comma.ai/shop/products/panda-paw) to go into DFU mode.
+
+
+If your device has an internal panda and none of the above works, try running `../tests/reflash_internal_panda.py`.

panda/board/SConscript

@@ -0,0 +1,194 @@
+import os
+import copy
+import subprocess
+
+PREFIX = "arm-none-eabi-"
+BUILDER = "DEV"
+
+common_flags = []
+build_projects = {}
+
+build_projects["pedal"] = {
+  "MAIN": "pedal/main.c",
+  "STARTUP_FILE": "stm32fx/startup_stm32f205xx.s",
+  "LINKER_SCRIPT": "stm32fx/stm32f2_flash.ld",
+  "APP_START_ADDRESS": "0x8004000",
+  "PROJECT_FLAGS": [
+    "-mcpu=cortex-m3",
+    "-msoft-float",
+    "-DSTM32F2",
+    "-DSTM32F205xx",
+    "-O2",
+    "-DPEDAL",
+  ],
+}
+
+build_projects["pedal_usb"] = copy.deepcopy(build_projects["pedal"])
+build_projects["pedal_usb"]["PROJECT_FLAGS"].append("-DPEDAL_USB")
+
+build_projects["panda"] = {
+  "MAIN": "main.c",
+  "STARTUP_FILE": "stm32fx/startup_stm32f413xx.s",
+  "LINKER_SCRIPT": "stm32fx/stm32f4_flash.ld",
+  "APP_START_ADDRESS": "0x8004000",
+  "PROJECT_FLAGS": [
+    "-mcpu=cortex-m4",
+    "-mhard-float",
+    "-DSTM32F4",
+    "-DSTM32F413xx",
+    "-mfpu=fpv4-sp-d16",
+    "-fsingle-precision-constant",
+    "-Os",
+    "-g",
+    "-DPANDA",
+  ],
+}
+
+build_projects["panda_h7"] = {
+  "MAIN": "main.c",
+  "STARTUP_FILE": "stm32h7/startup_stm32h7x5xx.s",
+  "LINKER_SCRIPT": "stm32h7/stm32h7x5_flash.ld",
+  "APP_START_ADDRESS": "0x8020000",
+  "PROJECT_FLAGS": [
+    "-mcpu=cortex-m7",
+    "-mhard-float",
+    "-DSTM32H7",
+    "-DSTM32H725xx",
+    "-mfpu=fpv5-d16",
+    "-fsingle-precision-constant",
+    "-Os",
+    "-g",
+    "-DPANDA",
+  ],
+}
+
+if os.getenv("RELEASE"):
+  BUILD_TYPE = "RELEASE"
+  cert_fn = os.getenv("CERT")
+  assert cert_fn is not None, 'No certificate file specified. Please set CERT env variable'
+  assert os.path.exists(cert_fn), 'Certificate file not found. Please specify absolute path'
+else:
+  BUILD_TYPE = "DEBUG"
+  cert_fn = File("../certs/debug").srcnode().abspath
+  common_flags += ["-DALLOW_DEBUG"]
+
+if os.getenv("DEBUG"):
+  common_flags += ["-DDEBUG"]
+
+includes = [
+  "stm32fx/inc",
+  "stm32h7/inc",
+  "..",
+  ".",
+]
+
+def get_version(builder, build_type):
+  try:
+    git = subprocess.check_output(["git", "rev-parse", "--short=8", "HEAD"], encoding='utf8').strip()
+  except subprocess.CalledProcessError:
+    git = "unknown"
+  return f"{builder}-{git}-{build_type}"
+
+
+def to_c_uint32(x):
+  nums = []
+  for _ in range(0x20):
+    nums.append(x % (2**32))
+    x //= (2**32)
+  return "{" + 'U,'.join(map(str, nums)) + "U}"
+
+
+def get_key_header(name):
+  from Crypto.PublicKey import RSA
+
+  public_fn = File(f'../certs/{name}.pub').srcnode().abspath
+  with open(public_fn) as f:
+    rsa = RSA.importKey(f.read())
+  assert(rsa.size_in_bits() == 1024)
+
+  rr = pow(2**1024, 2, rsa.n)
+  n0inv = 2**32 - pow(rsa.n, -1, 2**32)
+
+  r = [
+    f"RSAPublicKey {name}_rsa_key = {{",
+    f"  .len = 0x20,",
+    f"  .n0inv = {n0inv}U,",
+    f"  .n = {to_c_uint32(rsa.n)},",
+    f"  .rr = {to_c_uint32(rr)},",
+    f"  .exponent = {rsa.e},",
+    f"}};",
+  ]
+  return r
+
+def objcopy(source, target, env, for_signature):
+    return '$OBJCOPY -O binary %s %s' % (source[0], target[0])
+
+# Common autogenerated includes
+with open("obj/gitversion.h", "w") as f:
+  f.write(f'const uint8_t gitversion[] = "{get_version(BUILDER, BUILD_TYPE)}";\n')
+
+with open("obj/version", "w") as f:
+  f.write(f'{get_version(BUILDER, BUILD_TYPE)}')
+
+certs = [get_key_header(n) for n in ["debug", "release"]]
+with open("obj/cert.h", "w") as f:
+  for cert in certs:
+    f.write("\n".join(cert) + "\n")
+
+
+for project_name in build_projects:
+  project = build_projects[project_name]
+  linkerscript_fn = File(project["LINKER_SCRIPT"]).srcnode().abspath
+
+  flags = [
+    "-Wall",
+    "-Wextra",
+    "-Wstrict-prototypes",
+    "-Werror",
+    "-mlittle-endian",
+    "-mthumb",
+    "-nostdlib",
+    "-fno-builtin",
+    f"-T{linkerscript_fn}",
+    "-std=gnu11",
+  ] + project["PROJECT_FLAGS"] + common_flags
+
+  if ("ENABLE_SPI" in os.environ or "h7" in project_name) and not project_name.startswith('pedal'):
+    flags.append('-DENABLE_SPI')
+
+  project_env = Environment(
+    ENV=os.environ,
+    CC=PREFIX + 'gcc',
+    AS=PREFIX + 'gcc',
+    OBJCOPY=PREFIX + 'objcopy',
+    OBJDUMP=PREFIX + 'objdump',
+    ASCOM="$AS $ASFLAGS -o $TARGET -c $SOURCES",
+    CFLAGS=flags,
+    ASFLAGS=flags,
+    LINKFLAGS=flags,
+    CPPPATH=includes,
+    BUILDERS={
+      'Objcopy': Builder(generator=objcopy, suffix='.bin', src_suffix='.elf')
+    }
+  )
+
+  startup = project_env.Object(f"obj/startup_{project_name}", project["STARTUP_FILE"])
+
+  # Bootstub
+  crypto_obj = [
+    project_env.Object(f"rsa-{project_name}", "../crypto/rsa.c"),
+    project_env.Object(f"sha-{project_name}", "../crypto/sha.c")
+  ]
+  bootstub_obj = project_env.Object(f"bootstub-{project_name}", "bootstub.c")
+  bootstub_elf = project_env.Program(f"obj/bootstub.{project_name}.elf", [startup] + crypto_obj + [bootstub_obj])
+  bootstub_bin = project_env.Objcopy(f"obj/bootstub.{project_name}.bin", bootstub_elf)
+
+  # Build main
+  main_obj = project_env.Object(f"main-{project_name}", project["MAIN"])
+  main_elf = project_env.Program(f"obj/{project_name}.elf", [startup, main_obj],
+    LINKFLAGS=[f"-Wl,--section-start,.isr_vector={project['APP_START_ADDRESS']}"] + flags)
+  main_bin = project_env.Objcopy(f"obj/{project_name}.bin", main_elf)
+
+  # Sign main
+  sign_py = File("../crypto/sign.py").srcnode().abspath
+  panda_bin_signed = project_env.Command(f"obj/{project_name}.bin.signed", main_bin, f"SETLEN=1 {sign_py} $SOURCE $TARGET {cert_fn}")

panda/board/boards/black.h

@@ -0,0 +1,210 @@
+// ///////////////////// //
+// Black Panda + Harness //
+// ///////////////////// //
+
+void black_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1U:
+      set_gpio_output(GPIOC, 1, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOC, 13, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOA, 0, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void black_enable_can_transceivers(bool enabled) {
+  for(uint8_t i=1U; i<=4U; i++){
+    // Leave main CAN always on for CAN-based ignition detection
+    if((harness.status == HARNESS_STATUS_FLIPPED) ? (i == 3U) : (i == 1U)){
+      black_enable_can_transceiver(i, true);
+    } else {
+      black_enable_can_transceiver(i, enabled);
+    }
+  }
+}
+
+void black_set_led(uint8_t color, bool enabled) {
+  switch (color){
+    case LED_RED:
+      set_gpio_output(GPIOC, 9, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOC, 7, !enabled);
+      break;
+    case LED_BLUE:
+      set_gpio_output(GPIOC, 6, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void black_set_gps_load_switch(bool enabled) {
+  set_gpio_output(GPIOC, 12, enabled);
+}
+
+void black_set_usb_load_switch(bool enabled) {
+  set_gpio_output(GPIOB, 1, !enabled);
+}
+
+void black_set_gps_mode(uint8_t mode) {
+  switch (mode) {
+    case GPS_DISABLED:
+      // GPS OFF
+      set_gpio_output(GPIOC, 12, 0);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    case GPS_ENABLED:
+      // GPS ON
+      set_gpio_output(GPIOC, 12, 1);
+      set_gpio_output(GPIOC, 5, 1);
+      break;
+    case GPS_BOOTMODE:
+      set_gpio_output(GPIOC, 12, 1);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    default:
+      print("Invalid GPS mode\n");
+      break;
+  }
+}
+
+void black_set_can_mode(uint8_t mode){
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable OBD mode
+        set_gpio_mode(GPIOB, 12, MODE_INPUT);
+        set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+        // B5,B6: normal CAN2 mode
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+      } else {
+        // B5,B6: disable normal CAN2 mode
+        set_gpio_mode(GPIOB, 5, MODE_INPUT);
+        set_gpio_mode(GPIOB, 6, MODE_INPUT);
+
+        // B12,B13: OBD mode
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_CAN2);
+      }
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+bool black_check_ignition(void){
+  // ignition is checked through harness
+  return harness_check_ignition();
+}
+
+void black_init(void) {
+  common_init_gpio();
+
+  // A8,A15: normal CAN3 mode
+  set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+  set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+
+  // C0: OBD_SBU1 (orientation detection)
+  // C3: OBD_SBU2 (orientation detection)
+  set_gpio_mode(GPIOC, 0, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 3, MODE_ANALOG);
+
+  // Set default state of GPS
+  current_board->set_gps_mode(GPS_ENABLED);
+
+  // C10: OBD_SBU1_RELAY (harness relay driving output)
+  // C11: OBD_SBU2_RELAY (harness relay driving output)
+  set_gpio_mode(GPIOC, 10, MODE_OUTPUT);
+  set_gpio_mode(GPIOC, 11, MODE_OUTPUT);
+  set_gpio_output_type(GPIOC, 10, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output_type(GPIOC, 11, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output(GPIOC, 10, 1);
+  set_gpio_output(GPIOC, 11, 1);
+
+  // Turn on GPS load switch.
+  black_set_gps_load_switch(true);
+
+  // Turn on USB load switch.
+  black_set_usb_load_switch(true);
+
+  // Initialize harness
+  harness_init();
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  black_enable_can_transceivers(true);
+
+  // Disable LEDs
+  black_set_led(LED_RED, false);
+  black_set_led(LED_GREEN, false);
+  black_set_led(LED_BLUE, false);
+
+  // Set normal CAN mode
+  black_set_can_mode(CAN_MODE_NORMAL);
+
+  // flip CAN0 and CAN2 if we are flipped
+  if (harness.status == HARNESS_STATUS_FLIPPED) {
+    can_flip_buses(0, 2);
+  }
+}
+
+const harness_configuration black_harness_config = {
+  .has_harness = true,
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOC,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 0,
+  .pin_SBU2 = 3,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_channel_SBU1 = 10,
+  .adc_channel_SBU2 = 13
+};
+
+const board board_black = {
+  .board_type = "Black",
+  .board_tick = unused_board_tick,
+  .harness_config = &black_harness_config,
+  .has_gps = true,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+  .has_spi = false,
+  .has_canfd = false,
+  .has_rtc_battery = false,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = black_init,
+  .enable_can_transceiver = black_enable_can_transceiver,
+  .enable_can_transceivers = black_enable_can_transceivers,
+  .set_led = black_set_led,
+  .set_gps_mode = black_set_gps_mode,
+  .set_can_mode = black_set_can_mode,
+  .check_ignition = black_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/board_declarations.h

@@ -0,0 +1,80 @@
+// ******************** Prototypes ********************
+typedef void (*board_init)(void);
+typedef void (*board_enable_can_transceiver)(uint8_t transceiver, bool enabled);
+typedef void (*board_enable_can_transceivers)(bool enabled);
+typedef void (*board_set_led)(uint8_t color, bool enabled);
+typedef void (*board_set_gps_mode)(uint8_t mode);
+typedef void (*board_set_can_mode)(uint8_t mode);
+typedef bool (*board_check_ignition)(void);
+typedef uint32_t (*board_read_current)(void);
+typedef void (*board_set_ir_power)(uint8_t percentage);
+typedef void (*board_set_fan_enabled)(bool enabled);
+typedef void (*board_set_phone_power)(bool enabled);
+typedef void (*board_set_siren)(bool enabled);
+typedef bool (*board_board_tick)(bool ignition, bool usb_enum, bool heartbeat_seen, bool harness_inserted);
+typedef bool (*board_read_som_gpio)(void);
+
+struct board {
+  const char *board_type;
+  const harness_configuration *harness_config;
+  const bool has_gps;
+  const bool has_hw_gmlan;
+  const bool has_obd;
+  const bool has_lin;
+  const bool has_spi;
+  const bool has_canfd;
+  const bool has_rtc_battery;
+  const uint16_t fan_max_rpm;
+  const uint16_t avdd_mV;
+  const bool fan_stall_recovery;
+  const uint8_t fan_enable_cooldown_time;
+  board_init init;
+  board_enable_can_transceiver enable_can_transceiver;
+  board_enable_can_transceivers enable_can_transceivers;
+  board_set_led set_led;
+  board_set_gps_mode set_gps_mode;
+  board_set_can_mode set_can_mode;
+  board_check_ignition check_ignition;
+  board_read_current read_current;
+  board_set_ir_power set_ir_power;
+  board_set_fan_enabled set_fan_enabled;
+  board_set_phone_power set_phone_power;
+  board_set_siren set_siren;
+  board_board_tick board_tick;
+  board_read_som_gpio read_som_gpio;
+};
+
+// ******************* Definitions ********************
+// These should match the enums in cereal/log.capnp and __init__.py
+#define HW_TYPE_UNKNOWN 0U
+#define HW_TYPE_WHITE_PANDA 1U
+#define HW_TYPE_GREY_PANDA 2U
+#define HW_TYPE_BLACK_PANDA 3U
+#define HW_TYPE_PEDAL 4U
+#define HW_TYPE_UNO 5U
+#define HW_TYPE_DOS 6U
+#define HW_TYPE_RED_PANDA 7U
+#define HW_TYPE_RED_PANDA_V2 8U
+#define HW_TYPE_TRES 9U
+
+// LED colors
+#define LED_RED 0U
+#define LED_GREEN 1U
+#define LED_BLUE 2U
+
+// USB power modes (from cereal.log.health)
+#define USB_POWER_NONE 0U
+#define USB_POWER_CLIENT 1U
+#define USB_POWER_CDP 2U
+#define USB_POWER_DCP 3U
+
+// GPS modes
+#define GPS_DISABLED 0U
+#define GPS_ENABLED 1U
+#define GPS_BOOTMODE 2U
+
+// CAN modes
+#define CAN_MODE_NORMAL 0U
+#define CAN_MODE_GMLAN_CAN2 1U
+#define CAN_MODE_GMLAN_CAN3 2U
+#define CAN_MODE_OBD_CAN2 3U

panda/board/boards/dos.h

@@ -0,0 +1,237 @@
+// ///////////// //
+// Dos + Harness //
+// ///////////// //
+
+void dos_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1U:
+      set_gpio_output(GPIOC, 1, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOC, 13, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOA, 0, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void dos_enable_can_transceivers(bool enabled) {
+  for(uint8_t i=1U; i<=4U; i++){
+    // Leave main CAN always on for CAN-based ignition detection
+    if((harness.status == HARNESS_STATUS_FLIPPED) ? (i == 3U) : (i == 1U)){
+      dos_enable_can_transceiver(i, true);
+    } else {
+      dos_enable_can_transceiver(i, enabled);
+    }
+  }
+}
+
+void dos_set_led(uint8_t color, bool enabled) {
+  switch (color){
+    case LED_RED:
+      set_gpio_output(GPIOC, 9, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOC, 7, !enabled);
+      break;
+    case LED_BLUE:
+      set_gpio_output(GPIOC, 6, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void dos_set_bootkick(bool enabled){
+  set_gpio_output(GPIOC, 4, !enabled);
+}
+
+bool dos_board_tick(bool ignition, bool usb_enum, bool heartbeat_seen, bool harness_inserted) {
+  bool ret = false;
+  if ((ignition && !usb_enum) || harness_inserted) {
+    // enable bootkick if ignition seen or if plugged into a harness
+    ret = true;
+    dos_set_bootkick(true);
+  } else if (heartbeat_seen) {
+    // disable once openpilot is up
+    dos_set_bootkick(false);
+  } else {
+
+  }
+  return ret;
+}
+
+void dos_set_can_mode(uint8_t mode){
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable OBD mode
+        set_gpio_mode(GPIOB, 12, MODE_INPUT);
+        set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+        // B5,B6: normal CAN2 mode
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+      } else {
+        // B5,B6: disable normal CAN2 mode
+        set_gpio_mode(GPIOB, 5, MODE_INPUT);
+        set_gpio_mode(GPIOB, 6, MODE_INPUT);
+
+        // B12,B13: OBD mode
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_CAN2);
+      }
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+bool dos_check_ignition(void){
+  // ignition is checked through harness
+  return harness_check_ignition();
+}
+
+void dos_set_usb_switch(bool phone){
+  set_gpio_output(GPIOB, 3, phone);
+}
+
+void dos_set_ir_power(uint8_t percentage){
+  pwm_set(TIM4, 2, percentage);
+}
+
+void dos_set_fan_enabled(bool enabled){
+  set_gpio_output(GPIOA, 1, enabled);
+}
+
+void dos_set_siren(bool enabled){
+  set_gpio_output(GPIOC, 12, enabled);
+}
+
+bool dos_read_som_gpio (void){
+  return (get_gpio_input(GPIOC, 2) != 0);
+}
+
+void dos_init(void) {
+  common_init_gpio();
+
+  // A8,A15: normal CAN3 mode
+  set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+  set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+
+  // C0: OBD_SBU1 (orientation detection)
+  // C3: OBD_SBU2 (orientation detection)
+  set_gpio_mode(GPIOC, 0, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 3, MODE_ANALOG);
+
+  // C10: OBD_SBU1_RELAY (harness relay driving output)
+  // C11: OBD_SBU2_RELAY (harness relay driving output)
+  set_gpio_mode(GPIOC, 10, MODE_OUTPUT);
+  set_gpio_mode(GPIOC, 11, MODE_OUTPUT);
+  set_gpio_output_type(GPIOC, 10, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output_type(GPIOC, 11, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output(GPIOC, 10, 1);
+  set_gpio_output(GPIOC, 11, 1);
+
+#ifdef ENABLE_SPI
+  // SPI init
+  gpio_spi_init();
+#endif
+
+  // C8: FAN PWM aka TIM3_CH3
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+
+  // C2: SOM GPIO used as input (fan control at boot)
+  set_gpio_mode(GPIOC, 2, MODE_INPUT);
+  set_gpio_pullup(GPIOC, 2, PULL_DOWN);
+
+  // Initialize IR PWM and set to 0%
+  set_gpio_alternate(GPIOB, 7, GPIO_AF2_TIM4);
+  pwm_init(TIM4, 2);
+  dos_set_ir_power(0U);
+
+  // Initialize harness
+  harness_init();
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  dos_enable_can_transceivers(true);
+
+  // Disable LEDs
+  dos_set_led(LED_RED, false);
+  dos_set_led(LED_GREEN, false);
+  dos_set_led(LED_BLUE, false);
+
+  // Bootkick
+  dos_set_bootkick(true);
+
+  // Set normal CAN mode
+  dos_set_can_mode(CAN_MODE_NORMAL);
+
+  // flip CAN0 and CAN2 if we are flipped
+  if (harness.status == HARNESS_STATUS_FLIPPED) {
+    can_flip_buses(0, 2);
+  }
+
+  // Init clock source (camera strobe) using PWM
+  clock_source_init();
+}
+
+const harness_configuration dos_harness_config = {
+  .has_harness = true,
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOC,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 0,
+  .pin_SBU2 = 3,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_channel_SBU1 = 10,
+  .adc_channel_SBU2 = 13
+};
+
+const board board_dos = {
+  .board_type = "Dos",
+  .board_tick = dos_board_tick,
+  .harness_config = &dos_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+#ifdef ENABLE_SPI
+  .has_spi = true,
+#else
+  .has_spi = false,
+#endif
+  .has_canfd = false,
+  .has_rtc_battery = true,
+  .fan_max_rpm = 6500U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = true,
+  .fan_enable_cooldown_time = 3U,
+  .init = dos_init,
+  .enable_can_transceiver = dos_enable_can_transceiver,
+  .enable_can_transceivers = dos_enable_can_transceivers,
+  .set_led = dos_set_led,
+  .set_gps_mode = unused_set_gps_mode,
+  .set_can_mode = dos_set_can_mode,
+  .check_ignition = dos_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = dos_set_fan_enabled,
+  .set_ir_power = dos_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = dos_set_siren,
+  .read_som_gpio = dos_read_som_gpio
+};

panda/board/boards/grey.h

@@ -0,0 +1,64 @@
+// ////////// //
+// Grey Panda //
+// ////////// //
+
+// Most hardware functionality is similar to white panda
+
+void grey_init(void) {
+  white_grey_common_init();
+
+  // Set default state of GPS
+  current_board->set_gps_mode(GPS_ENABLED);
+}
+
+void grey_set_gps_mode(uint8_t mode) {
+  switch (mode) {
+    case GPS_DISABLED:
+      // GPS OFF
+      set_gpio_output(GPIOC, 14, 0);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    case GPS_ENABLED:
+      // GPS ON
+      set_gpio_output(GPIOC, 14, 1);
+      set_gpio_output(GPIOC, 5, 1);
+      break;
+    case GPS_BOOTMODE:
+      set_gpio_output(GPIOC, 14, 1);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    default:
+      print("Invalid ESP/GPS mode\n");
+      break;
+  }
+}
+
+const board board_grey = {
+  .board_type = "Grey",
+  .board_tick = unused_board_tick,
+  .harness_config = &white_harness_config,
+  .has_gps = true,
+  .has_hw_gmlan = true,
+  .has_obd = false,
+  .has_lin = true,
+  .has_spi = false,
+  .has_canfd = false,
+  .has_rtc_battery = false,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = grey_init,
+  .enable_can_transceiver = white_enable_can_transceiver,
+  .enable_can_transceivers = white_enable_can_transceivers,
+  .set_led = white_set_led,
+  .set_gps_mode = grey_set_gps_mode,
+  .set_can_mode = white_set_can_mode,
+  .check_ignition = white_check_ignition,
+  .read_current = white_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/pedal.h

@@ -0,0 +1,102 @@
+// ///// //
+// Pedal //
+// ///// //
+
+void pedal_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1:
+      set_gpio_output(GPIOB, 3, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void pedal_enable_can_transceivers(bool enabled) {
+  pedal_enable_can_transceiver(1U, enabled);
+}
+
+void pedal_set_led(uint8_t color, bool enabled) {
+  switch (color){
+    case LED_RED:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOB, 11, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void pedal_set_gps_mode(uint8_t mode) {
+  UNUSED(mode);
+  print("Trying to set ESP/GPS mode on pedal. This is not supported.\n");
+}
+
+void pedal_set_can_mode(uint8_t mode){
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+bool pedal_check_ignition(void){
+  // not supported on pedal
+  return false;
+}
+
+void pedal_init(void) {
+  common_init_gpio();
+
+  // C0, C1: Throttle inputs
+  set_gpio_mode(GPIOC, 0, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 1, MODE_ANALOG);
+  // DAC outputs on A4 and A5
+  //   apparently they don't need GPIO setup
+
+  // Enable transceiver
+  pedal_enable_can_transceivers(true);
+
+  // Disable LEDs
+  pedal_set_led(LED_RED, false);
+  pedal_set_led(LED_GREEN, false);
+}
+
+const harness_configuration pedal_harness_config = {
+  .has_harness = false
+};
+
+const board board_pedal = {
+  .board_type = "Pedal",
+  .board_tick = unused_board_tick,
+  .harness_config = &pedal_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = false,
+  .has_obd = false,
+  .has_lin = false,
+  .has_spi = false,
+  .has_canfd = false,
+  .has_rtc_battery = false,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = pedal_init,
+  .enable_can_transceiver = pedal_enable_can_transceiver,
+  .enable_can_transceivers = pedal_enable_can_transceivers,
+  .set_led = pedal_set_led,
+  .set_gps_mode = pedal_set_gps_mode,
+  .set_can_mode = pedal_set_can_mode,
+  .check_ignition = pedal_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/red.h

@@ -0,0 +1,197 @@
+// ///////////////////// //
+// Red Panda + Harness //
+// ///////////////////// //
+
+void red_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver) {
+    case 1U:
+      set_gpio_output(GPIOG, 11, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 3, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOD, 7, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 4, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void red_enable_can_transceivers(bool enabled) {
+  uint8_t main_bus = (harness.status == HARNESS_STATUS_FLIPPED) ? 3U : 1U;
+  for (uint8_t i=1U; i<=4U; i++) {
+    // Leave main CAN always on for CAN-based ignition detection
+    if (i == main_bus) {
+      red_enable_can_transceiver(i, true);
+    } else {
+      red_enable_can_transceiver(i, enabled);
+    }
+  }
+}
+
+void red_set_led(uint8_t color, bool enabled) {
+  switch (color) {
+    case LED_RED:
+      set_gpio_output(GPIOE, 4, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOE, 3, !enabled);
+      break;
+    case LED_BLUE:
+      set_gpio_output(GPIOE, 2, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void red_set_can_mode(uint8_t mode) {
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable normal mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_mode(GPIOB, 12, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_mode(GPIOB, 13, MODE_ANALOG);
+
+        // B5,B6: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_FDCAN2);
+      } else {
+        // B5,B6: disable normal mode
+        set_gpio_pullup(GPIOB, 5, PULL_NONE);
+        set_gpio_mode(GPIOB, 5, MODE_ANALOG);
+
+        set_gpio_pullup(GPIOB, 6, PULL_NONE);
+        set_gpio_mode(GPIOB, 6, MODE_ANALOG);
+        // B12,B13: FDCAN2 mode
+        set_gpio_pullup(GPIOB, 12, PULL_NONE);
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_FDCAN2);
+
+        set_gpio_pullup(GPIOB, 13, PULL_NONE);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_FDCAN2);
+      }
+      break;
+    default:
+      break;
+  }
+}
+
+bool red_check_ignition(void) {
+  // ignition is checked through harness
+  return harness_check_ignition();
+}
+
+void red_init(void) {
+  common_init_gpio();
+
+  //C10,C11 : OBD_SBU1_RELAY, OBD_SBU2_RELAY
+  set_gpio_output_type(GPIOC, 10, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOC, 10, PULL_NONE);
+  set_gpio_mode(GPIOC, 10, MODE_OUTPUT);
+  set_gpio_output(GPIOC, 10, 1);
+
+  set_gpio_output_type(GPIOC, 11, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOC, 11, PULL_NONE);
+  set_gpio_mode(GPIOC, 11, MODE_OUTPUT);
+  set_gpio_output(GPIOC, 11, 1);
+
+  // G11,B3,D7,B4: transceiver enable
+  set_gpio_pullup(GPIOG, 11, PULL_NONE);
+  set_gpio_mode(GPIOG, 11, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 3, PULL_NONE);
+  set_gpio_mode(GPIOB, 3, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOD, 7, PULL_NONE);
+  set_gpio_mode(GPIOD, 7, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 4, PULL_NONE);
+  set_gpio_mode(GPIOB, 4, MODE_OUTPUT);
+
+  //B1: 5VOUT_S
+  set_gpio_pullup(GPIOB, 1, PULL_NONE);
+  set_gpio_mode(GPIOB, 1, MODE_ANALOG);
+
+  // B14: usb load switch, enabled by pull resistor on board, obsolete for red panda
+  set_gpio_output_type(GPIOB, 14, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOB, 14, PULL_UP);
+  set_gpio_mode(GPIOB, 14, MODE_OUTPUT);
+  set_gpio_output(GPIOB, 14, 1);
+
+  // Initialize harness
+  harness_init();
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  red_enable_can_transceivers(true);
+
+  // Disable LEDs
+  red_set_led(LED_RED, false);
+  red_set_led(LED_GREEN, false);
+  red_set_led(LED_BLUE, false);
+
+  // Set normal CAN mode
+  red_set_can_mode(CAN_MODE_NORMAL);
+
+  // flip CAN0 and CAN2 if we are flipped
+  if (harness.status == HARNESS_STATUS_FLIPPED) {
+    can_flip_buses(0, 2);
+  }
+}
+
+const harness_configuration red_harness_config = {
+  .has_harness = true,
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOA,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 4,
+  .pin_SBU2 = 1,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_channel_SBU1 = 4, //ADC12_INP4
+  .adc_channel_SBU2 = 17 //ADC1_INP17
+};
+
+const board board_red = {
+  .board_type = "Red",
+  .board_tick = unused_board_tick,
+  .harness_config = &red_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+  .has_spi = false,
+  .has_canfd = true,
+  .has_rtc_battery = false,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = red_init,
+  .enable_can_transceiver = red_enable_can_transceiver,
+  .enable_can_transceivers = red_enable_can_transceivers,
+  .set_led = red_set_led,
+  .set_gps_mode = unused_set_gps_mode,
+  .set_can_mode = red_set_can_mode,
+  .check_ignition = red_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/red_chiplet.h

@@ -0,0 +1,112 @@
+// ///////////////////// //
+// Red Panda chiplet + Harness //
+// ///////////////////// //
+
+// Most hardware functionality is similar to red panda
+
+void red_chiplet_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver) {
+    case 1U:
+      set_gpio_output(GPIOG, 11, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOD, 7, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 11, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void red_chiplet_enable_can_transceivers(bool enabled) {
+  uint8_t main_bus = (harness.status == HARNESS_STATUS_FLIPPED) ? 3U : 1U;
+  for (uint8_t i=1U; i<=4U; i++) {
+    // Leave main CAN always on for CAN-based ignition detection
+    if (i == main_bus) {
+      red_chiplet_enable_can_transceiver(i, true);
+    } else {
+      red_chiplet_enable_can_transceiver(i, enabled);
+    }
+  }
+}
+
+void red_chiplet_set_fan_or_usb_load_switch(bool enabled) {
+  set_gpio_output(GPIOD, 3, enabled);
+}
+
+void red_chiplet_init(void) {
+  common_init_gpio();
+
+  // A8, A3: OBD_SBU1_RELAY, OBD_SBU2_RELAY
+  set_gpio_output_type(GPIOA, 8, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOA, 8, PULL_NONE);
+  set_gpio_output(GPIOA, 8, 1);
+  set_gpio_mode(GPIOA, 8, MODE_OUTPUT);
+
+  set_gpio_output_type(GPIOA, 3, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_pullup(GPIOA, 3, PULL_NONE);
+  set_gpio_output(GPIOA, 3, 1);
+  set_gpio_mode(GPIOA, 3, MODE_OUTPUT);
+
+  // G11,B10,D7,B11: transceiver enable
+  set_gpio_pullup(GPIOG, 11, PULL_NONE);
+  set_gpio_mode(GPIOG, 11, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 10, PULL_NONE);
+  set_gpio_mode(GPIOB, 10, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOD, 7, PULL_NONE);
+  set_gpio_mode(GPIOD, 7, MODE_OUTPUT);
+
+  set_gpio_pullup(GPIOB, 11, PULL_NONE);
+  set_gpio_mode(GPIOB, 11, MODE_OUTPUT);
+
+  // D3: usb load switch
+  set_gpio_pullup(GPIOD, 3, PULL_NONE);
+  set_gpio_mode(GPIOD, 3, MODE_OUTPUT);
+
+  // B0: 5VOUT_S
+  set_gpio_pullup(GPIOB, 0, PULL_NONE);
+  set_gpio_mode(GPIOB, 0, MODE_ANALOG);
+
+  // Initialize harness
+  harness_init();
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  red_chiplet_enable_can_transceivers(true);
+
+  // Disable LEDs
+  red_set_led(LED_RED, false);
+  red_set_led(LED_GREEN, false);
+  red_set_led(LED_BLUE, false);
+
+  // Set normal CAN mode
+  red_set_can_mode(CAN_MODE_NORMAL);
+
+  // flip CAN0 and CAN2 if we are flipped
+  if (harness.status == HARNESS_STATUS_FLIPPED) {
+    can_flip_buses(0, 2);
+  }
+}
+
+const harness_configuration red_chiplet_harness_config = {
+  .has_harness = true,
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOA,
+  .GPIO_relay_SBU1 = GPIOA,
+  .GPIO_relay_SBU2 = GPIOA,
+  .pin_SBU1 = 4,
+  .pin_SBU2 = 1,
+  .pin_relay_SBU1 = 8,
+  .pin_relay_SBU2 = 3,
+  .adc_channel_SBU1 = 4, // ADC12_INP4
+  .adc_channel_SBU2 = 17 // ADC1_INP17
+};

panda/board/boards/red_v2.h

@@ -0,0 +1,41 @@
+// ///////////////////// //
+// Red Panda V2 with chiplet + Harness //
+// ///////////////////// //
+
+void red_panda_v2_init(void) {
+  // common chiplet init
+  red_chiplet_init();
+
+  // Turn on USB load switch
+  red_chiplet_set_fan_or_usb_load_switch(true);
+}
+
+const board board_red_v2 = {
+  .board_type = "Red_v2",
+  .board_tick = unused_board_tick,
+  .harness_config = &red_chiplet_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+  .has_spi = false,
+  .has_canfd = true,
+  .has_rtc_battery = true,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = red_panda_v2_init,
+  .enable_can_transceiver = red_chiplet_enable_can_transceiver,
+  .enable_can_transceivers = red_chiplet_enable_can_transceivers,
+  .set_led = red_set_led,
+  .set_gps_mode = unused_set_gps_mode,
+  .set_can_mode = red_set_can_mode,
+  .check_ignition = red_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/tres.h

@@ -0,0 +1,116 @@
+// /////////////////
+// Tres + Harness //
+// /////////////////
+
+bool tres_ir_enabled;
+bool tres_fan_enabled;
+void tres_update_fan_ir_power(void) {
+  red_chiplet_set_fan_or_usb_load_switch(tres_ir_enabled || tres_fan_enabled);
+}
+
+void tres_set_ir_power(uint8_t percentage){
+  tres_ir_enabled = (percentage > 0U);
+  tres_update_fan_ir_power();
+  pwm_set(TIM3, 4, percentage);
+}
+
+void tres_set_bootkick(bool enabled){
+  set_gpio_output(GPIOA, 0, !enabled);
+}
+
+bool tres_ignition_prev = false;
+bool tres_board_tick(bool ignition, bool usb_enum, bool heartbeat_seen, bool harness_inserted) {
+  UNUSED(usb_enum);
+  bool ret = false;
+  if ((ignition && !tres_ignition_prev) || harness_inserted) {
+    // enable bootkick on rising edge of ignition
+    ret = true;
+    tres_set_bootkick(true);
+  } else if (heartbeat_seen) {
+    // disable once openpilot is up
+    tres_set_bootkick(false);
+  } else {
+
+  }
+  tres_ignition_prev = ignition;
+  return ret;
+}
+
+void tres_set_fan_enabled(bool enabled) {
+  // NOTE: fan controller reset doesn't work on a tres if IR is enabled
+  tres_fan_enabled = enabled;
+  tres_update_fan_ir_power();
+}
+
+bool tres_read_som_gpio (void){
+  return (get_gpio_input(GPIOC, 2) != 0);
+}
+
+void tres_init(void) {
+  // Enable USB 3.3V LDO for USB block
+  register_set_bits(&(PWR->CR3), PWR_CR3_USBREGEN);
+  register_set_bits(&(PWR->CR3), PWR_CR3_USB33DEN);
+  while ((PWR->CR3 & PWR_CR3_USB33RDY) == 0);
+
+  red_chiplet_init();
+
+  // C2: SOM GPIO used as input (fan control at boot)
+  set_gpio_mode(GPIOC, 2, MODE_INPUT);
+  set_gpio_pullup(GPIOC, 2, PULL_DOWN);
+
+  tres_set_bootkick(true);
+
+  // SOM debugging UART
+  gpio_uart7_init();
+  uart_init(&uart_ring_som_debug, 115200);
+
+  // SPI init
+  gpio_spi_init();
+
+  // fan setup
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+
+  // Initialize IR PWM and set to 0%
+  set_gpio_alternate(GPIOC, 9, GPIO_AF2_TIM3);
+  pwm_init(TIM3, 4);
+  tres_set_ir_power(0U);
+
+  // Fake siren
+  set_gpio_alternate(GPIOC, 10, GPIO_AF4_I2C5);
+  set_gpio_alternate(GPIOC, 11, GPIO_AF4_I2C5);
+  register_set_bits(&(GPIOC->OTYPER), GPIO_OTYPER_OT10 | GPIO_OTYPER_OT11); // open drain
+  fake_siren_init();
+
+  // Clock source
+  clock_source_init();
+}
+
+const board board_tres = {
+  .board_type = "Tres",
+  .board_tick = tres_board_tick,
+  .harness_config = &red_chiplet_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+  .has_spi = true,
+  .has_canfd = true,
+  .has_rtc_battery = true,
+  .fan_max_rpm = 6600U,
+  .avdd_mV = 1800U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 3U,
+  .init = tres_init,
+  .enable_can_transceiver = red_chiplet_enable_can_transceiver,
+  .enable_can_transceivers = red_chiplet_enable_can_transceivers,
+  .set_led = red_set_led,
+  .set_gps_mode = unused_set_gps_mode,
+  .set_can_mode = red_set_can_mode,
+  .check_ignition = red_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = tres_set_fan_enabled,
+  .set_ir_power = tres_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = fake_siren_set,
+  .read_som_gpio = tres_read_som_gpio
+};

panda/board/boards/uno.h

@@ -0,0 +1,272 @@
+// ///////////// //
+// Uno + Harness //
+// ///////////// //
+#define BOOTKICK_TIME 3U
+uint8_t bootkick_timer = 0U;
+
+void uno_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1U:
+      set_gpio_output(GPIOC, 1, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOC, 13, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOA, 0, !enabled);
+      break;
+    case 4U:
+      set_gpio_output(GPIOB, 10, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void uno_enable_can_transceivers(bool enabled) {
+  for(uint8_t i=1U; i<=4U; i++){
+    // Leave main CAN always on for CAN-based ignition detection
+    if((harness.status == HARNESS_STATUS_FLIPPED) ? (i == 3U) : (i == 1U)){
+      uno_enable_can_transceiver(i, true);
+    } else {
+      uno_enable_can_transceiver(i, enabled);
+    }
+  }
+}
+
+void uno_set_led(uint8_t color, bool enabled) {
+  switch (color){
+    case LED_RED:
+      set_gpio_output(GPIOC, 9, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOC, 7, !enabled);
+      break;
+    case LED_BLUE:
+      set_gpio_output(GPIOC, 6, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void uno_set_gps_load_switch(bool enabled) {
+  set_gpio_output(GPIOC, 12, enabled);
+}
+
+void uno_set_bootkick(bool enabled){
+  if (enabled) {
+    set_gpio_output(GPIOB, 14, false);
+  } else {
+    // We want the pin to be floating, not forced high!
+    set_gpio_mode(GPIOB, 14, MODE_INPUT);
+  }
+}
+
+void uno_bootkick(void) {
+  bootkick_timer = BOOTKICK_TIME;
+  uno_set_bootkick(true);
+}
+
+void uno_set_phone_power(bool enabled){
+  set_gpio_output(GPIOB, 4, enabled);
+}
+
+void uno_set_gps_mode(uint8_t mode) {
+  switch (mode) {
+    case GPS_DISABLED:
+      // GPS OFF
+      set_gpio_output(GPIOB, 1, 0);
+      set_gpio_output(GPIOC, 5, 0);
+      uno_set_gps_load_switch(false);
+      break;
+    case GPS_ENABLED:
+      // GPS ON
+      set_gpio_output(GPIOB, 1, 1);
+      set_gpio_output(GPIOC, 5, 1);
+      uno_set_gps_load_switch(true);
+      break;
+    case GPS_BOOTMODE:
+      set_gpio_output(GPIOB, 1, 1);
+      set_gpio_output(GPIOC, 5, 0);
+      uno_set_gps_load_switch(true);
+      break;
+    default:
+      print("Invalid ESP/GPS mode\n");
+      break;
+  }
+}
+
+void uno_set_can_mode(uint8_t mode){
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+    case CAN_MODE_OBD_CAN2:
+      if ((bool)(mode == CAN_MODE_NORMAL) != (bool)(harness.status == HARNESS_STATUS_FLIPPED)) {
+        // B12,B13: disable OBD mode
+        set_gpio_mode(GPIOB, 12, MODE_INPUT);
+        set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+        // B5,B6: normal CAN2 mode
+        set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+      } else {
+        // B5,B6: disable normal CAN2 mode
+        set_gpio_mode(GPIOB, 5, MODE_INPUT);
+        set_gpio_mode(GPIOB, 6, MODE_INPUT);
+
+        // B12,B13: OBD mode
+        set_gpio_alternate(GPIOB, 12, GPIO_AF9_CAN2);
+        set_gpio_alternate(GPIOB, 13, GPIO_AF9_CAN2);
+      }
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+bool uno_board_tick(bool ignition, bool usb_enum, bool heartbeat_seen, bool harness_inserted) {
+  UNUSED(ignition);
+  UNUSED(usb_enum);
+  UNUSED(heartbeat_seen);
+  UNUSED(harness_inserted);
+  if (bootkick_timer != 0U) {
+    bootkick_timer--;
+  } else {
+    uno_set_bootkick(false);
+  }
+  return false;
+}
+
+bool uno_check_ignition(void){
+  // ignition is checked through harness
+  return harness_check_ignition();
+}
+
+void uno_set_usb_switch(bool phone){
+  set_gpio_output(GPIOB, 3, phone);
+}
+
+void uno_set_ir_power(uint8_t percentage){
+  pwm_set(TIM4, 2, percentage);
+}
+
+void uno_set_fan_enabled(bool enabled){
+  set_gpio_output(GPIOA, 1, enabled);
+}
+
+void uno_init(void) {
+  common_init_gpio();
+
+  // A8,A15: normal CAN3 mode
+  set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+  set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+
+  // C0: OBD_SBU1 (orientation detection)
+  // C3: OBD_SBU2 (orientation detection)
+  set_gpio_mode(GPIOC, 0, MODE_ANALOG);
+  set_gpio_mode(GPIOC, 3, MODE_ANALOG);
+
+  // Set default state of GPS
+  current_board->set_gps_mode(GPS_ENABLED);
+
+  // C10: OBD_SBU1_RELAY (harness relay driving output)
+  // C11: OBD_SBU2_RELAY (harness relay driving output)
+  set_gpio_mode(GPIOC, 10, MODE_OUTPUT);
+  set_gpio_mode(GPIOC, 11, MODE_OUTPUT);
+  set_gpio_output_type(GPIOC, 10, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output_type(GPIOC, 11, OUTPUT_TYPE_OPEN_DRAIN);
+  set_gpio_output(GPIOC, 10, 1);
+  set_gpio_output(GPIOC, 11, 1);
+
+  // C8: FAN PWM aka TIM3_CH3
+  set_gpio_alternate(GPIOC, 8, GPIO_AF2_TIM3);
+
+  // Turn on GPS load switch.
+  uno_set_gps_load_switch(true);
+
+  // Turn on phone regulator
+  uno_set_phone_power(true);
+
+  // Initialize IR PWM and set to 0%
+  set_gpio_alternate(GPIOB, 7, GPIO_AF2_TIM4);
+  pwm_init(TIM4, 2);
+  uno_set_ir_power(0U);
+
+  // Initialize harness
+  harness_init();
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  uno_enable_can_transceivers(true);
+
+  // Disable LEDs
+  uno_set_led(LED_RED, false);
+  uno_set_led(LED_GREEN, false);
+  uno_set_led(LED_BLUE, false);
+
+  // Set normal CAN mode
+  uno_set_can_mode(CAN_MODE_NORMAL);
+
+  // flip CAN0 and CAN2 if we are flipped
+  if (harness.status == HARNESS_STATUS_FLIPPED) {
+    can_flip_buses(0, 2);
+  }
+
+  // Switch to phone usb mode if harness connection is powered by less than 7V
+  if((adc_get_mV(ADCCHAN_VIN) * VIN_READOUT_DIVIDER) < 7000U){
+    uno_set_usb_switch(true);
+  } else {
+    uno_set_usb_switch(false);
+  }
+
+  // Bootkick phone
+  uno_bootkick();
+}
+
+const harness_configuration uno_harness_config = {
+  .has_harness = true,
+  .GPIO_SBU1 = GPIOC,
+  .GPIO_SBU2 = GPIOC,
+  .GPIO_relay_SBU1 = GPIOC,
+  .GPIO_relay_SBU2 = GPIOC,
+  .pin_SBU1 = 0,
+  .pin_SBU2 = 3,
+  .pin_relay_SBU1 = 10,
+  .pin_relay_SBU2 = 11,
+  .adc_channel_SBU1 = 10,
+  .adc_channel_SBU2 = 13
+};
+
+const board board_uno = {
+  .board_type = "Uno",
+  .board_tick = uno_board_tick,
+  .harness_config = &uno_harness_config,
+  .has_gps = true,
+  .has_hw_gmlan = false,
+  .has_obd = true,
+  .has_lin = false,
+  .has_spi = false,
+  .has_canfd = false,
+  .has_rtc_battery = true,
+  .fan_max_rpm = 5100U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = uno_init,
+  .enable_can_transceiver = uno_enable_can_transceiver,
+  .enable_can_transceivers = uno_enable_can_transceivers,
+  .set_led = uno_set_led,
+  .set_gps_mode = uno_set_gps_mode,
+  .set_can_mode = uno_set_can_mode,
+  .check_ignition = uno_check_ignition,
+  .read_current = unused_read_current,
+  .set_fan_enabled = uno_set_fan_enabled,
+  .set_ir_power = uno_set_ir_power,
+  .set_phone_power = uno_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/boards/unused_funcs.h

@@ -0,0 +1,35 @@
+void unused_set_gps_mode(uint8_t mode) {
+  UNUSED(mode);
+}
+
+void unused_set_ir_power(uint8_t percentage) {
+  UNUSED(percentage);
+}
+
+void unused_set_fan_enabled(bool enabled) {
+  UNUSED(enabled);
+}
+
+void unused_set_phone_power(bool enabled) {
+  UNUSED(enabled);
+}
+
+void unused_set_siren(bool enabled) {
+  UNUSED(enabled);
+}
+
+uint32_t unused_read_current(void) {
+  return 0U;
+}
+
+bool unused_board_tick(bool ignition, bool usb_enum, bool heartbeat_seen, bool harness_inserted) {
+  UNUSED(ignition);
+  UNUSED(usb_enum);
+  UNUSED(heartbeat_seen);
+  UNUSED(harness_inserted);
+  return false;
+}
+
+bool unused_read_som_gpio(void) {
+  return false;
+}

panda/board/boards/white.h

@@ -0,0 +1,266 @@
+// /////////// //
+// White Panda //
+// /////////// //
+
+void white_enable_can_transceiver(uint8_t transceiver, bool enabled) {
+  switch (transceiver){
+    case 1U:
+      set_gpio_output(GPIOC, 1, !enabled);
+      break;
+    case 2U:
+      set_gpio_output(GPIOC, 13, !enabled);
+      break;
+    case 3U:
+      set_gpio_output(GPIOA, 0, !enabled);
+      break;
+    default:
+      print("Invalid CAN transceiver ("); puth(transceiver); print("): enabling failed\n");
+      break;
+  }
+}
+
+void white_enable_can_transceivers(bool enabled) {
+  uint8_t t1 = enabled ? 1U : 2U;  // leave transceiver 1 enabled to detect CAN ignition
+  for(uint8_t i=t1; i<=3U; i++) {
+    white_enable_can_transceiver(i, enabled);
+  }
+}
+
+void white_set_led(uint8_t color, bool enabled) {
+  switch (color){
+    case LED_RED:
+      set_gpio_output(GPIOC, 9, !enabled);
+      break;
+     case LED_GREEN:
+      set_gpio_output(GPIOC, 7, !enabled);
+      break;
+    case LED_BLUE:
+      set_gpio_output(GPIOC, 6, !enabled);
+      break;
+    default:
+      break;
+  }
+}
+
+void white_set_usb_power_mode(uint8_t mode){
+  switch (mode) {
+    case USB_POWER_CLIENT:
+      // B2,A13: set client mode
+      set_gpio_output(GPIOB, 2, 0);
+      set_gpio_output(GPIOA, 13, 1);
+      break;
+    case USB_POWER_CDP:
+      // B2,A13: set CDP mode
+      set_gpio_output(GPIOB, 2, 1);
+      set_gpio_output(GPIOA, 13, 1);
+      break;
+    case USB_POWER_DCP:
+      // B2,A13: set DCP mode on the charger (breaks USB!)
+      set_gpio_output(GPIOB, 2, 0);
+      set_gpio_output(GPIOA, 13, 0);
+      break;
+    default:
+      print("Invalid usb power mode\n");
+      break;
+  }
+}
+
+void white_set_gps_mode(uint8_t mode) {
+  switch (mode) {
+    case GPS_DISABLED:
+      // ESP OFF
+      set_gpio_output(GPIOC, 14, 0);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    case GPS_BOOTMODE:
+      set_gpio_output(GPIOC, 14, 1);
+      set_gpio_output(GPIOC, 5, 0);
+      break;
+    default:
+      print("Invalid ESP/GPS mode\n");
+      break;
+  }
+}
+
+void white_set_can_mode(uint8_t mode){
+  switch (mode) {
+    case CAN_MODE_NORMAL:
+      // B12,B13: disable GMLAN mode
+      set_gpio_mode(GPIOB, 12, MODE_INPUT);
+      set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+      // B3,B4: disable GMLAN mode
+      set_gpio_mode(GPIOB, 3, MODE_INPUT);
+      set_gpio_mode(GPIOB, 4, MODE_INPUT);
+
+      // B5,B6: normal CAN2 mode
+      set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+      set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+
+      // A8,A15: normal CAN3 mode
+      set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+      set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+      break;
+    case CAN_MODE_GMLAN_CAN2:
+      // B5,B6: disable CAN2 mode
+      set_gpio_mode(GPIOB, 5, MODE_INPUT);
+      set_gpio_mode(GPIOB, 6, MODE_INPUT);
+
+      // B3,B4: disable GMLAN mode
+      set_gpio_mode(GPIOB, 3, MODE_INPUT);
+      set_gpio_mode(GPIOB, 4, MODE_INPUT);
+
+      // B12,B13: GMLAN mode
+      set_gpio_alternate(GPIOB, 12, GPIO_AF9_CAN2);
+      set_gpio_alternate(GPIOB, 13, GPIO_AF9_CAN2);
+
+      // A8,A15: normal CAN3 mode
+      set_gpio_alternate(GPIOA, 8, GPIO_AF11_CAN3);
+      set_gpio_alternate(GPIOA, 15, GPIO_AF11_CAN3);
+      break;
+    case CAN_MODE_GMLAN_CAN3:
+      // A8,A15: disable CAN3 mode
+      set_gpio_mode(GPIOA, 8, MODE_INPUT);
+      set_gpio_mode(GPIOA, 15, MODE_INPUT);
+
+      // B12,B13: disable GMLAN mode
+      set_gpio_mode(GPIOB, 12, MODE_INPUT);
+      set_gpio_mode(GPIOB, 13, MODE_INPUT);
+
+      // B3,B4: GMLAN mode
+      set_gpio_alternate(GPIOB, 3, GPIO_AF11_CAN3);
+      set_gpio_alternate(GPIOB, 4, GPIO_AF11_CAN3);
+
+      // B5,B6: normal CAN2 mode
+      set_gpio_alternate(GPIOB, 5, GPIO_AF9_CAN2);
+      set_gpio_alternate(GPIOB, 6, GPIO_AF9_CAN2);
+      break;
+    default:
+      print("Tried to set unsupported CAN mode: "); puth(mode); print("\n");
+      break;
+  }
+}
+
+uint32_t white_read_current(void){
+  return adc_get_raw(ADCCHAN_CURRENT);
+}
+
+bool white_check_ignition(void){
+  // ignition is on PA1
+  return !get_gpio_input(GPIOA, 1);
+}
+
+void white_grey_common_init(void) {
+  common_init_gpio();
+
+  // C3: current sense
+  set_gpio_mode(GPIOC, 3, MODE_ANALOG);
+
+  // A1: started_alt
+  set_gpio_pullup(GPIOA, 1, PULL_UP);
+
+  // A2, A3: USART 2 for debugging
+  set_gpio_alternate(GPIOA, 2, GPIO_AF7_USART2);
+  set_gpio_alternate(GPIOA, 3, GPIO_AF7_USART2);
+
+  // A4, A5, A6, A7: SPI
+  set_gpio_alternate(GPIOA, 4, GPIO_AF5_SPI1);
+  set_gpio_alternate(GPIOA, 5, GPIO_AF5_SPI1);
+  set_gpio_alternate(GPIOA, 6, GPIO_AF5_SPI1);
+  set_gpio_alternate(GPIOA, 7, GPIO_AF5_SPI1);
+
+  // B12: GMLAN, ignition sense, pull up
+  set_gpio_pullup(GPIOB, 12, PULL_UP);
+
+  /* GMLAN mode pins:
+      M0(B15)  M1(B14)  mode
+      =======================
+      0        0        sleep
+      1        0        100kbit
+      0        1        high voltage wakeup
+      1        1        33kbit (normal)
+  */
+  set_gpio_output(GPIOB, 14, 1);
+  set_gpio_output(GPIOB, 15, 1);
+
+  // B7: K-line enable
+  set_gpio_output(GPIOB, 7, 1);
+
+  // C12, D2: Setup K-line (UART5)
+  set_gpio_alternate(GPIOC, 12, GPIO_AF8_UART5);
+  set_gpio_alternate(GPIOD, 2, GPIO_AF8_UART5);
+  set_gpio_pullup(GPIOD, 2, PULL_UP);
+
+  // L-line enable
+  set_gpio_output(GPIOA, 14, 1);
+
+  // C10, C11: L-Line setup (USART3)
+  set_gpio_alternate(GPIOC, 10, GPIO_AF7_USART3);
+  set_gpio_alternate(GPIOC, 11, GPIO_AF7_USART3);
+  set_gpio_pullup(GPIOC, 11, PULL_UP);
+
+  // Initialize RTC
+  rtc_init();
+
+  // Enable CAN transceivers
+  white_enable_can_transceivers(true);
+
+  // Disable LEDs
+  white_set_led(LED_RED, false);
+  white_set_led(LED_GREEN, false);
+  white_set_led(LED_BLUE, false);
+
+  // Set normal CAN mode
+  white_set_can_mode(CAN_MODE_NORMAL);
+
+  // Init usb power mode
+  uint32_t voltage = adc_get_mV(ADCCHAN_VIN) * VIN_READOUT_DIVIDER;
+  // Init in CDP mode only if panda is powered by 12V.
+  // Otherwise a PC would not be able to flash a standalone panda
+  if (voltage > 8000U) {  // 8V threshold
+    white_set_usb_power_mode(USB_POWER_CDP);
+  } else {
+    white_set_usb_power_mode(USB_POWER_CLIENT);
+  }
+}
+
+void white_init(void) {
+  white_grey_common_init();
+
+  // Set ESP off by default
+  current_board->set_gps_mode(GPS_DISABLED);
+}
+
+const harness_configuration white_harness_config = {
+  .has_harness = false
+};
+
+const board board_white = {
+  .board_type = "White",
+  .board_tick = unused_board_tick,
+  .harness_config = &white_harness_config,
+  .has_gps = false,
+  .has_hw_gmlan = true,
+  .has_obd = false,
+  .has_lin = true,
+  .has_spi = false,
+  .has_canfd = false,
+  .has_rtc_battery = false,
+  .fan_max_rpm = 0U,
+  .avdd_mV = 3300U,
+  .fan_stall_recovery = false,
+  .fan_enable_cooldown_time = 0U,
+  .init = white_init,
+  .enable_can_transceiver = white_enable_can_transceiver,
+  .enable_can_transceivers = white_enable_can_transceivers,
+  .set_led = white_set_led,
+  .set_gps_mode = white_set_gps_mode,
+  .set_can_mode = white_set_can_mode,
+  .check_ignition = white_check_ignition,
+  .read_current = white_read_current,
+  .set_fan_enabled = unused_set_fan_enabled,
+  .set_ir_power = unused_set_ir_power,
+  .set_phone_power = unused_set_phone_power,
+  .set_siren = unused_set_siren,
+  .read_som_gpio = unused_read_som_gpio
+};

panda/board/bootstub.c

@@ -0,0 +1,84 @@
+#define BOOTSTUB
+
+#define VERS_TAG 0x53524556
+#define MIN_VERSION 2
+
+// ********************* Includes *********************
+#include "config.h"
+
+#include "drivers/pwm.h"
+#include "drivers/usb.h"
+
+#include "early_init.h"
+#include "provision.h"
+
+#include "crypto/rsa.h"
+#include "crypto/sha.h"
+
+#include "obj/cert.h"
+#include "obj/gitversion.h"
+#include "flasher.h"
+
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+void fail(void) {
+  soft_flasher_start();
+}
+
+// know where to sig check
+extern void *_app_start[];
+
+// FIXME: sometimes your panda will fail flashing and will quickly blink a single Green LED
+// BOUNTY: $200 coupon on shop.comma.ai or $100 check.
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  disable_interrupts();
+  clock_init();
+  detect_board_type();
+
+  if (enter_bootloader_mode == ENTER_SOFTLOADER_MAGIC) {
+    enter_bootloader_mode = 0;
+    soft_flasher_start();
+  }
+
+  // validate length
+  int len = (int)_app_start[0];
+  if ((len < 8) || (len > (0x1000000 - 0x4000 - 4 - RSANUMBYTES))) goto fail;
+
+  // compute SHA hash
+  uint8_t digest[SHA_DIGEST_SIZE];
+  SHA_hash(&_app_start[1], len-4, digest);
+
+  // verify version, last bytes in the signed area
+  uint32_t vers[2] = {0};
+  memcpy(&vers, ((void*)&_app_start[0]) + len - sizeof(vers), sizeof(vers));
+  if (vers[0] != VERS_TAG || vers[1] < MIN_VERSION) {
+    goto fail;
+  }
+
+  // verify RSA signature
+  if (RSA_verify(&release_rsa_key, ((void*)&_app_start[0]) + len, RSANUMBYTES, digest, SHA_DIGEST_SIZE)) {
+    goto good;
+  }
+
+  // allow debug if built from source
+#ifdef ALLOW_DEBUG
+  if (RSA_verify(&debug_rsa_key, ((void*)&_app_start[0]) + len, RSANUMBYTES, digest, SHA_DIGEST_SIZE)) {
+    goto good;
+  }
+#endif
+
+// here is a failure
+fail:
+  fail();
+  return 0;
+good:
+  // jump to flash
+  ((void(*)(void)) _app_start[1])();
+  return 0;
+}

panda/board/bootstub_declarations.h

@@ -0,0 +1,20 @@
+// ******************** Prototypes ********************
+void print(const char *a){ UNUSED(a); }
+void puth(uint8_t i){ UNUSED(i); }
+void puth2(uint8_t i){ UNUSED(i); }
+void puth4(uint8_t i){ UNUSED(i); }
+void hexdump(const void *a, int l){ UNUSED(a); UNUSED(l); }
+typedef struct board board;
+typedef struct harness_configuration harness_configuration;
+// No CAN support on bootloader
+void can_flip_buses(uint8_t bus1, uint8_t bus2){UNUSED(bus1); UNUSED(bus2);}
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel);
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage);
+// No UART support in bootloader
+typedef struct uart_ring {} uart_ring;
+uart_ring uart_ring_som_debug;
+void uart_init(uart_ring *q, int baud) { UNUSED(q); UNUSED(baud); }
+
+// ********************* Globals **********************
+uint8_t hw_type = 0;
+const board *current_board;

panda/board/can_comms.h

@@ -0,0 +1,122 @@
+/*
+  CAN transactions to and from the host come in the form of
+  a certain number of CANPacket_t. The transaction is split
+  into multiple transfers or chunks.
+
+  * comms_can_read outputs this buffer in chunks of a specified length.
+    chunks are always the given length, except the last one.
+  * comms_can_write reads in this buffer in chunks.
+  * both functions maintain an overflow buffer for a partial CANPacket_t that
+    spans multiple transfers/chunks.
+  * the overflow buffers are reset by a dedicated control transfer handler,
+    which is sent by the host on each start of a connection.
+*/
+
+typedef struct {
+  uint32_t ptr;
+  uint32_t tail_size;
+  uint8_t data[72];
+} asm_buffer;
+
+asm_buffer can_read_buffer = {.ptr = 0U, .tail_size = 0U};
+
+int comms_can_read(uint8_t *data, uint32_t max_len) {
+  uint32_t pos = 0U;
+
+  // Send tail of previous message if it is in buffer
+  if (can_read_buffer.ptr > 0U) {
+    uint32_t overflow_len = MIN(max_len - pos, can_read_buffer.ptr);
+    (void)memcpy(&data[pos], can_read_buffer.data, overflow_len);
+    pos += overflow_len;
+    (void)memcpy(can_read_buffer.data, &can_read_buffer.data[overflow_len], can_read_buffer.ptr - overflow_len);
+    can_read_buffer.ptr -= overflow_len;
+  }
+
+  if (can_read_buffer.ptr == 0U) {
+    // Fill rest of buffer with new data
+    CANPacket_t can_packet;
+    while ((pos < max_len) && can_pop(&can_rx_q, &can_packet)) {
+      uint32_t pckt_len = CANPACKET_HEAD_SIZE + dlc_to_len[can_packet.data_len_code];
+      if ((pos + pckt_len) <= max_len) {
+        (void)memcpy(&data[pos], &can_packet, pckt_len);
+        pos += pckt_len;
+      } else {
+        (void)memcpy(&data[pos], &can_packet, max_len - pos);
+        can_read_buffer.ptr += pckt_len - (max_len - pos);
+        // cppcheck-suppress objectIndex
+        (void)memcpy(can_read_buffer.data, &((uint8_t*)&can_packet)[(max_len - pos)], can_read_buffer.ptr);
+        pos = max_len;
+      }
+    }
+  }
+
+  return pos;
+}
+
+asm_buffer can_write_buffer = {.ptr = 0U, .tail_size = 0U};
+
+// send on CAN
+void comms_can_write(uint8_t *data, uint32_t len) {
+  uint32_t pos = 0U;
+
+  // Assembling can message with data from buffer
+  if (can_write_buffer.ptr != 0U) {
+    if (can_write_buffer.tail_size <= (len - pos)) {
+      // we have enough data to complete the buffer
+      CANPacket_t to_push;
+      (void)memcpy(&can_write_buffer.data[can_write_buffer.ptr], &data[pos], can_write_buffer.tail_size);
+      can_write_buffer.ptr += can_write_buffer.tail_size;
+      pos += can_write_buffer.tail_size;
+
+      // send out
+      (void)memcpy(&to_push, can_write_buffer.data, can_write_buffer.ptr);
+      can_send(&to_push, to_push.bus, false);
+
+      // reset overflow buffer
+      can_write_buffer.ptr = 0U;
+      can_write_buffer.tail_size = 0U;
+    } else {
+      // maybe next time
+      uint32_t data_size = len - pos;
+      (void) memcpy(&can_write_buffer.data[can_write_buffer.ptr], &data[pos], data_size);
+      can_write_buffer.tail_size -= data_size;
+      can_write_buffer.ptr += data_size;
+      pos += data_size;
+    }
+  }
+
+  // rest of the message
+  while (pos < len) {
+    uint32_t pckt_len = CANPACKET_HEAD_SIZE + dlc_to_len[(data[pos] >> 4U)];
+    if ((pos + pckt_len) <= len) {
+      CANPacket_t to_push;
+      (void)memcpy(&to_push, &data[pos], pckt_len);
+      can_send(&to_push, to_push.bus, false);
+      pos += pckt_len;
+    } else {
+      (void)memcpy(can_write_buffer.data, &data[pos], len - pos);
+      can_write_buffer.ptr = len - pos;
+      can_write_buffer.tail_size = pckt_len - can_write_buffer.ptr;
+      pos += can_write_buffer.ptr;
+    }
+  }
+
+  refresh_can_tx_slots_available();
+}
+
+void comms_can_reset(void) {
+  can_write_buffer.ptr = 0U;
+  can_write_buffer.tail_size = 0U;
+  can_read_buffer.ptr = 0U;
+  can_read_buffer.tail_size = 0U;
+}
+
+// TODO: make this more general!
+void refresh_can_tx_slots_available(void) {
+  if (can_tx_check_min_slots_free(MAX_CAN_MSGS_PER_USB_BULK_TRANSFER)) {
+    can_tx_comms_resume_usb();
+  }
+  if (can_tx_check_min_slots_free(MAX_CAN_MSGS_PER_SPI_BULK_TRANSFER)) {
+    can_tx_comms_resume_spi();
+  }
+}

panda/board/can_definitions.h

@@ -0,0 +1,34 @@
+#pragma once
+
+const uint8_t PANDA_CAN_CNT = 3U;
+const uint8_t PANDA_BUS_CNT = 4U;
+
+// bump this when changing the CAN packet
+#define CAN_PACKET_VERSION 4
+
+#define CANPACKET_HEAD_SIZE 6U
+
+#if !defined(STM32F4) && !defined(STM32F2)
+  #define CANFD
+  #define CANPACKET_DATA_SIZE_MAX 64U
+#else
+  #define CANPACKET_DATA_SIZE_MAX 8U
+#endif
+
+typedef struct {
+  unsigned char reserved : 1;
+  unsigned char bus : 3;
+  unsigned char data_len_code : 4;  // lookup length with dlc_to_len
+  unsigned char rejected : 1;
+  unsigned char returned : 1;
+  unsigned char extended : 1;
+  unsigned int addr : 29;
+  unsigned char checksum;
+  unsigned char data[CANPACKET_DATA_SIZE_MAX];
+} __attribute__((packed, aligned(4))) CANPacket_t;
+
+const unsigned char dlc_to_len[] = {0U, 1U, 2U, 3U, 4U, 5U, 6U, 7U, 8U, 12U, 16U, 20U, 24U, 32U, 48U, 64U};
+
+#define GET_BUS(msg) ((msg)->bus)
+#define GET_LEN(msg) (dlc_to_len[(msg)->data_len_code])
+#define GET_ADDR(msg) ((msg)->addr)

panda/board/comms_definitions.h

@@ -0,0 +1,12 @@
+typedef struct {
+  uint8_t request;
+  uint16_t param1;
+  uint16_t param2;
+  uint16_t length;
+} __attribute__((packed)) ControlPacket_t;
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp);
+void comms_endpoint2_write(uint8_t *data, uint32_t len);
+void comms_can_write(uint8_t *data, uint32_t len);
+int comms_can_read(uint8_t *data, uint32_t max_len);
+void comms_can_reset(void);

panda/board/config.h

@@ -0,0 +1,39 @@
+#pragma once
+
+#include <stdbool.h>
+
+//#define DEBUG
+//#define DEBUG_UART
+//#define DEBUG_USB
+//#define DEBUG_SPI
+//#define DEBUG_FAULTS
+//#define DEBUG_COMMS
+//#define DEBUG_FAN
+
+#define CAN_INIT_TIMEOUT_MS 500U
+#define DEEPSLEEP_WAKEUP_DELAY 3U
+#define USBPACKET_MAX_SIZE 0x40U
+#define MAX_CAN_MSGS_PER_USB_BULK_TRANSFER 51U
+#define MAX_CAN_MSGS_PER_SPI_BULK_TRANSFER 170U
+
+#define VIN_READOUT_DIVIDER 11U
+
+// USB definitions
+#define USB_VID 0xBBAAU
+
+#ifdef BOOTSTUB
+  #define USB_PID 0xDDEEU
+#else
+  #define USB_PID 0xDDCCU
+#endif
+
+// platform includes
+#ifdef STM32H7
+  #include "stm32h7/stm32h7_config.h"
+#elif defined(STM32F2) || defined(STM32F4)
+  #include "stm32fx/stm32fx_config.h"
+#else
+  // TODO: uncomment this, cppcheck complains
+  // building for tests
+  //#include "fake_stm.h"
+#endif

panda/board/crc.h

@@ -0,0 +1,19 @@
+#pragma once
+
+uint8_t crc_checksum(uint8_t *dat, int len, const uint8_t poly) {
+  uint8_t crc = 0xFFU;
+  int i;
+  int j;
+  for (i = len - 1; i >= 0; i--) {
+    crc ^= dat[i];
+    for (j = 0; j < 8; j++) {
+      if ((crc & 0x80U) != 0U) {
+        crc = (uint8_t)((crc << 1) ^ poly);
+      }
+      else {
+        crc <<= 1;
+      }
+    }
+  }
+  return crc;
+}

panda/board/critical.h

@@ -0,0 +1,23 @@
+// ********************* Critical section helpers *********************
+volatile bool interrupts_enabled = false;
+
+void enable_interrupts(void) {
+  interrupts_enabled = true;
+  __enable_irq();
+}
+
+void disable_interrupts(void) {
+  interrupts_enabled = false;
+  __disable_irq();
+}
+
+uint8_t global_critical_depth = 0U;
+#define ENTER_CRITICAL()                                      \
+  __disable_irq();                                            \
+  global_critical_depth += 1U;
+
+#define EXIT_CRITICAL()                                       \
+  global_critical_depth -= 1U;                                \
+  if ((global_critical_depth == 0U) && interrupts_enabled) {  \
+    __enable_irq();                                           \
+  }

panda/board/dfu_util_f4.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -e
+
+DFU_UTIL="dfu-util"
+
+scons -u -j$(nproc)
+
+PYTHONPATH=.. python3 -c "from python import Panda; Panda().reset(enter_bootstub=True); Panda().reset(enter_bootloader=True)" || true
+sleep 1
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08004000 -D obj/panda.bin.signed
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08000000:leave -D obj/bootstub.panda.bin

panda/board/dfu_util_h7.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -e
+
+DFU_UTIL="dfu-util"
+
+scons -u -j$(nproc)
+
+PYTHONPATH=.. python3 -c "from python import Panda; Panda().reset(enter_bootstub=True); Panda().reset(enter_bootloader=True)" || true
+sleep 1
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08020000 -D obj/panda_h7.bin.signed
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08000000:leave -D obj/bootstub.panda_h7.bin

panda/board/drivers/bxcan.h

@@ -0,0 +1,263 @@
+// IRQs: CAN1_TX, CAN1_RX0, CAN1_SCE
+//       CAN2_TX, CAN2_RX0, CAN2_SCE
+//       CAN3_TX, CAN3_RX0, CAN3_SCE
+
+CAN_TypeDef *cans[] = {CAN1, CAN2, CAN3};
+uint8_t can_irq_number[3][3] = {
+  { CAN1_TX_IRQn, CAN1_RX0_IRQn, CAN1_SCE_IRQn },
+  { CAN2_TX_IRQn, CAN2_RX0_IRQn, CAN2_SCE_IRQn },
+  { CAN3_TX_IRQn, CAN3_RX0_IRQn, CAN3_SCE_IRQn },
+};
+
+bool can_set_speed(uint8_t can_number) {
+  bool ret = true;
+  CAN_TypeDef *CAN = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  ret &= llcan_set_speed(
+    CAN,
+    bus_config[bus_number].can_speed,
+    can_loopback,
+    (unsigned int)(can_silent) & (1U << can_number)
+  );
+  return ret;
+}
+
+// TODO: Cleanup with new abstraction
+void can_set_gmlan(uint8_t bus) {
+  if(current_board->has_hw_gmlan){
+    // first, disable GMLAN on prev bus
+    uint8_t prev_bus = bus_config[3].can_num_lookup;
+    if (bus != prev_bus) {
+      switch (prev_bus) {
+        case 1:
+        case 2:
+          print("Disable GMLAN on CAN");
+          puth(prev_bus + 1U);
+          print("\n");
+          current_board->set_can_mode(CAN_MODE_NORMAL);
+          bus_config[prev_bus].bus_lookup = prev_bus;
+          bus_config[prev_bus].can_num_lookup = prev_bus;
+          bus_config[3].can_num_lookup = -1;
+          bool ret = can_init(prev_bus);
+          UNUSED(ret);
+          break;
+        default:
+          // GMLAN was not set on either BUS 1 or 2
+          break;
+      }
+    }
+
+    // now enable GMLAN on the new bus
+    switch (bus) {
+      case 1:
+      case 2:
+        print("Enable GMLAN on CAN");
+        puth(bus + 1U);
+        print("\n");
+        current_board->set_can_mode((bus == 1U) ? CAN_MODE_GMLAN_CAN2 : CAN_MODE_GMLAN_CAN3);
+        bus_config[bus].bus_lookup = 3;
+        bus_config[bus].can_num_lookup = -1;
+        bus_config[3].can_num_lookup = bus;
+        bool ret = can_init(bus);
+        UNUSED(ret);
+        break;
+      case 0xFF:  //-1 unsigned
+        break;
+      default:
+        print("GMLAN can only be set on CAN2 or CAN3\n");
+        break;
+    }
+  } else {
+    print("GMLAN not available on black panda\n");
+  }
+}
+
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg) {
+  CAN_TypeDef *CAN = CANIF_FROM_CAN_NUM(can_number);
+  uint32_t esr_reg = CAN->ESR;
+
+  can_health[can_number].bus_off = ((esr_reg & CAN_ESR_BOFF) >> CAN_ESR_BOFF_Pos);
+  can_health[can_number].bus_off_cnt += can_health[can_number].bus_off;
+  can_health[can_number].error_warning = ((esr_reg & CAN_ESR_EWGF) >> CAN_ESR_EWGF_Pos);
+  can_health[can_number].error_passive = ((esr_reg & CAN_ESR_EPVF) >> CAN_ESR_EPVF_Pos);
+
+  can_health[can_number].last_error = ((esr_reg & CAN_ESR_LEC) >> CAN_ESR_LEC_Pos);
+  if ((can_health[can_number].last_error != 0U) && (can_health[can_number].last_error != 7U)) {
+    can_health[can_number].last_stored_error = can_health[can_number].last_error;
+  }
+
+  can_health[can_number].receive_error_cnt = ((esr_reg & CAN_ESR_REC) >> CAN_ESR_REC_Pos);
+  can_health[can_number].transmit_error_cnt = ((esr_reg & CAN_ESR_TEC) >> CAN_ESR_TEC_Pos);
+
+  can_health[can_number].irq0_call_rate = interrupts[can_irq_number[can_number][0]].call_rate;
+  can_health[can_number].irq1_call_rate = interrupts[can_irq_number[can_number][1]].call_rate;
+  can_health[can_number].irq2_call_rate = interrupts[can_irq_number[can_number][2]].call_rate;
+
+  if (ir_reg != 0U) {
+    can_health[can_number].total_error_cnt += 1U;
+
+    // RX message lost due to FIFO overrun
+    if ((CAN->RF0R & (CAN_RF0R_FOVR0)) != 0) {
+      can_health[can_number].total_rx_lost_cnt += 1U;
+      CAN->RF0R &= ~(CAN_RF0R_FOVR0);
+    }
+    can_health[can_number].can_core_reset_cnt += 1U;
+    llcan_clear_send(CAN);
+  }
+}
+
+// ***************************** CAN *****************************
+// CANx_SCE IRQ Handler
+void can_sce(uint8_t can_number) {
+  update_can_health_pkt(can_number, 1U);
+}
+
+// CANx_TX IRQ Handler
+void process_can(uint8_t can_number) {
+  if (can_number != 0xffU) {
+
+    ENTER_CRITICAL();
+
+    CAN_TypeDef *CAN = CANIF_FROM_CAN_NUM(can_number);
+    uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+    // check for empty mailbox
+    CANPacket_t to_send;
+    if ((CAN->TSR & (CAN_TSR_TERR0 | CAN_TSR_ALST0)) != 0) { // last TX failed due to error arbitration lost
+      can_health[can_number].total_tx_lost_cnt += 1U;
+      CAN->TSR |= (CAN_TSR_TERR0 | CAN_TSR_ALST0);
+    }
+    if ((CAN->TSR & CAN_TSR_TME0) == CAN_TSR_TME0) {
+      // add successfully transmitted message to my fifo
+      if ((CAN->TSR & CAN_TSR_RQCP0) == CAN_TSR_RQCP0) {
+        if ((CAN->TSR & CAN_TSR_TXOK0) == CAN_TSR_TXOK0) {
+          CANPacket_t to_push;
+          to_push.returned = 1U;
+          to_push.rejected = 0U;
+          to_push.extended = (CAN->sTxMailBox[0].TIR >> 2) & 0x1U;
+          to_push.addr = (to_push.extended != 0U) ? (CAN->sTxMailBox[0].TIR >> 3) : (CAN->sTxMailBox[0].TIR >> 21);
+          to_push.data_len_code = CAN->sTxMailBox[0].TDTR & 0xFU;
+          to_push.bus = bus_number;
+          WORD_TO_BYTE_ARRAY(&to_push.data[0], CAN->sTxMailBox[0].TDLR);
+          WORD_TO_BYTE_ARRAY(&to_push.data[4], CAN->sTxMailBox[0].TDHR);
+          can_set_checksum(&to_push);
+
+          rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+        }
+
+        // clear interrupt
+        // careful, this can also be cleared by requesting a transmission
+        CAN->TSR |= CAN_TSR_RQCP0;
+      }
+
+      if (can_pop(can_queues[bus_number], &to_send)) {
+        if (can_check_checksum(&to_send)) {
+          can_health[can_number].total_tx_cnt += 1U;
+          // only send if we have received a packet
+          CAN->sTxMailBox[0].TIR = ((to_send.extended != 0U) ? (to_send.addr << 3) : (to_send.addr << 21)) | (to_send.extended << 2);
+          CAN->sTxMailBox[0].TDTR = to_send.data_len_code;
+          BYTE_ARRAY_TO_WORD(CAN->sTxMailBox[0].TDLR, &to_send.data[0]);
+          BYTE_ARRAY_TO_WORD(CAN->sTxMailBox[0].TDHR, &to_send.data[4]);
+          // Send request TXRQ
+          CAN->sTxMailBox[0].TIR |= 0x1U;
+        } else {
+          can_health[can_number].total_tx_checksum_error_cnt += 1U;
+        }
+
+        refresh_can_tx_slots_available();
+      }
+    }
+
+    EXIT_CRITICAL();
+  }
+}
+
+// CANx_RX0 IRQ Handler
+// blink blue when we are receiving CAN messages
+void can_rx(uint8_t can_number) {
+  CAN_TypeDef *CAN = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  while ((CAN->RF0R & CAN_RF0R_FMP0) != 0) {
+    can_health[can_number].total_rx_cnt += 1U;
+
+    // can is live
+    pending_can_live = 1;
+
+    // add to my fifo
+    CANPacket_t to_push;
+
+    to_push.returned = 0U;
+    to_push.rejected = 0U;
+    to_push.extended = (CAN->sFIFOMailBox[0].RIR >> 2) & 0x1U;
+    to_push.addr = (to_push.extended != 0U) ? (CAN->sFIFOMailBox[0].RIR >> 3) : (CAN->sFIFOMailBox[0].RIR >> 21);
+    to_push.data_len_code = CAN->sFIFOMailBox[0].RDTR & 0xFU;
+    to_push.bus = bus_number;
+    WORD_TO_BYTE_ARRAY(&to_push.data[0], CAN->sFIFOMailBox[0].RDLR);
+    WORD_TO_BYTE_ARRAY(&to_push.data[4], CAN->sFIFOMailBox[0].RDHR);
+    can_set_checksum(&to_push);
+
+    // forwarding (panda only)
+    int bus_fwd_num = safety_fwd_hook(bus_number, to_push.addr);
+    if (bus_fwd_num != -1) {
+      CANPacket_t to_send;
+
+      to_send.returned = 0U;
+      to_send.rejected = 0U;
+      to_send.extended = to_push.extended; // TXRQ
+      to_send.addr = to_push.addr;
+      to_send.bus = to_push.bus;
+      to_send.data_len_code = to_push.data_len_code;
+      (void)memcpy(to_send.data, to_push.data, dlc_to_len[to_push.data_len_code]);
+      can_set_checksum(&to_send);
+
+      can_send(&to_send, bus_fwd_num, true);
+      can_health[can_number].total_fwd_cnt += 1U;
+    }
+
+    safety_rx_invalid += safety_rx_hook(&to_push) ? 0U : 1U;
+    ignition_can_hook(&to_push);
+
+    current_board->set_led(LED_BLUE, true);
+    rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+
+    // next
+    CAN->RF0R |= CAN_RF0R_RFOM0;
+  }
+}
+
+void CAN1_TX_IRQ_Handler(void) { process_can(0); }
+void CAN1_RX0_IRQ_Handler(void) { can_rx(0); }
+void CAN1_SCE_IRQ_Handler(void) { can_sce(0); }
+
+void CAN2_TX_IRQ_Handler(void) { process_can(1); }
+void CAN2_RX0_IRQ_Handler(void) { can_rx(1); }
+void CAN2_SCE_IRQ_Handler(void) { can_sce(1); }
+
+void CAN3_TX_IRQ_Handler(void) { process_can(2); }
+void CAN3_RX0_IRQ_Handler(void) { can_rx(2); }
+void CAN3_SCE_IRQ_Handler(void) { can_sce(2); }
+
+bool can_init(uint8_t can_number) {
+  bool ret = false;
+
+  REGISTER_INTERRUPT(CAN1_TX_IRQn, CAN1_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_RX0_IRQn, CAN1_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_SCE_IRQn, CAN1_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN2_TX_IRQn, CAN2_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN2_RX0_IRQn, CAN2_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN2_SCE_IRQn, CAN2_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(CAN3_TX_IRQn, CAN3_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(CAN3_RX0_IRQn, CAN3_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(CAN3_SCE_IRQn, CAN3_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+
+  if (can_number != 0xffU) {
+    CAN_TypeDef *CAN = CANIF_FROM_CAN_NUM(can_number);
+    ret &= can_set_speed(can_number);
+    ret &= llcan_init(CAN);
+    // in case there are queued up messages
+    process_can(can_number);
+  }
+  return ret;
+}

panda/board/drivers/can_common.h

@@ -0,0 +1,277 @@
+typedef struct {
+  volatile uint32_t w_ptr;
+  volatile uint32_t r_ptr;
+  uint32_t fifo_size;
+  CANPacket_t *elems;
+} can_ring;
+
+typedef struct {
+  uint8_t bus_lookup;
+  uint8_t can_num_lookup;
+  uint32_t can_speed;
+  uint32_t can_data_speed;
+  bool canfd_enabled;
+  bool brs_enabled;
+  bool canfd_non_iso;
+} bus_config_t;
+
+uint32_t safety_tx_blocked = 0;
+uint32_t safety_rx_invalid = 0;
+uint32_t tx_buffer_overflow = 0;
+uint32_t rx_buffer_overflow = 0;
+uint32_t gmlan_send_errs = 0;
+
+can_health_t can_health[] = {{0}, {0}, {0}};
+
+extern int can_live;
+extern int pending_can_live;
+
+// must reinit after changing these
+extern int can_loopback;
+extern int can_silent;
+
+// Ignition detected from CAN meessages
+bool ignition_can = false;
+uint32_t ignition_can_cnt = 0U;
+
+#define ALL_CAN_SILENT 0xFF
+#define ALL_CAN_LIVE 0
+
+int can_live = 0;
+int pending_can_live = 0;
+int can_loopback = 0;
+int can_silent = ALL_CAN_SILENT;
+
+// ******************* functions prototypes *********************
+bool can_init(uint8_t can_number);
+void process_can(uint8_t can_number);
+
+// ********************* instantiate queues *********************
+#define can_buffer(x, size) \
+  CANPacket_t elems_##x[size]; \
+  can_ring can_##x = { .w_ptr = 0, .r_ptr = 0, .fifo_size = (size), .elems = (CANPacket_t *)&(elems_##x) };
+
+#ifdef STM32H7
+__attribute__((section(".ram_d1"))) can_buffer(rx_q, 0x1000)
+__attribute__((section(".ram_d1"))) can_buffer(tx2_q, 0x1A0)
+__attribute__((section(".ram_d2"))) can_buffer(txgmlan_q, 0x1A0)
+#else
+can_buffer(rx_q, 0x1000)
+can_buffer(tx2_q, 0x1A0)
+can_buffer(txgmlan_q, 0x1A0)
+#endif
+can_buffer(tx1_q, 0x1A0)
+can_buffer(tx3_q, 0x1A0)
+// FIXME:
+// cppcheck-suppress misra-c2012-9.3
+can_ring *can_queues[] = {&can_tx1_q, &can_tx2_q, &can_tx3_q, &can_txgmlan_q};
+
+// helpers
+#define WORD_TO_BYTE_ARRAY(dst8, src32) 0[dst8] = ((src32) & 0xFFU); 1[dst8] = (((src32) >> 8U) & 0xFFU); 2[dst8] = (((src32) >> 16U) & 0xFFU); 3[dst8] = (((src32) >> 24U) & 0xFFU)
+#define BYTE_ARRAY_TO_WORD(dst32, src8) ((dst32) = 0[src8] | (1[src8] << 8U) | (2[src8] << 16U) | (3[src8] << 24U))
+
+// ********************* interrupt safe queue *********************
+bool can_pop(can_ring *q, CANPacket_t *elem) {
+  bool ret = 0;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr != q->r_ptr) {
+    *elem = q->elems[q->r_ptr];
+    if ((q->r_ptr + 1U) == q->fifo_size) {
+      q->r_ptr = 0;
+    } else {
+      q->r_ptr += 1U;
+    }
+    ret = 1;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool can_push(can_ring *q, CANPacket_t *elem) {
+  bool ret = false;
+  uint32_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  if ((q->w_ptr + 1U) == q->fifo_size) {
+    next_w_ptr = 0;
+  } else {
+    next_w_ptr = q->w_ptr + 1U;
+  }
+  if (next_w_ptr != q->r_ptr) {
+    q->elems[q->w_ptr] = *elem;
+    q->w_ptr = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+  if (!ret) {
+    #ifdef DEBUG
+      print("can_push to ");
+      if (q == &can_rx_q) {
+        print("can_rx_q");
+      } else if (q == &can_tx1_q) {
+        print("can_tx1_q");
+      } else if (q == &can_tx2_q) {
+        print("can_tx2_q");
+      } else if (q == &can_tx3_q) {
+        print("can_tx3_q");
+      } else if (q == &can_txgmlan_q) {
+        print("can_txgmlan_q");
+      } else {
+        print("unknown");
+      }
+      print(" failed!\n");
+    #endif
+  }
+  return ret;
+}
+
+uint32_t can_slots_empty(can_ring *q) {
+  uint32_t ret = 0;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr >= q->r_ptr) {
+    ret = q->fifo_size - 1U - q->w_ptr + q->r_ptr;
+  } else {
+    ret = q->r_ptr - q->w_ptr - 1U;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+void can_clear(can_ring *q) {
+  ENTER_CRITICAL();
+  q->w_ptr = 0;
+  q->r_ptr = 0;
+  EXIT_CRITICAL();
+  // handle TX buffer full with zero ECUs awake on the bus
+  refresh_can_tx_slots_available();
+}
+
+// assign CAN numbering
+// bus num: Can bus number on ODB connector. Sent to/from USB
+//    Min: 0; Max: 127; Bit 7 marks message as receipt (bus 129 is receipt for but 1)
+// cans: Look up MCU can interface from bus number
+// can number: numeric lookup for MCU CAN interfaces (0 = CAN1, 1 = CAN2, etc);
+// bus_lookup: Translates from 'can number' to 'bus number'.
+// can_num_lookup: Translates from 'bus number' to 'can number'.
+
+// Helpers
+// Panda:       Bus 0=CAN1   Bus 1=CAN2   Bus 2=CAN3
+bus_config_t bus_config[] = {
+  { .bus_lookup = 0U, .can_num_lookup = 0U, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+  { .bus_lookup = 1U, .can_num_lookup = 1U, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+  { .bus_lookup = 2U, .can_num_lookup = 2U, .can_speed = 5000U, .can_data_speed = 20000U, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+  { .bus_lookup = 0xFFU, .can_num_lookup = 0xFFU, .can_speed = 333U, .can_data_speed = 333U, .canfd_enabled = false, .brs_enabled = false, .canfd_non_iso = false },
+};
+
+#define CANIF_FROM_CAN_NUM(num) (cans[num])
+#define BUS_NUM_FROM_CAN_NUM(num) (bus_config[num].bus_lookup)
+#define CAN_NUM_FROM_BUS_NUM(num) (bus_config[num].can_num_lookup)
+
+void can_init_all(void) {
+  bool ret = true;
+  for (uint8_t i=0U; i < PANDA_CAN_CNT; i++) {
+    if (!current_board->has_canfd) {
+      bus_config[i].can_data_speed = 0U;
+    }
+    can_clear(can_queues[i]);
+    ret &= can_init(i);
+  }
+  UNUSED(ret);
+}
+
+void can_flip_buses(uint8_t bus1, uint8_t bus2){
+  bus_config[bus1].bus_lookup = bus2;
+  bus_config[bus2].bus_lookup = bus1;
+  bus_config[bus1].can_num_lookup = bus2;
+  bus_config[bus2].can_num_lookup = bus1;
+}
+
+void ignition_can_hook(CANPacket_t *to_push) {
+  int bus = GET_BUS(to_push);
+  int addr = GET_ADDR(to_push);
+  int len = GET_LEN(to_push);
+
+  if (bus == 0) {
+    // GM exception
+    if ((addr == 0x160) && (len == 5)) {
+      // this message isn't all zeros when ignition is on
+      ignition_can = GET_BYTES(to_push, 0, 4) != 0U;
+      ignition_can_cnt = 0U;
+    }
+
+    // Tesla exception
+    if ((addr == 0x348) && (len == 8)) {
+      // GTW_status
+      ignition_can = (GET_BYTE(to_push, 0) & 0x1U) != 0U;
+      ignition_can_cnt = 0U;
+    }
+
+    // Mazda exception
+    if ((addr == 0x9E) && (len == 8)) {
+      ignition_can = (GET_BYTE(to_push, 0) >> 5) == 0x6U;
+      ignition_can_cnt = 0U;
+    }
+
+  }
+}
+
+bool can_tx_check_min_slots_free(uint32_t min) {
+  return
+    (can_slots_empty(&can_tx1_q) >= min) &&
+    (can_slots_empty(&can_tx2_q) >= min) &&
+    (can_slots_empty(&can_tx3_q) >= min) &&
+    (can_slots_empty(&can_txgmlan_q) >= min);
+}
+
+uint8_t calculate_checksum(uint8_t *dat, uint32_t len) {
+  uint8_t checksum = 0U;
+  for (uint32_t i = 0U; i < len; i++) {
+    checksum ^= dat[i];
+  }
+  return checksum;
+}
+
+void can_set_checksum(CANPacket_t *packet) {
+  packet->checksum = 0U;
+  packet->checksum = calculate_checksum((uint8_t *) packet, CANPACKET_HEAD_SIZE + GET_LEN(packet));
+}
+
+bool can_check_checksum(CANPacket_t *packet) {
+  return (calculate_checksum((uint8_t *) packet, CANPACKET_HEAD_SIZE + GET_LEN(packet)) == 0U);
+}
+
+void can_send(CANPacket_t *to_push, uint8_t bus_number, bool skip_tx_hook) {
+  if (skip_tx_hook || safety_tx_hook(to_push) != 0) {
+    if (bus_number < PANDA_BUS_CNT) {
+      // add CAN packet to send queue
+      if ((bus_number == 3U) && (bus_config[3].can_num_lookup == 0xFFU)) {
+        gmlan_send_errs += bitbang_gmlan(to_push) ? 0U : 1U;
+      } else {
+        tx_buffer_overflow += can_push(can_queues[bus_number], to_push) ? 0U : 1U;
+        process_can(CAN_NUM_FROM_BUS_NUM(bus_number));
+      }
+    }
+  } else {
+    safety_tx_blocked += 1U;
+    to_push->returned = 0U;
+    to_push->rejected = 1U;
+
+    // data changed
+    can_set_checksum(to_push);
+    rx_buffer_overflow += can_push(&can_rx_q, to_push) ? 0U : 1U;
+  }
+}
+
+bool is_speed_valid(uint32_t speed, const uint32_t *speeds, uint8_t len) {
+  bool ret = false;
+  for (uint8_t i = 0U; i < len; i++) {
+    if (speeds[i] == speed) {
+      ret = true;
+    }
+  }
+  return ret;
+}

panda/board/drivers/clock_source.h

@@ -0,0 +1,33 @@
+#define CLOCK_SOURCE_PERIOD_MS           50U
+#define CLOCK_SOURCE_PULSE_LEN_MS        2U
+
+void clock_source_init(void) {
+  // Setup timer
+  register_set(&(TIM1->PSC), ((APB2_TIMER_FREQ*100U)-1U), 0xFFFFU);           // Tick on 0.1 ms
+  register_set(&(TIM1->ARR), ((CLOCK_SOURCE_PERIOD_MS*10U) - 1U), 0xFFFFU);   // Period
+  register_set(&(TIM1->CCMR1), 0U, 0xFFFFU);                                  // No output on compare
+  register_set(&(TIM1->CCER), TIM_CCER_CC1E, 0xFFFFU);                        // Enable compare 1
+  register_set(&(TIM1->CCR1), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set(&(TIM1->CCR2), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set(&(TIM1->CCR3), (CLOCK_SOURCE_PULSE_LEN_MS*10U), 0xFFFFU);      // Compare 1 value
+  register_set_bits(&(TIM1->DIER), TIM_DIER_UIE | TIM_DIER_CC1IE);            // Enable interrupts
+  register_set(&(TIM1->CR1), TIM_CR1_CEN, 0x3FU);                             // Enable timer
+
+  // No interrupts
+  NVIC_DisableIRQ(TIM1_UP_TIM10_IRQn);
+  NVIC_DisableIRQ(TIM1_CC_IRQn);
+
+  // Set GPIO as timer channels
+  set_gpio_alternate(GPIOB, 14, GPIO_AF1_TIM1);
+  set_gpio_alternate(GPIOB, 15, GPIO_AF1_TIM1);
+
+  // Set PWM mode
+  register_set(&(TIM1->CCMR1), (0b110 << TIM_CCMR1_OC2M_Pos), 0xFFFFU);
+  register_set(&(TIM1->CCMR2), (0b110 << TIM_CCMR2_OC3M_Pos), 0xFFFFU);
+
+  // Enable output
+  register_set(&(TIM1->BDTR), TIM_BDTR_MOE, 0xFFFFU);
+
+  // Enable complementary compares
+  register_set_bits(&(TIM1->CCER), TIM_CCER_CC2NE | TIM_CCER_CC3NE);
+}

panda/board/drivers/fake_siren.h

@@ -0,0 +1,76 @@
+#include "stm32h7/lli2c.h"
+
+#define CODEC_I2C_ADDR 0x10
+
+// 1Vpp sine wave with 1V offset
+const uint8_t fake_siren_lut[360] = { 134U, 135U, 137U, 138U, 139U, 140U, 141U, 143U, 144U, 145U, 146U, 148U, 149U, 150U, 151U, 152U, 154U, 155U, 156U, 157U, 158U, 159U, 160U, 162U, 163U, 164U, 165U, 166U, 167U, 168U, 169U, 170U, 171U, 172U, 174U, 175U, 176U, 177U, 177U, 178U, 179U, 180U, 181U, 182U, 183U, 184U, 185U, 186U, 186U, 187U, 188U, 189U, 190U, 190U, 191U, 192U, 193U, 193U, 194U, 195U, 195U, 196U, 196U, 197U, 197U, 198U, 199U, 199U, 199U, 200U, 200U, 201U, 201U, 202U, 202U, 202U, 203U, 203U, 203U, 203U, 204U, 204U, 204U, 204U, 204U, 204U, 204U, 205U, 205U, 205U, 205U, 205U, 205U, 205U, 204U, 204U, 204U, 204U, 204U, 204U, 204U, 203U, 203U, 203U, 203U, 202U, 202U, 202U, 201U, 201U, 200U, 200U, 199U, 199U, 199U, 198U, 197U, 197U, 196U, 196U, 195U, 195U, 194U, 193U, 193U, 192U, 191U, 190U, 190U, 189U, 188U, 187U, 186U, 186U, 185U, 184U, 183U, 182U, 181U, 180U, 179U, 178U, 177U, 177U, 176U, 175U, 174U, 172U, 171U, 170U, 169U, 168U, 167U, 166U, 165U, 164U, 163U, 162U, 160U, 159U, 158U, 157U, 156U, 155U, 154U, 152U, 151U, 150U, 149U, 148U, 146U, 145U, 144U, 143U, 141U, 140U, 139U, 138U, 137U, 135U, 134U, 133U, 132U, 130U, 129U, 128U, 127U, 125U, 124U, 123U, 122U, 121U, 119U, 118U, 117U, 116U, 115U, 113U, 112U, 111U, 110U, 109U, 108U, 106U, 105U, 104U, 103U, 102U, 101U, 100U, 99U, 98U, 97U, 96U, 95U, 94U, 93U, 92U, 91U, 90U, 89U, 88U, 87U, 86U, 85U, 84U, 83U, 82U, 82U, 81U, 80U, 79U, 78U, 78U, 77U, 76U, 76U, 75U, 74U, 74U, 73U, 72U, 72U, 71U, 71U, 70U, 70U, 69U, 69U, 68U, 68U, 67U, 67U, 67U, 66U, 66U, 66U, 65U, 65U, 65U, 65U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 63U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 64U, 65U, 65U, 65U, 65U, 66U, 66U, 66U, 67U, 67U, 67U, 68U, 68U, 69U, 69U, 70U, 70U, 71U, 71U, 72U, 72U, 73U, 74U, 74U, 75U, 76U, 76U, 77U, 78U, 78U, 79U, 80U, 81U, 82U, 82U, 83U, 84U, 85U, 86U, 87U, 88U, 89U, 90U, 91U, 92U, 93U, 94U, 95U, 96U, 97U, 98U, 99U, 100U, 101U, 102U, 103U, 104U, 105U, 106U, 108U, 109U, 110U, 111U, 112U, 113U, 115U, 116U, 117U, 118U, 119U, 121U, 122U, 123U, 124U, 125U, 127U, 128U, 129U, 130U, 132U, 133U };
+
+bool fake_siren_enabled = false;
+
+void fake_siren_codec_enable(bool enabled) {
+  if (enabled) {
+    bool success = true;
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x2B, (1U << 1)); // Left speaker mix from INA1
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x2C, (1U << 1)); // Right speaker mix from INA1
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x3D, 0x17, 0b11111); // Left speaker volume
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x3E, 0x17, 0b11111); // Right speaker volume
+    success &= i2c_set_reg_mask(I2C5, CODEC_I2C_ADDR, 0x37, 0b101, 0b111); // INA gain
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x4C, (1U << 7)); // Enable INA
+    success &= i2c_set_reg_bits(I2C5, CODEC_I2C_ADDR, 0x51, (1U << 7)); // Disable global shutdown
+    if (!success) {
+      print("Siren codec enable failed\n");
+      fault_occurred(FAULT_SIREN_MALFUNCTION);
+    }
+  } else {
+    // Disable INA input. Make sure to retry a few times if the I2C bus is busy.
+    for (uint8_t i=0U; i<10U; i++) {
+      if (i2c_clear_reg_bits(I2C5, CODEC_I2C_ADDR, 0x4C, (1U << 7))) {
+        break;
+      }
+    }
+  }
+}
+
+
+void fake_siren_set(bool enabled) {
+  if (enabled != fake_siren_enabled) {
+    fake_siren_codec_enable(enabled);
+  }
+
+  if (enabled) {
+    register_set_bits(&DMA1_Stream1->CR, DMA_SxCR_EN);
+  } else {
+    register_clear_bits(&DMA1_Stream1->CR, DMA_SxCR_EN);
+  }
+  fake_siren_enabled = enabled;
+}
+
+void fake_siren_init(void) {
+  // Init DAC
+  register_set(&DAC1->MCR, 0U, 0xFFFFFFFFU);
+  register_set(&DAC1->CR, DAC_CR_TEN1 | (6U << DAC_CR_TSEL1_Pos) | DAC_CR_DMAEN1, 0xFFFFFFFFU);
+  register_set_bits(&DAC1->CR, DAC_CR_EN1);
+
+  // Setup DMAMUX (DAC_CH1_DMA as input)
+  register_set(&DMAMUX1_Channel1->CCR, 67U, DMAMUX_CxCR_DMAREQ_ID_Msk);
+
+  // Setup DMA
+  register_set(&DMA1_Stream1->M0AR, (uint32_t) fake_siren_lut, 0xFFFFFFFFU);
+  register_set(&DMA1_Stream1->PAR, (uint32_t) &(DAC1->DHR8R1), 0xFFFFFFFFU);
+  DMA1_Stream1->NDTR = sizeof(fake_siren_lut);
+  register_set(&DMA1_Stream1->FCR, 0U, 0x00000083U);
+  DMA1_Stream1->CR = (0b11 << DMA_SxCR_PL_Pos);
+  DMA1_Stream1->CR |= DMA_SxCR_MINC | DMA_SxCR_CIRC | (1 << DMA_SxCR_DIR_Pos);
+
+  // Init trigger timer (around 2.5kHz)
+  register_set(&TIM7->PSC, 0U, 0xFFFFU);
+  register_set(&TIM7->ARR, 133U, 0xFFFFU);
+  register_set(&TIM7->CR2, (0b10 << TIM_CR2_MMS_Pos), TIM_CR2_MMS_Msk);
+  register_set(&TIM7->CR1, TIM_CR1_ARPE | TIM_CR1_URS, 0x088EU);
+  TIM7->SR = 0U;
+  TIM7->CR1 |= TIM_CR1_CEN;
+
+  // Enable the I2C to the codec
+  i2c_init(I2C5);
+  fake_siren_codec_enable(false);
+}

panda/board/drivers/fan.h

@@ -0,0 +1,95 @@
+struct fan_state_t {
+  uint16_t tach_counter;
+  uint16_t rpm;
+  uint16_t target_rpm;
+  uint8_t power;
+  float error_integral;
+  uint8_t stall_counter;
+  uint8_t stall_threshold;
+  uint8_t total_stall_count;
+  uint8_t cooldown_counter;
+} fan_state_t;
+struct fan_state_t fan_state;
+
+const float FAN_I = 0.001f;
+
+const uint8_t FAN_TICK_FREQ = 8U;
+const uint8_t FAN_STALL_THRESHOLD_MIN = 3U;
+const uint8_t FAN_STALL_THRESHOLD_MAX = 8U;
+
+
+void fan_set_power(uint8_t percentage) {
+  fan_state.target_rpm = ((current_board->fan_max_rpm * CLAMP(percentage, 0U, 100U)) / 100U);
+}
+
+void llfan_init(void);
+void fan_init(void) {
+  fan_state.stall_threshold = FAN_STALL_THRESHOLD_MIN;
+  fan_state.cooldown_counter = current_board->fan_enable_cooldown_time * FAN_TICK_FREQ;
+  llfan_init();
+}
+
+// Call this at FAN_TICK_FREQ
+void fan_tick(void) {
+  if (current_board->fan_max_rpm > 0U) {
+    // Measure fan RPM
+    uint16_t fan_rpm_fast = fan_state.tach_counter * (60U * FAN_TICK_FREQ / 4U);   // 4 interrupts per rotation
+    fan_state.tach_counter = 0U;
+    fan_state.rpm = (fan_rpm_fast + (3U * fan_state.rpm)) / 4U;
+
+    // Stall detection
+    bool fan_stalled = false;
+    if (current_board->fan_stall_recovery) {
+      if (fan_state.target_rpm > 0U) {
+        if (fan_rpm_fast == 0U) {
+          fan_state.stall_counter = MIN(fan_state.stall_counter + 1U, 255U);
+        } else {
+          fan_state.stall_counter = 0U;
+        }
+
+        if (fan_state.stall_counter > (fan_state.stall_threshold*FAN_TICK_FREQ)) {
+          fan_stalled = true;
+          fan_state.stall_counter = 0U;
+          fan_state.stall_threshold = CLAMP(fan_state.stall_threshold + 2U, FAN_STALL_THRESHOLD_MIN, FAN_STALL_THRESHOLD_MAX);
+          fan_state.total_stall_count += 1U;
+
+          // datasheet gives this range as the minimum startup duty
+          fan_state.error_integral = CLAMP(fan_state.error_integral, 20.0f, 45.0f);
+        }
+      } else {
+        fan_state.stall_counter = 0U;
+        fan_state.stall_threshold = FAN_STALL_THRESHOLD_MIN;
+      }
+    }
+
+    #ifdef DEBUG_FAN
+      puth(fan_state.target_rpm);
+      print(" "); puth(fan_rpm_fast);
+      print(" "); puth(fan_state.power);
+      print(" "); puth(fan_state.stall_counter);
+      print("\n");
+    #endif
+
+    // Cooldown counter
+    if (fan_state.target_rpm > 0U) {
+      fan_state.cooldown_counter = current_board->fan_enable_cooldown_time * FAN_TICK_FREQ;
+    } else {
+      if (fan_state.cooldown_counter > 0U) {
+        fan_state.cooldown_counter--;
+      }
+    }
+
+    // Update controller
+    if (fan_state.target_rpm == 0U) {
+      fan_state.error_integral = 0.0f;
+    } else {
+      float error = fan_state.target_rpm - fan_rpm_fast;
+      fan_state.error_integral += FAN_I * error;
+    }
+    fan_state.power = CLAMP(fan_state.error_integral, 0U, 100U);
+
+    // Set PWM and enable line
+    pwm_set(TIM3, 3, fan_state.power);
+    current_board->set_fan_enabled(!fan_stalled && ((fan_state.target_rpm > 0U) || (fan_state.cooldown_counter > 0U)));
+  }
+}

panda/board/drivers/fdcan.h

@@ -0,0 +1,265 @@
+// IRQs: FDCAN1_IT0, FDCAN1_IT1
+//       FDCAN2_IT0, FDCAN2_IT1
+//       FDCAN3_IT0, FDCAN3_IT1
+
+#define CANFD
+
+typedef struct {
+  volatile uint32_t header[2];
+  volatile uint32_t data_word[CANPACKET_DATA_SIZE_MAX/4U];
+} canfd_fifo;
+
+FDCAN_GlobalTypeDef *cans[] = {FDCAN1, FDCAN2, FDCAN3};
+
+uint8_t can_irq_number[3][2] = {
+  { FDCAN1_IT0_IRQn, FDCAN1_IT1_IRQn },
+  { FDCAN2_IT0_IRQn, FDCAN2_IT1_IRQn },
+  { FDCAN3_IT0_IRQn, FDCAN3_IT1_IRQn },
+};
+
+#define CAN_ACK_ERROR 3U
+
+bool can_set_speed(uint8_t can_number) {
+  bool ret = true;
+  FDCAN_GlobalTypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  ret &= llcan_set_speed(
+    CANx,
+    bus_config[bus_number].can_speed,
+    bus_config[bus_number].can_data_speed,
+    bus_config[bus_number].canfd_non_iso,
+    can_loopback,
+    (unsigned int)(can_silent) & (1U << can_number)
+  );
+  return ret;
+}
+
+void can_set_gmlan(uint8_t bus) {
+  UNUSED(bus);
+  print("GMLAN not available on red panda\n");
+}
+
+void update_can_health_pkt(uint8_t can_number, uint32_t ir_reg) {
+  FDCAN_GlobalTypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint32_t psr_reg = CANx->PSR;
+  uint32_t ecr_reg = CANx->ECR;
+
+  can_health[can_number].bus_off = ((psr_reg & FDCAN_PSR_BO) >> FDCAN_PSR_BO_Pos);
+  can_health[can_number].bus_off_cnt += can_health[can_number].bus_off;
+  can_health[can_number].error_warning = ((psr_reg & FDCAN_PSR_EW) >> FDCAN_PSR_EW_Pos);
+  can_health[can_number].error_passive = ((psr_reg & FDCAN_PSR_EP) >> FDCAN_PSR_EP_Pos);
+
+  can_health[can_number].last_error = ((psr_reg & FDCAN_PSR_LEC) >> FDCAN_PSR_LEC_Pos);
+  if ((can_health[can_number].last_error != 0U) && (can_health[can_number].last_error != 7U)) {
+    can_health[can_number].last_stored_error = can_health[can_number].last_error;
+  }
+
+  can_health[can_number].last_data_error = ((psr_reg & FDCAN_PSR_DLEC) >> FDCAN_PSR_DLEC_Pos);
+  if ((can_health[can_number].last_data_error != 0U) && (can_health[can_number].last_data_error != 7U)) {
+    can_health[can_number].last_data_stored_error = can_health[can_number].last_data_error;
+  }
+
+  can_health[can_number].receive_error_cnt = ((ecr_reg & FDCAN_ECR_REC) >> FDCAN_ECR_REC_Pos);
+  can_health[can_number].transmit_error_cnt = ((ecr_reg & FDCAN_ECR_TEC) >> FDCAN_ECR_TEC_Pos);
+
+  can_health[can_number].irq0_call_rate = interrupts[can_irq_number[can_number][0]].call_rate;
+  can_health[can_number].irq1_call_rate = interrupts[can_irq_number[can_number][1]].call_rate;
+
+
+  if (ir_reg != 0U) {
+    // Clear error interrupts
+    CANx->IR |= (FDCAN_IR_PED | FDCAN_IR_PEA | FDCAN_IR_EP | FDCAN_IR_BO | FDCAN_IR_RF0L);
+    can_health[can_number].total_error_cnt += 1U;
+    // Check for RX FIFO overflow
+    if ((ir_reg & (FDCAN_IR_RF0L)) != 0) {
+      can_health[can_number].total_rx_lost_cnt += 1U;
+    }
+    // While multiplexing between buses 1 and 3 we are getting ACK errors that overwhelm CAN core
+    // By resseting CAN core when no ACK is detected for a while(until TEC counter reaches 127) it can recover faster
+    if (((can_health[can_number].last_error == CAN_ACK_ERROR) || (can_health[can_number].last_data_error == CAN_ACK_ERROR)) && (can_health[can_number].transmit_error_cnt > 127U)) {
+      can_health[can_number].can_core_reset_cnt += 1U;
+      can_health[can_number].total_tx_lost_cnt += (FDCAN_TX_FIFO_EL_CNT - (CANx->TXFQS & FDCAN_TXFQS_TFFL)); // TX FIFO msgs will be lost after reset
+      llcan_clear_send(CANx);
+    }
+  }
+}
+
+// ***************************** CAN *****************************
+// FDCANx_IT1 IRQ Handler (TX)
+void process_can(uint8_t can_number) {
+  if (can_number != 0xffU) {
+    ENTER_CRITICAL();
+
+    FDCAN_GlobalTypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+    uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+    CANx->IR |= FDCAN_IR_TFE; // Clear Tx FIFO Empty flag
+
+    if ((CANx->TXFQS & FDCAN_TXFQS_TFQF) == 0) {
+      CANPacket_t to_send;
+      if (can_pop(can_queues[bus_number], &to_send)) {
+        if (can_check_checksum(&to_send)) {
+          can_health[can_number].total_tx_cnt += 1U;
+
+          uint32_t TxFIFOSA = FDCAN_START_ADDRESS + (can_number * FDCAN_OFFSET) + (FDCAN_RX_FIFO_0_EL_CNT * FDCAN_RX_FIFO_0_EL_SIZE);
+          // get the index of the next TX FIFO element (0 to FDCAN_TX_FIFO_EL_CNT - 1)
+          uint8_t tx_index = (CANx->TXFQS >> FDCAN_TXFQS_TFQPI_Pos) & 0x1F;
+          // only send if we have received a packet
+          canfd_fifo *fifo;
+          fifo = (canfd_fifo *)(TxFIFOSA + (tx_index * FDCAN_TX_FIFO_EL_SIZE));
+
+          fifo->header[0] = (to_send.extended << 30) | ((to_send.extended != 0U) ? (to_send.addr) : (to_send.addr << 18));
+          fifo->header[1] = (to_send.data_len_code << 16) | (bus_config[can_number].canfd_enabled << 21) | (bus_config[can_number].brs_enabled << 20);
+
+          uint8_t data_len_w = (dlc_to_len[to_send.data_len_code] / 4U);
+          data_len_w += ((dlc_to_len[to_send.data_len_code] % 4U) > 0U) ? 1U : 0U;
+          for (unsigned int i = 0; i < data_len_w; i++) {
+            BYTE_ARRAY_TO_WORD(fifo->data_word[i], &to_send.data[i*4U]);
+          }
+
+          CANx->TXBAR = (1UL << tx_index);
+
+          // Send back to USB
+          CANPacket_t to_push;
+
+          to_push.returned = 1U;
+          to_push.rejected = 0U;
+          to_push.extended = to_send.extended;
+          to_push.addr = to_send.addr;
+          to_push.bus = to_send.bus;
+          to_push.data_len_code = to_send.data_len_code;
+          (void)memcpy(to_push.data, to_send.data, dlc_to_len[to_push.data_len_code]);
+          can_set_checksum(&to_push);
+
+          rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+        } else {
+          can_health[can_number].total_tx_checksum_error_cnt += 1U;
+        }
+
+        refresh_can_tx_slots_available();
+      }
+    }
+    EXIT_CRITICAL();
+  }
+}
+
+// FDCANx_IT0 IRQ Handler (RX and errors)
+// blink blue when we are receiving CAN messages
+void can_rx(uint8_t can_number) {
+  FDCAN_GlobalTypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+  uint8_t bus_number = BUS_NUM_FROM_CAN_NUM(can_number);
+
+  uint32_t ir_reg = CANx->IR;
+
+  // Clear all new messages from Rx FIFO 0
+  CANx->IR |= FDCAN_IR_RF0N;
+  while((CANx->RXF0S & FDCAN_RXF0S_F0FL) != 0) {
+    can_health[can_number].total_rx_cnt += 1U;
+
+    // can is live
+    pending_can_live = 1;
+
+    // get the index of the next RX FIFO element (0 to FDCAN_RX_FIFO_0_EL_CNT - 1)
+    uint8_t rx_fifo_idx = (uint8_t)((CANx->RXF0S >> FDCAN_RXF0S_F0GI_Pos) & 0x3F);
+
+    // Recommended to offset get index by at least +1 if RX FIFO is in overwrite mode and full (datasheet)
+    if((CANx->RXF0S & FDCAN_RXF0S_F0F) == FDCAN_RXF0S_F0F) {
+      rx_fifo_idx = ((rx_fifo_idx + 1U) >= FDCAN_RX_FIFO_0_EL_CNT) ? 0U : (rx_fifo_idx + 1U);
+      can_health[can_number].total_rx_lost_cnt += 1U; // At least one message was lost
+    }
+
+    uint32_t RxFIFO0SA = FDCAN_START_ADDRESS + (can_number * FDCAN_OFFSET);
+    CANPacket_t to_push;
+    canfd_fifo *fifo;
+
+    // getting address
+    fifo = (canfd_fifo *)(RxFIFO0SA + (rx_fifo_idx * FDCAN_RX_FIFO_0_EL_SIZE));
+
+    to_push.returned = 0U;
+    to_push.rejected = 0U;
+    to_push.extended = (fifo->header[0] >> 30) & 0x1U;
+    to_push.addr = ((to_push.extended != 0U) ? (fifo->header[0] & 0x1FFFFFFFU) : ((fifo->header[0] >> 18) & 0x7FFU));
+    to_push.bus = bus_number;
+    to_push.data_len_code = ((fifo->header[1] >> 16) & 0xFU);
+
+    bool canfd_frame = ((fifo->header[1] >> 21) & 0x1U);
+    bool brs_frame = ((fifo->header[1] >> 20) & 0x1U);
+
+    uint8_t data_len_w = (dlc_to_len[to_push.data_len_code] / 4U);
+    data_len_w += ((dlc_to_len[to_push.data_len_code] % 4U) > 0U) ? 1U : 0U;
+    for (unsigned int i = 0; i < data_len_w; i++) {
+      WORD_TO_BYTE_ARRAY(&to_push.data[i*4U], fifo->data_word[i]);
+    }
+    can_set_checksum(&to_push);
+
+    // forwarding (panda only)
+    int bus_fwd_num = safety_fwd_hook(bus_number, to_push.addr);
+    if (bus_fwd_num != -1) {
+      CANPacket_t to_send;
+
+      to_send.returned = 0U;
+      to_send.rejected = 0U;
+      to_send.extended = to_push.extended;
+      to_send.addr = to_push.addr;
+      to_send.bus = to_push.bus;
+      to_send.data_len_code = to_push.data_len_code;
+      (void)memcpy(to_send.data, to_push.data, dlc_to_len[to_push.data_len_code]);
+      can_set_checksum(&to_send);
+
+      can_send(&to_send, bus_fwd_num, true);
+      can_health[can_number].total_fwd_cnt += 1U;
+    }
+
+    safety_rx_invalid += safety_rx_hook(&to_push) ? 0U : 1U;
+    ignition_can_hook(&to_push);
+
+    current_board->set_led(LED_BLUE, true);
+    rx_buffer_overflow += can_push(&can_rx_q, &to_push) ? 0U : 1U;
+
+    // Enable CAN FD and BRS if CAN FD message was received
+    if (!(bus_config[can_number].canfd_enabled) && (canfd_frame)) {
+      bus_config[can_number].canfd_enabled = true;
+    }
+    if (!(bus_config[can_number].brs_enabled) && (brs_frame)) {
+      bus_config[can_number].brs_enabled = true;
+    }
+
+    // update read index
+    CANx->RXF0A = rx_fifo_idx;
+  }
+
+  // Error handling
+  if ((ir_reg & (FDCAN_IR_PED | FDCAN_IR_PEA | FDCAN_IR_EP | FDCAN_IR_BO | FDCAN_IR_RF0L)) != 0) {
+    update_can_health_pkt(can_number, ir_reg);
+  }
+}
+
+void FDCAN1_IT0_IRQ_Handler(void) { can_rx(0); }
+void FDCAN1_IT1_IRQ_Handler(void) { process_can(0); }
+
+void FDCAN2_IT0_IRQ_Handler(void) { can_rx(1); }
+void FDCAN2_IT1_IRQ_Handler(void) { process_can(1); }
+
+void FDCAN3_IT0_IRQ_Handler(void) { can_rx(2);  }
+void FDCAN3_IT1_IRQ_Handler(void) { process_can(2); }
+
+bool can_init(uint8_t can_number) {
+  bool ret = false;
+
+  REGISTER_INTERRUPT(FDCAN1_IT0_IRQn, FDCAN1_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(FDCAN1_IT1_IRQn, FDCAN1_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(FDCAN2_IT0_IRQn, FDCAN2_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(FDCAN2_IT1_IRQn, FDCAN2_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_2)
+  REGISTER_INTERRUPT(FDCAN3_IT0_IRQn, FDCAN3_IT0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+  REGISTER_INTERRUPT(FDCAN3_IT1_IRQn, FDCAN3_IT1_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_3)
+
+  if (can_number != 0xffU) {
+    FDCAN_GlobalTypeDef *CANx = CANIF_FROM_CAN_NUM(can_number);
+    ret &= can_set_speed(can_number);
+    ret &= llcan_init(CANx);
+    // in case there are queued up messages
+    process_can(can_number);
+  }
+  return ret;
+}

panda/board/drivers/gmlan_alt.h

@@ -0,0 +1,293 @@
+#define GMLAN_TICKS_PER_SECOND 33300 //1sec @ 33.3kbps
+#define GMLAN_TICKS_PER_TIMEOUT_TICKLE 500 //15ms @ 33.3kbps
+#define GMLAN_HIGH 0 //0 is high on bus (dominant)
+#define GMLAN_LOW 1 //1 is low on bus
+
+#define DISABLED -1
+#define BITBANG 0
+#define GPIO_SWITCH 1
+
+#define MAX_BITS_CAN_PACKET (200)
+
+int gmlan_alt_mode = DISABLED;
+
+// returns out_len
+int do_bitstuff(char *out, char *in, int in_len) {
+  int last_bit = -1;
+  int bit_cnt = 0;
+  int j = 0;
+  for (int i = 0; i < in_len; i++) {
+    char bit = in[i];
+    out[j] = bit;
+    j++;
+
+    // do the stuffing
+    if (bit == last_bit) {
+      bit_cnt++;
+      if (bit_cnt == 5) {
+        // 5 in a row the same, do stuff
+        last_bit = !bit;
+        out[j] = last_bit;
+        j++;
+        bit_cnt = 1;
+      }
+    } else {
+      // this is a new bit
+      last_bit = bit;
+      bit_cnt = 1;
+    }
+  }
+  return j;
+}
+
+int append_crc(char *in, int in_len) {
+  unsigned int crc = 0;
+  for (int i = 0; i < in_len; i++) {
+    crc <<= 1;
+    if (((unsigned int)(in[i]) ^ ((crc >> 15) & 1U)) != 0U) {
+      crc = crc ^ 0x4599U;
+    }
+    crc &= 0x7fffU;
+  }
+  int in_len_copy = in_len;
+  for (int i = 14; i >= 0; i--) {
+    in[in_len_copy] = (crc >> (unsigned int)(i)) & 1U;
+    in_len_copy++;
+  }
+  return in_len_copy;
+}
+
+int append_bits(char *in, int in_len, char *app, int app_len) {
+  int in_len_copy = in_len;
+  for (int i = 0; i < app_len; i++) {
+    in[in_len_copy] = app[i];
+    in_len_copy++;
+  }
+  return in_len_copy;
+}
+
+int append_int(char *in, int in_len, int val, int val_len) {
+  int in_len_copy = in_len;
+  for (int i = val_len - 1; i >= 0; i--) {
+    in[in_len_copy] = ((unsigned int)(val) & (1U << (unsigned int)(i))) != 0U;
+    in_len_copy++;
+  }
+  return in_len_copy;
+}
+
+int get_bit_message(char *out, CANPacket_t *to_bang) {
+  char pkt[MAX_BITS_CAN_PACKET];
+  char footer[] = {
+    1,  // CRC delimiter
+    1,  // ACK
+    1,  // ACK delimiter
+    1,1,1,1,1,1,1, // EOF
+    1,1,1, // IFS
+  };
+
+  int len = 0;
+
+  // test packet
+  int dlc_len = GET_LEN(to_bang);
+  len = append_int(pkt, len, 0, 1);    // Start-of-frame
+
+  if (to_bang->extended != 0U) {
+    // extended identifier
+    len = append_int(pkt, len, GET_ADDR(to_bang) >> 18, 11);  // Identifier
+    len = append_int(pkt, len, 3, 2);    // SRR+IDE
+    len = append_int(pkt, len, (GET_ADDR(to_bang)) & ((1U << 18) - 1U), 18);  // Identifier
+    len = append_int(pkt, len, 0, 3);    // RTR+r1+r0
+  } else {
+    // standard identifier
+    len = append_int(pkt, len, GET_ADDR(to_bang), 11);  // Identifier
+    len = append_int(pkt, len, 0, 3);    // RTR+IDE+reserved
+  }
+
+  len = append_int(pkt, len, dlc_len, 4);    // Data length code
+
+  // append data
+  for (int i = 0; i < dlc_len; i++) {
+    len = append_int(pkt, len, to_bang->data[i], 8);
+  }
+
+  // append crc
+  len = append_crc(pkt, len);
+
+  // do bitstuffing
+  len = do_bitstuff(out, pkt, len);
+
+  // append footer
+  len = append_bits(out, len, footer, sizeof(footer));
+  return len;
+}
+
+void TIM12_IRQ_Handler(void);
+
+void setup_timer(void) {
+  // register interrupt
+  REGISTER_INTERRUPT(TIM8_BRK_TIM12_IRQn, TIM12_IRQ_Handler, 40000U, FAULT_INTERRUPT_RATE_GMLAN)
+
+  // setup
+  register_set(&(TIM12->PSC), (48-1), 0xFFFFU);    // Tick on 1 us
+  register_set(&(TIM12->CR1), TIM_CR1_CEN, 0x3FU); // Enable
+  register_set(&(TIM12->ARR), (30-1), 0xFFFFU);   // 33.3 kbps
+
+  // in case it's disabled
+  NVIC_EnableIRQ(TIM8_BRK_TIM12_IRQn);
+
+  // run the interrupt
+  register_set(&(TIM12->DIER), TIM_DIER_UIE, 0x5F5FU); // Update interrupt
+  TIM12->SR = 0;
+}
+
+int gmlan_timeout_counter = GMLAN_TICKS_PER_TIMEOUT_TICKLE; //GMLAN transceiver times out every 17ms held high; tickle every 15ms
+int can_timeout_counter = GMLAN_TICKS_PER_SECOND; //1 second
+
+int inverted_bit_to_send = GMLAN_HIGH;
+int gmlan_switch_below_timeout = -1;
+int gmlan_switch_timeout_enable = 0;
+
+void gmlan_switch_init(int timeout_enable) {
+  gmlan_switch_timeout_enable = timeout_enable;
+  gmlan_alt_mode = GPIO_SWITCH;
+  gmlan_switch_below_timeout = 1;
+  set_gpio_mode(GPIOB, 13, MODE_OUTPUT);
+
+  setup_timer();
+
+  inverted_bit_to_send = GMLAN_LOW; //We got initialized, set the output low
+}
+
+void set_gmlan_digital_output(int to_set) {
+  inverted_bit_to_send = to_set;
+  /*
+  print("Writing ");
+  puth(inverted_bit_to_send);
+  print("\n");
+  */
+}
+
+void reset_gmlan_switch_timeout(void) {
+  can_timeout_counter = GMLAN_TICKS_PER_SECOND;
+  gmlan_switch_below_timeout = 1;
+  gmlan_alt_mode = GPIO_SWITCH;
+}
+
+void set_bitbanged_gmlan(int val) {
+  if (val != 0) {
+    register_set_bits(&(GPIOB->ODR), (1U << 13));
+  } else {
+    register_clear_bits(&(GPIOB->ODR), (1U << 13));
+  }
+}
+
+char pkt_stuffed[MAX_BITS_CAN_PACKET];
+int gmlan_sending = -1;
+int gmlan_sendmax = -1;
+bool gmlan_send_ok = true;
+
+int gmlan_silent_count = 0;
+int gmlan_fail_count = 0;
+#define REQUIRED_SILENT_TIME 10
+#define MAX_FAIL_COUNT 10
+
+void TIM12_IRQ_Handler(void) {
+  if (gmlan_alt_mode == BITBANG) {
+    if ((TIM12->SR & TIM_SR_UIF) && (gmlan_sendmax != -1)) {
+      int read = get_gpio_input(GPIOB, 12);
+      if (gmlan_silent_count < REQUIRED_SILENT_TIME) {
+        if (read == 0) {
+          gmlan_silent_count = 0;
+        } else {
+          gmlan_silent_count++;
+        }
+      } else {
+        bool retry = 0;
+        // in send loop
+        if ((gmlan_sending > 0) &&  // not first bit
+           ((read == 0) && (pkt_stuffed[gmlan_sending-1] == 1)) &&  // bus wrongly dominant
+           (gmlan_sending != (gmlan_sendmax - 11))) {    //not ack bit
+          print("GMLAN ERR: bus driven at ");
+          puth(gmlan_sending);
+          print("\n");
+          retry = 1;
+        } else if ((read == 1) && (gmlan_sending == (gmlan_sendmax - 11))) {    // recessive during ACK
+          print("GMLAN ERR: didn't recv ACK\n");
+          retry = 1;
+        } else {
+          // do not retry
+        }
+        if (retry) {
+          // reset sender (retry after 7 silent)
+          set_bitbanged_gmlan(1); // recessive
+          gmlan_silent_count = 0;
+          gmlan_sending = 0;
+          gmlan_fail_count++;
+          if (gmlan_fail_count == MAX_FAIL_COUNT) {
+            print("GMLAN ERR: giving up send\n");
+            gmlan_send_ok = false;
+          }
+        } else {
+          set_bitbanged_gmlan(pkt_stuffed[gmlan_sending]);
+          gmlan_sending++;
+        }
+      }
+      if ((gmlan_sending == gmlan_sendmax) || (gmlan_fail_count == MAX_FAIL_COUNT)) {
+        set_bitbanged_gmlan(1); // recessive
+        set_gpio_mode(GPIOB, 13, MODE_INPUT);
+        register_clear_bits(&(TIM12->DIER), TIM_DIER_UIE); // No update interrupt
+        register_set(&(TIM12->CR1), 0U, 0x3FU); // Disable timer
+        gmlan_sendmax = -1;   // exit
+      }
+    }
+  } else if (gmlan_alt_mode == GPIO_SWITCH) {
+    if ((TIM12->SR & TIM_SR_UIF) && (gmlan_switch_below_timeout != -1)) {
+      if ((can_timeout_counter == 0) && gmlan_switch_timeout_enable) {
+        //it has been more than 1 second since timeout was reset; disable timer and restore the GMLAN output
+        set_gpio_output(GPIOB, 13, GMLAN_LOW);
+        gmlan_switch_below_timeout = -1;
+        gmlan_timeout_counter = GMLAN_TICKS_PER_TIMEOUT_TICKLE;
+        gmlan_alt_mode = DISABLED;
+      }
+      else {
+        can_timeout_counter--;
+        if (gmlan_timeout_counter == 0) {
+          //Send a 1 (bus low) every 15ms to reset the GMLAN transceivers timeout
+          gmlan_timeout_counter = GMLAN_TICKS_PER_TIMEOUT_TICKLE;
+          set_gpio_output(GPIOB, 13, GMLAN_LOW);
+        }
+        else {
+          set_gpio_output(GPIOB, 13, inverted_bit_to_send);
+          gmlan_timeout_counter--;
+        }
+      }
+    }
+  } else {
+    // Invalid GMLAN mode. Do not put a print statement here, way too fast to keep up with
+  }
+  TIM12->SR = 0;
+}
+
+bool bitbang_gmlan(CANPacket_t *to_bang) {
+  gmlan_send_ok = true;
+  gmlan_alt_mode = BITBANG;
+
+#ifndef STM32H7
+  if (gmlan_sendmax == -1) {
+    int len = get_bit_message(pkt_stuffed, to_bang);
+    gmlan_fail_count = 0;
+    gmlan_silent_count = 0;
+    gmlan_sending = 0;
+    gmlan_sendmax = len;
+    // setup for bitbang loop
+    set_bitbanged_gmlan(1); // recessive
+    set_gpio_mode(GPIOB, 13, MODE_OUTPUT);
+
+    // 33kbps
+    setup_timer();
+  }
+#else
+  UNUSED(to_bang);
+#endif
+  return gmlan_send_ok;
+}

panda/board/drivers/gpio.h

@@ -0,0 +1,75 @@
+#define MODE_INPUT 0
+#define MODE_OUTPUT 1
+#define MODE_ALTERNATE 2
+#define MODE_ANALOG 3
+
+#define PULL_NONE 0
+#define PULL_UP 1
+#define PULL_DOWN 2
+
+#define OUTPUT_TYPE_PUSH_PULL 0U
+#define OUTPUT_TYPE_OPEN_DRAIN 1U
+
+void set_gpio_mode(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->MODER;
+  tmp &= ~(3U << (pin * 2U));
+  tmp |= (mode << (pin * 2U));
+  register_set(&(GPIO->MODER), tmp, 0xFFFFFFFFU);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_output(GPIO_TypeDef *GPIO, unsigned int pin, bool enabled) {
+  ENTER_CRITICAL();
+  if (enabled) {
+    register_set_bits(&(GPIO->ODR), (1U << pin));
+  } else {
+    register_clear_bits(&(GPIO->ODR), (1U << pin));
+  }
+  set_gpio_mode(GPIO, pin, MODE_OUTPUT);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_output_type(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int output_type){
+  ENTER_CRITICAL();
+  if(output_type == OUTPUT_TYPE_OPEN_DRAIN) {
+    register_set_bits(&(GPIO->OTYPER), (1U << pin));
+  } else {
+    register_clear_bits(&(GPIO->OTYPER), (1U << pin));
+  }
+  EXIT_CRITICAL();
+}
+
+void set_gpio_alternate(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->AFR[pin >> 3U];
+  tmp &= ~(0xFU << ((pin & 7U) * 4U));
+  tmp |= mode << ((pin & 7U) * 4U);
+  register_set(&(GPIO->AFR[pin >> 3]), tmp, 0xFFFFFFFFU);
+  set_gpio_mode(GPIO, pin, MODE_ALTERNATE);
+  EXIT_CRITICAL();
+}
+
+void set_gpio_pullup(GPIO_TypeDef *GPIO, unsigned int pin, unsigned int mode) {
+  ENTER_CRITICAL();
+  uint32_t tmp = GPIO->PUPDR;
+  tmp &= ~(3U << (pin * 2U));
+  tmp |= (mode << (pin * 2U));
+  register_set(&(GPIO->PUPDR), tmp, 0xFFFFFFFFU);
+  EXIT_CRITICAL();
+}
+
+int get_gpio_input(GPIO_TypeDef *GPIO, unsigned int pin) {
+  return (GPIO->IDR & (1U << pin)) == (1U << pin);
+}
+
+// Detection with internal pullup
+#define PULL_EFFECTIVE_DELAY 4096
+bool detect_with_pull(GPIO_TypeDef *GPIO, int pin, int mode) {
+  set_gpio_mode(GPIO, pin, MODE_INPUT);
+  set_gpio_pullup(GPIO, pin, mode);
+  for (volatile int i=0; i<PULL_EFFECTIVE_DELAY; i++);
+  bool ret = get_gpio_input(GPIO, pin);
+  set_gpio_pullup(GPIO, pin, PULL_NONE);
+  return ret;
+}

panda/board/drivers/harness.h

@@ -0,0 +1,133 @@
+#define HARNESS_STATUS_NC 0U
+#define HARNESS_STATUS_NORMAL 1U
+#define HARNESS_STATUS_FLIPPED 2U
+
+struct harness_t {
+  uint8_t status;
+  uint16_t sbu1_voltage_mV;
+  uint16_t sbu2_voltage_mV;
+  bool relay_driven;
+  bool sbu_adc_lock;
+};
+struct harness_t harness;
+
+struct harness_configuration {
+  const bool has_harness;
+  GPIO_TypeDef *GPIO_SBU1;
+  GPIO_TypeDef *GPIO_SBU2;
+  GPIO_TypeDef *GPIO_relay_SBU1;
+  GPIO_TypeDef *GPIO_relay_SBU2;
+  uint8_t pin_SBU1;
+  uint8_t pin_SBU2;
+  uint8_t pin_relay_SBU1;
+  uint8_t pin_relay_SBU2;
+  uint8_t adc_channel_SBU1;
+  uint8_t adc_channel_SBU2;
+};
+
+void set_intercept_relay(bool intercept) {
+  if (current_board->harness_config->has_harness) {
+    bool drive_relay = intercept;
+    if (harness.status == HARNESS_STATUS_NC) {
+      // no harness, no relay to drive
+      drive_relay = false;
+    }
+
+    if (drive_relay) {
+      harness.relay_driven = true;
+    }
+
+    // wait until we're not reading the analog voltages anymore
+    while (harness.sbu_adc_lock == true) {}
+
+    if (harness.status == HARNESS_STATUS_NORMAL) {
+      set_gpio_output(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, true);
+      set_gpio_output(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, !drive_relay);
+    } else {
+      set_gpio_output(current_board->harness_config->GPIO_relay_SBU1, current_board->harness_config->pin_relay_SBU1, !drive_relay);
+      set_gpio_output(current_board->harness_config->GPIO_relay_SBU2, current_board->harness_config->pin_relay_SBU2, true);
+    }
+
+    if (!drive_relay) {
+      harness.relay_driven = false;
+    }
+  }
+}
+
+bool harness_check_ignition(void) {
+  bool ret = false;
+
+  // wait until we're not reading the analog voltages anymore
+  while (harness.sbu_adc_lock == true) {}
+
+  switch(harness.status){
+    case HARNESS_STATUS_NORMAL:
+      ret = !get_gpio_input(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1);
+      break;
+    case HARNESS_STATUS_FLIPPED:
+      ret = !get_gpio_input(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2);
+      break;
+    default:
+      break;
+  }
+  return ret;
+}
+
+uint8_t harness_detect_orientation(void) {
+  uint8_t ret = harness.status;
+
+  #ifndef BOOTSTUB
+  // We can't detect orientation if the relay is being driven
+  if (!harness.relay_driven && current_board->harness_config->has_harness) {
+    harness.sbu_adc_lock = true;
+    set_gpio_mode(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1, MODE_ANALOG);
+    set_gpio_mode(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2, MODE_ANALOG);
+
+    harness.sbu1_voltage_mV = adc_get_mV(current_board->harness_config->adc_channel_SBU1);
+    harness.sbu2_voltage_mV = adc_get_mV(current_board->harness_config->adc_channel_SBU2);
+    uint16_t detection_threshold = current_board->avdd_mV / 2U;
+
+    // Detect connection and orientation
+    if((harness.sbu1_voltage_mV < detection_threshold) || (harness.sbu2_voltage_mV < detection_threshold)){
+      if (harness.sbu1_voltage_mV < harness.sbu2_voltage_mV) {
+        // orientation flipped (PANDA_SBU1->HARNESS_SBU1(relay), PANDA_SBU2->HARNESS_SBU2(ign))
+        ret = HARNESS_STATUS_FLIPPED;
+      } else {
+        // orientation normal (PANDA_SBU2->HARNESS_SBU1(relay), PANDA_SBU1->HARNESS_SBU2(ign))
+        ret = HARNESS_STATUS_NORMAL;
+      }
+    } else {
+      ret = HARNESS_STATUS_NC;
+    }
+
+    // Pins are not 5V tolerant in ADC mode
+    set_gpio_mode(current_board->harness_config->GPIO_SBU1, current_board->harness_config->pin_SBU1, MODE_INPUT);
+    set_gpio_mode(current_board->harness_config->GPIO_SBU2, current_board->harness_config->pin_SBU2, MODE_INPUT);
+    harness.sbu_adc_lock = false;
+  }
+  #endif
+
+  return ret;
+}
+
+void harness_tick(void) {
+  harness.status = harness_detect_orientation();
+}
+
+void harness_init(void) {
+  // delay such that the connection is fully made before trying orientation detection
+  current_board->set_led(LED_BLUE, true);
+  delay(10000000);
+  current_board->set_led(LED_BLUE, false);
+
+  // try to detect orientation
+  harness.status = harness_detect_orientation();
+  if (harness.status != HARNESS_STATUS_NC) {
+    print("detected car harness with orientation "); puth2(harness.status); print("\n");
+  } else {
+    print("failed to detect car harness!\n");
+  }
+
+  // keep buses connected by default
+  set_intercept_relay(false);
+}

panda/board/drivers/interrupts.h

@@ -0,0 +1,99 @@
+typedef struct interrupt {
+  IRQn_Type irq_type;
+  void (*handler)(void);
+  uint32_t call_counter;
+  uint32_t call_rate;
+  uint32_t max_call_rate;   // Call rate is defined as the amount of calls each second
+  uint32_t call_rate_fault;
+} interrupt;
+
+void interrupt_timer_init(void);
+uint32_t microsecond_timer_get(void);
+
+void unused_interrupt_handler(void) {
+  // Something is wrong if this handler is called!
+  print("Unused interrupt handler called!\n");
+  fault_occurred(FAULT_UNUSED_INTERRUPT_HANDLED);
+}
+
+interrupt interrupts[NUM_INTERRUPTS];
+
+#define REGISTER_INTERRUPT(irq_num, func_ptr, call_rate_max, rate_fault) \
+  interrupts[irq_num].irq_type = (irq_num); \
+  interrupts[irq_num].handler = (func_ptr);  \
+  interrupts[irq_num].call_counter = 0U;   \
+  interrupts[irq_num].call_rate = 0U;   \
+  interrupts[irq_num].max_call_rate = (call_rate_max); \
+  interrupts[irq_num].call_rate_fault = (rate_fault);
+
+bool check_interrupt_rate = false;
+
+uint8_t interrupt_depth = 0U;
+uint32_t last_time = 0U;
+uint32_t idle_time = 0U;
+uint32_t busy_time = 0U;
+float interrupt_load = 0.0f;
+
+void handle_interrupt(IRQn_Type irq_type){
+  ENTER_CRITICAL();
+  if (interrupt_depth == 0U) {
+    uint32_t time = microsecond_timer_get();
+    idle_time += get_ts_elapsed(time, last_time);
+    last_time = time;
+  }
+  interrupt_depth += 1U;
+  EXIT_CRITICAL();
+
+  interrupts[irq_type].call_counter++;
+  interrupts[irq_type].handler();
+
+  // Check that the interrupts don't fire too often
+  if (check_interrupt_rate && (interrupts[irq_type].call_counter > interrupts[irq_type].max_call_rate)) {
+    fault_occurred(interrupts[irq_type].call_rate_fault);
+  }
+
+  ENTER_CRITICAL();
+  interrupt_depth -= 1U;
+  if (interrupt_depth == 0U) {
+    uint32_t time = microsecond_timer_get();
+    busy_time += get_ts_elapsed(time, last_time);
+    last_time = time;
+  }
+  EXIT_CRITICAL();
+}
+
+// Every second
+void interrupt_timer_handler(void) {
+  if (INTERRUPT_TIMER->SR != 0) {
+    for (uint16_t i = 0U; i < NUM_INTERRUPTS; i++) {
+      // Log IRQ call rate faults
+      if (check_interrupt_rate && (interrupts[i].call_counter > interrupts[i].max_call_rate)) {
+        print("Interrupt 0x"); puth(i); print(" fired too often (0x"); puth(interrupts[i].call_counter); print("/s)!\n");
+      }
+
+      // Reset interrupt counters
+      interrupts[i].call_rate = interrupts[i].call_counter;
+      interrupts[i].call_counter = 0U;
+    }
+
+    // Calculate interrupt load
+    // The bootstub does not have the FPU enabled, so can't do float operations.
+#if !defined(PEDAL) && !defined(BOOTSTUB)
+    interrupt_load = ((busy_time + idle_time) > 0U) ? ((float) busy_time) / (busy_time + idle_time) : 0.0f;
+#endif
+    idle_time = 0U;
+    busy_time = 0U;
+  }
+  INTERRUPT_TIMER->SR = 0;
+}
+
+void init_interrupts(bool check_rate_limit){
+  check_interrupt_rate = check_rate_limit;
+
+  for(uint16_t i=0U; i<NUM_INTERRUPTS; i++){
+    interrupts[i].handler = unused_interrupt_handler;
+  }
+
+  // Init interrupt timer for a 1s interval
+  interrupt_timer_init();
+}

panda/board/drivers/kline_init.h

@@ -0,0 +1,119 @@
+void TIM5_IRQ_Handler(void);
+
+void setup_timer5(void) {
+  // register interrupt
+  REGISTER_INTERRUPT(TIM5_IRQn, TIM5_IRQ_Handler, 1050000U, FAULT_INTERRUPT_RATE_KLINE_INIT)
+
+  // setup
+  register_set(&(TIM5->PSC), (48-1), 0xFFFFU);        // Tick on 1 us
+  register_set(&(TIM5->CR1), TIM_CR1_CEN, 0x3FU);     // Enable
+  register_set(&(TIM5->ARR), (5000-1), 0xFFFFFFFFU);  // Reset every 5 ms
+
+  // in case it's disabled
+  NVIC_EnableIRQ(TIM5_IRQn);
+
+  // run the interrupt
+  register_set(&(TIM5->DIER), TIM_DIER_UIE, 0x5F5FU); // Update interrupt
+  TIM5->SR = 0;
+}
+
+bool k_init = false;
+bool l_init = false;
+void setup_kline(bool bitbang) {
+  if (bitbang) {
+    if (k_init) {
+      set_gpio_output(GPIOC, 12, true);
+    }
+    if (l_init) {
+      set_gpio_output(GPIOC, 10, true);
+    }
+  } else {
+    if (k_init) {
+      set_gpio_mode(GPIOC, 12, MODE_ALTERNATE);
+    }
+    if (l_init) {
+      set_gpio_mode(GPIOC, 10, MODE_ALTERNATE);
+    }
+  }
+}
+
+void set_bitbanged_kline(bool marking) {
+  // tickle needs to be super fast (so logic level doesn't change)
+  ENTER_CRITICAL();
+  if (k_init) {
+    register_set_bits(&(GPIOC->ODR), (1U << 12));
+    if (!marking) {
+      register_clear_bits(&(GPIOC->ODR), (1U << 12));
+    }
+  }
+  if (l_init) {
+    register_set_bits(&(GPIOC->ODR), (1U << 10));
+    if (!marking) {
+      register_clear_bits(&(GPIOC->ODR), (1U << 10));
+    }
+  }
+  EXIT_CRITICAL();
+  // blink blue LED each time line is pulled low
+  current_board->set_led(LED_BLUE, marking);
+}
+
+uint16_t kline_data = 0;
+uint16_t kline_data_len = 0;
+uint16_t kline_bit_count = 0;
+uint16_t kline_tick_count = 0;
+uint16_t kline_ticks_per_bit = 0;
+
+void TIM5_IRQ_Handler(void) {
+  if ((TIM5->SR & TIM_SR_UIF) && (kline_data != 0U)) {
+    if (kline_bit_count < kline_data_len) {
+      bool marking = (kline_data & (1U << kline_bit_count)) != 0U;
+      set_bitbanged_kline(marking);
+    } else {
+      register_clear_bits(&(TIM5->DIER), TIM_DIER_UIE); // No update interrupt
+      register_set(&(TIM5->CR1), 0U, 0x3FU); // Disable timer
+      setup_kline(false);
+      kline_data = 0U;
+      USB_WritePacket(NULL, 0, 0); // required call (so send nothing)
+      USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+    }
+    kline_tick_count++;
+    if ((kline_tick_count % kline_ticks_per_bit) == 0U) {
+      kline_bit_count++;
+    }
+  }
+  TIM5->SR = 0;
+}
+
+bool bitbang_five_baud_addr(bool k, bool l, uint8_t addr) {
+  bool result = false;
+  if (kline_data == 0U) {
+    k_init = k;
+    l_init = l;
+    kline_data = (addr << 1) + 0x200U; // add start/stop bits
+    kline_data_len = 10U;
+    kline_bit_count = 0;
+    kline_tick_count = 0;
+    kline_ticks_per_bit = 40U; // 200ms == 5bps
+    setup_kline(true);
+    setup_timer5();
+    result = true;
+  }
+  return result;
+}
+
+bool bitbang_wakeup(bool k, bool l) {
+  bool result = false;
+  if (kline_data == 0U) {
+    k_init = k;
+    l_init = l;
+    kline_data = 2U; // low then high
+    kline_data_len = 2U;
+    kline_bit_count = 0;
+    kline_tick_count = 0;
+    kline_ticks_per_bit = 5U; // 25ms == 40bps
+    setup_kline(true);
+    setup_timer5();
+    result = true;
+  }
+  return result;
+}

panda/board/drivers/logging.h

@@ -0,0 +1,193 @@
+
+#include "logging_definitions.h"
+
+#define BANK_SIZE LOGGING_FLASH_SECTOR_SIZE
+#define BANK_LOG_CAPACITY (BANK_SIZE / sizeof(log_t))
+#define TOTAL_LOG_CAPACITY (BANK_LOG_CAPACITY * 2U)
+
+#define LOGGING_MAX_LOGS_PER_MINUTE 10U
+
+struct logging_state_t {
+  uint16_t read_index;
+  uint16_t write_index;
+  uint16_t last_id;
+
+  uint8_t rate_limit_counter;
+  uint8_t rate_limit_log_count;
+};
+struct logging_state_t log_state = { 0 };
+log_t *log_arr = (log_t *) LOGGING_FLASH_BASE_A;
+
+uint16_t logging_next_id(uint16_t id) {
+  return (id + 1U) % 0xFFFEU;
+}
+
+uint16_t logging_next_index(uint16_t index) {
+  return (index + 1U) % TOTAL_LOG_CAPACITY;
+}
+
+void logging_erase_bank(uint8_t flash_sector) {
+  print("erasing sector "); puth(flash_sector); print("\n");
+  flash_unlock();
+  if (!flash_erase_sector(flash_sector)) {
+    print("failed to erase sector "); puth(flash_sector); print("\n");
+  }
+  flash_lock();
+}
+
+void logging_erase(void) {
+  logging_erase_bank(LOGGING_FLASH_SECTOR_A);
+  logging_erase_bank(LOGGING_FLASH_SECTOR_B);
+  log_state.read_index = 0U;
+  log_state.write_index = 0U;
+}
+
+void logging_find_read_index(uint16_t last_id) {
+  // Figure out the read index by the last empty slot
+  log_state.read_index = BANK_LOG_CAPACITY;
+  for (uint16_t i = 0U; i < TOTAL_LOG_CAPACITY; i++) {
+    if (log_arr[i].id == last_id) {
+      log_state.read_index = logging_next_index(i);
+    }
+  }
+}
+
+void logging_init_read_index(void) {
+  return logging_find_read_index(0xFFFFU);
+}
+
+void logging_init(void) {
+  COMPILE_TIME_ASSERT(sizeof(log_t) == 64U);
+  COMPILE_TIME_ASSERT((LOGGING_FLASH_BASE_A + BANK_SIZE) == LOGGING_FLASH_BASE_B);
+
+  // Make sure all empty-ID logs are fully empty
+  log_t empty_log;
+  (void) memset(&empty_log, 0xFF, sizeof(log_t));
+
+  for (uint16_t i = 0U; i < TOTAL_LOG_CAPACITY; i++) {
+    if ((log_arr[i].id == 0xFFFFU) && (memcmp(&log_arr[i], &empty_log, sizeof(log_t)) != 0)) {
+      logging_erase();
+      break;
+    }
+  }
+
+  logging_init_read_index();
+
+  // At initialization, the read index should always be at the beginning of a bank
+  // If not, clean slate
+  if ((log_state.read_index != 0U) && (log_state.read_index != BANK_LOG_CAPACITY)) {
+    logging_erase();
+  }
+
+  // Figure out the write index
+  log_state.write_index = log_state.read_index;
+  log_state.last_id = log_arr[log_state.write_index].id - 1U;
+  for (uint16_t i = 0U; i < TOTAL_LOG_CAPACITY; i++) {
+    bool done = false;
+    if (log_arr[log_state.write_index].id == 0xFFFFU) {
+      // Found the first empty slot after the read pointer
+      done = true;
+    } else if (log_arr[log_state.write_index].id != logging_next_id(log_state.last_id)) {
+      // Discontinuity in the index, shouldn't happen!
+      logging_erase();
+      done = true;
+    } else {
+      log_state.last_id = log_arr[log_state.write_index].id;
+      log_state.write_index = logging_next_index(log_state.write_index);
+    }
+
+    if (done) {
+      break;
+    }
+  }
+
+  // Reset rate limit
+  log_state.rate_limit_counter = 0U;
+  log_state.rate_limit_log_count = 0U;
+}
+
+// Call at 1Hz
+void logging_tick(void) {
+  flush_write_buffer();
+
+  log_state.rate_limit_counter++;
+  if (log_state.rate_limit_counter >= 60U) {
+    log_state.rate_limit_counter = 0U;
+    log_state.rate_limit_log_count = 0U;
+  }
+}
+
+void log(const char* msg){
+  if (log_state.rate_limit_log_count < LOGGING_MAX_LOGS_PER_MINUTE) {
+    ENTER_CRITICAL();
+    log_t new_log = {0};
+    new_log.id = logging_next_id(log_state.last_id);
+    log_state.last_id = new_log.id;
+    new_log.uptime = uptime_cnt;
+    if (current_board->has_rtc_battery) {
+      new_log.timestamp = rtc_get_time();
+    }
+
+    uint8_t i = 0U;
+    for (const char *in = msg; *in; in++) {
+      new_log.msg[i] = *in;
+      i++;
+      if (i >= sizeof(new_log.msg)) {
+        print("log message too long\n");
+        break;
+      }
+    }
+
+    // If we are at the beginning of a bank, erase it first and move the read pointer if needed
+    switch (log_state.write_index) {
+      case ((2U * BANK_LOG_CAPACITY) - 1U):
+        logging_erase_bank(LOGGING_FLASH_SECTOR_A);
+        if ((log_state.read_index < BANK_LOG_CAPACITY)) {
+          log_state.read_index = BANK_LOG_CAPACITY;
+        }
+        break;
+      case (BANK_LOG_CAPACITY - 1U):
+        // beginning to write in bank B
+        logging_erase_bank(LOGGING_FLASH_SECTOR_B);
+        if ((log_state.read_index > BANK_LOG_CAPACITY)) {
+          log_state.read_index = 0U;
+        }
+        break;
+      default:
+        break;
+    }
+
+    // Write!
+    void *addr = &log_arr[log_state.write_index];
+    uint32_t data[sizeof(log_t) / sizeof(uint32_t)];
+    (void) memcpy(data, &new_log, sizeof(log_t));
+
+    flash_unlock();
+    for (uint8_t j = 0U; j < sizeof(log_t) / sizeof(uint32_t); j++) {
+      flash_write_word(&((uint32_t *) addr)[j], data[j]);
+    }
+    flash_lock();
+
+    // Update the write index
+    log_state.write_index = logging_next_index(log_state.write_index);
+    EXIT_CRITICAL();
+
+    log_state.rate_limit_log_count++;
+  } else {
+    fault_occurred(FAULT_LOGGING_RATE_LIMIT);
+  }
+}
+
+uint8_t logging_read(uint8_t *buffer) {
+  uint8_t ret = 0U;
+  if ((log_arr[log_state.read_index].id != 0xFFFFU) && (log_state.read_index != log_state.write_index)) {
+    // Read the log
+    (void) memcpy(buffer, &log_arr[log_state.read_index], sizeof(log_t));
+
+    // Update the read index
+    log_state.read_index = logging_next_index(log_state.read_index);
+
+    ret = sizeof(log_t);
+  }
+  return ret;
+}

panda/board/drivers/logging_definitions.h

@@ -0,0 +1,9 @@
+
+// Flash is writable in 32-byte lines, this struct is designed to fit in two lines.
+// This also matches the USB transfer size.
+typedef struct __attribute__((packed)) log_t {
+  uint16_t id;
+  timestamp_t timestamp;
+  uint32_t uptime;
+  char msg[50];
+} log_t;

panda/board/drivers/pwm.h

@@ -0,0 +1,56 @@
+#define PWM_COUNTER_OVERFLOW 2000U // To get ~50kHz
+
+// TODO: Implement for 32-bit timers
+
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel){
+    // Enable timer and auto-reload
+    register_set(&(TIM->CR1), TIM_CR1_CEN | TIM_CR1_ARPE, 0x3FU);
+
+    // Set channel as PWM mode 1 and enable output
+    switch(channel){
+        case 1U:
+            register_set_bits(&(TIM->CCMR1), (TIM_CCMR1_OC1M_2 | TIM_CCMR1_OC1M_1 | TIM_CCMR1_OC1PE));
+            register_set_bits(&(TIM->CCER), TIM_CCER_CC1E);
+            break;
+        case 2U:
+            register_set_bits(&(TIM->CCMR1), (TIM_CCMR1_OC2M_2 | TIM_CCMR1_OC2M_1 | TIM_CCMR1_OC2PE));
+            register_set_bits(&(TIM->CCER), TIM_CCER_CC2E);
+            break;
+        case 3U:
+            register_set_bits(&(TIM->CCMR2), (TIM_CCMR2_OC3M_2 | TIM_CCMR2_OC3M_1 | TIM_CCMR2_OC3PE));
+            register_set_bits(&(TIM->CCER), TIM_CCER_CC3E);
+            break;
+        case 4U:
+            register_set_bits(&(TIM->CCMR2), (TIM_CCMR2_OC4M_2 | TIM_CCMR2_OC4M_1 | TIM_CCMR2_OC4PE));
+            register_set_bits(&(TIM->CCER), TIM_CCER_CC4E);
+            break;
+        default:
+            break;
+    }
+
+    // Set max counter value
+    register_set(&(TIM->ARR), PWM_COUNTER_OVERFLOW, 0xFFFFU);
+
+    // Update registers and clear counter
+    TIM->EGR |= TIM_EGR_UG;
+}
+
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage){
+    uint16_t comp_value = (((uint16_t) percentage * PWM_COUNTER_OVERFLOW) / 100U);
+    switch(channel){
+        case 1U:
+            register_set(&(TIM->CCR1), comp_value, 0xFFFFU);
+            break;
+        case 2U:
+            register_set(&(TIM->CCR2), comp_value, 0xFFFFU);
+            break;
+        case 3U:
+            register_set(&(TIM->CCR3), comp_value, 0xFFFFU);
+            break;
+        case 4U:
+            register_set(&(TIM->CCR4), comp_value, 0xFFFFU);
+            break;
+        default:
+            break;
+    }
+}

panda/board/drivers/registers.h

@@ -0,0 +1,81 @@
+
+typedef struct reg {
+  volatile uint32_t *address;
+  uint32_t value;
+  uint32_t check_mask;
+} reg;
+
+// 10 bit hash with 23 as a prime
+#define REGISTER_MAP_SIZE 0x3FFU
+#define HASHING_PRIME 23U
+#define CHECK_COLLISION(hash, addr) (((uint32_t) register_map[hash].address != 0U) && (register_map[hash].address != (addr)))
+
+reg register_map[REGISTER_MAP_SIZE];
+
+// Hash spread in first and second iterations seems to be reasonable.
+// See: tests/development/register_hashmap_spread.py
+// Also, check the collision warnings in the debug output, and minimize those.
+uint16_t hash_addr(uint32_t input){
+  return (((input >> 16U) ^ ((((input + 1U) & 0xFFFFU) * HASHING_PRIME) & 0xFFFFU)) & REGISTER_MAP_SIZE);
+}
+
+// Do not put bits in the check mask that get changed by the hardware
+void register_set(volatile uint32_t *addr, uint32_t val, uint32_t mask){
+  ENTER_CRITICAL()
+  // Set bits in register that are also in the mask
+  (*addr) = ((*addr) & (~mask)) | (val & mask);
+
+  // Add these values to the map
+  uint16_t hash = hash_addr((uint32_t) addr);
+  uint16_t tries = REGISTER_MAP_SIZE;
+  while(CHECK_COLLISION(hash, addr) && (tries > 0U)) { hash = hash_addr((uint32_t) hash); tries--;}
+  if (tries != 0U){
+    register_map[hash].address = addr;
+    register_map[hash].value = (register_map[hash].value & (~mask)) | (val & mask);
+    register_map[hash].check_mask |= mask;
+  } else {
+    #ifdef DEBUG_FAULTS
+      print("Hash collision: address 0x"); puth((uint32_t) addr); print("!\n");
+    #endif
+  }
+  EXIT_CRITICAL()
+}
+
+// Set individual bits. Also add them to the check_mask.
+// Do not use this to change bits that get reset by the hardware
+void register_set_bits(volatile uint32_t *addr, uint32_t val) {
+  return register_set(addr, val, val);
+}
+
+// Clear individual bits. Also add them to the check_mask.
+// Do not use this to clear bits that get set by the hardware
+void register_clear_bits(volatile uint32_t *addr, uint32_t val) {
+  return register_set(addr, (~val), val);
+}
+
+// To be called periodically
+void check_registers(void){
+  for(uint16_t i=0U; i<REGISTER_MAP_SIZE; i++){
+    if((uint32_t) register_map[i].address != 0U){
+      ENTER_CRITICAL()
+      if((*(register_map[i].address) & register_map[i].check_mask) != (register_map[i].value & register_map[i].check_mask)){
+        #ifdef DEBUG_FAULTS
+          print("Register at address 0x"); puth((uint32_t) register_map[i].address); print(" is divergent!");
+          print("   Map: 0x"); puth(register_map[i].value);
+          print("   Register: 0x"); puth(*(register_map[i].address));
+          print("   Mask: 0x"); puth(register_map[i].check_mask);
+          print("\n");
+        #endif
+        fault_occurred(FAULT_REGISTER_DIVERGENT);
+      }
+      EXIT_CRITICAL()
+    }
+  }
+}
+
+void init_registers(void) {
+  for(uint16_t i=0U; i<REGISTER_MAP_SIZE; i++){
+    register_map[i].address = (volatile uint32_t *) 0U;
+    register_map[i].check_mask = 0U;
+  }
+}

panda/board/drivers/rtc.h

@@ -0,0 +1,64 @@
+
+#include "rtc_definitions.h"
+
+#define YEAR_OFFSET 2000U
+
+uint8_t to_bcd(uint16_t value){
+  return (((value / 10U) & 0x0FU) << 4U) | ((value % 10U) & 0x0FU);
+}
+
+uint16_t from_bcd(uint8_t value){
+  return (((value & 0xF0U) >> 4U) * 10U) + (value & 0x0FU);
+}
+
+void rtc_set_time(timestamp_t time){
+  print("Setting RTC time\n");
+
+  // Disable write protection
+  disable_bdomain_protection();
+  RTC->WPR = 0xCA;
+  RTC->WPR = 0x53;
+
+  // Enable initialization mode
+  register_set_bits(&(RTC->ISR), RTC_ISR_INIT);
+  while((RTC->ISR & RTC_ISR_INITF) == 0){}
+
+  // Set time
+  RTC->TR = (to_bcd(time.hour) << RTC_TR_HU_Pos) | (to_bcd(time.minute) << RTC_TR_MNU_Pos) | (to_bcd(time.second) << RTC_TR_SU_Pos);
+  RTC->DR = (to_bcd(time.year - YEAR_OFFSET) << RTC_DR_YU_Pos) | (time.weekday << RTC_DR_WDU_Pos) | (to_bcd(time.month) << RTC_DR_MU_Pos) | (to_bcd(time.day) << RTC_DR_DU_Pos);
+
+  // Set options
+  register_set(&(RTC->CR), 0U, 0xFCFFFFU);
+
+  // Disable initalization mode
+  register_clear_bits(&(RTC->ISR), RTC_ISR_INIT);
+
+  // Wait for synchronization
+  while((RTC->ISR & RTC_ISR_RSF) == 0){}
+
+  // Re-enable write protection
+  RTC->WPR = 0x00;
+  enable_bdomain_protection();
+}
+
+timestamp_t rtc_get_time(void){
+  timestamp_t result;
+
+  // Wait until the register sync flag is set
+  while((RTC->ISR & RTC_ISR_RSF) == 0){}
+
+  // Read time and date registers. Since our HSE > 7*LSE, this should be fine.
+  uint32_t time = RTC->TR;
+  uint32_t date = RTC->DR;
+
+  // Parse values
+  result.year = from_bcd((date & (RTC_DR_YT | RTC_DR_YU)) >> RTC_DR_YU_Pos) + YEAR_OFFSET;
+  result.month = from_bcd((date & (RTC_DR_MT | RTC_DR_MU)) >> RTC_DR_MU_Pos);
+  result.day = from_bcd((date & (RTC_DR_DT | RTC_DR_DU)) >> RTC_DR_DU_Pos);
+  result.weekday = ((date & RTC_DR_WDU) >> RTC_DR_WDU_Pos);
+  result.hour = from_bcd((time & (RTC_TR_HT | RTC_TR_HU)) >> RTC_TR_HU_Pos);
+  result.minute = from_bcd((time & (RTC_TR_MNT | RTC_TR_MNU)) >> RTC_TR_MNU_Pos);
+  result.second = from_bcd((time & (RTC_TR_ST | RTC_TR_SU)) >> RTC_TR_SU_Pos);
+
+  return result;
+}

panda/board/drivers/rtc_definitions.h

@@ -0,0 +1,9 @@
+typedef struct __attribute__((packed)) timestamp_t {
+  uint16_t year;
+  uint8_t month;
+  uint8_t day;
+  uint8_t weekday;
+  uint8_t hour;
+  uint8_t minute;
+  uint8_t second;
+} timestamp_t;

panda/board/drivers/simple_watchdog.h

@@ -0,0 +1,26 @@
+typedef struct simple_watchdog_state_t {
+  uint32_t fault;
+  uint32_t last_ts;
+  uint32_t threshold;
+} simple_watchdog_state_t;
+
+simple_watchdog_state_t wd_state;
+
+
+void simple_watchdog_kick(void) {
+  uint32_t ts = microsecond_timer_get();
+
+  uint32_t et = get_ts_elapsed(ts, wd_state.last_ts);
+  if (et > wd_state.threshold) {
+    print("WD timeout 0x"); puth(et); print("\n");
+    fault_occurred(wd_state.fault);
+  }
+
+  wd_state.last_ts = ts;
+}
+
+void simple_watchdog_init(uint32_t fault, uint32_t threshold) {
+  wd_state.fault = fault;
+  wd_state.threshold = threshold;
+  wd_state.last_ts = microsecond_timer_get();
+}

panda/board/drivers/spi.h

@@ -0,0 +1,255 @@
+#pragma once
+
+#include "crc.h"
+
+#define SPI_TIMEOUT_US 10000U
+
+// got max rate from hitting a non-existent endpoint
+// in a tight loop, plus some buffer
+#define SPI_IRQ_RATE  16000U
+
+#ifdef STM32H7
+#define SPI_BUF_SIZE 2048U
+__attribute__((section(".ram_d1"))) uint8_t spi_buf_rx[SPI_BUF_SIZE];
+__attribute__((section(".ram_d2"))) uint8_t spi_buf_tx[SPI_BUF_SIZE];
+#else
+#define SPI_BUF_SIZE 1024U
+uint8_t spi_buf_rx[SPI_BUF_SIZE];
+uint8_t spi_buf_tx[SPI_BUF_SIZE];
+#endif
+
+#define SPI_CHECKSUM_START 0xABU
+#define SPI_SYNC_BYTE 0x5AU
+#define SPI_HACK 0x79U
+#define SPI_DACK 0x85U
+#define SPI_NACK 0x1FU
+
+// SPI states
+enum {
+  SPI_STATE_HEADER,
+  SPI_STATE_HEADER_ACK,
+  SPI_STATE_HEADER_NACK,
+  SPI_STATE_DATA_RX,
+  SPI_STATE_DATA_RX_ACK,
+  SPI_STATE_DATA_TX
+};
+
+bool spi_tx_dma_done = false;
+uint8_t spi_state = SPI_STATE_HEADER;
+uint8_t spi_endpoint;
+uint16_t spi_data_len_mosi;
+uint16_t spi_data_len_miso;
+uint16_t spi_checksum_error_count = 0;
+bool spi_can_tx_ready = false;
+
+#define SPI_HEADER_SIZE 7U
+
+// low level SPI prototypes
+void llspi_init(void);
+void llspi_mosi_dma(uint8_t *addr, int len);
+void llspi_miso_dma(uint8_t *addr, int len);
+
+void can_tx_comms_resume_spi(void) {
+  spi_can_tx_ready = true;
+}
+
+uint16_t spi_version_packet(uint8_t *out) {
+  // this protocol version request is a stable portion of
+  // the panda's SPI protocol. its contents match that of the
+  // panda USB descriptors and are sufficent to list/enumerate
+  // a panda, determine panda type, and bootstub status.
+
+  // the response is:
+  // VERSION + 2 byte data length + data + CRC8
+
+  // echo "VERSION"
+  (void)memcpy(out, "VERSION", 7);
+
+  // write response
+  uint16_t data_len = 0;
+  uint16_t data_pos = 7U + 2U;
+
+  // write serial
+  #ifdef UID_BASE
+  (void)memcpy(&out[data_pos], ((uint8_t *)UID_BASE), 12);
+  data_len += 12U;
+  #endif
+
+  // HW type
+  out[data_pos + data_len] = hw_type;
+  data_len += 1U;
+
+  // bootstub
+  out[data_pos + data_len] = USB_PID & 0xFFU;
+  data_len += 1U;
+
+  // SPI protocol version
+  out[data_pos + data_len] = 0x2;
+  data_len += 1U;
+
+  // data length
+  out[7] = data_len & 0xFFU;
+  out[8] = (data_len >> 8) & 0xFFU;
+
+  // CRC8
+  uint16_t resp_len = data_pos + data_len;
+  out[resp_len] = crc_checksum(out, resp_len, 0xD5U);
+  resp_len += 1U;
+
+  return resp_len;
+}
+
+void spi_init(void) {
+  // platform init
+  llspi_init();
+
+  // Start the first packet!
+  spi_state = SPI_STATE_HEADER;
+  llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+}
+
+bool check_checksum(uint8_t *data, uint16_t len) {
+  // TODO: can speed this up by casting the bulk to uint32_t and xor-ing the bytes afterwards
+  uint8_t checksum = SPI_CHECKSUM_START;
+  for(uint16_t i = 0U; i < len; i++){
+    checksum ^= data[i];
+  }
+  return checksum == 0U;
+}
+
+void spi_rx_done(void) {
+  uint16_t response_len = 0U;
+  uint8_t next_rx_state = SPI_STATE_HEADER_NACK;
+  bool checksum_valid = false;
+
+  // parse header
+  spi_endpoint = spi_buf_rx[1];
+  spi_data_len_mosi = (spi_buf_rx[3] << 8) | spi_buf_rx[2];
+  spi_data_len_miso = (spi_buf_rx[5] << 8) | spi_buf_rx[4];
+
+  if (memcmp(spi_buf_rx, "VERSION", 7) == 0) {
+    response_len = spi_version_packet(spi_buf_tx);
+    next_rx_state = SPI_STATE_HEADER_NACK;;
+  } else if (spi_state == SPI_STATE_HEADER) {
+    checksum_valid = check_checksum(spi_buf_rx, SPI_HEADER_SIZE);
+    if ((spi_buf_rx[0] == SPI_SYNC_BYTE) && checksum_valid) {
+      // response: ACK and start receiving data portion
+      spi_buf_tx[0] = SPI_HACK;
+      next_rx_state = SPI_STATE_HEADER_ACK;
+      response_len = 1U;
+    } else {
+      // response: NACK and reset state machine
+      print("- incorrect header sync or checksum "); hexdump(spi_buf_rx, SPI_HEADER_SIZE);
+      spi_buf_tx[0] = SPI_NACK;
+      next_rx_state = SPI_STATE_HEADER_NACK;
+      response_len = 1U;
+    }
+  } else if (spi_state == SPI_STATE_DATA_RX) {
+    // We got everything! Based on the endpoint specified, call the appropriate handler
+    bool response_ack = false;
+    checksum_valid = check_checksum(&(spi_buf_rx[SPI_HEADER_SIZE]), spi_data_len_mosi + 1U);
+    if (checksum_valid) {
+      if (spi_endpoint == 0U) {
+        if (spi_data_len_mosi >= sizeof(ControlPacket_t)) {
+          ControlPacket_t ctrl;
+          (void)memcpy(&ctrl, &spi_buf_rx[SPI_HEADER_SIZE], sizeof(ControlPacket_t));
+          response_len = comms_control_handler(&ctrl, &spi_buf_tx[3]);
+          response_ack = true;
+        } else {
+          print("SPI: insufficient data for control handler\n");
+        }
+      } else if ((spi_endpoint == 1U) || (spi_endpoint == 0x81U)) {
+        if (spi_data_len_mosi == 0U) {
+          response_len = comms_can_read(&(spi_buf_tx[3]), spi_data_len_miso);
+          response_ack = true;
+        } else {
+          print("SPI: did not expect data for can_read\n");
+        }
+      } else if (spi_endpoint == 2U) {
+        comms_endpoint2_write(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi);
+        response_ack = true;
+      } else if (spi_endpoint == 3U) {
+        if (spi_data_len_mosi > 0U) {
+          if (spi_can_tx_ready) {
+            spi_can_tx_ready = false;
+            comms_can_write(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi);
+            response_ack = true;
+          } else {
+            response_ack = false;
+            print("SPI: CAN NACK\n");
+          }
+        } else {
+          print("SPI: did expect data for can_write\n");
+        }
+      } else {
+        print("SPI: unexpected endpoint"); puth(spi_endpoint); print("\n");
+      }
+    } else {
+      // Checksum was incorrect
+      response_ack = false;
+      print("- incorrect data checksum ");
+      puth4(spi_data_len_mosi);
+      print("\n");
+      hexdump(spi_buf_rx, SPI_HEADER_SIZE);
+      hexdump(&(spi_buf_rx[SPI_HEADER_SIZE]), MIN(spi_data_len_mosi, 64));
+      print("\n");
+    }
+
+    if (!response_ack) {
+      spi_buf_tx[0] = SPI_NACK;
+      next_rx_state = SPI_STATE_HEADER_NACK;
+      response_len = 1U;
+    } else {
+      // Setup response header
+      spi_buf_tx[0] = SPI_DACK;
+      spi_buf_tx[1] = response_len & 0xFFU;
+      spi_buf_tx[2] = (response_len >> 8) & 0xFFU;
+
+      // Add checksum
+      uint8_t checksum = SPI_CHECKSUM_START;
+      for(uint16_t i = 0U; i < (response_len + 3U); i++) {
+        checksum ^= spi_buf_tx[i];
+      }
+      spi_buf_tx[response_len + 3U] = checksum;
+      response_len += 4U;
+
+      next_rx_state = SPI_STATE_DATA_TX;
+    }
+  } else {
+    print("SPI: RX unexpected state: "); puth(spi_state); print("\n");
+  }
+
+  // send out response
+  if (response_len == 0U) {
+    print("SPI: no response\n");
+    spi_buf_tx[0] = SPI_NACK;
+    spi_state = SPI_STATE_HEADER_NACK;
+    response_len = 1U;
+  }
+  llspi_miso_dma(spi_buf_tx, response_len);
+
+  spi_state = next_rx_state;
+  if (!checksum_valid && (spi_checksum_error_count < __UINT16_MAX__)) {
+    spi_checksum_error_count += 1U;
+  }
+}
+
+void spi_tx_done(bool reset) {
+  if ((spi_state == SPI_STATE_HEADER_NACK) || reset) {
+    // Reset state
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+  } else if (spi_state == SPI_STATE_HEADER_ACK) {
+    // ACK was sent, queue up the RX buf for the data + checksum
+    spi_state = SPI_STATE_DATA_RX;
+    llspi_mosi_dma(&spi_buf_rx[SPI_HEADER_SIZE], spi_data_len_mosi + 1U);
+  } else if (spi_state == SPI_STATE_DATA_TX) {
+    // Reset state
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+  } else {
+    spi_state = SPI_STATE_HEADER;
+    llspi_mosi_dma(spi_buf_rx, SPI_HEADER_SIZE);
+    print("SPI: TX unexpected state: "); puth(spi_state); print("\n");
+  }
+}

panda/board/drivers/timers.h

@@ -0,0 +1,31 @@
+void timer_init(TIM_TypeDef *TIM, int psc) {
+  register_set(&(TIM->PSC), (psc-1), 0xFFFFU);
+  register_set(&(TIM->DIER), TIM_DIER_UIE, 0x5F5FU);
+  register_set(&(TIM->CR1), TIM_CR1_CEN, 0x3FU);
+  TIM->SR = 0;
+}
+
+void microsecond_timer_init(void) {
+  MICROSECOND_TIMER->PSC = (APB1_TIMER_FREQ - 1U);
+  MICROSECOND_TIMER->CR1 = TIM_CR1_CEN;
+  MICROSECOND_TIMER->EGR = TIM_EGR_UG;
+}
+
+uint32_t microsecond_timer_get(void) {
+  return MICROSECOND_TIMER->CNT;
+}
+
+void interrupt_timer_init(void) {
+  enable_interrupt_timer();
+  REGISTER_INTERRUPT(INTERRUPT_TIMER_IRQ, interrupt_timer_handler, 1, FAULT_INTERRUPT_RATE_INTERRUPTS)
+  register_set(&(INTERRUPT_TIMER->PSC), ((uint16_t)(15.25*APB1_TIMER_FREQ)-1U), 0xFFFFU);
+  register_set(&(INTERRUPT_TIMER->DIER), TIM_DIER_UIE, 0x5F5FU);
+  register_set(&(INTERRUPT_TIMER->CR1), TIM_CR1_CEN, 0x3FU);
+  INTERRUPT_TIMER->SR = 0;
+  NVIC_EnableIRQ(INTERRUPT_TIMER_IRQ);
+}
+
+void tick_timer_init(void) {
+  timer_init(TICK_TIMER, (uint16_t)((15.25*APB2_TIMER_FREQ)/8U));
+  NVIC_EnableIRQ(TICK_TIMER_IRQ);
+}

panda/board/drivers/uart.h

@@ -0,0 +1,231 @@
+// IRQs: USART1, USART2, USART3, UART5
+
+// ***************************** Definitions *****************************
+#define FIFO_SIZE_INT 0x400U
+#define FIFO_SIZE_DMA 0x1000U
+
+typedef struct uart_ring {
+  volatile uint16_t w_ptr_tx;
+  volatile uint16_t r_ptr_tx;
+  uint8_t *elems_tx;
+  uint32_t tx_fifo_size;
+  volatile uint16_t w_ptr_rx;
+  volatile uint16_t r_ptr_rx;
+  uint8_t *elems_rx;
+  uint32_t rx_fifo_size;
+  USART_TypeDef *uart;
+  void (*callback)(struct uart_ring*);
+  bool dma_rx;
+  bool overwrite;
+} uart_ring;
+
+#define UART_BUFFER(x, size_rx, size_tx, uart_ptr, callback_ptr, rx_dma, overwrite_mode) \
+  uint8_t elems_rx_##x[size_rx]; \
+  uint8_t elems_tx_##x[size_tx]; \
+  uart_ring uart_ring_##x = {  \
+    .w_ptr_tx = 0, \
+    .r_ptr_tx = 0, \
+    .elems_tx = ((uint8_t *)&(elems_tx_##x)), \
+    .tx_fifo_size = (size_tx), \
+    .w_ptr_rx = 0, \
+    .r_ptr_rx = 0, \
+    .elems_rx = ((uint8_t *)&(elems_rx_##x)), \
+    .rx_fifo_size = (size_rx), \
+    .uart = (uart_ptr), \
+    .callback = (callback_ptr), \
+    .dma_rx = (rx_dma), \
+    .overwrite = (overwrite_mode) \
+  };
+
+// ***************************** Function prototypes *****************************
+void debug_ring_callback(uart_ring *ring);
+void uart_tx_ring(uart_ring *q);
+void uart_send_break(uart_ring *u);
+
+// ******************************** UART buffers ********************************
+
+// gps = USART1
+UART_BUFFER(gps, FIFO_SIZE_DMA, FIFO_SIZE_INT, USART1, NULL, true, false)
+
+// lin1, K-LINE = UART5
+// lin2, L-LINE = USART3
+UART_BUFFER(lin1, FIFO_SIZE_INT, FIFO_SIZE_INT, UART5, NULL, false, false)
+UART_BUFFER(lin2, FIFO_SIZE_INT, FIFO_SIZE_INT, USART3, NULL, false, false)
+
+// debug = USART2
+UART_BUFFER(debug, FIFO_SIZE_INT, FIFO_SIZE_INT, USART2, debug_ring_callback, false, true)
+
+// SOM debug = UART7
+#ifdef STM32H7
+  UART_BUFFER(som_debug, FIFO_SIZE_INT, FIFO_SIZE_INT, UART7, NULL, false, true)
+#else
+  // UART7 is not available on F4
+  UART_BUFFER(som_debug, 1U, 1U, NULL, NULL, false, true)
+#endif
+
+uart_ring *get_ring_by_number(int a) {
+  uart_ring *ring = NULL;
+  switch(a) {
+    case 0:
+      ring = &uart_ring_debug;
+      break;
+    case 1:
+      ring = &uart_ring_gps;
+      break;
+    case 2:
+      ring = &uart_ring_lin1;
+      break;
+    case 3:
+      ring = &uart_ring_lin2;
+      break;
+    case 4:
+      ring = &uart_ring_som_debug;
+      break;
+    default:
+      ring = NULL;
+      break;
+  }
+  return ring;
+}
+
+// ************************* Low-level buffer functions *************************
+bool getc(uart_ring *q, char *elem) {
+  bool ret = false;
+
+  ENTER_CRITICAL();
+  if (q->w_ptr_rx != q->r_ptr_rx) {
+    if (elem != NULL) *elem = q->elems_rx[q->r_ptr_rx];
+    q->r_ptr_rx = (q->r_ptr_rx + 1U) % q->rx_fifo_size;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool injectc(uart_ring *q, char elem) {
+  int ret = false;
+  uint16_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  next_w_ptr = (q->w_ptr_rx + 1U) % q->rx_fifo_size;
+
+  if ((next_w_ptr == q->r_ptr_rx) && q->overwrite) {
+    // overwrite mode: drop oldest byte
+    q->r_ptr_rx = (q->r_ptr_rx + 1U) % q->rx_fifo_size;
+  }
+
+  if (next_w_ptr != q->r_ptr_rx) {
+    q->elems_rx[q->w_ptr_rx] = elem;
+    q->w_ptr_rx = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  return ret;
+}
+
+bool putc(uart_ring *q, char elem) {
+  bool ret = false;
+  uint16_t next_w_ptr;
+
+  ENTER_CRITICAL();
+  next_w_ptr = (q->w_ptr_tx + 1U) % q->tx_fifo_size;
+
+  if ((next_w_ptr == q->r_ptr_tx) && q->overwrite) {
+    // overwrite mode: drop oldest byte
+    q->r_ptr_tx = (q->r_ptr_tx + 1U) % q->tx_fifo_size;
+  }
+
+  if (next_w_ptr != q->r_ptr_tx) {
+    q->elems_tx[q->w_ptr_tx] = elem;
+    q->w_ptr_tx = next_w_ptr;
+    ret = true;
+  }
+  EXIT_CRITICAL();
+
+  uart_tx_ring(q);
+
+  return ret;
+}
+
+// Seems dangerous to use (might lock CPU if called with interrupts disabled f.e.)
+// TODO: Remove? Not used anyways
+void uart_flush(uart_ring *q) {
+  while (q->w_ptr_tx != q->r_ptr_tx) {
+    __WFI();
+  }
+}
+
+void uart_flush_sync(uart_ring *q) {
+  // empty the TX buffer
+  while (q->w_ptr_tx != q->r_ptr_tx) {
+    uart_tx_ring(q);
+  }
+}
+
+void clear_uart_buff(uart_ring *q) {
+  ENTER_CRITICAL();
+  q->w_ptr_tx = 0;
+  q->r_ptr_tx = 0;
+  q->w_ptr_rx = 0;
+  q->r_ptr_rx = 0;
+  EXIT_CRITICAL();
+}
+
+// ************************ High-level debug functions **********************
+void putch(const char a) {
+  // misra-c2012-17.7: serial debug function, ok to ignore output
+  (void)injectc(&uart_ring_debug, a);
+}
+
+void print(const char *a) {
+  for (const char *in = a; *in; in++) {
+    if (*in == '\n') putch('\r');
+    putch(*in);
+  }
+}
+
+void putui(uint32_t i) {
+  uint32_t i_copy = i;
+  char str[11];
+  uint8_t idx = 10;
+  str[idx] = '\0';
+  idx--;
+  do {
+    str[idx] = (i_copy % 10U) + 0x30U;
+    idx--;
+    i_copy /= 10;
+  } while (i_copy != 0U);
+  print(&str[idx + 1U]);
+}
+
+void puthx(uint32_t i, uint8_t len) {
+  const char c[] = "0123456789abcdef";
+  for (int pos = ((int)len * 4) - 4; pos > -4; pos -= 4) {
+    putch(c[(i >> (unsigned int)(pos)) & 0xFU]);
+  }
+}
+
+void puth(unsigned int i) {
+  puthx(i, 8U);
+}
+
+void puth2(unsigned int i) {
+  puthx(i, 2U);
+}
+
+void puth4(unsigned int i) {
+  puthx(i, 4U);
+}
+
+void hexdump(const void *a, int l) {
+  if (a != NULL) {
+    for (int i=0; i < l; i++) {
+      if ((i != 0) && ((i & 0xf) == 0)) print("\n");
+      puth2(((const unsigned char*)a)[i]);
+      print(" ");
+    }
+  }
+  print("\n");
+}

panda/board/drivers/usb.h

@@ -0,0 +1,943 @@
+// IRQs: OTG_FS
+
+typedef union {
+  uint16_t w;
+  struct BW {
+    uint8_t msb;
+    uint8_t lsb;
+  }
+  bw;
+}
+uint16_t_uint8_t;
+
+typedef union _USB_Setup {
+  uint32_t d8[2];
+  struct _SetupPkt_Struc
+  {
+    uint8_t           bmRequestType;
+    uint8_t           bRequest;
+    uint16_t_uint8_t  wValue;
+    uint16_t_uint8_t  wIndex;
+    uint16_t_uint8_t  wLength;
+  } b;
+}
+USB_Setup_TypeDef;
+
+bool usb_enumerated = false;
+uint16_t usb_last_frame_num = 0U;
+
+void usb_init(void);
+void refresh_can_tx_slots_available(void);
+
+// **** supporting defines ****
+
+#define  USB_REQ_GET_STATUS                             0x00
+#define  USB_REQ_CLEAR_FEATURE                          0x01
+#define  USB_REQ_SET_FEATURE                            0x03
+#define  USB_REQ_SET_ADDRESS                            0x05
+#define  USB_REQ_GET_DESCRIPTOR                         0x06
+#define  USB_REQ_SET_DESCRIPTOR                         0x07
+#define  USB_REQ_GET_CONFIGURATION                      0x08
+#define  USB_REQ_SET_CONFIGURATION                      0x09
+#define  USB_REQ_GET_INTERFACE                          0x0A
+#define  USB_REQ_SET_INTERFACE                          0x0B
+#define  USB_REQ_SYNCH_FRAME                            0x0C
+
+#define  USB_DESC_TYPE_DEVICE                           0x01
+#define  USB_DESC_TYPE_CONFIGURATION                    0x02
+#define  USB_DESC_TYPE_STRING                           0x03
+#define  USB_DESC_TYPE_INTERFACE                        0x04
+#define  USB_DESC_TYPE_ENDPOINT                         0x05
+#define  USB_DESC_TYPE_DEVICE_QUALIFIER                 0x06
+#define  USB_DESC_TYPE_OTHER_SPEED_CONFIGURATION        0x07
+#define  USB_DESC_TYPE_BINARY_OBJECT_STORE              0x0f
+
+// offsets for configuration strings
+#define  STRING_OFFSET_LANGID                           0x00
+#define  STRING_OFFSET_IMANUFACTURER                    0x01
+#define  STRING_OFFSET_IPRODUCT                         0x02
+#define  STRING_OFFSET_ISERIAL                          0x03
+#define  STRING_OFFSET_ICONFIGURATION                   0x04
+#define  STRING_OFFSET_IINTERFACE                       0x05
+
+// WebUSB requests
+#define  WEBUSB_REQ_GET_URL                             0x02
+
+// WebUSB types
+#define  WEBUSB_DESC_TYPE_URL                           0x03
+#define  WEBUSB_URL_SCHEME_HTTPS                        0x01
+#define  WEBUSB_URL_SCHEME_HTTP                         0x00
+
+// WinUSB requests
+#define  WINUSB_REQ_GET_COMPATID_DESCRIPTOR             0x04
+#define  WINUSB_REQ_GET_EXT_PROPS_OS                    0x05
+#define  WINUSB_REQ_GET_DESCRIPTOR                      0x07
+
+#define STS_GOUT_NAK                           1
+#define STS_DATA_UPDT                          2
+#define STS_XFER_COMP                          3
+#define STS_SETUP_COMP                         4
+#define STS_SETUP_UPDT                         6
+
+uint8_t resp[USBPACKET_MAX_SIZE];
+
+// for the repeating interfaces
+#define DSCR_INTERFACE_LEN 9
+#define DSCR_ENDPOINT_LEN 7
+#define DSCR_CONFIG_LEN 9
+#define DSCR_DEVICE_LEN 18
+
+// endpoint types
+#define ENDPOINT_TYPE_CONTROL 0
+#define ENDPOINT_TYPE_ISO 1
+#define ENDPOINT_TYPE_BULK 2
+#define ENDPOINT_TYPE_INT 3
+
+// These are arbitrary values used in bRequest
+#define  MS_VENDOR_CODE 0x20
+#define  WEBUSB_VENDOR_CODE 0x30
+
+// BOS constants
+#define BINARY_OBJECT_STORE_DESCRIPTOR_LENGTH   0x05
+#define BINARY_OBJECT_STORE_DESCRIPTOR          0x0F
+#define WINUSB_PLATFORM_DESCRIPTOR_LENGTH       0x9E
+
+// Convert machine byte order to USB byte order
+#define TOUSBORDER(num)\
+  ((num) & 0xFFU), (((num) >> 8) & 0xFFU)
+
+// take in string length and return the first 2 bytes of a string descriptor
+#define STRING_DESCRIPTOR_HEADER(size)\
+  (((((size) * 2) + 2) & 0xFF) | 0x0300)
+
+uint8_t device_desc[] = {
+  DSCR_DEVICE_LEN, USB_DESC_TYPE_DEVICE, //Length, Type
+  0x10, 0x02, // bcdUSB max version of USB supported (2.1)
+  0xFF, 0xFF, 0xFF, 0x40, // Class, Subclass, Protocol, Max Packet Size
+  TOUSBORDER(USB_VID), // idVendor
+  TOUSBORDER(USB_PID), // idProduct
+  0x00, 0x00, // bcdDevice
+  0x01, 0x02, // Manufacturer, Product
+  0x03, 0x01 // Serial Number, Num Configurations
+};
+
+uint8_t device_qualifier[] = {
+  0x0a, USB_DESC_TYPE_DEVICE_QUALIFIER, //Length, Type
+  0x10, 0x02, // bcdUSB max version of USB supported (2.1)
+  0xFF, 0xFF, 0xFF, 0x40, // bDeviceClass, bDeviceSubClass, bDeviceProtocol, bMaxPacketSize0
+  0x01, 0x00 // bNumConfigurations, bReserved
+};
+
+#define ENDPOINT_RCV 0x80
+#define ENDPOINT_SND 0x00
+
+uint8_t configuration_desc[] = {
+  DSCR_CONFIG_LEN, USB_DESC_TYPE_CONFIGURATION, // Length, Type,
+  TOUSBORDER(0x0045U), // Total Len (uint16)
+  0x01, 0x01, STRING_OFFSET_ICONFIGURATION, // Num Interface, Config Value, Configuration
+  0xc0, 0x32, // Attributes, Max Power
+  // interface 0 ALT 0
+  DSCR_INTERFACE_LEN, USB_DESC_TYPE_INTERFACE, // Length, Type
+  0x00, 0x00, 0x03, // Index, Alt Index idx, Endpoint count
+  0XFF, 0xFF, 0xFF, // Class, Subclass, Protocol
+  0x00, // Interface
+    // endpoint 1, read CAN
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_RCV | 1, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x00, // Polling Interval (NA)
+    // endpoint 2, send serial
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_SND | 2, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x00, // Polling Interval
+    // endpoint 3, send CAN
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_SND | 3, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x00, // Polling Interval
+  // interface 0 ALT 1
+  DSCR_INTERFACE_LEN, USB_DESC_TYPE_INTERFACE, // Length, Type
+  0x00, 0x01, 0x03, // Index, Alt Index idx, Endpoint count
+  0XFF, 0xFF, 0xFF, // Class, Subclass, Protocol
+  0x00, // Interface
+    // endpoint 1, read CAN
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_RCV | 1, ENDPOINT_TYPE_INT, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x05, // Polling Interval (5 frames)
+    // endpoint 2, send serial
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_SND | 2, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x00, // Polling Interval
+    // endpoint 3, send CAN
+    DSCR_ENDPOINT_LEN, USB_DESC_TYPE_ENDPOINT, // Length, Type
+    ENDPOINT_SND | 3, ENDPOINT_TYPE_BULK, // Endpoint Num/Direction, Type
+    TOUSBORDER(0x0040U), // Max Packet (0x0040)
+    0x00, // Polling Interval
+};
+
+// STRING_DESCRIPTOR_HEADER is for uint16 string descriptors
+// it takes in a string length, which is bytes/2 because unicode
+uint16_t string_language_desc[] = {
+  STRING_DESCRIPTOR_HEADER(1),
+  0x0409 // american english
+};
+
+// these strings are all uint16's so that we don't need to spam ,0 after every character
+uint16_t string_manufacturer_desc[] = {
+  STRING_DESCRIPTOR_HEADER(8),
+  'c', 'o', 'm', 'm', 'a', '.', 'a', 'i'
+};
+
+uint16_t string_product_desc[] = {
+  STRING_DESCRIPTOR_HEADER(5),
+  'p', 'a', 'n', 'd', 'a'
+};
+
+// default serial number when we're not a panda
+uint16_t string_serial_desc[] = {
+  STRING_DESCRIPTOR_HEADER(4),
+  'n', 'o', 'n', 'e'
+};
+
+// a string containing the default configuration index
+uint16_t string_configuration_desc[] = {
+  STRING_DESCRIPTOR_HEADER(2),
+  '0', '1' // "01"
+};
+
+// WCID (auto install WinUSB driver)
+// https://github.com/pbatard/libwdi/wiki/WCID-Devices
+// https://docs.microsoft.com/en-us/windows-hardware/drivers/usbcon/winusb-installation#automatic-installation-of--winusb-without-an-inf-file
+// WinUSB 1.0 descriptors, this is mostly used by Windows XP
+uint8_t string_238_desc[] = {
+  0x12, USB_DESC_TYPE_STRING, // bLength, bDescriptorType
+  'M',0, 'S',0, 'F',0, 'T',0, '1',0, '0',0, '0',0, // qwSignature (MSFT100)
+  MS_VENDOR_CODE, 0x00 // bMS_VendorCode, bPad
+};
+uint8_t winusb_ext_compatid_os_desc[] = {
+  0x28, 0x00, 0x00, 0x00, // dwLength
+  0x00, 0x01, // bcdVersion
+  0x04, 0x00, // wIndex
+  0x01, // bCount
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // Reserved
+  0x00, // bFirstInterfaceNumber
+  0x00, // Reserved
+  'W', 'I', 'N', 'U', 'S', 'B', 0x00, 0x00, // compatible ID (WINUSB)
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // subcompatible ID (none)
+  0x00, 0x00, 0x00, 0x00, 0x00, 0x00 // Reserved
+};
+uint8_t winusb_ext_prop_os_desc[] = {
+  0x8e, 0x00, 0x00, 0x00, // dwLength
+  0x00, 0x01, // bcdVersion
+  0x05, 0x00, // wIndex
+  0x01, 0x00, // wCount
+  // first property
+  0x84, 0x00, 0x00, 0x00, // dwSize
+  0x01, 0x00, 0x00, 0x00, // dwPropertyDataType
+  0x28, 0x00, // wPropertyNameLength
+  'D',0, 'e',0, 'v',0, 'i',0, 'c',0, 'e',0, 'I',0, 'n',0, 't',0, 'e',0, 'r',0, 'f',0, 'a',0, 'c',0, 'e',0, 'G',0, 'U',0, 'I',0, 'D',0, 0, 0, // bPropertyName (DeviceInterfaceGUID)
+  0x4e, 0x00, 0x00, 0x00, // dwPropertyDataLength
+  '{',0, 'c',0, 'c',0, 'e',0, '5',0, '2',0, '9',0, '1',0, 'c',0, '-',0, 'a',0, '6',0, '9',0, 'f',0, '-',0, '4',0 ,'9',0 ,'9',0 ,'5',0 ,'-',0, 'a',0, '4',0, 'c',0, '2',0, '-',0, '2',0, 'a',0, 'e',0, '5',0, '7',0, 'a',0, '5',0, '1',0, 'a',0, 'd',0, 'e',0, '9',0, '}',0, 0, 0, // bPropertyData ({CCE5291C-A69F-4995-A4C2-2AE57A51ADE9})
+};
+
+/*
+Binary Object Store descriptor used to expose WebUSB (and more WinUSB) metadata
+comments are from the wicg spec
+References used:
+  https://wicg.github.io/webusb/#webusb-platform-capability-descriptor
+  https://github.com/sowbug/weblight/blob/192ad7a0e903542e2aa28c607d98254a12a6399d/firmware/webusb.c
+  https://os.mbed.com/users/larsgk/code/USBDevice_WebUSB/file/1d8a6665d607/WebUSBDevice/
+
+*/
+uint8_t binary_object_store_desc[] = {
+  // BOS header
+  BINARY_OBJECT_STORE_DESCRIPTOR_LENGTH, // bLength, this is only the length of the header
+  BINARY_OBJECT_STORE_DESCRIPTOR, // bDescriptorType
+  0x39, 0x00, // wTotalLength (LSB, MSB)
+  0x02, // bNumDeviceCaps (WebUSB + WinUSB)
+
+  // -------------------------------------------------
+  // WebUSB descriptor
+  // header
+    0x18, // bLength, Size of this descriptor. Must be set to 24.
+    0x10, // bDescriptorType, DEVICE CAPABILITY descriptor
+    0x05, // bDevCapabilityType, PLATFORM capability
+    0x00, // bReserved, This field is reserved and shall be set to zero.
+
+  // PlatformCapabilityUUID, Must be set to {3408b638-09a9-47a0-8bfd-a0768815b665}.
+    0x38, 0xB6, 0x08, 0x34,
+    0xA9, 0x09, 0xA0, 0x47,
+    0x8B, 0xFD, 0xA0, 0x76,
+    0x88, 0x15, 0xB6, 0x65,
+  // </PlatformCapabilityUUID>
+
+  0x00, 0x01, // bcdVersion, Protocol version supported. Must be set to 0x0100.
+  WEBUSB_VENDOR_CODE, // bVendorCode, bRequest value used for issuing WebUSB requests.
+  // there used to be a concept of "allowed origins", but it was removed from the spec
+  // it was intended to be a security feature, but then the entire security model relies on domain ownership
+  // https://github.com/WICG/webusb/issues/49
+  // other implementations use various other indexed to leverate this no-longer-valid feature. we wont.
+  // the spec says we *must* reply to index 0x03 with the url, so we'll hint that that's the right index
+  0x03, // iLandingPage, URL descriptor index of the device’s landing page.
+
+  // -------------------------------------------------
+  // WinUSB descriptor
+  // header
+    0x1C, // Descriptor size (28 bytes)
+    0x10, // Descriptor type (Device Capability)
+    0x05, // Capability type (Platform)
+    0x00, // Reserved
+
+  // MS OS 2.0 Platform Capability ID (D8DD60DF-4589-4CC7-9CD2-659D9E648A9F)
+  // Indicates the device supports the Microsoft OS 2.0 descriptor
+    0xDF, 0x60, 0xDD, 0xD8,
+    0x89, 0x45, 0xC7, 0x4C,
+    0x9C, 0xD2, 0x65, 0x9D,
+    0x9E, 0x64, 0x8A, 0x9F,
+
+  0x00, 0x00, 0x03, 0x06, // Windows version, currently set to 8.1 (0x06030000)
+
+  WINUSB_PLATFORM_DESCRIPTOR_LENGTH, 0x00, // MS OS 2.0 descriptor size (word)
+  MS_VENDOR_CODE, 0x00 // vendor code, no alternate enumeration
+};
+
+uint8_t webusb_url_descriptor[] = {
+  0x14,                  /* bLength */
+  WEBUSB_DESC_TYPE_URL, // bDescriptorType
+  WEBUSB_URL_SCHEME_HTTPS, // bScheme
+  'u', 's', 'b', 'p', 'a', 'n', 'd', 'a', '.', 'c', 'o', 'm', 'm', 'a', '.', 'a', 'i'
+};
+
+// WinUSB 2.0 descriptor. This is what modern systems use
+// https://github.com/sowbug/weblight/blob/192ad7a0e903542e2aa28c607d98254a12a6399d/firmware/webusb.c
+// http://janaxelson.com/files/ms_os_20_descriptors.c
+// https://books.google.com/books?id=pkefBgAAQBAJ&pg=PA353&lpg=PA353
+uint8_t winusb_20_desc[WINUSB_PLATFORM_DESCRIPTOR_LENGTH] = {
+  // Microsoft OS 2.0 descriptor set header (table 10)
+  0x0A, 0x00, // Descriptor size (10 bytes)
+  0x00, 0x00, // MS OS 2.0 descriptor set header
+
+  0x00, 0x00, 0x03, 0x06, // Windows version (8.1) (0x06030000)
+  WINUSB_PLATFORM_DESCRIPTOR_LENGTH, 0x00, // Total size of MS OS 2.0 descriptor set
+
+  // Microsoft OS 2.0 compatible ID descriptor
+    0x14, 0x00, // Descriptor size (20 bytes)
+    0x03, 0x00, // MS OS 2.0 compatible ID descriptor
+    'W', 'I', 'N', 'U', 'S', 'B', 0x00, 0x00, // compatible ID (WINUSB)
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,     // Sub-compatible ID
+
+  // Registry property descriptor
+  0x80, 0x00, // Descriptor size (130 bytes)
+  0x04, 0x00, // Registry Property descriptor
+  0x01, 0x00, // Strings are null-terminated Unicode
+  0x28, 0x00, // Size of Property Name (40 bytes) "DeviceInterfaceGUID"
+
+  // bPropertyName (DeviceInterfaceGUID)
+    'D', 0x00, 'e', 0x00, 'v', 0x00, 'i', 0x00, 'c', 0x00, 'e', 0x00, 'I', 0x00, 'n', 0x00,
+    't', 0x00, 'e', 0x00, 'r', 0x00, 'f', 0x00, 'a', 0x00, 'c', 0x00, 'e', 0x00, 'G', 0x00,
+    'U', 0x00, 'I', 0x00, 'D', 0x00, 0x00, 0x00,
+
+  0x4E, 0x00, // Size of Property Data (78 bytes)
+
+  // Vendor-defined property data: {CCE5291C-A69F-4995-A4C2-2AE57A51ADE9}
+    '{', 0x00, 'c', 0x00, 'c', 0x00, 'e', 0x00, '5', 0x00, '2', 0x00, '9', 0x00, '1', 0x00, // 16
+    'c', 0x00, '-', 0x00, 'a', 0x00, '6', 0x00, '9', 0x00, 'f', 0x00, '-', 0x00, '4', 0x00, // 32
+    '9', 0x00, '9', 0x00, '5', 0x00, '-', 0x00, 'a', 0x00, '4', 0x00, 'c', 0x00, '2', 0x00, // 48
+    '-', 0x00, '2', 0x00, 'a', 0x00, 'e', 0x00, '5', 0x00, '7', 0x00, 'a', 0x00, '5', 0x00, // 64
+    '1', 0x00, 'a', 0x00, 'd', 0x00, 'e', 0x00, '9', 0x00, '}', 0x00, 0x00, 0x00 // 78 bytes
+};
+
+// current packet
+USB_Setup_TypeDef setup;
+uint8_t usbdata[0x100] __attribute__((aligned(4)));
+uint8_t* ep0_txdata = NULL;
+uint16_t ep0_txlen = 0;
+bool outep3_processing = false;
+
+// Store the current interface alt setting.
+int current_int0_alt_setting = 0;
+
+// packet read and write
+
+void *USB_ReadPacket(void *dest, uint16_t len) {
+  uint32_t *dest_copy = (uint32_t *)dest;
+  uint32_t count32b = (len + 3U) / 4U;
+
+  for (uint32_t i = 0; i < count32b; i++) {
+    *dest_copy = USBx_DFIFO(0);
+    dest_copy++;
+  }
+  return ((void *)dest_copy);
+}
+
+void USB_WritePacket(const void *src, uint16_t len, uint32_t ep) {
+  #ifdef DEBUG_USB
+  print("writing ");
+  hexdump(src, len);
+  #endif
+
+  uint32_t numpacket = (len + (USBPACKET_MAX_SIZE - 1U)) / USBPACKET_MAX_SIZE;
+  uint32_t count32b = 0;
+  count32b = (len + 3U) / 4U;
+
+  // TODO: revisit this
+  USBx_INEP(ep)->DIEPTSIZ = ((numpacket << 19) & USB_OTG_DIEPTSIZ_PKTCNT) |
+                            (len               & USB_OTG_DIEPTSIZ_XFRSIZ);
+  USBx_INEP(ep)->DIEPCTL |= (USB_OTG_DIEPCTL_CNAK | USB_OTG_DIEPCTL_EPENA);
+
+  // load the FIFO
+  if (src != NULL) {
+    const uint32_t *src_copy = (const uint32_t *)src;
+    for (uint32_t i = 0; i < count32b; i++) {
+      USBx_DFIFO(ep) = *src_copy;
+      src_copy++;
+    }
+  }
+}
+
+// IN EP 0 TX FIFO has a max size of 127 bytes (much smaller than the rest)
+// so use TX FIFO empty interrupt to send larger amounts of data
+void USB_WritePacket_EP0(uint8_t *src, uint16_t len) {
+  #ifdef DEBUG_USB
+  print("writing ");
+  hexdump(src, len);
+  #endif
+
+  uint16_t wplen = MIN(len, 0x40);
+  USB_WritePacket(src, wplen, 0);
+
+  if (wplen < len) {
+    ep0_txdata = &src[wplen];
+    ep0_txlen = len - wplen;
+    USBx_DEVICE->DIEPEMPMSK |= 1;
+  } else {
+    USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+  }
+}
+
+void usb_reset(void) {
+  // unmask endpoint interrupts, so many sets
+  USBx_DEVICE->DAINT = 0xFFFFFFFF;
+  USBx_DEVICE->DAINTMSK = 0xFFFFFFFF;
+  //USBx_DEVICE->DOEPMSK = (USB_OTG_DOEPMSK_STUPM | USB_OTG_DOEPMSK_XFRCM | USB_OTG_DOEPMSK_EPDM);
+  //USBx_DEVICE->DIEPMSK = (USB_OTG_DIEPMSK_TOM | USB_OTG_DIEPMSK_XFRCM | USB_OTG_DIEPMSK_EPDM | USB_OTG_DIEPMSK_ITTXFEMSK);
+  //USBx_DEVICE->DIEPMSK = (USB_OTG_DIEPMSK_TOM | USB_OTG_DIEPMSK_XFRCM | USB_OTG_DIEPMSK_EPDM);
+
+  // all interrupts for debugging
+  USBx_DEVICE->DIEPMSK = 0xFFFFFFFF;
+  USBx_DEVICE->DOEPMSK = 0xFFFFFFFF;
+
+  // clear interrupts
+  USBx_INEP(0)->DIEPINT = 0xFF;
+  USBx_OUTEP(0)->DOEPINT = 0xFF;
+
+  // unset the address
+  USBx_DEVICE->DCFG &= ~USB_OTG_DCFG_DAD;
+
+  // set up USB FIFOs
+  // RX start address is fixed to 0
+  USBx->GRXFSIZ = 0x40;
+
+  // 0x100 to offset past GRXFSIZ
+  USBx->DIEPTXF0_HNPTXFSIZ = (0x40U << 16) | 0x40U;
+
+  // EP1, massive
+  USBx->DIEPTXF[0] = (0x40U << 16) | 0x80U;
+
+  // flush TX fifo
+  USBx->GRSTCTL = USB_OTG_GRSTCTL_TXFFLSH | USB_OTG_GRSTCTL_TXFNUM_4;
+  while ((USBx->GRSTCTL & USB_OTG_GRSTCTL_TXFFLSH) == USB_OTG_GRSTCTL_TXFFLSH);
+  // flush RX FIFO
+  USBx->GRSTCTL = USB_OTG_GRSTCTL_RXFFLSH;
+  while ((USBx->GRSTCTL & USB_OTG_GRSTCTL_RXFFLSH) == USB_OTG_GRSTCTL_RXFFLSH);
+
+  // no global NAK
+  USBx_DEVICE->DCTL |= USB_OTG_DCTL_CGINAK;
+
+  // ready to receive setup packets
+  USBx_OUTEP(0)->DOEPTSIZ = USB_OTG_DOEPTSIZ_STUPCNT | (USB_OTG_DOEPTSIZ_PKTCNT & (1U << 19)) | (3U << 3);
+}
+
+char to_hex_char(int a) {
+  char ret;
+  if (a < 10) {
+    ret = '0' + a;
+  } else {
+    ret = 'a' + (a - 10);
+  }
+  return ret;
+}
+
+void usb_tick(void) {
+  uint16_t current_frame_num = (USBx_DEVICE->DSTS & USB_OTG_DSTS_FNSOF_Msk) >> USB_OTG_DSTS_FNSOF_Pos;
+  usb_enumerated = (current_frame_num != usb_last_frame_num);
+  usb_last_frame_num = current_frame_num;
+}
+
+void usb_setup(void) {
+  int resp_len;
+  ControlPacket_t control_req;
+
+  // setup packet is ready
+  switch (setup.b.bRequest) {
+    case USB_REQ_SET_CONFIGURATION:
+      // enable other endpoints, has to be here?
+      USBx_INEP(1)->DIEPCTL = (0x40U & USB_OTG_DIEPCTL_MPSIZ) | (2U << 18) | (1U << 22) |
+                              USB_OTG_DIEPCTL_SD0PID_SEVNFRM | USB_OTG_DIEPCTL_USBAEP;
+      USBx_INEP(1)->DIEPINT = 0xFF;
+
+      USBx_OUTEP(2)->DOEPTSIZ = (1U << 19) | 0x40U;
+      USBx_OUTEP(2)->DOEPCTL = (0x40U & USB_OTG_DOEPCTL_MPSIZ) | (2U << 18) |
+                               USB_OTG_DOEPCTL_SD0PID_SEVNFRM | USB_OTG_DOEPCTL_USBAEP;
+      USBx_OUTEP(2)->DOEPINT = 0xFF;
+
+      USBx_OUTEP(3)->DOEPTSIZ = (32U << 19) | 0x800U;
+      USBx_OUTEP(3)->DOEPCTL = (0x40U & USB_OTG_DOEPCTL_MPSIZ) | (2U << 18) |
+                               USB_OTG_DOEPCTL_SD0PID_SEVNFRM | USB_OTG_DOEPCTL_USBAEP;
+      USBx_OUTEP(3)->DOEPINT = 0xFF;
+
+      // mark ready to receive
+      USBx_OUTEP(2)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+      USBx_OUTEP(3)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case USB_REQ_SET_ADDRESS:
+      // set now?
+      USBx_DEVICE->DCFG |= ((setup.b.wValue.w & 0x7fU) << 4);
+
+      #ifdef DEBUG_USB
+        print(" set address\n");
+      #endif
+
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+
+      break;
+    case USB_REQ_GET_DESCRIPTOR:
+      switch (setup.b.wValue.bw.lsb) {
+        case USB_DESC_TYPE_DEVICE:
+          //print("    writing device descriptor\n");
+
+          // set bcdDevice to hardware type
+          device_desc[13] = hw_type;
+          // setup transfer
+          USB_WritePacket(device_desc, MIN(sizeof(device_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+
+          //print("D");
+          break;
+        case USB_DESC_TYPE_CONFIGURATION:
+          USB_WritePacket(configuration_desc, MIN(sizeof(configuration_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_DEVICE_QUALIFIER:
+          USB_WritePacket(device_qualifier, MIN(sizeof(device_qualifier), setup.b.wLength.w), 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_STRING:
+          switch (setup.b.wValue.bw.msb) {
+            case STRING_OFFSET_LANGID:
+              USB_WritePacket((uint8_t*)string_language_desc, MIN(sizeof(string_language_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_IMANUFACTURER:
+              USB_WritePacket((uint8_t*)string_manufacturer_desc, MIN(sizeof(string_manufacturer_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_IPRODUCT:
+              USB_WritePacket((uint8_t*)string_product_desc, MIN(sizeof(string_product_desc), setup.b.wLength.w), 0);
+              break;
+            case STRING_OFFSET_ISERIAL:
+              #ifdef UID_BASE
+                resp[0] = 0x02 + (12 * 4);
+                resp[1] = 0x03;
+
+                // 96 bits = 12 bytes
+                for (int i = 0; i < 12; i++){
+                  uint8_t cc = ((uint8_t *)UID_BASE)[i];
+                  resp[2 + (i * 4) + 0] = to_hex_char((cc >> 4) & 0xFU);
+                  resp[2 + (i * 4) + 1] = '\0';
+                  resp[2 + (i * 4) + 2] = to_hex_char((cc >> 0) & 0xFU);
+                  resp[2 + (i * 4) + 3] = '\0';
+                }
+
+                USB_WritePacket(resp, MIN(resp[0], setup.b.wLength.w), 0);
+              #else
+                USB_WritePacket((const uint8_t *)string_serial_desc, MIN(sizeof(string_serial_desc), setup.b.wLength.w), 0);
+              #endif
+              break;
+            case STRING_OFFSET_ICONFIGURATION:
+              USB_WritePacket((uint8_t*)string_configuration_desc, MIN(sizeof(string_configuration_desc), setup.b.wLength.w), 0);
+              break;
+            case 238:
+              USB_WritePacket((uint8_t*)string_238_desc, MIN(sizeof(string_238_desc), setup.b.wLength.w), 0);
+              break;
+            default:
+              // nothing
+              USB_WritePacket(0, 0, 0);
+              break;
+          }
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        case USB_DESC_TYPE_BINARY_OBJECT_STORE:
+          USB_WritePacket(binary_object_store_desc, MIN(sizeof(binary_object_store_desc), setup.b.wLength.w), 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        default:
+          // nothing here?
+          USB_WritePacket(0, 0, 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+      }
+      break;
+    case USB_REQ_GET_STATUS:
+      // empty resp?
+      resp[0] = 0;
+      resp[1] = 0;
+      USB_WritePacket((void*)&resp, 2, 0);
+      USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case USB_REQ_SET_INTERFACE:
+      // Store the alt setting number for IN EP behavior.
+      current_int0_alt_setting = setup.b.wValue.w;
+      USB_WritePacket(0, 0, 0);
+      USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      break;
+    case WEBUSB_VENDOR_CODE:
+      switch (setup.b.wIndex.w) {
+        case WEBUSB_REQ_GET_URL:
+          USB_WritePacket(webusb_url_descriptor, MIN(sizeof(webusb_url_descriptor), setup.b.wLength.w), 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+        default:
+          // probably asking for allowed origins, which was removed from the spec
+          USB_WritePacket(0, 0, 0);
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+          break;
+      }
+      break;
+    case MS_VENDOR_CODE:
+      switch (setup.b.wIndex.w) {
+        // winusb 2.0 descriptor from BOS
+        case WINUSB_REQ_GET_DESCRIPTOR:
+          USB_WritePacket_EP0((uint8_t*)winusb_20_desc, MIN(sizeof(winusb_20_desc), setup.b.wLength.w));
+          break;
+        // Extended Compat ID OS Descriptor
+        case WINUSB_REQ_GET_COMPATID_DESCRIPTOR:
+          USB_WritePacket_EP0((uint8_t*)winusb_ext_compatid_os_desc, MIN(sizeof(winusb_ext_compatid_os_desc), setup.b.wLength.w));
+          break;
+        // Extended Properties OS Descriptor
+        case WINUSB_REQ_GET_EXT_PROPS_OS:
+          USB_WritePacket_EP0((uint8_t*)winusb_ext_prop_os_desc, MIN(sizeof(winusb_ext_prop_os_desc), setup.b.wLength.w));
+          break;
+        default:
+          USB_WritePacket_EP0(0, 0);
+      }
+      break;
+    default:
+      control_req.request = setup.b.bRequest;
+      control_req.param1 = setup.b.wValue.w;
+      control_req.param2 = setup.b.wIndex.w;
+      control_req.length = setup.b.wLength.w;
+
+      resp_len = comms_control_handler(&control_req, resp);
+      // response pending if -1 was returned
+      if (resp_len != -1) {
+        USB_WritePacket(resp, MIN(resp_len, setup.b.wLength.w), 0);
+        USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+      }
+  }
+}
+
+
+
+// ***************************** USB port *****************************
+
+void usb_irqhandler(void) {
+  //USBx->GINTMSK = 0;
+
+  unsigned int gintsts = USBx->GINTSTS;
+  unsigned int gotgint = USBx->GOTGINT;
+  unsigned int daint = USBx_DEVICE->DAINT;
+
+  // gintsts SUSPEND? 04008428
+  #ifdef DEBUG_USB
+    puth(gintsts);
+    print(" ");
+    /*puth(USBx->GCCFG);
+    print(" ");*/
+    puth(gotgint);
+    print(" ep ");
+    puth(daint);
+    print(" USB interrupt!\n");
+  #endif
+
+  if ((gintsts & USB_OTG_GINTSTS_CIDSCHG) != 0) {
+    print("connector ID status change\n");
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_USBRST) != 0) {
+    print("USB reset\n");
+    usb_reset();
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_ENUMDNE) != 0) {
+    print("enumeration done");
+    // Full speed, ENUMSPD
+    //puth(USBx_DEVICE->DSTS);
+    print("\n");
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_OTGINT) != 0) {
+    print("OTG int:");
+    puth(USBx->GOTGINT);
+    print("\n");
+
+    // getting ADTOCHG
+    //USBx->GOTGINT = USBx->GOTGINT;
+  }
+
+  // RX FIFO first
+  if ((gintsts & USB_OTG_GINTSTS_RXFLVL) != 0) {
+    // 1. Read the Receive status pop register
+    volatile unsigned int rxst = USBx->GRXSTSP;
+    int status = (rxst & USB_OTG_GRXSTSP_PKTSTS) >> 17;
+
+    #ifdef DEBUG_USB
+      print(" RX FIFO:");
+      puth(rxst);
+      print(" status: ");
+      puth(status);
+      print(" len: ");
+      puth((rxst & USB_OTG_GRXSTSP_BCNT) >> 4);
+      print("\n");
+    #endif
+
+    if (status == STS_DATA_UPDT) {
+      int endpoint = (rxst & USB_OTG_GRXSTSP_EPNUM);
+      int len = (rxst & USB_OTG_GRXSTSP_BCNT) >> 4;
+      (void)USB_ReadPacket(&usbdata, len);
+      #ifdef DEBUG_USB
+        print("  data ");
+        puth(len);
+        print("\n");
+        hexdump(&usbdata, len);
+      #endif
+
+      if (endpoint == 2) {
+        comms_endpoint2_write((uint8_t *) usbdata, len);
+      }
+
+      if (endpoint == 3) {
+        outep3_processing = true;
+        comms_can_write(usbdata, len);
+      }
+    } else if (status == STS_SETUP_UPDT) {
+      (void)USB_ReadPacket(&setup, 8);
+      #ifdef DEBUG_USB
+        print("  setup ");
+        hexdump(&setup, 8);
+        print("\n");
+      #endif
+    } else {
+      // status is neither STS_DATA_UPDT or STS_SETUP_UPDT, skip
+    }
+  }
+
+  /*if (gintsts & USB_OTG_GINTSTS_HPRTINT) {
+    // host
+    print("HPRT:");
+    puth(USBx_HOST_PORT->HPRT);
+    print("\n");
+    if (USBx_HOST_PORT->HPRT & USB_OTG_HPRT_PCDET) {
+      USBx_HOST_PORT->HPRT |= USB_OTG_HPRT_PRST;
+      USBx_HOST_PORT->HPRT |= USB_OTG_HPRT_PCDET;
+    }
+
+  }*/
+
+  if ((gintsts & USB_OTG_GINTSTS_BOUTNAKEFF) || (gintsts & USB_OTG_GINTSTS_GINAKEFF)) {
+    // no global NAK, why is this getting set?
+    #ifdef DEBUG_USB
+      print("GLOBAL NAK\n");
+    #endif
+    USBx_DEVICE->DCTL |= USB_OTG_DCTL_CGONAK | USB_OTG_DCTL_CGINAK;
+  }
+
+  if ((gintsts & USB_OTG_GINTSTS_SRQINT) != 0) {
+    // we want to do "A-device host negotiation protocol" since we are the A-device
+    /*print("start request\n");
+    puth(USBx->GOTGCTL);
+    print("\n");*/
+    //USBx->GUSBCFG |= USB_OTG_GUSBCFG_FDMOD;
+    //USBx_HOST_PORT->HPRT = USB_OTG_HPRT_PPWR | USB_OTG_HPRT_PENA;
+    //USBx->GOTGCTL |= USB_OTG_GOTGCTL_SRQ;
+  }
+
+  // out endpoint hit
+  if ((gintsts & USB_OTG_GINTSTS_OEPINT) != 0) {
+    #ifdef DEBUG_USB
+      print("  0:");
+      puth(USBx_OUTEP(0)->DOEPINT);
+      print(" 2:");
+      puth(USBx_OUTEP(2)->DOEPINT);
+      print(" 3:");
+      puth(USBx_OUTEP(3)->DOEPINT);
+      print(" ");
+      puth(USBx_OUTEP(3)->DOEPCTL);
+      print(" 4:");
+      puth(USBx_OUTEP(4)->DOEPINT);
+      print(" OUT ENDPOINT\n");
+    #endif
+
+    if ((USBx_OUTEP(2)->DOEPINT & USB_OTG_DOEPINT_XFRC) != 0) {
+      #ifdef DEBUG_USB
+        print("  OUT2 PACKET XFRC\n");
+      #endif
+      USBx_OUTEP(2)->DOEPTSIZ = (1U << 19) | 0x40U;
+      USBx_OUTEP(2)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+    }
+
+    if ((USBx_OUTEP(3)->DOEPINT & USB_OTG_DOEPINT_XFRC) != 0) {
+      #ifdef DEBUG_USB
+        print("  OUT3 PACKET XFRC\n");
+      #endif
+      // NAK cleared by process_can (if tx buffers have room)
+      outep3_processing = false;
+      refresh_can_tx_slots_available();
+    } else if ((USBx_OUTEP(3)->DOEPINT & 0x2000) != 0) {
+      #ifdef DEBUG_USB
+        print("  OUT3 PACKET WTF\n");
+      #endif
+      // if NAK was set trigger this, unknown interrupt
+      // TODO: why was this here? fires when TX buffers when we can't clear NAK
+      // USBx_OUTEP(3)->DOEPTSIZ = (1U << 19) | 0x40U;
+      // USBx_OUTEP(3)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+    } else if ((USBx_OUTEP(3)->DOEPINT) != 0) {
+      #ifdef DEBUG_USB
+        print("OUTEP3 error ");
+        puth(USBx_OUTEP(3)->DOEPINT);
+        print("\n");
+      #endif
+    } else {
+      // USBx_OUTEP(3)->DOEPINT is 0, ok to skip
+    }
+
+    if ((USBx_OUTEP(0)->DOEPINT & USB_OTG_DIEPINT_XFRC) != 0) {
+      // ready for next packet
+      USBx_OUTEP(0)->DOEPTSIZ = USB_OTG_DOEPTSIZ_STUPCNT | (USB_OTG_DOEPTSIZ_PKTCNT & (1U << 19)) | (1U << 3);
+    }
+
+    // respond to setup packets
+    if ((USBx_OUTEP(0)->DOEPINT & USB_OTG_DOEPINT_STUP) != 0) {
+      usb_setup();
+    }
+
+    USBx_OUTEP(0)->DOEPINT = USBx_OUTEP(0)->DOEPINT;
+    USBx_OUTEP(2)->DOEPINT = USBx_OUTEP(2)->DOEPINT;
+    USBx_OUTEP(3)->DOEPINT = USBx_OUTEP(3)->DOEPINT;
+  }
+
+  // interrupt endpoint hit (Page 1221)
+  if ((gintsts & USB_OTG_GINTSTS_IEPINT) != 0) {
+    #ifdef DEBUG_USB
+      print("  ");
+      puth(USBx_INEP(0)->DIEPINT);
+      print(" ");
+      puth(USBx_INEP(1)->DIEPINT);
+      print(" IN ENDPOINT\n");
+    #endif
+
+    // Should likely check the EP of the IN request even if there is
+    // only one IN endpoint.
+
+    // No need to set NAK in OTG_DIEPCTL0 when nothing to send,
+    // Appears USB core automatically sets NAK. WritePacket clears it.
+
+    // Handle the two interface alternate settings. Setting 0 has EP1
+    // as bulk. Setting 1 has EP1 as interrupt. The code to handle
+    // these two EP variations are very similar and can be
+    // restructured for smaller code footprint. Keeping split out for
+    // now for clarity.
+
+    //TODO add default case. Should it NAK?
+    switch (current_int0_alt_setting) {
+      case 0: ////// Bulk config
+        // *** IN token received when TxFIFO is empty
+        if ((USBx_INEP(1)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0) {
+          #ifdef DEBUG_USB
+          print("  IN PACKET QUEUE\n");
+          #endif
+          // TODO: always assuming max len, can we get the length?
+          USB_WritePacket((void *)resp, comms_can_read(resp, 0x40), 1);
+        }
+        break;
+
+      case 1: ////// Interrupt config
+        // *** IN token received when TxFIFO is empty
+        if ((USBx_INEP(1)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0) {
+          #ifdef DEBUG_USB
+          print("  IN PACKET QUEUE\n");
+          #endif
+          // TODO: always assuming max len, can we get the length?
+          int len = comms_can_read(resp, 0x40);
+          if (len > 0) {
+            USB_WritePacket((void *)resp, len, 1);
+          }
+        }
+        break;
+      default:
+        print("current_int0_alt_setting value invalid\n");
+        break;
+    }
+
+    if ((USBx_INEP(0)->DIEPINT & USB_OTG_DIEPMSK_ITTXFEMSK) != 0) {
+      #ifdef DEBUG_USB
+      print("  IN PACKET QUEUE\n");
+      #endif
+
+      if ((ep0_txlen != 0U) && ((USBx_INEP(0)->DTXFSTS & USB_OTG_DTXFSTS_INEPTFSAV) >= 0x40U)) {
+        uint16_t len = MIN(ep0_txlen, 0x40);
+        USB_WritePacket(ep0_txdata, len, 0);
+        ep0_txdata = &ep0_txdata[len];
+        ep0_txlen -= len;
+        if (ep0_txlen == 0U) {
+          ep0_txdata = NULL;
+          USBx_DEVICE->DIEPEMPMSK &= ~1;
+          USBx_OUTEP(0)->DOEPCTL |= USB_OTG_DOEPCTL_CNAK;
+        }
+      }
+    }
+
+    // clear interrupts
+    USBx_INEP(0)->DIEPINT = USBx_INEP(0)->DIEPINT; // Why ep0?
+    USBx_INEP(1)->DIEPINT = USBx_INEP(1)->DIEPINT;
+  }
+
+  // clear all interrupts we handled
+  USBx_DEVICE->DAINT = daint;
+  USBx->GOTGINT = gotgint;
+  USBx->GINTSTS = gintsts;
+
+  //USBx->GINTMSK = 0xFFFFFFFF & ~(USB_OTG_GINTMSK_NPTXFEM | USB_OTG_GINTMSK_PTXFEM | USB_OTG_GINTSTS_SOF | USB_OTG_GINTSTS_EOPF);
+}
+
+void can_tx_comms_resume_usb(void) {
+  ENTER_CRITICAL();
+  if (!outep3_processing && (USBx_OUTEP(3)->DOEPCTL & USB_OTG_DOEPCTL_NAKSTS) != 0) {
+    USBx_OUTEP(3)->DOEPTSIZ = (32U << 19) | 0x800U;
+    USBx_OUTEP(3)->DOEPCTL |= USB_OTG_DOEPCTL_EPENA | USB_OTG_DOEPCTL_CNAK;
+  }
+  EXIT_CRITICAL();
+}
+
+void usb_soft_disconnect(bool enable) {
+  if (enable) {
+    USBx_DEVICE->DCTL |= USB_OTG_DCTL_SDIS;
+  } else {
+    USBx_DEVICE->DCTL &= ~USB_OTG_DCTL_SDIS;
+  }
+}

panda/board/drivers/watchdog.h

@@ -0,0 +1,30 @@
+// TODO: why doesn't it define these?
+#ifdef STM32F2
+#define IWDG_PR_PR_Msk 0x7U
+#define IWDG_RLR_RL_Msk 0xFFFU
+#endif
+
+typedef enum {
+  WATCHDOG_50_MS = (400U - 1U),
+  WATCHDOG_500_MS = 4000U,
+} WatchdogTimeout;
+
+void watchdog_feed(void) {
+  IND_WDG->KR = 0xAAAAU;
+}
+
+void watchdog_init(WatchdogTimeout timeout) {
+  // enable watchdog
+  IND_WDG->KR = 0xCCCCU;
+  IND_WDG->KR = 0x5555U;
+
+  // 32KHz / 4 prescaler = 8000Hz
+  register_set(&(IND_WDG->PR), 0x0U, IWDG_PR_PR_Msk);
+  register_set(&(IND_WDG->RLR), timeout, IWDG_RLR_RL_Msk);
+
+  // wait for watchdog to be updated
+  while (IND_WDG->SR != 0U);
+
+  // start the countdown
+  watchdog_feed();
+}

panda/board/early_init.h

@@ -0,0 +1,60 @@
+// Early bringup
+#define ENTER_BOOTLOADER_MAGIC 0xdeadbeefU
+#define ENTER_SOFTLOADER_MAGIC 0xdeadc0deU
+#define BOOT_NORMAL 0xdeadb111U
+
+extern void *g_pfnVectors;
+extern uint32_t enter_bootloader_mode;
+
+void jump_to_bootloader(void) {
+  // do enter bootloader
+  enter_bootloader_mode = 0;
+  void (*bootloader)(void) = (void (*)(void)) (*((uint32_t *)BOOTLOADER_ADDRESS));
+
+  // jump to bootloader
+  enable_interrupts();
+  bootloader();
+
+  // reset on exit
+  enter_bootloader_mode = BOOT_NORMAL;
+  NVIC_SystemReset();
+}
+
+void early_initialization(void) {
+  // Reset global critical depth
+  disable_interrupts();
+  global_critical_depth = 0;
+
+  // Init register and interrupt tables
+  init_registers();
+
+  // after it's been in the bootloader, things are initted differently, so we reset
+  if ((enter_bootloader_mode != BOOT_NORMAL) &&
+      (enter_bootloader_mode != ENTER_BOOTLOADER_MAGIC) &&
+      (enter_bootloader_mode != ENTER_SOFTLOADER_MAGIC)) {
+    enter_bootloader_mode = BOOT_NORMAL;
+    NVIC_SystemReset();
+  }
+
+  // if wrong chip, reboot
+  volatile unsigned int id = DBGMCU->IDCODE;
+  if ((id & 0xFFFU) != MCU_IDCODE) {
+    enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+  }
+
+  // setup interrupt table
+  SCB->VTOR = (uint32_t)&g_pfnVectors;
+
+  // early GPIOs float everything
+  early_gpio_float();
+
+  detect_board_type();
+
+  if (enter_bootloader_mode == ENTER_BOOTLOADER_MAGIC) {
+  #ifdef PANDA
+    current_board->set_gps_mode(GPS_DISABLED);
+  #endif
+    current_board->set_led(LED_GREEN, 1);
+    jump_to_bootloader();
+  }
+}

panda/board/fake_stm.h

@@ -0,0 +1,96 @@
+// minimal code to fake a panda for tests
+#include <stdio.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stdbool.h>
+
+#include "utils.h"
+#include "drivers/rtc_definitions.h"
+
+#define CANFD
+#define ALLOW_DEBUG
+#define PANDA
+
+#define ENTER_CRITICAL() 0
+#define EXIT_CRITICAL() 0
+
+void print(const char *a) {
+  printf("%s", a);
+}
+
+void puth(unsigned int i) {
+  printf("%u", i);
+}
+
+typedef struct {
+  uint32_t CNT;
+} TIM_TypeDef;
+
+TIM_TypeDef timer;
+TIM_TypeDef *MICROSECOND_TIMER = &timer;
+uint32_t microsecond_timer_get(void);
+
+uint32_t microsecond_timer_get(void) {
+  return MICROSECOND_TIMER->CNT;
+}
+
+// Register functions
+void register_set_bits(volatile uint32_t *addr, uint32_t val) {}
+
+// RTC
+timestamp_t rtc_get_time() {
+  timestamp_t result;
+  result.year = 1996;
+  result.month = 4;
+  result.day = 23;
+  result.weekday = 2;
+  result.hour = 4;
+  result.minute = 20;
+  result.second = 20;
+  return result;
+}
+
+// Logging and flash
+uint8_t fake_logging_bank[0x40000] __attribute__ ((aligned (4)));
+#define LOGGING_FLASH_BASE_A (&fake_logging_bank[0])
+#define LOGGING_FLASH_BASE_B (&fake_logging_bank[0x20000])
+#define LOGGING_FLASH_SECTOR_A 5
+#define LOGGING_FLASH_SECTOR_B 6
+#define LOGGING_FLASH_SECTOR_SIZE 0x20000U
+
+bool flash_locked = true;
+void flash_unlock(void) {
+  flash_locked = false;
+}
+void flash_lock(void) {
+  flash_locked = true;
+}
+
+void *memset(void *str, int c, unsigned int n);
+
+bool flash_erase_sector(uint8_t sector) {
+  if (flash_locked) {
+    return false;
+  }
+
+  switch (sector) {
+    case LOGGING_FLASH_SECTOR_A:
+      memset(LOGGING_FLASH_BASE_A, 0xFF, sizeof(fake_logging_bank)/2);
+      return true;
+    case LOGGING_FLASH_SECTOR_B:
+      memset(LOGGING_FLASH_BASE_B, 0xFF, sizeof(fake_logging_bank)/2);
+      return true;
+    default:
+      return false;
+  }
+}
+
+void flash_write_word(void *prog_ptr, uint32_t data) {
+  if (flash_locked || prog_ptr < (void *) LOGGING_FLASH_BASE_A || prog_ptr >= (void *) (LOGGING_FLASH_BASE_A + sizeof(fake_logging_bank))) {
+    return;
+  }
+
+  *(uint32_t *)prog_ptr = data;
+}
+
+void flush_write_buffer(void) {}

panda/board/faults.h

@@ -0,0 +1,60 @@
+#define FAULT_STATUS_NONE 0U
+#define FAULT_STATUS_TEMPORARY 1U
+#define FAULT_STATUS_PERMANENT 2U
+
+// Fault types, matches cereal.log.PandaState.FaultType
+#define FAULT_RELAY_MALFUNCTION             (1U << 0)
+#define FAULT_UNUSED_INTERRUPT_HANDLED      (1U << 1)
+#define FAULT_INTERRUPT_RATE_CAN_1          (1U << 2)
+#define FAULT_INTERRUPT_RATE_CAN_2          (1U << 3)
+#define FAULT_INTERRUPT_RATE_CAN_3          (1U << 4)
+#define FAULT_INTERRUPT_RATE_TACH           (1U << 5)
+#define FAULT_INTERRUPT_RATE_GMLAN          (1U << 6)
+#define FAULT_INTERRUPT_RATE_INTERRUPTS     (1U << 7)
+#define FAULT_INTERRUPT_RATE_SPI_DMA        (1U << 8)
+#define FAULT_INTERRUPT_RATE_SPI_CS         (1U << 9)
+#define FAULT_INTERRUPT_RATE_UART_1         (1U << 10)
+#define FAULT_INTERRUPT_RATE_UART_2         (1U << 11)
+#define FAULT_INTERRUPT_RATE_UART_3         (1U << 12)
+#define FAULT_INTERRUPT_RATE_UART_5         (1U << 13)
+#define FAULT_INTERRUPT_RATE_UART_DMA       (1U << 14)
+#define FAULT_INTERRUPT_RATE_USB            (1U << 15)
+#define FAULT_INTERRUPT_RATE_TIM1           (1U << 16)
+#define FAULT_INTERRUPT_RATE_TIM3           (1U << 17)
+#define FAULT_REGISTER_DIVERGENT            (1U << 18)
+#define FAULT_INTERRUPT_RATE_KLINE_INIT     (1U << 19)
+#define FAULT_INTERRUPT_RATE_CLOCK_SOURCE   (1U << 20)
+#define FAULT_INTERRUPT_RATE_TICK           (1U << 21)
+#define FAULT_INTERRUPT_RATE_EXTI           (1U << 22)
+#define FAULT_INTERRUPT_RATE_SPI            (1U << 23)
+#define FAULT_INTERRUPT_RATE_UART_7         (1U << 24)
+#define FAULT_SIREN_MALFUNCTION             (1U << 25)
+#define FAULT_HEARTBEAT_LOOP_WATCHDOG       (1U << 26)
+#define FAULT_LOGGING_RATE_LIMIT            (1U << 27)
+
+// Permanent faults
+#define PERMANENT_FAULTS 0U
+
+uint8_t fault_status = FAULT_STATUS_NONE;
+uint32_t faults = 0U;
+
+void fault_occurred(uint32_t fault) {
+  if ((faults & fault) == 0U) {
+    if ((PERMANENT_FAULTS & fault) != 0U) {
+      print("Permanent fault occurred: 0x"); puth(fault); print("\n");
+      fault_status = FAULT_STATUS_PERMANENT;
+    } else {
+      print("Temporary fault occurred: 0x"); puth(fault); print("\n");
+      fault_status = FAULT_STATUS_TEMPORARY;
+    }
+  }
+  faults |= fault;
+}
+
+void fault_recovered(uint32_t fault) {
+  if ((PERMANENT_FAULTS & fault) == 0U) {
+    faults &= ~fault;
+  } else {
+    print("Cannot recover from a permanent fault!\n");
+  }
+}

panda/board/flash.py

@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+import os
+import subprocess
+
+from panda import Panda
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  subprocess.check_call(f"scons -C {board_path}/.. -j$(nproc) {board_path}", shell=True)
+
+  serials = Panda.list()
+  print(f"found {len(serials)} panda(s) - {serials}")
+  for s in serials:
+    print("flashing", s)
+    with Panda(serial=s) as p:
+      p.flash()

panda/board/flasher.h

@@ -0,0 +1,315 @@
+// flasher state variables
+uint32_t *prog_ptr = NULL;
+
+void spi_init(void);
+
+#ifdef uart_ring
+void debug_ring_callback(uart_ring *ring) {}
+#endif
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  int resp_len = 0;
+
+  // flasher machine
+  memset(resp, 0, 4);
+  memcpy(resp+4, "\xde\xad\xd0\x0d", 4);
+  resp[0] = 0xff;
+  resp[2] = req->request;
+  resp[3] = ~req->request;
+  *((uint32_t **)&resp[8]) = prog_ptr;
+  resp_len = 0xc;
+
+  int sec;
+  switch (req->request) {
+    // **** 0xb0: flasher echo
+    case 0xb0:
+      resp[1] = 0xff;
+      break;
+    // **** 0xb1: unlock flash
+    case 0xb1:
+      if (flash_is_locked()) {
+        flash_unlock();
+        resp[1] = 0xff;
+      }
+      current_board->set_led(LED_GREEN, 1);
+      prog_ptr = (uint32_t *)APP_START_ADDRESS;
+      break;
+    // **** 0xb2: erase sector
+    case 0xb2:
+      sec = req->param1;
+      if (flash_erase_sector(sec)) {
+        resp[1] = 0xff;
+      }
+      break;
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xc3: fetch MCU UID
+    case 0xc3:
+      #ifdef UID_BASE
+        (void)memcpy(resp, ((uint8_t *)UID_BASE), 12);
+        resp_len = 12;
+      #endif
+      break;
+    // **** 0xd0: fetch serial number
+    case 0xd0:
+      #ifndef STM32F2
+        // addresses are OTP
+        if (req->param1 == 1) {
+          memcpy(resp, (void *)DEVICE_SERIAL_NUMBER_ADDRESS, 0x10);
+          resp_len = 0x10;
+        } else {
+          get_provision_chunk(resp);
+          resp_len = PROVISION_CHUNK_LEN;
+        }
+      #endif
+      break;
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      // this allows reflashing of the bootstub
+      switch (req->param1) {
+        case 0:
+          print("-> entering bootloader\n");
+          enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+      }
+      break;
+    // **** 0xd6: get version
+    case 0xd6:
+      COMPILE_TIME_ASSERT(sizeof(gitversion) <= USBPACKET_MAX_SIZE);
+      memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion);
+      break;
+    // **** 0xd8: reset ST
+    case 0xd8:
+      flush_write_buffer();
+      NVIC_SystemReset();
+      break;
+  }
+  return resp_len;
+}
+
+void comms_can_write(uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+
+int comms_can_read(uint8_t *data, uint32_t max_len) {
+  UNUSED(data);
+  UNUSED(max_len);
+  return 0;
+}
+
+void refresh_can_tx_slots_available(void) {}
+
+void comms_endpoint2_write(uint8_t *data, uint32_t len) {
+  current_board->set_led(LED_RED, 0);
+  for (uint32_t i = 0; i < len/4; i++) {
+    flash_write_word(prog_ptr, *(uint32_t*)(data+(i*4)));
+
+    //*(uint64_t*)(&spi_tx_buf[0x30+(i*4)]) = *prog_ptr;
+    prog_ptr++;
+  }
+  current_board->set_led(LED_RED, 1);
+}
+
+
+int spi_cb_rx(uint8_t *data, int len, uint8_t *data_out) {
+  UNUSED(len);
+  ControlPacket_t control_req;
+
+  int resp_len = 0;
+  switch (data[0]) {
+    case 0:
+      // control transfer
+      control_req.request = ((USB_Setup_TypeDef *)(data+4))->b.bRequest;
+      control_req.param1 = ((USB_Setup_TypeDef *)(data+4))->b.wValue.w;
+      control_req.param2 = ((USB_Setup_TypeDef *)(data+4))->b.wIndex.w;
+      control_req.length = ((USB_Setup_TypeDef *)(data+4))->b.wLength.w;
+
+      resp_len = comms_control_handler(&control_req, data_out);
+      break;
+    case 2:
+      // ep 2, flash!
+      comms_endpoint2_write(data+4, data[2]);
+      break;
+  }
+  return resp_len;
+}
+
+#ifdef PEDAL
+
+#include "stm32fx/llbxcan.h"
+#define CAN CAN1
+
+#define CAN_BL_INPUT 0x1
+#define CAN_BL_OUTPUT 0x2
+
+void CAN1_TX_IRQ_Handler(void) {
+  // clear interrupt
+  CAN->TSR |= CAN_TSR_RQCP0;
+}
+
+#define ISOTP_BUF_SIZE 0x110
+
+uint8_t isotp_buf[ISOTP_BUF_SIZE];
+uint8_t *isotp_buf_ptr = NULL;
+int isotp_buf_remain = 0;
+
+uint8_t isotp_buf_out[ISOTP_BUF_SIZE];
+uint8_t *isotp_buf_out_ptr = NULL;
+int isotp_buf_out_remain = 0;
+int isotp_buf_out_idx = 0;
+
+void bl_can_send(uint8_t *odat) {
+  // wait for send
+  while (!(CAN->TSR & CAN_TSR_TME0));
+
+  // send continue
+  CAN->sTxMailBox[0].TDLR = ((uint32_t*)odat)[0];
+  CAN->sTxMailBox[0].TDHR = ((uint32_t*)odat)[1];
+  CAN->sTxMailBox[0].TDTR = 8;
+  CAN->sTxMailBox[0].TIR = (CAN_BL_OUTPUT << 21) | 1;
+}
+
+void CAN1_RX0_IRQ_Handler(void) {
+  while (CAN->RF0R & CAN_RF0R_FMP0) {
+    if ((CAN->sFIFOMailBox[0].RIR>>21) == CAN_BL_INPUT) {
+      uint8_t dat[8];
+      for (int i = 0; i < 8; i++) {
+        dat[i] = GET_MAILBOX_BYTE(&CAN->sFIFOMailBox[0], i);
+      }
+      uint8_t odat[8];
+      uint8_t type = dat[0] & 0xF0;
+      if (type == 0x30) {
+        // continue
+        while (isotp_buf_out_remain > 0) {
+          // wait for send
+          while (!(CAN->TSR & CAN_TSR_TME0));
+
+          odat[0] = 0x20 | isotp_buf_out_idx;
+          memcpy(odat+1, isotp_buf_out_ptr, 7);
+          isotp_buf_out_remain -= 7;
+          isotp_buf_out_ptr += 7;
+          isotp_buf_out_idx++;
+
+          bl_can_send(odat);
+        }
+      } else if (type == 0x20) {
+        if (isotp_buf_remain > 0) {
+          memcpy(isotp_buf_ptr, dat+1, 7);
+          isotp_buf_ptr += 7;
+          isotp_buf_remain -= 7;
+        }
+        if (isotp_buf_remain <= 0) {
+          int len = isotp_buf_ptr - isotp_buf + isotp_buf_remain;
+
+          // call the function
+          memset(isotp_buf_out, 0, ISOTP_BUF_SIZE);
+          isotp_buf_out_remain = spi_cb_rx(isotp_buf, len, isotp_buf_out);
+          isotp_buf_out_ptr = isotp_buf_out;
+          isotp_buf_out_idx = 0;
+
+          // send initial
+          if (isotp_buf_out_remain <= 7) {
+            odat[0] = isotp_buf_out_remain;
+            memcpy(odat+1, isotp_buf_out_ptr, isotp_buf_out_remain);
+          } else {
+            odat[0] = 0x10 | (isotp_buf_out_remain>>8);
+            odat[1] = isotp_buf_out_remain & 0xFF;
+            memcpy(odat+2, isotp_buf_out_ptr, 6);
+            isotp_buf_out_remain -= 6;
+            isotp_buf_out_ptr += 6;
+            isotp_buf_out_idx++;
+          }
+
+          bl_can_send(odat);
+        }
+      } else if (type == 0x10) {
+        int len = ((dat[0]&0xF)<<8) | dat[1];
+
+        // setup buffer
+        isotp_buf_ptr = isotp_buf;
+        memcpy(isotp_buf_ptr, dat+2, 6);
+
+        if (len < (ISOTP_BUF_SIZE-0x10)) {
+          isotp_buf_ptr += 6;
+          isotp_buf_remain = len-6;
+        }
+
+        memset(odat, 0, 8);
+        odat[0] = 0x30;
+        bl_can_send(odat);
+      }
+    }
+    // next
+    CAN->RF0R |= CAN_RF0R_RFOM0;
+  }
+}
+
+void CAN1_SCE_IRQ_Handler(void) {
+  llcan_clear_send(CAN);
+}
+
+#endif
+
+void soft_flasher_start(void) {
+  #ifdef PEDAL
+    REGISTER_INTERRUPT(CAN1_TX_IRQn, CAN1_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+    REGISTER_INTERRUPT(CAN1_RX0_IRQn, CAN1_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+    REGISTER_INTERRUPT(CAN1_SCE_IRQn, CAN1_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  #endif
+
+  print("\n\n\n************************ FLASHER START ************************\n");
+
+  enter_bootloader_mode = 0;
+
+  flasher_peripherals_init();
+
+// pedal has the canloader
+#ifdef PEDAL
+  RCC->APB1ENR |= RCC_APB1ENR_CAN1EN;
+
+  // B8,B9: CAN 1
+  set_gpio_alternate(GPIOB, 8, GPIO_AF9_CAN1);
+  set_gpio_alternate(GPIOB, 9, GPIO_AF9_CAN1);
+  current_board->enable_can_transceiver(1, true);
+
+  // init can
+  llcan_set_speed(CAN1, 5000, false, false);
+  llcan_init(CAN1);
+#endif
+
+  gpio_usart2_init();
+  gpio_usb_init();
+
+  // enable USB
+  usb_init();
+
+  // enable SPI
+  if (current_board->has_spi) {
+    gpio_spi_init();
+    spi_init();
+  }
+
+  // green LED on for flashing
+  current_board->set_led(LED_GREEN, 1);
+
+  enable_interrupts();
+
+  for (;;) {
+    // blink the green LED fast
+    current_board->set_led(LED_GREEN, 0);
+    delay(500000);
+    current_board->set_led(LED_GREEN, 1);
+    delay(500000);
+  }
+}

panda/board/health.h

@@ -0,0 +1,62 @@
+// When changing these structs, python/__init__.py needs to be kept up to date!
+
+#define HEALTH_PACKET_VERSION 14
+struct __attribute__((packed)) health_t {
+  uint32_t uptime_pkt;
+  uint32_t voltage_pkt;
+  uint32_t current_pkt;
+  uint32_t safety_tx_blocked_pkt;
+  uint32_t safety_rx_invalid_pkt;
+  uint32_t tx_buffer_overflow_pkt;
+  uint32_t rx_buffer_overflow_pkt;
+  uint32_t gmlan_send_errs_pkt;
+  uint32_t faults_pkt;
+  uint8_t ignition_line_pkt;
+  uint8_t ignition_can_pkt;
+  uint8_t controls_allowed_pkt;
+  uint8_t gas_interceptor_detected_pkt;
+  uint8_t car_harness_status_pkt;
+  uint8_t safety_mode_pkt;
+  uint16_t safety_param_pkt;
+  uint8_t fault_status_pkt;
+  uint8_t power_save_enabled_pkt;
+  uint8_t heartbeat_lost_pkt;
+  uint16_t alternative_experience_pkt;
+  float interrupt_load;
+  uint8_t fan_power;
+  uint8_t safety_rx_checks_invalid;
+  uint16_t spi_checksum_error_count;
+  uint8_t fan_stall_count;
+  uint16_t sbu1_voltage_mV;
+  uint16_t sbu2_voltage_mV;
+};
+
+#define CAN_HEALTH_PACKET_VERSION 5
+typedef struct __attribute__((packed)) {
+  uint8_t bus_off;
+  uint32_t bus_off_cnt;
+  uint8_t error_warning;
+  uint8_t error_passive;
+  uint8_t last_error; // real time LEC value
+  uint8_t last_stored_error; // last LEC positive error code stored
+  uint8_t last_data_error; // DLEC (for CANFD only)
+  uint8_t last_data_stored_error; // last DLEC positive error code stored (for CANFD only)
+  uint8_t receive_error_cnt; // Actual state of the receive error counter, values between 0 and 127. FDCAN_ECR.REC
+  uint8_t transmit_error_cnt; // Actual state of the transmit error counter, values between 0 and 255. FDCAN_ECR.TEC
+  uint32_t total_error_cnt; // How many times any error interrupt was invoked
+  uint32_t total_tx_lost_cnt; // Tx event FIFO element lost
+  uint32_t total_rx_lost_cnt; // Rx FIFO 0 message lost due to FIFO full condition
+  uint32_t total_tx_cnt;
+  uint32_t total_rx_cnt;
+  uint32_t total_fwd_cnt; // Messages forwarded from one bus to another
+  uint32_t total_tx_checksum_error_cnt;
+  uint16_t can_speed;
+  uint16_t can_data_speed;
+  uint8_t canfd_enabled;
+  uint8_t brs_enabled;
+  uint8_t canfd_non_iso;
+  uint32_t irq0_call_rate;
+  uint32_t irq1_call_rate;
+  uint32_t irq2_call_rate;
+  uint32_t can_core_reset_cnt;
+} can_health_t;

panda/board/libc.h

@@ -0,0 +1,64 @@
+// **** libc ****
+
+void delay(uint32_t a) {
+  volatile uint32_t i;
+  for (i = 0; i < a; i++);
+}
+
+void *memset(void *str, int c, unsigned int n) {
+  uint8_t *s = str;
+  for (unsigned int i = 0; i < n; i++) {
+    *s = c;
+    s++;
+  }
+  return str;
+}
+
+#define UNALIGNED(X, Y) \
+  (((uint32_t)(X) & (sizeof(uint32_t) - 1U)) | ((uint32_t)(Y) & (sizeof(uint32_t) - 1U)))
+
+void *memcpy(void *dest, const void *src, unsigned int len) {
+  unsigned int n = len;
+  uint8_t *d8 = dest;
+  const uint8_t *s8 = src;
+
+  if ((n >= 4U) && !UNALIGNED(s8, d8)) {
+    uint32_t *d32 = (uint32_t *)d8; // cppcheck-suppress misra-c2012-11.3 ; already checked that it's properly aligned
+    const uint32_t *s32 = (const uint32_t *)s8; // cppcheck-suppress misra-c2012-11.3 ; already checked that it's properly aligned
+
+    while(n >= 16U) {
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      *d32 = *s32; d32++; s32++;
+      n -= 16U;
+    }
+
+    while(n >= 4U) {
+      *d32 = *s32; d32++; s32++;
+      n -= 4U;
+    }
+
+    d8 = (uint8_t *)d32;
+    s8 = (const uint8_t *)s32;
+  }
+  while (n-- > 0U) {
+    *d8 = *s8; d8++; s8++;
+  }
+  return dest;
+}
+
+int memcmp(const void * ptr1, const void * ptr2, unsigned int num) {
+  int ret = 0;
+  const uint8_t *p1 = ptr1;
+  const uint8_t *p2 = ptr2;
+  for (unsigned int i = 0; i < num; i++) {
+    if (*p1 != *p2) {
+      ret = -1;
+      break;
+    }
+    p1++;
+    p2++;
+  }
+  return ret;
+}

panda/board/main.c

@@ -0,0 +1,477 @@
+// ********************* Includes *********************
+#include "config.h"
+
+#include "drivers/pwm.h"
+#include "drivers/usb.h"
+#include "drivers/gmlan_alt.h"
+#include "drivers/kline_init.h"
+#include "drivers/simple_watchdog.h"
+#include "drivers/logging.h"
+
+#include "early_init.h"
+#include "provision.h"
+
+#include "safety.h"
+
+#include "health.h"
+
+#include "drivers/can_common.h"
+
+#ifdef STM32H7
+  #include "drivers/fdcan.h"
+#else
+  #include "drivers/bxcan.h"
+#endif
+
+#include "power_saving.h"
+
+#include "obj/gitversion.h"
+
+#include "can_comms.h"
+#include "main_comms.h"
+
+
+// ********************* Serial debugging *********************
+
+bool check_started(void) {
+  bool started = current_board->check_ignition() || ignition_can;
+  ignition_seen |= started;
+  return started;
+}
+
+void debug_ring_callback(uart_ring *ring) {
+  char rcv;
+  while (getc(ring, &rcv)) {
+    (void)putc(ring, rcv);  // misra-c2012-17.7: cast to void is ok: debug function
+
+    // only allow bootloader entry on debug builds
+    #ifdef ALLOW_DEBUG
+      // jump to DFU flash
+      if (rcv == 'z') {
+        enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+        NVIC_SystemReset();
+      }
+    #endif
+
+    // normal reset
+    if (rcv == 'x') {
+      NVIC_SystemReset();
+    }
+  }
+}
+
+// ****************************** safety mode ******************************
+
+// this is the only way to leave silent mode
+void set_safety_mode(uint16_t mode, uint16_t param) {
+  uint16_t mode_copy = mode;
+  int err = set_safety_hooks(mode_copy, param);
+  if (err == -1) {
+    print("Error: safety set mode failed. Falling back to SILENT\n");
+    mode_copy = SAFETY_SILENT;
+    err = set_safety_hooks(mode_copy, 0U);
+    if (err == -1) {
+      print("Error: Failed setting SILENT mode. Hanging\n");
+      while (true) {
+        // TERMINAL ERROR: we can't continue if SILENT safety mode isn't succesfully set
+      }
+    }
+  }
+  safety_tx_blocked = 0;
+  safety_rx_invalid = 0;
+
+  switch (mode_copy) {
+    case SAFETY_SILENT:
+      set_intercept_relay(false);
+      if (current_board->has_obd) {
+        current_board->set_can_mode(CAN_MODE_NORMAL);
+      }
+      can_silent = ALL_CAN_SILENT;
+      break;
+    case SAFETY_NOOUTPUT:
+      set_intercept_relay(false);
+      if (current_board->has_obd) {
+        current_board->set_can_mode(CAN_MODE_NORMAL);
+      }
+      can_silent = ALL_CAN_LIVE;
+      break;
+    case SAFETY_ELM327:
+      set_intercept_relay(false);
+      heartbeat_counter = 0U;
+      heartbeat_lost = false;
+      if (current_board->has_obd) {
+        if (param == 0U) {
+          current_board->set_can_mode(CAN_MODE_OBD_CAN2);
+        } else {
+          current_board->set_can_mode(CAN_MODE_NORMAL);
+        }
+      }
+      can_silent = ALL_CAN_LIVE;
+      break;
+    default:
+      set_intercept_relay(true);
+      heartbeat_counter = 0U;
+      heartbeat_lost = false;
+      if (current_board->has_obd) {
+        current_board->set_can_mode(CAN_MODE_NORMAL);
+      }
+      can_silent = ALL_CAN_LIVE;
+      break;
+  }
+  can_init_all();
+}
+
+bool is_car_safety_mode(uint16_t mode) {
+  return (mode != SAFETY_SILENT) &&
+         (mode != SAFETY_NOOUTPUT) &&
+         (mode != SAFETY_ALLOUTPUT) &&
+         (mode != SAFETY_ELM327);
+}
+
+// ***************************** main code *****************************
+
+// cppcheck-suppress unusedFunction ; used in headers not included in cppcheck
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+void __attribute__ ((noinline)) enable_fpu(void) {
+  // enable the FPU
+  SCB->CPACR |= ((3UL << (10U * 2U)) | (3UL << (11U * 2U)));
+}
+
+// go into SILENT when heartbeat isn't received for this amount of seconds.
+#define HEARTBEAT_IGNITION_CNT_ON 5U
+#define HEARTBEAT_IGNITION_CNT_OFF 2U
+
+// called at 8Hz
+uint8_t loop_counter = 0U;
+uint8_t previous_harness_status = HARNESS_STATUS_NC;
+uint32_t waiting_to_boot_count = 0;
+bool waiting_to_boot = false;
+void tick_handler(void) {
+  if (TICK_TIMER->SR != 0) {
+    // siren
+    current_board->set_siren((loop_counter & 1U) && (siren_enabled || (siren_countdown > 0U)));
+
+    // tick drivers at 8Hz
+    fan_tick();
+    usb_tick();
+    simple_watchdog_kick();
+
+    // decimated to 1Hz
+    if (loop_counter == 0U) {
+      can_live = pending_can_live;
+
+      //puth(usart1_dma); print(" "); puth(DMA2_Stream5->M0AR); print(" "); puth(DMA2_Stream5->NDTR); print("\n");
+
+      // reset this every 16th pass
+      if ((uptime_cnt & 0xFU) == 0U) {
+        pending_can_live = 0;
+      }
+      #ifdef DEBUG
+        print("** blink ");
+        print("rx:"); puth4(can_rx_q.r_ptr); print("-"); puth4(can_rx_q.w_ptr); print("  ");
+        print("tx1:"); puth4(can_tx1_q.r_ptr); print("-"); puth4(can_tx1_q.w_ptr); print("  ");
+        print("tx2:"); puth4(can_tx2_q.r_ptr); print("-"); puth4(can_tx2_q.w_ptr); print("  ");
+        print("tx3:"); puth4(can_tx3_q.r_ptr); print("-"); puth4(can_tx3_q.w_ptr); print("\n");
+      #endif
+
+      // set green LED to be controls allowed
+      current_board->set_led(LED_GREEN, controls_allowed | green_led_enabled);
+
+      // turn off the blue LED, turned on by CAN
+      // unless we are in power saving mode
+      current_board->set_led(LED_BLUE, (uptime_cnt & 1U) && (power_save_status == POWER_SAVE_STATUS_ENABLED));
+
+      // tick drivers at 1Hz
+      harness_tick();
+      logging_tick();
+
+      const bool recent_heartbeat = heartbeat_counter == 0U;
+      const bool harness_inserted = (harness.status != previous_harness_status) && (harness.status != HARNESS_STATUS_NC);
+      const bool just_bootkicked = current_board->board_tick(check_started(), usb_enumerated, recent_heartbeat, harness_inserted);
+      previous_harness_status = harness.status;
+
+      // log device boot time
+      const bool som_running = current_board->read_som_gpio();
+      if (just_bootkicked && !som_running) {
+        log("bootkick");
+        waiting_to_boot = true;
+      }
+      if (waiting_to_boot) {
+        if (som_running) {
+          log("device booted");
+          waiting_to_boot = false;
+        } else if (waiting_to_boot_count == 10U) {
+          log("not booted after 10s");
+        } else {
+
+        }
+        waiting_to_boot_count += 1U;
+      }
+
+      // increase heartbeat counter and cap it at the uint32 limit
+      if (heartbeat_counter < __UINT32_MAX__) {
+        heartbeat_counter += 1U;
+      }
+
+      // disabling heartbeat not allowed while in safety mode
+      if (is_car_safety_mode(current_safety_mode)) {
+        heartbeat_disabled = false;
+      }
+
+      if (siren_countdown > 0U) {
+        siren_countdown -= 1U;
+      }
+
+      if (controls_allowed || heartbeat_engaged) {
+        controls_allowed_countdown = 30U;
+      } else if (controls_allowed_countdown > 0U) {
+        controls_allowed_countdown -= 1U;
+      } else {
+
+      }
+
+      // exit controls allowed if unused by openpilot for a few seconds
+      if (controls_allowed && !heartbeat_engaged) {
+        heartbeat_engaged_mismatches += 1U;
+        if (heartbeat_engaged_mismatches >= 3U) {
+          controls_allowed = 0U;
+        }
+      } else {
+        heartbeat_engaged_mismatches = 0U;
+      }
+
+      if (!heartbeat_disabled) {
+        // if the heartbeat has been gone for a while, go to SILENT safety mode and enter power save
+        if (heartbeat_counter >= (check_started() ? HEARTBEAT_IGNITION_CNT_ON : HEARTBEAT_IGNITION_CNT_OFF)) {
+          print("device hasn't sent a heartbeat for 0x");
+          puth(heartbeat_counter);
+          print(" seconds. Safety is set to SILENT mode.\n");
+
+          if (controls_allowed_countdown > 0U) {
+            siren_countdown = 5U;
+            controls_allowed_countdown = 0U;
+          }
+
+          // set flag to indicate the heartbeat was lost
+          if (is_car_safety_mode(current_safety_mode)) {
+            heartbeat_lost = true;
+          }
+
+          // clear heartbeat engaged state
+          heartbeat_engaged = false;
+
+          if (current_safety_mode != SAFETY_SILENT) {
+            set_safety_mode(SAFETY_SILENT, 0U);
+          }
+
+          if (power_save_status != POWER_SAVE_STATUS_ENABLED) {
+            set_power_save_state(POWER_SAVE_STATUS_ENABLED);
+          }
+
+          // Also disable IR when the heartbeat goes missing
+          current_board->set_ir_power(0U);
+
+          // Run fan when device is up, but not talking to us
+          // * bootloader enables the SOM GPIO on boot
+          // * fallback to USB enumerated where supported
+          bool enabled = usb_enumerated || current_board->read_som_gpio();
+          fan_set_power(enabled ? 50U : 0U);
+        }
+      }
+
+      // check registers
+      check_registers();
+
+      // set ignition_can to false after 2s of no CAN seen
+      if (ignition_can_cnt > 2U) {
+        ignition_can = false;
+      }
+
+      // on to the next one
+      uptime_cnt += 1U;
+      safety_mode_cnt += 1U;
+      ignition_can_cnt += 1U;
+
+      // synchronous safety check
+      safety_tick(current_rx_checks);
+    }
+
+    loop_counter++;
+    loop_counter %= 8U;
+  }
+  TICK_TIMER->SR = 0;
+}
+
+void EXTI_IRQ_Handler(void) {
+  if (check_exti_irq()) {
+    exti_irq_clear();
+    clock_init();
+
+    set_power_save_state(POWER_SAVE_STATUS_DISABLED);
+    deepsleep_allowed = false;
+    heartbeat_counter = 0U;
+    usb_soft_disconnect(false);
+
+    NVIC_EnableIRQ(TICK_TIMER_IRQ);
+  }
+}
+
+uint8_t rtc_counter = 0;
+void RTC_WKUP_IRQ_Handler(void) {
+  exti_irq_clear();
+  clock_init();
+
+  rtc_counter++;
+  if ((rtc_counter % 2U) == 0U) {
+    current_board->set_led(LED_BLUE, false);
+  } else {
+    current_board->set_led(LED_BLUE, true);
+  }
+
+  if (rtc_counter == __UINT8_MAX__) {
+    rtc_counter = 1U;
+  }
+}
+
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  // shouldn't have interrupts here, but just in case
+  disable_interrupts();
+
+  // init early devices
+  clock_init();
+  peripherals_init();
+  detect_board_type();
+  adc_init();
+  logging_init();
+
+  // print hello
+  print("\n\n\n************************ MAIN START ************************\n");
+
+  // check for non-supported board types
+  if(hw_type == HW_TYPE_UNKNOWN){
+    print("Unsupported board type\n");
+    while (1) { /* hang */ }
+  }
+
+  print("Config:\n");
+  print("  Board type: "); print(current_board->board_type); print("\n");
+
+  // init board
+  current_board->init();
+
+  // panda has an FPU, let's use it!
+  enable_fpu();
+
+  log("main start");
+
+  if (current_board->has_gps) {
+    uart_init(&uart_ring_gps, 9600);
+  } else {
+    // enable ESP uart
+    uart_init(&uart_ring_gps, 115200);
+  }
+
+  if (current_board->has_lin) {
+    // enable LIN
+    uart_init(&uart_ring_lin1, 10400);
+    UART5->CR2 |= USART_CR2_LINEN;
+    uart_init(&uart_ring_lin2, 10400);
+    USART3->CR2 |= USART_CR2_LINEN;
+  }
+
+  if (current_board->fan_max_rpm > 0U) {
+    fan_init();
+  }
+
+  microsecond_timer_init();
+
+  // init to SILENT and can silent
+  set_safety_mode(SAFETY_SILENT, 0U);
+
+  // enable CAN TXs
+  current_board->enable_can_transceivers(true);
+
+  // init watchdog for heartbeat loop, fed at 8Hz
+  simple_watchdog_init(FAULT_HEARTBEAT_LOOP_WATCHDOG, (3U * 1000000U / 8U));
+
+  // 8Hz timer
+  REGISTER_INTERRUPT(TICK_TIMER_IRQ, tick_handler, 10U, FAULT_INTERRUPT_RATE_TICK)
+  tick_timer_init();
+
+#ifdef DEBUG
+  print("DEBUG ENABLED\n");
+#endif
+  // enable USB (right before interrupts or enum can fail!)
+  usb_init();
+
+#ifdef ENABLE_SPI
+  if (current_board->has_spi) {
+    spi_init();
+  }
+#endif
+
+  print("**** INTERRUPTS ON ****\n");
+  enable_interrupts();
+
+  // LED should keep on blinking all the time
+  uint64_t cnt = 0;
+
+  for (cnt=0;;cnt++) {
+    if (power_save_status == POWER_SAVE_STATUS_DISABLED) {
+      #ifdef DEBUG_FAULTS
+      if (fault_status == FAULT_STATUS_NONE) {
+      #endif
+        // useful for debugging, fade breaks = panda is overloaded
+        for (uint32_t fade = 0U; fade < MAX_LED_FADE; fade += 1U) {
+          current_board->set_led(LED_RED, true);
+          delay(fade >> 4);
+          current_board->set_led(LED_RED, false);
+          delay((MAX_LED_FADE - fade) >> 4);
+        }
+
+        for (uint32_t fade = MAX_LED_FADE; fade > 0U; fade -= 1U) {
+          current_board->set_led(LED_RED, true);
+          delay(fade >> 4);
+          current_board->set_led(LED_RED, false);
+          delay((MAX_LED_FADE - fade) >> 4);
+        }
+
+      #ifdef DEBUG_FAULTS
+      } else {
+          current_board->set_led(LED_RED, 1);
+          delay(512000U);
+          current_board->set_led(LED_RED, 0);
+          delay(512000U);
+        }
+      #endif
+    } else {
+      if (deepsleep_allowed && !usb_enumerated && !check_started() && ignition_seen && (heartbeat_counter > 20U)) {
+        usb_soft_disconnect(true);
+        fan_set_power(0U);
+        NVIC_DisableIRQ(TICK_TIMER_IRQ);
+        delay(512000U);
+
+        // Init IRQs for CAN transceiver and ignition line
+        exti_irq_init();
+
+        // Init RTC Wakeup event on EXTI22
+        REGISTER_INTERRUPT(RTC_WKUP_IRQn, RTC_WKUP_IRQ_Handler, 10U, FAULT_INTERRUPT_RATE_EXTI)
+        rtc_wakeup_init();
+
+        // STOP mode
+        SCB->SCR |= SCB_SCR_SLEEPDEEP_Msk;
+      }
+      __WFI();
+      SCB->SCR &= ~SCB_SCR_SLEEPDEEP_Msk;
+    }
+  }
+
+  return 0;
+}

panda/board/main_comms.h

@@ -0,0 +1,512 @@
+extern int _app_start[0xc000]; // Only first 3 sectors of size 0x4000 are used
+
+// Prototypes
+void set_safety_mode(uint16_t mode, uint16_t param);
+bool is_car_safety_mode(uint16_t mode);
+
+int get_health_pkt(void *dat) {
+  COMPILE_TIME_ASSERT(sizeof(struct health_t) <= USBPACKET_MAX_SIZE);
+  struct health_t * health = (struct health_t*)dat;
+
+  health->uptime_pkt = uptime_cnt;
+  health->voltage_pkt = adc_get_mV(ADCCHAN_VIN) * VIN_READOUT_DIVIDER;
+  health->current_pkt = current_board->read_current();
+
+  // Use the GPIO pin to determine ignition or use a CAN based logic
+  health->ignition_line_pkt = (uint8_t)(current_board->check_ignition());
+  health->ignition_can_pkt = (uint8_t)(ignition_can);
+
+  health->controls_allowed_pkt = controls_allowed;
+  health->gas_interceptor_detected_pkt = gas_interceptor_detected;
+  health->safety_tx_blocked_pkt = safety_tx_blocked;
+  health->safety_rx_invalid_pkt = safety_rx_invalid;
+  health->tx_buffer_overflow_pkt = tx_buffer_overflow;
+  health->rx_buffer_overflow_pkt = rx_buffer_overflow;
+  health->gmlan_send_errs_pkt = gmlan_send_errs;
+  health->car_harness_status_pkt = harness.status;
+  health->safety_mode_pkt = (uint8_t)(current_safety_mode);
+  health->safety_param_pkt = current_safety_param;
+  health->alternative_experience_pkt = alternative_experience;
+  health->power_save_enabled_pkt = (uint8_t)(power_save_status == POWER_SAVE_STATUS_ENABLED);
+  health->heartbeat_lost_pkt = (uint8_t)(heartbeat_lost);
+  health->safety_rx_checks_invalid = safety_rx_checks_invalid;
+
+  health->spi_checksum_error_count = spi_checksum_error_count;
+
+  health->fault_status_pkt = fault_status;
+  health->faults_pkt = faults;
+
+  health->interrupt_load = interrupt_load;
+
+  health->fan_power = fan_state.power;
+  health->fan_stall_count = fan_state.total_stall_count;
+
+  health->sbu1_voltage_mV = harness.sbu1_voltage_mV;
+  health->sbu2_voltage_mV = harness.sbu2_voltage_mV;
+
+  return sizeof(*health);
+}
+
+int get_rtc_pkt(void *dat) {
+  timestamp_t t = rtc_get_time();
+  (void)memcpy(dat, &t, sizeof(t));
+  return sizeof(t);
+}
+
+// send on serial, first byte to select the ring
+void comms_endpoint2_write(uint8_t *data, uint32_t len) {
+  uart_ring *ur = get_ring_by_number(data[0]);
+  if ((len != 0U) && (ur != NULL)) {
+    if ((data[0] < 2U) || (data[0] >= 4U) || safety_tx_lin_hook(data[0] - 2U, &data[1], len - 1U)) {
+      for (uint32_t i = 1; i < len; i++) {
+        while (!putc(ur, data[i])) {
+          // wait
+        }
+      }
+    }
+  }
+}
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  unsigned int resp_len = 0;
+  uart_ring *ur = NULL;
+  timestamp_t t;
+  uint32_t time;
+
+#ifdef DEBUG_COMMS
+  print("raw control request: "); hexdump(req, sizeof(ControlPacket_t)); print("\n");
+  print("- request "); puth(req->request); print("\n");
+  print("- param1 "); puth(req->param1); print("\n");
+  print("- param2 "); puth(req->param2); print("\n");
+#endif
+
+  switch (req->request) {
+    // **** 0xa0: get rtc time
+    case 0xa0:
+      resp_len = get_rtc_pkt(resp);
+      break;
+    // **** 0xa1: set rtc year
+    case 0xa1:
+      t = rtc_get_time();
+      t.year = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa2: set rtc month
+    case 0xa2:
+      t = rtc_get_time();
+      t.month = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa3: set rtc day
+    case 0xa3:
+      t = rtc_get_time();
+      t.day = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa4: set rtc weekday
+    case 0xa4:
+      t = rtc_get_time();
+      t.weekday = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa5: set rtc hour
+    case 0xa5:
+      t = rtc_get_time();
+      t.hour = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa6: set rtc minute
+    case 0xa6:
+      t = rtc_get_time();
+      t.minute = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa7: set rtc second
+    case 0xa7:
+      t = rtc_get_time();
+      t.second = req->param1;
+      rtc_set_time(t);
+      break;
+    // **** 0xa8: get microsecond timer
+    case 0xa8:
+      time = microsecond_timer_get();
+      resp[0] = (time & 0x000000FFU);
+      resp[1] = ((time & 0x0000FF00U) >> 8U);
+      resp[2] = ((time & 0x00FF0000U) >> 16U);
+      resp[3] = ((time & 0xFF000000U) >> 24U);
+      resp_len = 4U;
+      break;
+    // **** 0xb0: set IR power
+    case 0xb0:
+      current_board->set_ir_power(req->param1);
+      break;
+    // **** 0xb1: set fan power
+    case 0xb1:
+      fan_set_power(req->param1);
+      break;
+    // **** 0xb2: get fan rpm
+    case 0xb2:
+      resp[0] = (fan_state.rpm & 0x00FFU);
+      resp[1] = ((fan_state.rpm & 0xFF00U) >> 8U);
+      resp_len = 2;
+      break;
+    // **** 0xb3: set phone power
+    case 0xb3:
+      current_board->set_phone_power(req->param1 > 0U);
+      break;
+    // **** 0xc0: reset communications
+    case 0xc0:
+      comms_can_reset();
+      break;
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xc2: CAN health stats
+    case 0xc2:
+      COMPILE_TIME_ASSERT(sizeof(can_health_t) <= USBPACKET_MAX_SIZE);
+      if (req->param1 < 3U) {
+        update_can_health_pkt(req->param1, 0U);
+        can_health[req->param1].can_speed = (bus_config[req->param1].can_speed / 10U);
+        can_health[req->param1].can_data_speed = (bus_config[req->param1].can_data_speed / 10U);
+        can_health[req->param1].canfd_enabled = bus_config[req->param1].canfd_enabled;
+        can_health[req->param1].brs_enabled = bus_config[req->param1].brs_enabled;
+        can_health[req->param1].canfd_non_iso = bus_config[req->param1].canfd_non_iso;
+        resp_len = sizeof(can_health[req->param1]);
+        (void)memcpy(resp, &can_health[req->param1], resp_len);
+      }
+      break;
+    // **** 0xc3: fetch MCU UID
+    case 0xc3:
+      (void)memcpy(resp, ((uint8_t *)UID_BASE), 12);
+      resp_len = 12;
+      break;
+    case 0xc4:
+      // **** 0xc4: get interrupt call rate
+      if (req->param1 < NUM_INTERRUPTS) {
+        uint32_t load = interrupts[req->param1].call_rate;
+        resp[0] = (load & 0x000000FFU);
+        resp[1] = ((load & 0x0000FF00U) >> 8U);
+        resp[2] = ((load & 0x00FF0000U) >> 16U);
+        resp[3] = ((load & 0xFF000000U) >> 24U);
+        resp_len = 4U;
+      }
+      break;
+    // **** 0xd0: fetch serial (aka the provisioned dongle ID)
+    case 0xd0:
+      // addresses are OTP
+      if (req->param1 == 1U) {
+        (void)memcpy(resp, (uint8_t *)DEVICE_SERIAL_NUMBER_ADDRESS, 0x10);
+        resp_len = 0x10;
+      } else {
+        get_provision_chunk(resp);
+        resp_len = PROVISION_CHUNK_LEN;
+      }
+      break;
+    // **** 0xd1: enter bootloader mode
+    case 0xd1:
+      // this allows reflashing of the bootstub
+      switch (req->param1) {
+        case 0:
+          // only allow bootloader entry on debug builds
+          #ifdef ALLOW_DEBUG
+            print("-> entering bootloader\n");
+            enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+            NVIC_SystemReset();
+          #endif
+          break;
+        case 1:
+          print("-> entering softloader\n");
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+          break;
+        default:
+          print("Bootloader mode invalid\n");
+          break;
+      }
+      break;
+    // **** 0xd2: get health packet
+    case 0xd2:
+      resp_len = get_health_pkt(resp);
+      break;
+    // **** 0xd3: get first 64 bytes of signature
+    case 0xd3:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len], resp_len);
+      }
+      break;
+    // **** 0xd4: get second 64 bytes of signature
+    case 0xd4:
+      {
+        resp_len = 64;
+        char * code = (char*)_app_start;
+        int code_len = _app_start[0];
+        (void)memcpy(resp, &code[code_len + 64], resp_len);
+      }
+      break;
+    // **** 0xd6: get version
+    case 0xd6:
+      COMPILE_TIME_ASSERT(sizeof(gitversion) <= USBPACKET_MAX_SIZE);
+      (void)memcpy(resp, gitversion, sizeof(gitversion));
+      resp_len = sizeof(gitversion) - 1U;
+      break;
+    // **** 0xd8: reset ST
+    case 0xd8:
+      NVIC_SystemReset();
+      break;
+    // **** 0xd9: set ESP power
+    case 0xd9:
+      if (req->param1 == 1U) {
+        current_board->set_gps_mode(GPS_ENABLED);
+      } else if (req->param1 == 2U) {
+        current_board->set_gps_mode(GPS_BOOTMODE);
+      } else {
+        current_board->set_gps_mode(GPS_DISABLED);
+      }
+      break;
+    // **** 0xda: reset ESP, with optional boot mode
+    case 0xda:
+      current_board->set_gps_mode(GPS_DISABLED);
+      delay(1000000);
+      if (req->param1 == 1U) {
+        current_board->set_gps_mode(GPS_BOOTMODE);
+      } else {
+        current_board->set_gps_mode(GPS_ENABLED);
+      }
+      delay(1000000);
+      current_board->set_gps_mode(GPS_ENABLED);
+      break;
+    // **** 0xdb: set GMLAN (white/grey) or OBD CAN (black) multiplexing mode
+    case 0xdb:
+      if(current_board->has_obd){
+        if (req->param1 == 1U) {
+          // Enable OBD CAN
+          current_board->set_can_mode(CAN_MODE_OBD_CAN2);
+        } else {
+          // Disable OBD CAN
+          current_board->set_can_mode(CAN_MODE_NORMAL);
+        }
+      } else {
+        if (req->param1 == 1U) {
+          // GMLAN ON
+          if (req->param2 == 1U) {
+            can_set_gmlan(1);
+          } else if (req->param2 == 2U) {
+            can_set_gmlan(2);
+          } else {
+            print("Invalid bus num for GMLAN CAN set\n");
+          }
+        } else {
+          can_set_gmlan(-1);
+        }
+      }
+      break;
+
+    // **** 0xdc: set safety mode
+    case 0xdc:
+      set_safety_mode(req->param1, (uint16_t)req->param2);
+      break;
+    // **** 0xdd: get healthpacket and CANPacket versions
+    case 0xdd:
+      resp[0] = HEALTH_PACKET_VERSION;
+      resp[1] = CAN_PACKET_VERSION;
+      resp[2] = CAN_HEALTH_PACKET_VERSION;
+      resp_len = 3;
+      break;
+    // **** 0xde: set can bitrate
+    case 0xde:
+      if ((req->param1 < PANDA_BUS_CNT) && is_speed_valid(req->param2, speeds, sizeof(speeds)/sizeof(speeds[0]))) {
+        bus_config[req->param1].can_speed = req->param2;
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xdf: set alternative experience
+    case 0xdf:
+      // you can only set this if you are in a non car safety mode
+      if (!is_car_safety_mode(current_safety_mode)) {
+        alternative_experience = req->param1;
+      }
+      break;
+    // **** 0xe0: uart read
+    case 0xe0:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+
+      // TODO: Remove this again and fix boardd code to hande the message bursts instead of single chars
+      if (ur == &uart_ring_gps) {
+        dma_pointer_handler(ur, DMA2_Stream5->NDTR);
+      }
+
+      // read
+      while ((resp_len < MIN(req->length, USBPACKET_MAX_SIZE)) &&
+                         getc(ur, (char*)&resp[resp_len])) {
+        ++resp_len;
+      }
+      break;
+    // **** 0xe1: uart set baud rate
+    case 0xe1:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+      uart_set_baud(ur->uart, req->param2);
+      break;
+    // **** 0xe2: uart set parity
+    case 0xe2:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+      switch (req->param2) {
+        case 0:
+          // disable parity, 8-bit
+          ur->uart->CR1 &= ~(USART_CR1_PCE | USART_CR1_M);
+          break;
+        case 1:
+          // even parity, 9-bit
+          ur->uart->CR1 &= ~USART_CR1_PS;
+          ur->uart->CR1 |= USART_CR1_PCE | USART_CR1_M;
+          break;
+        case 2:
+          // odd parity, 9-bit
+          ur->uart->CR1 |= USART_CR1_PS;
+          ur->uart->CR1 |= USART_CR1_PCE | USART_CR1_M;
+          break;
+        default:
+          break;
+      }
+      break;
+    // **** 0xe4: uart set baud rate extended
+    case 0xe4:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+      uart_set_baud(ur->uart, (int)req->param2*300);
+      break;
+    // **** 0xe5: set CAN loopback (for testing)
+    case 0xe5:
+      can_loopback = (req->param1 > 0U);
+      can_init_all();
+      break;
+    // **** 0xe7: set power save state
+    case 0xe7:
+      set_power_save_state(req->param1);
+      break;
+    // **** 0xf0: k-line/l-line wake-up pulse for KWP2000 fast initialization
+    case 0xf0:
+      if(current_board->has_lin) {
+        bool k = (req->param1 == 0U) || (req->param1 == 2U);
+        bool l = (req->param1 == 1U) || (req->param1 == 2U);
+        if (bitbang_wakeup(k, l)) {
+          resp_len = -1; // do not clear NAK yet (wait for bit banging to finish)
+        }
+      }
+      break;
+    // **** 0xf1: Clear CAN ring buffer.
+    case 0xf1:
+      if (req->param1 == 0xFFFFU) {
+        print("Clearing CAN Rx queue\n");
+        can_clear(&can_rx_q);
+      } else if (req->param1 < PANDA_BUS_CNT) {
+        print("Clearing CAN Tx queue\n");
+        can_clear(can_queues[req->param1]);
+      } else {
+        print("Clearing CAN CAN ring buffer failed: wrong bus number\n");
+      }
+      break;
+    // **** 0xf2: Clear UART ring buffer.
+    case 0xf2:
+      {
+        uart_ring * rb = get_ring_by_number(req->param1);
+        if (rb != NULL) {
+          print("Clearing UART queue.\n");
+          clear_uart_buff(rb);
+        }
+        break;
+      }
+    // **** 0xf3: Heartbeat. Resets heartbeat counter.
+    case 0xf3:
+      {
+        heartbeat_counter = 0U;
+        heartbeat_lost = false;
+        heartbeat_disabled = false;
+        heartbeat_engaged = (req->param1 == 1U);
+        break;
+      }
+    // **** 0xf4: k-line/l-line 5 baud initialization
+    case 0xf4:
+      if(current_board->has_lin) {
+        bool k = (req->param1 == 0U) || (req->param1 == 2U);
+        bool l = (req->param1 == 1U) || (req->param1 == 2U);
+        uint8_t five_baud_addr = (req->param2 & 0xFFU);
+        if (bitbang_five_baud_addr(k, l, five_baud_addr)) {
+          resp_len = -1; // do not clear NAK yet (wait for bit banging to finish)
+        }
+      }
+      break;
+    // **** 0xf6: set siren enabled
+    case 0xf6:
+      siren_enabled = (req->param1 != 0U);
+      break;
+    // **** 0xf7: set green led enabled
+    case 0xf7:
+      green_led_enabled = (req->param1 != 0U);
+      break;
+    // **** 0xf8: disable heartbeat checks
+    case 0xf8:
+      if (!is_car_safety_mode(current_safety_mode)) {
+        heartbeat_disabled = true;
+      }
+      break;
+    // **** 0xf9: set CAN FD data bitrate
+    case 0xf9:
+      if ((req->param1 < PANDA_CAN_CNT) &&
+           current_board->has_canfd &&
+           is_speed_valid(req->param2, data_speeds, sizeof(data_speeds)/sizeof(data_speeds[0]))) {
+        bus_config[req->param1].can_data_speed = req->param2;
+        bus_config[req->param1].canfd_enabled = (req->param2 >= bus_config[req->param1].can_speed);
+        bus_config[req->param1].brs_enabled = (req->param2 > bus_config[req->param1].can_speed);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // **** 0xfb: allow highest power saving mode (stop) to be entered
+    case 0xfb:
+      deepsleep_allowed = true;
+      break;
+    // **** 0xfc: set CAN FD non-ISO mode
+    case 0xfc:
+      if ((req->param1 < PANDA_CAN_CNT) && current_board->has_canfd) {
+        bus_config[req->param1].canfd_non_iso = (req->param2 != 0U);
+        bool ret = can_init(CAN_NUM_FROM_BUS_NUM(req->param1));
+        UNUSED(ret);
+      }
+      break;
+    // *** 0xfd: read logs
+    case 0xfd:
+      if (req->param1 == 1U) {
+        logging_init_read_index();
+      }
+
+      if (req->param2 != 0xFFFFU) {
+        logging_find_read_index(req->param2);
+      }
+
+      resp_len = logging_read(resp);
+      break;
+    default:
+      print("NO HANDLER ");
+      puth(req->request);
+      print("\n");
+      break;
+  }
+  return resp_len;
+}

panda/board/main_declarations.h

@@ -0,0 +1,32 @@
+// ******************** Prototypes ********************
+void print(const char *a);
+void puth(unsigned int i);
+void puth2(unsigned int i);
+void puth4(unsigned int i);
+void hexdump(const void *a, int l);
+typedef struct board board;
+typedef struct harness_configuration harness_configuration;
+void can_flip_buses(uint8_t bus1, uint8_t bus2);
+void pwm_init(TIM_TypeDef *TIM, uint8_t channel);
+void pwm_set(TIM_TypeDef *TIM, uint8_t channel, uint8_t percentage);
+
+// ********************* Globals **********************
+uint8_t hw_type = 0;
+const board *current_board;
+uint32_t uptime_cnt = 0;
+bool green_led_enabled = false;
+
+// heartbeat state
+uint32_t heartbeat_counter = 0;
+bool heartbeat_lost = false;
+bool heartbeat_disabled = false;            // set over USB
+
+// Enter deep sleep mode
+bool deepsleep_allowed = false;
+bool ignition_seen = false;
+
+// siren state
+bool siren_enabled = false;
+uint32_t siren_countdown = 0; // siren plays while countdown > 0
+uint32_t controls_allowed_countdown = 0;
+

panda/board/pedal/.gitignore

@@ -0,0 +1 @@
+obj/*

panda/board/pedal/README

@@ -0,0 +1,28 @@
+# pedal
+
+This is the firmware for the comma pedal.
+
+The comma pedal is a gas pedal interceptor for Honda/Acura and Toyota/Lexus. It allows you to "virtually" press the pedal and borrows a lot from panda.
+
+== Test Plan ==
+
+* Startup
+** Confirm STATE_FAULT_STARTUP
+* Timeout
+** Send value
+** Confirm value is output
+** Stop sending messages
+** Confirm value is passthru after 100ms
+** Confirm STATE_FAULT_TIMEOUT
+* Random values
+** Send random 6 byte messages
+** Confirm random values cause passthru
+** Confirm STATE_FAULT_BAD_CHECKSUM
+* Same message lockout
+** Send same message repeated
+** Confirm timeout behavior
+* Don't set enable
+** Confirm no output
+* Set enable and values
+** Confirm output
+

panda/board/pedal/flash_can.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env sh
+set -e
+
+cd ..
+PEDAL=1 scons -u -j$(nproc)
+cd pedal
+
+../../tests/pedal/enter_canloader.py ../obj/pedal.bin.signed

panda/board/pedal/main.c

@@ -0,0 +1,316 @@
+// ********************* Includes *********************
+//#define PEDAL_USB
+#include "../config.h"
+
+#include "early_init.h"
+#include "crc.h"
+
+#define CAN CAN1
+
+#ifdef PEDAL_USB
+  #include "drivers/usb.h"
+#else
+  // no serial either
+  void print(const char *a) {
+    UNUSED(a);
+  }
+  void puth(unsigned int i) {
+    UNUSED(i);
+  }
+  void puth2(unsigned int i) {
+    UNUSED(i);
+  }
+#endif
+
+#define ENTER_BOOTLOADER_MAGIC 0xdeadbeefU
+uint32_t enter_bootloader_mode;
+
+// cppcheck-suppress unusedFunction ; used in headers not included in cppcheck
+void __initialize_hardware_early(void) {
+  early_initialization();
+}
+
+// ********************* serial debugging *********************
+
+#ifdef PEDAL_USB
+
+void debug_ring_callback(uart_ring *ring) {
+  char rcv;
+  while (getc(ring, &rcv) != 0) {
+    (void)putc(ring, rcv);
+  }
+}
+
+int comms_can_read(uint8_t *data, uint32_t max_len) {
+  UNUSED(data);
+  UNUSED(max_len);
+  return 0;
+}
+void comms_can_write(uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+void comms_endpoint2_write(uint8_t *data, uint32_t len) {
+  UNUSED(data);
+  UNUSED(len);
+}
+void refresh_can_tx_slots_available(void) {}
+
+int comms_control_handler(ControlPacket_t *req, uint8_t *resp) {
+  unsigned int resp_len = 0;
+  uart_ring *ur = NULL;
+  switch (req->request) {
+    // **** 0xc1: get hardware type
+    case 0xc1:
+      resp[0] = hw_type;
+      resp_len = 1;
+      break;
+    // **** 0xe0: uart read
+    case 0xe0:
+      ur = get_ring_by_number(req->param1);
+      if (!ur) {
+        break;
+      }
+      // read
+      while ((resp_len < MIN(req->length, USBPACKET_MAX_SIZE)) &&
+                         getc(ur, (char*)&resp[resp_len])) {
+        ++resp_len;
+      }
+      break;
+    default:
+      print("NO HANDLER ");
+      puth(req->request);
+      print("\n");
+      break;
+  }
+  return resp_len;
+}
+
+#endif
+
+// ***************************** can port *****************************
+
+// addresses to be used on CAN
+#define CAN_GAS_INPUT  0x200
+#define CAN_GAS_OUTPUT 0x201U
+#define CAN_GAS_SIZE 6
+#define COUNTER_CYCLE 0xFU
+
+void CAN1_TX_IRQ_Handler(void) {
+  // clear interrupt
+  CAN->TSR |= CAN_TSR_RQCP0;
+}
+
+// two independent values
+uint16_t gas_set_0 = 0;
+uint16_t gas_set_1 = 0;
+
+#define MAX_TIMEOUT 10U
+uint32_t timeout = 0;
+uint32_t current_index = 0;
+
+#define NO_FAULT 0U
+#define FAULT_BAD_CHECKSUM 1U
+#define FAULT_SEND 2U
+#define FAULT_SCE 3U
+#define FAULT_STARTUP 4U
+#define FAULT_TIMEOUT 5U
+#define FAULT_INVALID 6U
+uint8_t state = FAULT_STARTUP;
+const uint8_t crc_poly = 0xD5U;  // standard crc8
+
+void CAN1_RX0_IRQ_Handler(void) {
+  while ((CAN->RF0R & CAN_RF0R_FMP0) != 0) {
+    #ifdef DEBUG
+      print("CAN RX\n");
+    #endif
+    int address = CAN->sFIFOMailBox[0].RIR >> 21;
+    if (address == CAN_GAS_INPUT) {
+      // softloader entry
+      if (GET_MAILBOX_BYTES_04(&CAN->sFIFOMailBox[0]) == 0xdeadface) {
+        if (GET_MAILBOX_BYTES_48(&CAN->sFIFOMailBox[0]) == 0x0ab00b1e) {
+          enter_bootloader_mode = ENTER_SOFTLOADER_MAGIC;
+          NVIC_SystemReset();
+        } else if (GET_MAILBOX_BYTES_48(&CAN->sFIFOMailBox[0]) == 0x02b00b1e) {
+          enter_bootloader_mode = ENTER_BOOTLOADER_MAGIC;
+          NVIC_SystemReset();
+        } else {
+          print("Failed entering Softloader or Bootloader\n");
+        }
+      }
+
+      // normal packet
+      uint8_t dat[8];
+      for (int i=0; i<8; i++) {
+        dat[i] = GET_MAILBOX_BYTE(&CAN->sFIFOMailBox[0], i);
+      }
+      uint16_t value_0 = (dat[0] << 8) | dat[1];
+      uint16_t value_1 = (dat[2] << 8) | dat[3];
+      bool enable = ((dat[4] >> 7) & 1U) != 0U;
+      uint8_t index = dat[4] & COUNTER_CYCLE;
+      if (crc_checksum(dat, CAN_GAS_SIZE - 1, crc_poly) == dat[5]) {
+        if (((current_index + 1U) & COUNTER_CYCLE) == index) {
+          #ifdef DEBUG
+            print("setting gas ");
+            puth(value_0);
+            print("\n");
+          #endif
+          if (enable) {
+            gas_set_0 = value_0;
+            gas_set_1 = value_1;
+          } else {
+            // clear the fault state if values are 0
+            if ((value_0 == 0U) && (value_1 == 0U)) {
+              state = NO_FAULT;
+            } else {
+              state = FAULT_INVALID;
+            }
+            gas_set_0 = 0;
+            gas_set_1 = 0;
+          }
+          // clear the timeout
+          timeout = 0;
+        }
+        current_index = index;
+      } else {
+        // wrong checksum = fault
+        state = FAULT_BAD_CHECKSUM;
+      }
+    }
+    // next
+    CAN->RF0R |= CAN_RF0R_RFOM0;
+  }
+}
+
+void CAN1_SCE_IRQ_Handler(void) {
+  state = FAULT_SCE;
+  llcan_clear_send(CAN);
+}
+
+uint32_t pdl0 = 0;
+uint32_t pdl1 = 0;
+unsigned int pkt_idx = 0;
+
+int led_value = 0;
+
+void TIM3_IRQ_Handler(void) {
+  #ifdef DEBUG
+    puth(TIM3->CNT);
+    print(" ");
+    puth(pdl0);
+    print(" ");
+    puth(pdl1);
+    print("\n");
+  #endif
+
+  // check timer for sending the user pedal and clearing the CAN
+  if ((CAN->TSR & CAN_TSR_TME0) == CAN_TSR_TME0) {
+    uint8_t dat[8];
+    dat[0] = (pdl0 >> 8) & 0xFFU;
+    dat[1] = (pdl0 >> 0) & 0xFFU;
+    dat[2] = (pdl1 >> 8) & 0xFFU;
+    dat[3] = (pdl1 >> 0) & 0xFFU;
+    dat[4] = ((state & 0xFU) << 4) | pkt_idx;
+    dat[5] = crc_checksum(dat, CAN_GAS_SIZE - 1, crc_poly);
+    CAN->sTxMailBox[0].TDLR = dat[0] | (dat[1] << 8) | (dat[2] << 16) | (dat[3] << 24);
+    CAN->sTxMailBox[0].TDHR = dat[4] | (dat[5] << 8);
+    CAN->sTxMailBox[0].TDTR = 6;  // len of packet is 5
+    CAN->sTxMailBox[0].TIR = (CAN_GAS_OUTPUT << 21) | 1U;
+    ++pkt_idx;
+    pkt_idx &= COUNTER_CYCLE;
+  } else {
+    // old can packet hasn't sent!
+    state = FAULT_SEND;
+    #ifdef DEBUG
+      print("CAN MISS\n");
+    #endif
+  }
+
+  // blink the LED
+  current_board->set_led(LED_GREEN, led_value);
+  led_value = !led_value;
+
+  TIM3->SR = 0;
+
+  // up timeout for gas set
+  if (timeout == MAX_TIMEOUT) {
+    state = FAULT_TIMEOUT;
+  } else {
+    timeout += 1U;
+  }
+}
+
+// ***************************** main code *****************************
+
+void pedal(void) {
+  // read/write
+  pdl0 = adc_get_raw(ADCCHAN_ACCEL0);
+  pdl1 = adc_get_raw(ADCCHAN_ACCEL1);
+
+  // write the pedal to the DAC
+  if (state == NO_FAULT) {
+    dac_set(0, MAX(gas_set_0, pdl0));
+    dac_set(1, MAX(gas_set_1, pdl1));
+  } else {
+    dac_set(0, pdl0);
+    dac_set(1, pdl1);
+  }
+
+  watchdog_feed();
+}
+
+int main(void) {
+  // Init interrupt table
+  init_interrupts(true);
+
+  REGISTER_INTERRUPT(CAN1_TX_IRQn, CAN1_TX_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_RX0_IRQn, CAN1_RX0_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  REGISTER_INTERRUPT(CAN1_SCE_IRQn, CAN1_SCE_IRQ_Handler, CAN_INTERRUPT_RATE, FAULT_INTERRUPT_RATE_CAN_1)
+  
+  // Should run at around 732Hz (see init below)
+  REGISTER_INTERRUPT(TIM3_IRQn, TIM3_IRQ_Handler, 1000U, FAULT_INTERRUPT_RATE_TIM3)
+
+  disable_interrupts();
+
+  // init devices
+  clock_init();
+  peripherals_init();
+  detect_board_type();
+
+  // init board
+  current_board->init();
+
+#ifdef PEDAL_USB
+  // enable USB
+  usb_init();
+#endif
+
+  // pedal stuff
+  dac_init();
+  adc_init();
+
+  // init can
+  bool llcan_speed_set = llcan_set_speed(CAN1, 5000, false, false);
+  if (!llcan_speed_set) {
+    print("Failed to set llcan speed");
+  }
+
+  bool ret = llcan_init(CAN1);
+  UNUSED(ret);
+
+  // 48mhz / 65536 ~= 732
+  timer_init(TIM3, 15);
+  NVIC_EnableIRQ(TIM3_IRQn);
+
+  watchdog_init(WATCHDOG_50_MS);
+
+  print("**** INTERRUPTS ON ****\n");
+  enable_interrupts();
+
+  // main pedal loop
+  while (1) {
+    pedal();
+  }
+
+  return 0;
+}

panda/board/pedal/main_declarations.h

@@ -0,0 +1,11 @@
+// ******************** Prototypes ********************
+void print(const char *a);
+void puth(unsigned int i);
+void puth2(unsigned int i);
+void puth4(unsigned int i);
+typedef struct board board;
+typedef struct harness_configuration harness_configuration;
+
+// ********************* Globals **********************
+uint8_t hw_type = 0;
+const board *current_board;

panda/board/pedal/recover.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env sh
+set -e
+
+DFU_UTIL="dfu-util"
+
+cd ..
+PEDAL=1 scons -u -j$(nproc)
+cd pedal
+
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08004000 -D ../obj/pedal.bin.signed
+$DFU_UTIL -d 0483:df11 -a 0 -s 0x08000000:leave -D ../obj/bootstub.pedal.bin

panda/board/power_saving.h

@@ -0,0 +1,74 @@
+// WARNING: To stay in compliance with the SIL2 rules laid out in STM UM1840, we should never implement any of the available hardware low power modes.
+// See rule: CoU_3
+
+#define POWER_SAVE_STATUS_DISABLED 0
+#define POWER_SAVE_STATUS_ENABLED 1
+
+int power_save_status = POWER_SAVE_STATUS_DISABLED;
+
+void set_power_save_state(int state) {
+
+  bool is_valid_state = (state == POWER_SAVE_STATUS_ENABLED) || (state == POWER_SAVE_STATUS_DISABLED);
+  if (is_valid_state && (state != power_save_status)) {
+    bool enable = false;
+    if (state == POWER_SAVE_STATUS_ENABLED) {
+      print("enable power savings\n");
+      if (current_board->has_gps) {
+        const char UBLOX_SLEEP_MSG[] = "\xb5\x62\x06\x04\x04\x00\x01\x00\x08\x00\x17\x78";
+        uart_ring *ur = get_ring_by_number(1);
+        for (unsigned int i = 0; i < sizeof(UBLOX_SLEEP_MSG) - 1U; i++) while (!putc(ur, UBLOX_SLEEP_MSG[i]));
+      }
+      // Disable CAN interrupts
+      if (harness.status == HARNESS_STATUS_FLIPPED) {
+        llcan_irq_disable(cans[0]);
+      } else {
+        llcan_irq_disable(cans[2]);
+      }
+      llcan_irq_disable(cans[1]);
+    } else {
+      print("disable power savings\n");
+      if (current_board->has_gps) {
+        const char UBLOX_WAKE_MSG[] = "\xb5\x62\x06\x04\x04\x00\x01\x00\x09\x00\x18\x7a";
+        uart_ring *ur = get_ring_by_number(1);
+        for (unsigned int i = 0; i < sizeof(UBLOX_WAKE_MSG) - 1U; i++) while (!putc(ur, UBLOX_WAKE_MSG[i]));
+      }
+
+      if (harness.status == HARNESS_STATUS_FLIPPED) {
+        llcan_irq_enable(cans[0]);
+      } else {
+        llcan_irq_enable(cans[2]);
+      }
+      llcan_irq_enable(cans[1]);
+
+      enable = true;
+    }
+
+    current_board->enable_can_transceivers(enable);
+
+    // Switch EPS/GPS
+    if (enable) {
+      current_board->set_gps_mode(GPS_ENABLED);
+    } else {
+      current_board->set_gps_mode(GPS_DISABLED);
+    }
+
+    if(current_board->has_hw_gmlan){
+      // turn on GMLAN
+      set_gpio_output(GPIOB, 14, enable);
+      set_gpio_output(GPIOB, 15, enable);
+    }
+
+    if(current_board->has_lin){
+      // turn on LIN
+      set_gpio_output(GPIOB, 7, enable);
+      set_gpio_output(GPIOA, 14, enable);
+    }
+
+    // Switch off IR when in power saving
+    if(!enable){
+      current_board->set_ir_power(0U);
+    }
+
+    power_save_status = state;
+  }
+}

panda/board/provision.h

@@ -0,0 +1,17 @@
+// this is where we manage the dongle ID assigned during our
+// manufacturing. aside from this, there's a UID for the MCU
+
+#define PROVISION_CHUNK_LEN 0x20
+
+void get_provision_chunk(uint8_t *resp) {
+  (void)memcpy(resp, (uint8_t *)PROVISION_CHUNK_ADDRESS, PROVISION_CHUNK_LEN);
+  if (memcmp(resp, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff", 0x20) == 0) {
+    (void)memcpy(resp, "unprovisioned\x00\x00\x00testing123\x00\x00\xa3\xa6\x99\xec", 0x20);
+  }
+}
+
+uint8_t chunk[PROVISION_CHUNK_LEN];
+bool is_provisioned(void) {
+  (void)memcpy(chunk, (uint8_t *)PROVISION_CHUNK_ADDRESS, PROVISION_CHUNK_LEN);
+  return (memcmp(chunk, "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff", 0x20) != 0);
+}

panda/board/recover.py

@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+import os
+import time
+import subprocess
+
+from panda import Panda, PandaDFU
+
+board_path = os.path.dirname(os.path.realpath(__file__))
+
+if __name__ == "__main__":
+  subprocess.check_call(f"scons -C {board_path}/.. -j$(nproc) {board_path}", shell=True)
+
+  for s in Panda.list():
+    print("putting", s, "in DFU mode")
+    with Panda(serial=s) as p:
+      p.reset(enter_bootstub=True)
+      p.reset(enter_bootloader=True)
+
+  # wait for reset pandas to come back up
+  time.sleep(1)
+
+  dfu_serials = PandaDFU.list()
+  print(f"found {len(dfu_serials)} panda(s) in DFU - {dfu_serials}")
+  for s in dfu_serials:
+    print("flashing", s)
+    PandaDFU(s).recover()

panda/board/safety.h

@@ -0,0 +1,676 @@
+#include "safety_declarations.h"
+#include "can_definitions.h"
+
+// include the safety policies.
+#include "safety/safety_defaults.h"
+#include "safety/safety_honda.h"
+#include "safety/safety_toyota.h"
+#include "safety/safety_tesla.h"
+#include "safety/safety_gm.h"
+#include "safety/safety_ford.h"
+#include "safety/safety_hyundai.h"
+#include "safety/safety_chrysler.h"
+#include "safety/safety_subaru.h"
+#include "safety/safety_subaru_preglobal.h"
+#include "safety/safety_mazda.h"
+#include "safety/safety_nissan.h"
+#include "safety/safety_volkswagen_mqb.h"
+#include "safety/safety_volkswagen_pq.h"
+#include "safety/safety_elm327.h"
+#include "safety/safety_body.h"
+
+// CAN-FD only safety modes
+#ifdef CANFD
+#include "safety/safety_hyundai_canfd.h"
+#endif
+
+// from cereal.car.CarParams.SafetyModel
+#define SAFETY_SILENT 0U
+#define SAFETY_HONDA_NIDEC 1U
+#define SAFETY_TOYOTA 2U
+#define SAFETY_ELM327 3U
+#define SAFETY_GM 4U
+#define SAFETY_HONDA_BOSCH_GIRAFFE 5U
+#define SAFETY_FORD 6U
+#define SAFETY_HYUNDAI 8U
+#define SAFETY_CHRYSLER 9U
+#define SAFETY_TESLA 10U
+#define SAFETY_SUBARU 11U
+#define SAFETY_MAZDA 13U
+#define SAFETY_NISSAN 14U
+#define SAFETY_VOLKSWAGEN_MQB 15U
+#define SAFETY_ALLOUTPUT 17U
+#define SAFETY_GM_ASCM 18U
+#define SAFETY_NOOUTPUT 19U
+#define SAFETY_HONDA_BOSCH 20U
+#define SAFETY_VOLKSWAGEN_PQ 21U
+#define SAFETY_SUBARU_PREGLOBAL 22U
+#define SAFETY_HYUNDAI_LEGACY 23U
+#define SAFETY_HYUNDAI_COMMUNITY 24U
+#define SAFETY_STELLANTIS 25U
+#define SAFETY_FAW 26U
+#define SAFETY_BODY 27U
+#define SAFETY_HYUNDAI_CANFD 28U
+
+uint16_t current_safety_mode = SAFETY_SILENT;
+uint16_t current_safety_param = 0;
+const safety_hooks *current_hooks = &nooutput_hooks;
+const addr_checks *current_rx_checks = &default_rx_checks;
+
+int safety_rx_hook(CANPacket_t *to_push) {
+  bool controls_allowed_prev = controls_allowed;
+  int ret = current_hooks->rx(to_push);
+
+  // reset mismatches on rising edge of controls_allowed to avoid rare race condition
+  if (controls_allowed && !controls_allowed_prev) {
+    heartbeat_engaged_mismatches = 0;
+  }
+
+  return ret;
+}
+
+int safety_tx_hook(CANPacket_t *to_send) {
+  return (relay_malfunction ? -1 : current_hooks->tx(to_send));
+}
+
+int safety_tx_lin_hook(int lin_num, uint8_t *data, int len) {
+  return current_hooks->tx_lin(lin_num, data, len);
+}
+
+int safety_fwd_hook(int bus_num, int addr) {
+  return (relay_malfunction ? -1 : current_hooks->fwd(bus_num, addr));
+}
+
+bool get_longitudinal_allowed(void) {
+  return controls_allowed && !gas_pressed_prev;
+}
+
+// Given a CRC-8 poly, generate a static lookup table to use with a fast CRC-8
+// algorithm. Called at init time for safety modes using CRC-8.
+void gen_crc_lookup_table_8(uint8_t poly, uint8_t crc_lut[]) {
+  for (int i = 0; i < 256; i++) {
+    uint8_t crc = i;
+    for (int j = 0; j < 8; j++) {
+      if ((crc & 0x80U) != 0U) {
+        crc = (uint8_t)((crc << 1) ^ poly);
+      } else {
+        crc <<= 1;
+      }
+    }
+    crc_lut[i] = crc;
+  }
+}
+
+void gen_crc_lookup_table_16(uint16_t poly, uint16_t crc_lut[]) {
+  for (uint16_t i = 0; i < 256U; i++) {
+    uint16_t crc = i << 8U;
+    for (uint16_t j = 0; j < 8U; j++) {
+      if ((crc & 0x8000U) != 0U) {
+        crc = (uint16_t)((crc << 1) ^ poly);
+      } else {
+        crc <<= 1;
+      }
+    }
+    crc_lut[i] = crc;
+  }
+}
+
+bool msg_allowed(CANPacket_t *to_send, const CanMsg msg_list[], int len) {
+  int addr = GET_ADDR(to_send);
+  int bus = GET_BUS(to_send);
+  int length = GET_LEN(to_send);
+
+  bool allowed = false;
+  for (int i = 0; i < len; i++) {
+    if ((addr == msg_list[i].addr) && (bus == msg_list[i].bus) && (length == msg_list[i].len)) {
+      allowed = true;
+      break;
+    }
+  }
+  return allowed;
+}
+
+int get_addr_check_index(CANPacket_t *to_push, AddrCheckStruct addr_list[], const int len) {
+  int bus = GET_BUS(to_push);
+  int addr = GET_ADDR(to_push);
+  int length = GET_LEN(to_push);
+
+  int index = -1;
+  for (int i = 0; i < len; i++) {
+    // if multiple msgs are allowed, determine which one is present on the bus
+    if (!addr_list[i].msg_seen) {
+      for (uint8_t j = 0U; (j < MAX_ADDR_CHECK_MSGS) && (addr_list[i].msg[j].addr != 0); j++) {
+        if ((addr == addr_list[i].msg[j].addr) && (bus == addr_list[i].msg[j].bus) &&
+              (length == addr_list[i].msg[j].len)) {
+          addr_list[i].index = j;
+          addr_list[i].msg_seen = true;
+          break;
+        }
+      }
+    }
+
+    if (addr_list[i].msg_seen) {
+      int idx = addr_list[i].index;
+      if ((addr == addr_list[i].msg[idx].addr) && (bus == addr_list[i].msg[idx].bus) &&
+          (length == addr_list[i].msg[idx].len)) {
+        index = i;
+        break;
+      }
+    }
+  }
+  return index;
+}
+
+// 1Hz safety function called by main. Now just a check for lagging safety messages
+void safety_tick(const addr_checks *rx_checks) {
+  bool rx_checks_invalid = false;
+  uint32_t ts = microsecond_timer_get();
+  if (rx_checks != NULL) {
+    for (int i=0; i < rx_checks->len; i++) {
+      uint32_t elapsed_time = get_ts_elapsed(ts, rx_checks->check[i].last_timestamp);
+      // lag threshold is max of: 1s and MAX_MISSED_MSGS * expected timestep.
+      // Quite conservative to not risk false triggers.
+      // 2s of lag is worse case, since the function is called at 1Hz
+      bool lagging = elapsed_time > MAX(rx_checks->check[i].msg[rx_checks->check[i].index].expected_timestep * MAX_MISSED_MSGS, 1e6);
+      rx_checks->check[i].lagging = lagging;
+      if (lagging) {
+        controls_allowed = 0;
+      }
+
+      if (lagging || !is_msg_valid(rx_checks->check, i)) {
+        rx_checks_invalid = true;
+      }
+    }
+  }
+
+  safety_rx_checks_invalid = rx_checks_invalid;
+}
+
+void update_counter(AddrCheckStruct addr_list[], int index, uint8_t counter) {
+  if (index != -1) {
+    uint8_t expected_counter = (addr_list[index].last_counter + 1U) % (addr_list[index].msg[addr_list[index].index].max_counter + 1U);
+    addr_list[index].wrong_counters += (expected_counter == counter) ? -1 : 1;
+    addr_list[index].wrong_counters = MAX(MIN(addr_list[index].wrong_counters, MAX_WRONG_COUNTERS), 0);
+    addr_list[index].last_counter = counter;
+  }
+}
+
+bool is_msg_valid(AddrCheckStruct addr_list[], int index) {
+  bool valid = true;
+  if (index != -1) {
+    if (!addr_list[index].valid_checksum || !addr_list[index].valid_quality_flag || (addr_list[index].wrong_counters >= MAX_WRONG_COUNTERS)) {
+      valid = false;
+      controls_allowed = 0;
+    }
+  }
+  return valid;
+}
+
+void update_addr_timestamp(AddrCheckStruct addr_list[], int index) {
+  if (index != -1) {
+    uint32_t ts = microsecond_timer_get();
+    addr_list[index].last_timestamp = ts;
+  }
+}
+
+bool addr_safety_check(CANPacket_t *to_push,
+                       const addr_checks *rx_checks,
+                       uint32_t (*get_checksum)(CANPacket_t *to_push),
+                       uint32_t (*compute_checksum)(CANPacket_t *to_push),
+                       uint8_t (*get_counter)(CANPacket_t *to_push),
+                       bool (*get_quality_flag_valid)(CANPacket_t *to_push)) {
+
+  int index = get_addr_check_index(to_push, rx_checks->check, rx_checks->len);
+  update_addr_timestamp(rx_checks->check, index);
+
+  if (index != -1) {
+    // checksum check
+    if ((get_checksum != NULL) && (compute_checksum != NULL) && rx_checks->check[index].msg[rx_checks->check[index].index].check_checksum) {
+      uint32_t checksum = get_checksum(to_push);
+      uint32_t checksum_comp = compute_checksum(to_push);
+      rx_checks->check[index].valid_checksum = checksum_comp == checksum;
+    } else {
+      rx_checks->check[index].valid_checksum = true;
+    }
+
+    // counter check (max_counter == 0 means skip check)
+    if ((get_counter != NULL) && (rx_checks->check[index].msg[rx_checks->check[index].index].max_counter > 0U)) {
+      uint8_t counter = get_counter(to_push);
+      update_counter(rx_checks->check, index, counter);
+    } else {
+      rx_checks->check[index].wrong_counters = 0U;
+    }
+
+    // quality flag check
+    if ((get_quality_flag_valid != NULL) && rx_checks->check[index].msg[rx_checks->check[index].index].quality_flag) {
+      rx_checks->check[index].valid_quality_flag = get_quality_flag_valid(to_push);
+    } else {
+      rx_checks->check[index].valid_quality_flag = true;
+    }
+  }
+  return is_msg_valid(rx_checks->check, index);
+}
+
+void generic_rx_checks(bool stock_ecu_detected) {
+  // exit controls on rising edge of gas press
+  if (gas_pressed && !gas_pressed_prev && !(alternative_experience & ALT_EXP_DISABLE_DISENGAGE_ON_GAS)) {
+    controls_allowed = 0;
+  }
+  gas_pressed_prev = gas_pressed;
+
+  // exit controls on rising edge of brake press
+  if (brake_pressed && (!brake_pressed_prev || vehicle_moving)) {
+    controls_allowed = 0;
+  }
+  brake_pressed_prev = brake_pressed;
+
+  // exit controls on rising edge of regen paddle
+  if (regen_braking && (!regen_braking_prev || vehicle_moving)) {
+    controls_allowed = 0;
+  }
+  regen_braking_prev = regen_braking;
+
+  // check if stock ECU is on bus broken by car harness
+  if ((safety_mode_cnt > RELAY_TRNS_TIMEOUT) && stock_ecu_detected) {
+    relay_malfunction_set();
+  }
+}
+
+void relay_malfunction_set(void) {
+  relay_malfunction = true;
+  fault_occurred(FAULT_RELAY_MALFUNCTION);
+}
+
+void relay_malfunction_reset(void) {
+  relay_malfunction = false;
+  fault_recovered(FAULT_RELAY_MALFUNCTION);
+}
+
+typedef struct {
+  uint16_t id;
+  const safety_hooks *hooks;
+} safety_hook_config;
+
+const safety_hook_config safety_hook_registry[] = {
+  {SAFETY_SILENT, &nooutput_hooks},
+  {SAFETY_HONDA_NIDEC, &honda_nidec_hooks},
+  {SAFETY_TOYOTA, &toyota_hooks},
+  {SAFETY_ELM327, &elm327_hooks},
+  {SAFETY_GM, &gm_hooks},
+  {SAFETY_HONDA_BOSCH, &honda_bosch_hooks},
+  {SAFETY_HYUNDAI, &hyundai_hooks},
+  {SAFETY_CHRYSLER, &chrysler_hooks},
+  {SAFETY_SUBARU, &subaru_hooks},
+  {SAFETY_VOLKSWAGEN_MQB, &volkswagen_mqb_hooks},
+  {SAFETY_NISSAN, &nissan_hooks},
+  {SAFETY_NOOUTPUT, &nooutput_hooks},
+  {SAFETY_HYUNDAI_LEGACY, &hyundai_legacy_hooks},
+  {SAFETY_MAZDA, &mazda_hooks},
+  {SAFETY_BODY, &body_hooks},
+  {SAFETY_FORD, &ford_hooks},
+#ifdef CANFD
+  {SAFETY_HYUNDAI_CANFD, &hyundai_canfd_hooks},
+#endif
+#ifdef ALLOW_DEBUG
+  {SAFETY_TESLA, &tesla_hooks},
+  {SAFETY_SUBARU_PREGLOBAL, &subaru_preglobal_hooks},
+  {SAFETY_VOLKSWAGEN_PQ, &volkswagen_pq_hooks},
+  {SAFETY_ALLOUTPUT, &alloutput_hooks},
+#endif
+};
+
+int set_safety_hooks(uint16_t mode, uint16_t param) {
+  // reset state set by safety mode
+  safety_mode_cnt = 0U;
+  relay_malfunction = false;
+  gas_interceptor_detected = false;
+  gas_interceptor_prev = 0;
+  gas_pressed = false;
+  gas_pressed_prev = false;
+  brake_pressed = false;
+  brake_pressed_prev = false;
+  regen_braking = false;
+  regen_braking_prev = false;
+  cruise_engaged_prev = false;
+  vehicle_moving = false;
+  acc_main_on = false;
+  cruise_button_prev = 0;
+  desired_torque_last = 0;
+  rt_torque_last = 0;
+  ts_angle_last = 0;
+  desired_angle_last = 0;
+  ts_torque_check_last = 0;
+  ts_steer_req_mismatch_last = 0;
+  valid_steer_req_count = 0;
+  invalid_steer_req_count = 0;
+
+  vehicle_speed.min = 0;
+  vehicle_speed.max = 0;
+  torque_meas.min = 0;
+  torque_meas.max = 0;
+  torque_driver.min = 0;
+  torque_driver.max = 0;
+  angle_meas.min = 0;
+  angle_meas.max = 0;
+
+  controls_allowed = false;
+  relay_malfunction_reset();
+  safety_rx_checks_invalid = false;
+
+  int set_status = -1;  // not set
+  int hook_config_count = sizeof(safety_hook_registry) / sizeof(safety_hook_config);
+  for (int i = 0; i < hook_config_count; i++) {
+    if (safety_hook_registry[i].id == mode) {
+      current_hooks = safety_hook_registry[i].hooks;
+      current_safety_mode = mode;
+      current_safety_param = param;
+      set_status = 0;  // set
+    }
+  }
+  if ((set_status == 0) && (current_hooks->init != NULL)) {
+    current_rx_checks = current_hooks->init(param);
+    // reset message index and seen flags in addr struct
+    for (int j = 0; j < current_rx_checks->len; j++) {
+      current_rx_checks->check[j].index = 0;
+      current_rx_checks->check[j].msg_seen = false;
+    }
+  }
+  return set_status;
+}
+
+// convert a trimmed integer to signed 32 bit int
+int to_signed(int d, int bits) {
+  int d_signed = d;
+  if (d >= (1 << MAX((bits - 1), 0))) {
+    d_signed = d - (1 << MAX(bits, 0));
+  }
+  return d_signed;
+}
+
+// given a new sample, update the sample_t struct
+void update_sample(struct sample_t *sample, int sample_new) {
+  int sample_size = sizeof(sample->values) / sizeof(sample->values[0]);
+  for (int i = sample_size - 1; i > 0; i--) {
+    sample->values[i] = sample->values[i-1];
+  }
+  sample->values[0] = sample_new;
+
+  // get the minimum and maximum measured samples
+  sample->min = sample->values[0];
+  sample->max = sample->values[0];
+  for (int i = 1; i < sample_size; i++) {
+    if (sample->values[i] < sample->min) {
+      sample->min = sample->values[i];
+    }
+    if (sample->values[i] > sample->max) {
+      sample->max = sample->values[i];
+    }
+  }
+}
+
+bool max_limit_check(int val, const int MAX_VAL, const int MIN_VAL) {
+  return (val > MAX_VAL) || (val < MIN_VAL);
+}
+
+// check that commanded torque value isn't too far from measured
+bool dist_to_meas_check(int val, int val_last, struct sample_t *val_meas,
+                        const int MAX_RATE_UP, const int MAX_RATE_DOWN, const int MAX_ERROR) {
+
+  // *** val rate limit check ***
+  int highest_allowed_rl = MAX(val_last, 0) + MAX_RATE_UP;
+  int lowest_allowed_rl = MIN(val_last, 0) - MAX_RATE_UP;
+
+  // if we've exceeded the meas val, we must start moving toward 0
+  int highest_allowed = MIN(highest_allowed_rl, MAX(val_last - MAX_RATE_DOWN, MAX(val_meas->max, 0) + MAX_ERROR));
+  int lowest_allowed = MAX(lowest_allowed_rl, MIN(val_last + MAX_RATE_DOWN, MIN(val_meas->min, 0) - MAX_ERROR));
+
+  // check for violation
+  return max_limit_check(val, highest_allowed, lowest_allowed);
+}
+
+// check that commanded value isn't fighting against driver
+bool driver_limit_check(int val, int val_last, struct sample_t *val_driver,
+                        const int MAX_VAL, const int MAX_RATE_UP, const int MAX_RATE_DOWN,
+                        const int MAX_ALLOWANCE, const int DRIVER_FACTOR) {
+
+  // torque delta/rate limits
+  int highest_allowed_rl = MAX(val_last, 0) + MAX_RATE_UP;
+  int lowest_allowed_rl = MIN(val_last, 0) - MAX_RATE_UP;
+
+  // driver
+  int driver_max_limit = MAX_VAL + (MAX_ALLOWANCE + val_driver->max) * DRIVER_FACTOR;
+  int driver_min_limit = -MAX_VAL + (-MAX_ALLOWANCE + val_driver->min) * DRIVER_FACTOR;
+
+  // if we've exceeded the applied torque, we must start moving toward 0
+  int highest_allowed = MIN(highest_allowed_rl, MAX(val_last - MAX_RATE_DOWN,
+                                             MAX(driver_max_limit, 0)));
+  int lowest_allowed = MAX(lowest_allowed_rl, MIN(val_last + MAX_RATE_DOWN,
+                                           MIN(driver_min_limit, 0)));
+
+  // check for violation
+  return max_limit_check(val, highest_allowed, lowest_allowed);
+}
+
+
+// real time check, mainly used for steer torque rate limiter
+bool rt_rate_limit_check(int val, int val_last, const int MAX_RT_DELTA) {
+
+  // *** torque real time rate limit check ***
+  int highest_val = MAX(val_last, 0) + MAX_RT_DELTA;
+  int lowest_val = MIN(val_last, 0) - MAX_RT_DELTA;
+
+  // check for violation
+  return max_limit_check(val, highest_val, lowest_val);
+}
+
+
+// interp function that holds extreme values
+float interpolate(struct lookup_t xy, float x) {
+
+  int size = sizeof(xy.x) / sizeof(xy.x[0]);
+  float ret = xy.y[size - 1];  // default output is last point
+
+  // x is lower than the first point in the x array. Return the first point
+  if (x <= xy.x[0]) {
+    ret = xy.y[0];
+
+  } else {
+    // find the index such that (xy.x[i] <= x < xy.x[i+1]) and linearly interp
+    for (int i=0; i < (size - 1); i++) {
+      if (x < xy.x[i+1]) {
+        float x0 = xy.x[i];
+        float y0 = xy.y[i];
+        float dx = xy.x[i+1] - x0;
+        float dy = xy.y[i+1] - y0;
+        // dx should not be zero as xy.x is supposed to be monotonic
+        if (dx <= 0.) {
+          dx = 0.0001;
+        }
+        ret = (dy * (x - x0) / dx) + y0;
+        break;
+      }
+    }
+  }
+  return ret;
+}
+
+int ROUND(float val) {
+  return val + ((val > 0.0) ? 0.5 : -0.5);
+}
+
+// Safety checks for longitudinal actuation
+bool longitudinal_accel_checks(int desired_accel, const LongitudinalLimits limits) {
+  bool accel_valid = get_longitudinal_allowed() && !max_limit_check(desired_accel, limits.max_accel, limits.min_accel);
+  bool accel_inactive = desired_accel == limits.inactive_accel;
+  return !(accel_valid || accel_inactive);
+}
+
+bool longitudinal_speed_checks(int desired_speed, const LongitudinalLimits limits) {
+  return !get_longitudinal_allowed() && (desired_speed != limits.inactive_speed);
+}
+
+bool longitudinal_gas_checks(int desired_gas, const LongitudinalLimits limits) {
+  bool gas_valid = get_longitudinal_allowed() && !max_limit_check(desired_gas, limits.max_gas, limits.min_gas);
+  bool gas_inactive = desired_gas == limits.inactive_gas;
+  return !(gas_valid || gas_inactive);
+}
+
+bool longitudinal_brake_checks(int desired_brake, const LongitudinalLimits limits) {
+  bool violation = false;
+  violation |= !get_longitudinal_allowed() && (desired_brake != 0);
+  violation |= desired_brake > limits.max_brake;
+  return violation;
+}
+
+bool longitudinal_interceptor_checks(CANPacket_t *to_send) {
+  return !get_longitudinal_allowed() && (GET_BYTE(to_send, 0) || GET_BYTE(to_send, 1));
+}
+
+// Safety checks for torque-based steering commands
+bool steer_torque_cmd_checks(int desired_torque, int steer_req, const SteeringLimits limits) {
+  bool violation = false;
+  uint32_t ts = microsecond_timer_get();
+
+  if (controls_allowed) {
+    // *** global torque limit check ***
+    violation |= max_limit_check(desired_torque, limits.max_steer, -limits.max_steer);
+
+    // *** torque rate limit check ***
+    if (limits.type == TorqueDriverLimited) {
+      violation |= driver_limit_check(desired_torque, desired_torque_last, &torque_driver,
+                                      limits.max_steer, limits.max_rate_up, limits.max_rate_down,
+                                      limits.driver_torque_allowance, limits.driver_torque_factor);
+    } else {
+      violation |= dist_to_meas_check(desired_torque, desired_torque_last, &torque_meas,
+                                      limits.max_rate_up, limits.max_rate_down, limits.max_torque_error);
+    }
+    desired_torque_last = desired_torque;
+
+    // *** torque real time rate limit check ***
+    violation |= rt_rate_limit_check(desired_torque, rt_torque_last, limits.max_rt_delta);
+
+    // every RT_INTERVAL set the new limits
+    uint32_t ts_elapsed = get_ts_elapsed(ts, ts_torque_check_last);
+    if (ts_elapsed > limits.max_rt_interval) {
+      rt_torque_last = desired_torque;
+      ts_torque_check_last = ts;
+    }
+  }
+
+  // no torque if controls is not allowed
+  if (!controls_allowed && (desired_torque != 0)) {
+    violation = true;
+  }
+
+  // certain safety modes set their steer request bit low for one or more frame at a
+  // predefined max frequency to avoid steering faults in certain situations
+  bool steer_req_mismatch = (steer_req == 0) && (desired_torque != 0);
+  if (!limits.has_steer_req_tolerance) {
+    if (steer_req_mismatch) {
+      violation = true;
+    }
+
+  } else {
+    if (steer_req_mismatch) {
+      if (invalid_steer_req_count == 0) {
+        // disallow torque cut if not enough recent matching steer_req messages
+        if (valid_steer_req_count < limits.min_valid_request_frames) {
+          violation = true;
+        }
+
+        // or we've cut torque too recently in time
+        uint32_t ts_elapsed = get_ts_elapsed(ts, ts_steer_req_mismatch_last);
+        if (ts_elapsed < limits.min_valid_request_rt_interval) {
+          violation = true;
+        }
+      } else {
+        // or we're cutting more frames consecutively than allowed
+        if (invalid_steer_req_count >= limits.max_invalid_request_frames) {
+          violation = true;
+        }
+      }
+
+      valid_steer_req_count = 0;
+      ts_steer_req_mismatch_last = ts;
+      invalid_steer_req_count = MIN(invalid_steer_req_count + 1, limits.max_invalid_request_frames);
+    } else {
+      valid_steer_req_count = MIN(valid_steer_req_count + 1, limits.min_valid_request_frames);
+      invalid_steer_req_count = 0;
+    }
+  }
+
+  // reset to 0 if either controls is not allowed or there's a violation
+  if (violation || !controls_allowed) {
+    valid_steer_req_count = 0;
+    invalid_steer_req_count = 0;
+    desired_torque_last = 0;
+    rt_torque_last = 0;
+    ts_torque_check_last = ts;
+    ts_steer_req_mismatch_last = ts;
+  }
+
+  return violation;
+}
+
+// Safety checks for angle-based steering commands
+bool steer_angle_cmd_checks(int desired_angle, bool steer_control_enabled, const SteeringLimits limits) {
+  bool violation = false;
+
+  if (controls_allowed && steer_control_enabled) {
+    // convert floating point angle rate limits to integers in the scale of the desired angle on CAN,
+    // add 1 to not false trigger the violation. also fudge the speed by 1 m/s so rate limits are
+    // always slightly above openpilot's in case we read an updated speed in between angle commands
+    // TODO: this speed fudge can be much lower, look at data to determine the lowest reasonable offset
+    int delta_angle_up = (interpolate(limits.angle_rate_up_lookup, (vehicle_speed.min / VEHICLE_SPEED_FACTOR) - 1.) * limits.angle_deg_to_can) + 1.;
+    int delta_angle_down = (interpolate(limits.angle_rate_down_lookup, (vehicle_speed.min / VEHICLE_SPEED_FACTOR) - 1.) * limits.angle_deg_to_can) + 1.;
+
+    // allow down limits at zero since small floats will be rounded to 0
+    int highest_desired_angle = desired_angle_last + ((desired_angle_last > 0) ? delta_angle_up : delta_angle_down);
+    int lowest_desired_angle = desired_angle_last - ((desired_angle_last >= 0) ? delta_angle_down : delta_angle_up);
+
+    // check that commanded angle value isn't too far from measured, used to limit torque for some safety modes
+    // ensure we start moving in direction of meas while respecting rate limits if error is exceeded
+    if (limits.enforce_angle_error && ((vehicle_speed.values[0] / VEHICLE_SPEED_FACTOR) > limits.angle_error_min_speed)) {
+      // the rate limits above are liberally above openpilot's to avoid false positives.
+      // likewise, allow a lower rate for moving towards meas when error is exceeded
+      int delta_angle_up_lower = interpolate(limits.angle_rate_up_lookup, (vehicle_speed.max / VEHICLE_SPEED_FACTOR) + 1.) * limits.angle_deg_to_can;
+      int delta_angle_down_lower = interpolate(limits.angle_rate_down_lookup, (vehicle_speed.max / VEHICLE_SPEED_FACTOR) + 1.) * limits.angle_deg_to_can;
+
+      int highest_desired_angle_lower = desired_angle_last + ((desired_angle_last > 0) ? delta_angle_up_lower : delta_angle_down_lower);
+      int lowest_desired_angle_lower = desired_angle_last - ((desired_angle_last >= 0) ? delta_angle_down_lower : delta_angle_up_lower);
+
+      lowest_desired_angle = MIN(MAX(lowest_desired_angle, angle_meas.min - limits.max_angle_error - 1), highest_desired_angle_lower);
+      highest_desired_angle = MAX(MIN(highest_desired_angle, angle_meas.max + limits.max_angle_error + 1), lowest_desired_angle_lower);
+
+      // don't enforce above the max steer
+      lowest_desired_angle = CLAMP(lowest_desired_angle, -limits.max_steer, limits.max_steer);
+      highest_desired_angle = CLAMP(highest_desired_angle, -limits.max_steer, limits.max_steer);
+    }
+
+    // check for violation;
+    violation |= max_limit_check(desired_angle, highest_desired_angle, lowest_desired_angle);
+  }
+  desired_angle_last = desired_angle;
+
+  // Angle should either be 0 or same as current angle while not steering
+  if (!steer_control_enabled) {
+    violation |= (limits.inactive_angle_is_zero ? (desired_angle != 0) :
+                  max_limit_check(desired_angle, angle_meas.max + 1, angle_meas.min - 1));
+  }
+
+  // No angle control allowed when controls are not allowed
+  violation |= !controls_allowed && steer_control_enabled;
+
+  return violation;
+}
+
+void pcm_cruise_check(bool cruise_engaged) {
+  // Enter controls on rising edge of stock ACC, exit controls if stock ACC disengages
+  if (!cruise_engaged) {
+    controls_allowed = false;
+  }
+  if (cruise_engaged && !cruise_engaged_prev) {
+    controls_allowed = true;
+  }
+  cruise_engaged_prev = cruise_engaged;
+}

panda/board/safety/safety_body.h

@@ -0,0 +1,52 @@
+const CanMsg BODY_TX_MSGS[] = {{0x250, 0, 8}, {0x250, 0, 6}, {0x251, 0, 5},  // body
+                               {0x350, 0, 8}, {0x350, 0, 6}, {0x351, 0, 5}}; // knee
+
+AddrCheckStruct body_addr_checks[] = {
+  {.msg = {{0x201, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+};
+#define BODY_ADDR_CHECK_LEN (sizeof(body_addr_checks) / sizeof(body_addr_checks[0]))
+addr_checks body_rx_checks = {body_addr_checks, BODY_ADDR_CHECK_LEN};
+
+static int body_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &body_rx_checks, NULL, NULL, NULL, NULL);
+
+  controls_allowed = valid;
+
+  return valid;
+}
+
+static int body_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 0;
+  int addr = GET_ADDR(to_send);
+
+  // CAN flasher
+  if (addr == 0x1) {
+    tx = 1;
+  }
+
+  if (msg_allowed(to_send, BODY_TX_MSGS, sizeof(BODY_TX_MSGS)/sizeof(BODY_TX_MSGS[0])) && controls_allowed) {
+    tx = 1;
+  }
+
+  // Allow going into CAN flashing mode even if controls are not allowed
+  if (!controls_allowed && (GET_BYTES(to_send, 0, 4) == 0xdeadfaceU) && (GET_BYTES(to_send, 4, 4) == 0x0ab00b1eU)) {
+    tx = 1;
+  }
+
+  return tx;
+}
+
+static const addr_checks* body_init(uint16_t param) {
+  UNUSED(param);
+  return &body_rx_checks;
+}
+
+const safety_hooks body_hooks = {
+  .init = body_init,
+  .rx = body_rx_hook,
+  .tx = body_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = default_fwd_hook,
+};

panda/board/safety/safety_chrysler.h

@@ -0,0 +1,311 @@
+const SteeringLimits CHRYSLER_STEERING_LIMITS = {
+  .max_steer = 261,
+  .max_rt_delta = 112,
+  .max_rt_interval = 250000,
+  .max_rate_up = 3,
+  .max_rate_down = 3,
+  .max_torque_error = 80,
+  .type = TorqueMotorLimited,
+};
+
+const SteeringLimits CHRYSLER_RAM_DT_STEERING_LIMITS = {
+  .max_steer = 350,
+  .max_rt_delta = 112,
+  .max_rt_interval = 250000,
+  .max_rate_up = 6,
+  .max_rate_down = 6,
+  .max_torque_error = 80,
+  .type = TorqueMotorLimited,
+};
+
+const SteeringLimits CHRYSLER_RAM_HD_STEERING_LIMITS = {
+  .max_steer = 361,
+  .max_rt_delta = 182,
+  .max_rt_interval = 250000,
+  .max_rate_up = 14,
+  .max_rate_down = 14,
+  .max_torque_error = 80,
+  .type = TorqueMotorLimited,
+};
+
+typedef struct {
+  const int EPS_2;
+  const int ESP_1;
+  const int ESP_8;
+  const int ECM_5;
+  const int DAS_3;
+  const int DAS_6;
+  const int LKAS_COMMAND;
+  const int CRUISE_BUTTONS;
+} ChryslerAddrs;
+
+// CAN messages for Chrysler/Jeep platforms
+const ChryslerAddrs CHRYSLER_ADDRS = {
+  .EPS_2            = 544,  // EPS driver input torque
+  .ESP_1            = 320,  // Brake pedal and vehicle speed
+  .ESP_8            = 284,  // Brake pedal and vehicle speed
+  .ECM_5            = 559,  // Throttle position sensor
+  .DAS_3            = 500,  // ACC engagement states from DASM
+  .DAS_6            = 678,  // LKAS HUD and auto headlight control from DASM
+  .LKAS_COMMAND     = 658,  // LKAS controls from DASM
+  .CRUISE_BUTTONS   = 571,  // Cruise control buttons
+};
+
+// CAN messages for the 5th gen RAM DT platform
+const ChryslerAddrs CHRYSLER_RAM_DT_ADDRS = {
+  .EPS_2            = 49,   // EPS driver input torque
+  .ESP_1            = 131,  // Brake pedal and vehicle speed
+  .ESP_8            = 121,  // Brake pedal and vehicle speed
+  .ECM_5            = 157,  // Throttle position sensor
+  .DAS_3            = 153,  // ACC engagement states from DASM
+  .DAS_6            = 250,  // LKAS HUD and auto headlight control from DASM
+  .LKAS_COMMAND     = 166,  // LKAS controls from DASM
+  .CRUISE_BUTTONS   = 177,  // Cruise control buttons
+};
+
+// CAN messages for the 5th gen RAM HD platform
+const ChryslerAddrs CHRYSLER_RAM_HD_ADDRS = {
+  .EPS_2            = 544,  // EPS driver input torque
+  .ESP_1            = 320,  // Brake pedal and vehicle speed
+  .ESP_8            = 284,  // Brake pedal and vehicle speed
+  .ECM_5            = 559,  // Throttle position sensor
+  .DAS_3            = 500,  // ACC engagement states from DASM
+  .DAS_6            = 629,  // LKAS HUD and auto headlight control from DASM
+  .LKAS_COMMAND     = 630,  // LKAS controls from DASM
+  .CRUISE_BUTTONS   = 570,  // Cruise control buttons
+};
+
+const CanMsg CHRYSLER_TX_MSGS[] = {
+  {CHRYSLER_ADDRS.CRUISE_BUTTONS, 0, 3},
+  {CHRYSLER_ADDRS.LKAS_COMMAND, 0, 6},
+  {CHRYSLER_ADDRS.DAS_6, 0, 8},
+};
+
+const CanMsg CHRYSLER_RAM_DT_TX_MSGS[] = {
+  {CHRYSLER_RAM_DT_ADDRS.CRUISE_BUTTONS, 2, 3},
+  {CHRYSLER_RAM_DT_ADDRS.LKAS_COMMAND, 0, 8},
+  {CHRYSLER_RAM_DT_ADDRS.DAS_6, 0, 8},
+};
+
+const CanMsg CHRYSLER_RAM_HD_TX_MSGS[] = {
+  {CHRYSLER_RAM_HD_ADDRS.CRUISE_BUTTONS, 2, 3},
+  {CHRYSLER_RAM_HD_ADDRS.LKAS_COMMAND, 0, 8},
+  {CHRYSLER_RAM_HD_ADDRS.DAS_6, 0, 8},
+};
+
+AddrCheckStruct chrysler_addr_checks[] = {
+  {.msg = {{CHRYSLER_ADDRS.EPS_2, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_ADDRS.ESP_1, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  //{.msg = {{ESP_8, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}}},
+  {.msg = {{514, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_ADDRS.ECM_5, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_ADDRS.DAS_3, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define CHRYSLER_ADDR_CHECK_LEN (sizeof(chrysler_addr_checks) / sizeof(chrysler_addr_checks[0]))
+
+AddrCheckStruct chrysler_ram_dt_addr_checks[] = {
+  {.msg = {{CHRYSLER_RAM_DT_ADDRS.EPS_2, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_DT_ADDRS.ESP_1, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_DT_ADDRS.ESP_8, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_DT_ADDRS.ECM_5, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_DT_ADDRS.DAS_3, 2, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define CHRYSLER_RAM_DT_ADDR_CHECK_LEN (sizeof(chrysler_ram_dt_addr_checks) / sizeof(chrysler_ram_dt_addr_checks[0]))
+
+AddrCheckStruct chrysler_ram_hd_addr_checks[] = {
+  {.msg = {{CHRYSLER_RAM_HD_ADDRS.EPS_2, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_HD_ADDRS.ESP_1, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_HD_ADDRS.ESP_8, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_HD_ADDRS.ECM_5, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{CHRYSLER_RAM_HD_ADDRS.DAS_3, 2, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define CHRYSLER_RAM_HD_ADDR_CHECK_LEN (sizeof(chrysler_ram_hd_addr_checks) / sizeof(chrysler_ram_hd_addr_checks[0]))
+
+
+addr_checks chrysler_rx_checks = {chrysler_addr_checks, CHRYSLER_ADDR_CHECK_LEN};
+
+const uint32_t CHRYSLER_PARAM_RAM_DT = 1U;  // set for Ram DT platform
+const uint32_t CHRYSLER_PARAM_RAM_HD = 2U;  // set for Ram DT platform
+
+enum {
+  CHRYSLER_RAM_DT,
+  CHRYSLER_RAM_HD,
+  CHRYSLER_PACIFICA,  // plus Jeep
+} chrysler_platform = CHRYSLER_PACIFICA;
+const ChryslerAddrs *chrysler_addrs = &CHRYSLER_ADDRS;
+
+static uint32_t chrysler_get_checksum(CANPacket_t *to_push) {
+  int checksum_byte = GET_LEN(to_push) - 1U;
+  return (uint8_t)(GET_BYTE(to_push, checksum_byte));
+}
+
+static uint32_t chrysler_compute_checksum(CANPacket_t *to_push) {
+  // TODO: clean this up
+  // http://illmatics.com/Remote%20Car%20Hacking.pdf
+  uint8_t checksum = 0xFFU;
+  int len = GET_LEN(to_push);
+  for (int j = 0; j < (len - 1); j++) {
+    uint8_t shift = 0x80U;
+    uint8_t curr = (uint8_t)GET_BYTE(to_push, j);
+    for (int i=0; i<8; i++) {
+      uint8_t bit_sum = curr & shift;
+      uint8_t temp_chk = checksum & 0x80U;
+      if (bit_sum != 0U) {
+        bit_sum = 0x1C;
+        if (temp_chk != 0U) {
+          bit_sum = 1;
+        }
+        checksum = checksum << 1;
+        temp_chk = checksum | 1U;
+        bit_sum ^= temp_chk;
+      } else {
+        if (temp_chk != 0U) {
+          bit_sum = 0x1D;
+        }
+        checksum = checksum << 1;
+        bit_sum ^= checksum;
+      }
+      checksum = bit_sum;
+      shift = shift >> 1;
+    }
+  }
+  return (uint8_t)(~checksum);
+}
+
+static uint8_t chrysler_get_counter(CANPacket_t *to_push) {
+  return (uint8_t)(GET_BYTE(to_push, 6) >> 4);
+}
+
+static int chrysler_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &chrysler_rx_checks,
+                                 chrysler_get_checksum, chrysler_compute_checksum,
+                                 chrysler_get_counter, NULL);
+
+  const int bus = GET_BUS(to_push);
+  const int addr = GET_ADDR(to_push);
+
+  if (valid) {
+
+    // Measured EPS torque
+    if ((bus == 0) && (addr == chrysler_addrs->EPS_2)) {
+      int torque_meas_new = ((GET_BYTE(to_push, 4) & 0x7U) << 8) + GET_BYTE(to_push, 5) - 1024U;
+      update_sample(&torque_meas, torque_meas_new);
+    }
+
+    // enter controls on rising edge of ACC, exit controls on ACC off
+    const int das_3_bus = (chrysler_platform == CHRYSLER_PACIFICA) ? 0 : 2;
+    if ((bus == das_3_bus) && (addr == chrysler_addrs->DAS_3)) {
+      bool cruise_engaged = GET_BIT(to_push, 21U) == 1U;
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    // TODO: use the same message for both
+    // update vehicle moving
+    if ((chrysler_platform != CHRYSLER_PACIFICA) && (bus == 0) && (addr == chrysler_addrs->ESP_8)) {
+      vehicle_moving = ((GET_BYTE(to_push, 4) << 8) + GET_BYTE(to_push, 5)) != 0U;
+    }
+    if ((chrysler_platform == CHRYSLER_PACIFICA) && (bus == 0) && (addr == 514)) {
+      int speed_l = (GET_BYTE(to_push, 0) << 4) + (GET_BYTE(to_push, 1) >> 4);
+      int speed_r = (GET_BYTE(to_push, 2) << 4) + (GET_BYTE(to_push, 3) >> 4);
+      vehicle_moving = (speed_l != 0) || (speed_r != 0);
+    }
+
+    // exit controls on rising edge of gas press
+    if ((bus == 0) && (addr == chrysler_addrs->ECM_5)) {
+      gas_pressed = GET_BYTE(to_push, 0U) != 0U;
+    }
+
+    // exit controls on rising edge of brake press
+    if ((bus == 0) && (addr == chrysler_addrs->ESP_1)) {
+      brake_pressed = ((GET_BYTE(to_push, 0U) & 0xFU) >> 2U) == 1U;
+    }
+
+    generic_rx_checks((bus == 0) && (addr == chrysler_addrs->LKAS_COMMAND));
+  }
+  return valid;
+}
+
+static int chrysler_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+
+  if (chrysler_platform == CHRYSLER_RAM_DT) {
+    tx = msg_allowed(to_send, CHRYSLER_RAM_DT_TX_MSGS, sizeof(CHRYSLER_RAM_DT_TX_MSGS) / sizeof(CHRYSLER_RAM_DT_TX_MSGS[0]));
+  } else if (chrysler_platform == CHRYSLER_RAM_HD) {
+    tx = msg_allowed(to_send, CHRYSLER_RAM_HD_TX_MSGS, sizeof(CHRYSLER_RAM_HD_TX_MSGS) / sizeof(CHRYSLER_RAM_HD_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, CHRYSLER_TX_MSGS, sizeof(CHRYSLER_TX_MSGS) / sizeof(CHRYSLER_TX_MSGS[0]));
+  }
+
+  // STEERING
+  if (tx && (addr == chrysler_addrs->LKAS_COMMAND)) {
+    int start_byte = (chrysler_platform == CHRYSLER_PACIFICA) ? 0 : 1;
+    int desired_torque = ((GET_BYTE(to_send, start_byte) & 0x7U) << 8) | GET_BYTE(to_send, start_byte + 1);
+    desired_torque -= 1024;
+
+    const SteeringLimits limits = (chrysler_platform == CHRYSLER_PACIFICA) ? CHRYSLER_STEERING_LIMITS :
+                                  (chrysler_platform == CHRYSLER_RAM_DT) ? CHRYSLER_RAM_DT_STEERING_LIMITS : CHRYSLER_RAM_HD_STEERING_LIMITS;
+    if (steer_torque_cmd_checks(desired_torque, -1, limits)) {
+      tx = 0;
+    }
+  }
+
+  // FORCE CANCEL: only the cancel button press is allowed
+  if (addr == chrysler_addrs->CRUISE_BUTTONS) {
+    const bool is_cancel = GET_BYTE(to_send, 0) == 1U;
+    const bool is_resume = GET_BYTE(to_send, 0) == 0x10U;
+    const bool allowed = is_cancel || (is_resume && controls_allowed);
+    if (!allowed) {
+      tx = 0;
+    }
+  }
+
+  return tx;
+}
+
+static int chrysler_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  // forward to camera
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+
+  // forward all messages from camera except LKAS messages
+  const bool is_lkas = ((addr == chrysler_addrs->LKAS_COMMAND) || (addr == chrysler_addrs->DAS_6));
+  if ((bus_num == 2) && !is_lkas){
+    bus_fwd = 0;
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* chrysler_init(uint16_t param) {
+  if (GET_FLAG(param, CHRYSLER_PARAM_RAM_DT)) {
+    chrysler_platform = CHRYSLER_RAM_DT;
+    chrysler_addrs = &CHRYSLER_RAM_DT_ADDRS;
+    chrysler_rx_checks = (addr_checks){chrysler_ram_dt_addr_checks, CHRYSLER_RAM_DT_ADDR_CHECK_LEN};
+  } else if (GET_FLAG(param, CHRYSLER_PARAM_RAM_HD)) {
+#ifdef ALLOW_DEBUG
+    chrysler_platform = CHRYSLER_RAM_HD;
+    chrysler_addrs = &CHRYSLER_RAM_HD_ADDRS;
+    chrysler_rx_checks = (addr_checks){chrysler_ram_hd_addr_checks, CHRYSLER_RAM_HD_ADDR_CHECK_LEN};
+#endif
+  } else {
+    chrysler_platform = CHRYSLER_PACIFICA;
+    chrysler_addrs = &CHRYSLER_ADDRS;
+    chrysler_rx_checks = (addr_checks){chrysler_addr_checks, CHRYSLER_ADDR_CHECK_LEN};
+  }
+
+  return &chrysler_rx_checks;
+}
+
+const safety_hooks chrysler_hooks = {
+  .init = chrysler_init,
+  .rx = chrysler_rx_hook,
+  .tx = chrysler_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = chrysler_fwd_hook,
+};

panda/board/safety/safety_defaults.h

@@ -0,0 +1,90 @@
+const addr_checks default_rx_checks = {
+  .check = NULL,
+  .len = 0,
+};
+
+int default_rx_hook(CANPacket_t *to_push) {
+  UNUSED(to_push);
+  return true;
+}
+
+// *** no output safety mode ***
+
+static const addr_checks* nooutput_init(uint16_t param) {
+  UNUSED(param);
+  return &default_rx_checks;
+}
+
+static int nooutput_tx_hook(CANPacket_t *to_send) {
+  UNUSED(to_send);
+  return false;
+}
+
+static int nooutput_tx_lin_hook(int lin_num, uint8_t *data, int len) {
+  UNUSED(lin_num);
+  UNUSED(data);
+  UNUSED(len);
+  return false;
+}
+
+static int default_fwd_hook(int bus_num, int addr) {
+  UNUSED(bus_num);
+  UNUSED(addr);
+  return -1;
+}
+
+const safety_hooks nooutput_hooks = {
+  .init = nooutput_init,
+  .rx = default_rx_hook,
+  .tx = nooutput_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = default_fwd_hook,
+};
+
+// *** all output safety mode ***
+
+// Enables passthrough mode where relay is open and bus 0 gets forwarded to bus 2 and vice versa
+const uint16_t ALLOUTPUT_PARAM_PASSTHROUGH = 1;
+bool alloutput_passthrough = false;
+
+static const addr_checks* alloutput_init(uint16_t param) {
+  controls_allowed = true;
+  alloutput_passthrough = GET_FLAG(param, ALLOUTPUT_PARAM_PASSTHROUGH);
+  return &default_rx_checks;
+}
+
+static int alloutput_tx_hook(CANPacket_t *to_send) {
+  UNUSED(to_send);
+  return true;
+}
+
+static int alloutput_tx_lin_hook(int lin_num, uint8_t *data, int len) {
+  UNUSED(lin_num);
+  UNUSED(data);
+  UNUSED(len);
+  return true;
+}
+
+static int alloutput_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+  UNUSED(addr);
+
+  if (alloutput_passthrough) {
+    if (bus_num == 0) {
+      bus_fwd = 2;
+    }
+    if (bus_num == 2) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+const safety_hooks alloutput_hooks = {
+  .init = alloutput_init,
+  .rx = default_rx_hook,
+  .tx = alloutput_tx_hook,
+  .tx_lin = alloutput_tx_lin_hook,
+  .fwd = alloutput_fwd_hook,
+};

panda/board/safety/safety_elm327.h

@@ -0,0 +1,43 @@
+static int elm327_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  int len = GET_LEN(to_send);
+
+  //All ISO 15765-4 messages must be 8 bytes long
+  if (len != 8) {
+    tx = 0;
+  }
+
+  //Check valid 29 bit send addresses for ISO 15765-4
+  //Check valid 11 bit send addresses for ISO 15765-4
+  if ((addr != 0x18DB33F1) && ((addr & 0x1FFF00FF) != 0x18DA00F1) &&
+      ((addr & 0x1FFFFF00) != 0x600) && ((addr & 0x1FFFFF00) != 0x700)) {
+    tx = 0;
+  }
+  return tx;
+}
+
+static int elm327_tx_lin_hook(int lin_num, uint8_t *data, int len) {
+  int tx = 1;
+  if (lin_num != 0) {
+    tx = 0;  //Only operate on LIN 0, aka serial 2
+  }
+  if ((len < 5) || (len > 11)) {
+    tx = 0;  //Valid KWP size
+  }
+  if (!(((data[0] & 0xF8U) == 0xC0U) && ((data[0] & 0x07U) != 0U) &&
+        (data[1] == 0x33U) && (data[2] == 0xF1U))) {
+    tx = 0;  //Bad msg
+  }
+  return tx;
+}
+
+// If current_board->has_obd and safety_param == 0, bus 1 is multiplexed to the OBD-II port
+const safety_hooks elm327_hooks = {
+  .init = nooutput_init,
+  .rx = default_rx_hook,
+  .tx = elm327_tx_hook,
+  .tx_lin = elm327_tx_lin_hook,
+  .fwd = default_fwd_hook,
+};

panda/board/safety/safety_ford.h

@@ -0,0 +1,437 @@
+// Safety-relevant CAN messages for Ford vehicles.
+#define FORD_EngBrakeData          0x165   // RX from PCM, for driver brake pedal and cruise state
+#define FORD_EngVehicleSpThrottle  0x204   // RX from PCM, for driver throttle input
+#define FORD_DesiredTorqBrk        0x213   // RX from ABS, for standstill state
+#define FORD_BrakeSysFeatures      0x415   // RX from ABS, for vehicle speed
+#define FORD_EngVehicleSpThrottle2 0x202   // RX from PCM, for second vehicle speed
+#define FORD_Yaw_Data_FD1          0x91    // RX from RCM, for yaw rate
+#define FORD_Steering_Data_FD1     0x083   // TX by OP, various driver switches and LKAS/CC buttons
+#define FORD_ACCDATA               0x186   // TX by OP, ACC controls
+#define FORD_ACCDATA_3             0x18A   // TX by OP, ACC/TJA user interface
+#define FORD_Lane_Assist_Data1     0x3CA   // TX by OP, Lane Keep Assist
+#define FORD_LateralMotionControl  0x3D3   // TX by OP, Lateral Control message
+#define FORD_LateralMotionControl2 0x3D6   // TX by OP, alternate Lateral Control message
+#define FORD_IPMA_Data             0x3D8   // TX by OP, IPMA and LKAS user interface
+
+// CAN bus numbers.
+#define FORD_MAIN_BUS 0U
+#define FORD_CAM_BUS  2U
+
+const CanMsg FORD_STOCK_TX_MSGS[] = {
+  {FORD_Steering_Data_FD1, 0, 8},
+  {FORD_Steering_Data_FD1, 2, 8},
+  {FORD_ACCDATA_3, 0, 8},
+  {FORD_Lane_Assist_Data1, 0, 8},
+  {FORD_LateralMotionControl, 0, 8},
+  {FORD_IPMA_Data, 0, 8},
+};
+#define FORD_STOCK_TX_LEN (sizeof(FORD_STOCK_TX_MSGS) / sizeof(FORD_STOCK_TX_MSGS[0]))
+
+const CanMsg FORD_LONG_TX_MSGS[] = {
+  {FORD_Steering_Data_FD1, 0, 8},
+  {FORD_Steering_Data_FD1, 2, 8},
+  {FORD_ACCDATA, 0, 8},
+  {FORD_ACCDATA_3, 0, 8},
+  {FORD_Lane_Assist_Data1, 0, 8},
+  {FORD_LateralMotionControl, 0, 8},
+  {FORD_IPMA_Data, 0, 8},
+};
+#define FORD_LONG_TX_LEN (sizeof(FORD_LONG_TX_MSGS) / sizeof(FORD_LONG_TX_MSGS[0]))
+
+const CanMsg FORD_CANFD_STOCK_TX_MSGS[] = {
+  {FORD_Steering_Data_FD1, 0, 8},
+  {FORD_Steering_Data_FD1, 2, 8},
+  {FORD_ACCDATA_3, 0, 8},
+  {FORD_Lane_Assist_Data1, 0, 8},
+  {FORD_LateralMotionControl2, 0, 8},
+  {FORD_IPMA_Data, 0, 8},
+};
+#define FORD_CANFD_STOCK_TX_LEN (sizeof(FORD_CANFD_STOCK_TX_MSGS) / sizeof(FORD_CANFD_STOCK_TX_MSGS[0]))
+
+const CanMsg FORD_CANFD_LONG_TX_MSGS[] = {
+  {FORD_Steering_Data_FD1, 0, 8},
+  {FORD_Steering_Data_FD1, 2, 8},
+  {FORD_ACCDATA, 0, 8},
+  {FORD_ACCDATA_3, 0, 8},
+  {FORD_Lane_Assist_Data1, 0, 8},
+  {FORD_LateralMotionControl2, 0, 8},
+  {FORD_IPMA_Data, 0, 8},
+};
+#define FORD_CANFD_LONG_TX_LEN (sizeof(FORD_CANFD_LONG_TX_MSGS) / sizeof(FORD_CANFD_LONG_TX_MSGS[0]))
+
+// warning: quality flags are not yet checked in openpilot's CAN parser,
+// this may be the cause of blocked messages
+AddrCheckStruct ford_addr_checks[] = {
+  {.msg = {{FORD_BrakeSysFeatures, 0, 8, .check_checksum = true, .max_counter = 15U, .quality_flag=true, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  // TODO: FORD_EngVehicleSpThrottle2 has a counter that skips by 2, understand and enable counter check
+  {.msg = {{FORD_EngVehicleSpThrottle2, 0, 8, .check_checksum = true, .quality_flag=true, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{FORD_Yaw_Data_FD1, 0, 8, .check_checksum = true, .max_counter = 255U, .quality_flag=true, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  // These messages have no counter or checksum
+  {.msg = {{FORD_EngBrakeData, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{FORD_EngVehicleSpThrottle, 0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{FORD_DesiredTorqBrk, 0, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define FORD_ADDR_CHECK_LEN (sizeof(ford_addr_checks) / sizeof(ford_addr_checks[0]))
+addr_checks ford_rx_checks = {ford_addr_checks, FORD_ADDR_CHECK_LEN};
+
+static uint8_t ford_get_counter(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t cnt;
+  if (addr == FORD_BrakeSysFeatures) {
+    // Signal: VehVActlBrk_No_Cnt
+    cnt = (GET_BYTE(to_push, 2) >> 2) & 0xFU;
+  } else if (addr == FORD_EngVehicleSpThrottle2) {
+    // Signal: VehVActlEng_No_Cnt
+    cnt = (GET_BYTE(to_push, 2) >> 3) & 0xFU;
+  } else if (addr == FORD_Yaw_Data_FD1) {
+    // Signal: VehRollYaw_No_Cnt
+    cnt = GET_BYTE(to_push, 5);
+  } else {
+    cnt = 0;
+  }
+  return cnt;
+}
+
+static uint32_t ford_get_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t chksum;
+  if (addr == FORD_BrakeSysFeatures) {
+    // Signal: VehVActlBrk_No_Cs
+    chksum = GET_BYTE(to_push, 3);
+  } else if (addr == FORD_EngVehicleSpThrottle2) {
+    // Signal: VehVActlEng_No_Cs
+    chksum = GET_BYTE(to_push, 1);
+  } else if (addr == FORD_Yaw_Data_FD1) {
+    // Signal: VehRollYawW_No_Cs
+    chksum = GET_BYTE(to_push, 4);
+  } else {
+    chksum = 0;
+  }
+  return chksum;
+}
+
+static uint32_t ford_compute_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t chksum = 0;
+  if (addr == FORD_BrakeSysFeatures) {
+    chksum += GET_BYTE(to_push, 0) + GET_BYTE(to_push, 1);  // Veh_V_ActlBrk
+    chksum += GET_BYTE(to_push, 2) >> 6;                    // VehVActlBrk_D_Qf
+    chksum += (GET_BYTE(to_push, 2) >> 2) & 0xFU;           // VehVActlBrk_No_Cnt
+    chksum = 0xFFU - chksum;
+  } else if (addr == FORD_EngVehicleSpThrottle2) {
+    chksum += (GET_BYTE(to_push, 2) >> 3) & 0xFU;           // VehVActlEng_No_Cnt
+    chksum += (GET_BYTE(to_push, 4) >> 5) & 0x3U;           // VehVActlEng_D_Qf
+    chksum += GET_BYTE(to_push, 6) + GET_BYTE(to_push, 7);  // Veh_V_ActlEng
+    chksum = 0xFFU - chksum;
+  } else if (addr == FORD_Yaw_Data_FD1) {
+    chksum += GET_BYTE(to_push, 0) + GET_BYTE(to_push, 1);  // VehRol_W_Actl
+    chksum += GET_BYTE(to_push, 2) + GET_BYTE(to_push, 3);  // VehYaw_W_Actl
+    chksum += GET_BYTE(to_push, 5);                         // VehRollYaw_No_Cnt
+    chksum += GET_BYTE(to_push, 6) >> 6;                    // VehRolWActl_D_Qf
+    chksum += (GET_BYTE(to_push, 6) >> 4) & 0x3U;           // VehYawWActl_D_Qf
+    chksum = 0xFFU - chksum;
+  } else {
+  }
+
+  return chksum;
+}
+
+static bool ford_get_quality_flag_valid(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  bool valid = false;
+  if (addr == FORD_BrakeSysFeatures) {
+    valid = (GET_BYTE(to_push, 2) >> 6) == 0x3U;           // VehVActlBrk_D_Qf
+  } else if (addr == FORD_EngVehicleSpThrottle2) {
+    valid = ((GET_BYTE(to_push, 4) >> 5) & 0x3U) == 0x3U;  // VehVActlEng_D_Qf
+  } else if (addr == FORD_Yaw_Data_FD1) {
+    valid = ((GET_BYTE(to_push, 6) >> 4) & 0x3U) == 0x3U;  // VehYawWActl_D_Qf
+  } else {
+  }
+  return valid;
+}
+
+const uint16_t FORD_PARAM_LONGITUDINAL = 1;
+const uint16_t FORD_PARAM_CANFD = 2;
+
+bool ford_longitudinal = false;
+bool ford_canfd = false;
+
+const LongitudinalLimits FORD_LONG_LIMITS = {
+  // acceleration cmd limits (used for brakes)
+  // Signal: AccBrkTot_A_Rq
+  .max_accel = 5641,       //  1.9999 m/s^s
+  .min_accel = 4231,       // -3.4991 m/s^2
+  .inactive_accel = 5128,  // -0.0008 m/s^2
+
+  // gas cmd limits
+  // Signal: AccPrpl_A_Rq
+  .max_gas = 700,          //  2.0 m/s^2
+  .min_gas = 450,          // -0.5 m/s^2
+  .inactive_gas = 0,       // -5.0 m/s^2
+};
+
+#define FORD_INACTIVE_CURVATURE 1000U
+#define FORD_INACTIVE_CURVATURE_RATE 4096U
+#define FORD_INACTIVE_PATH_OFFSET 512U
+#define FORD_INACTIVE_PATH_ANGLE 1000U
+
+#define FORD_CANFD_INACTIVE_CURVATURE_RATE 1024U
+
+#define FORD_MAX_SPEED_DELTA 2.0  // m/s
+
+static bool ford_lkas_msg_check(int addr) {
+  return (addr == FORD_ACCDATA_3)
+      || (addr == FORD_Lane_Assist_Data1)
+      || (addr == FORD_LateralMotionControl)
+      || (addr == FORD_LateralMotionControl2)
+      || (addr == FORD_IPMA_Data);
+}
+
+// Curvature rate limits
+const SteeringLimits FORD_STEERING_LIMITS = {
+  .max_steer = 1000,
+  .angle_deg_to_can = 50000,        // 1 / (2e-5) rad to can
+  .max_angle_error = 100,           // 0.002 * FORD_STEERING_LIMITS.angle_deg_to_can
+  .angle_rate_up_lookup = {
+    {5., 25., 25.},
+    {0.0002, 0.0001, 0.0001}
+  },
+  .angle_rate_down_lookup = {
+    {5., 25., 25.},
+    {0.000225, 0.00015, 0.00015}
+  },
+
+  // no blending at low speed due to lack of torque wind-up and inaccurate current curvature
+  .angle_error_min_speed = 10.0,    // m/s
+
+  .enforce_angle_error = true,
+  .inactive_angle_is_zero = true,
+};
+
+static int ford_rx_hook(CANPacket_t *to_push) {
+  bool valid = addr_safety_check(to_push, &ford_rx_checks,
+                                 ford_get_checksum, ford_compute_checksum, ford_get_counter, ford_get_quality_flag_valid);
+
+  if (valid && (GET_BUS(to_push) == FORD_MAIN_BUS)) {
+    int addr = GET_ADDR(to_push);
+
+    // Update in motion state from standstill signal
+    if (addr == FORD_DesiredTorqBrk) {
+      // Signal: VehStop_D_Stat
+      vehicle_moving = ((GET_BYTE(to_push, 3) >> 3) & 0x3U) == 0U;
+    }
+
+    // Update vehicle speed
+    if (addr == FORD_BrakeSysFeatures) {
+      // Signal: Veh_V_ActlBrk
+      update_sample(&vehicle_speed, ROUND(((GET_BYTE(to_push, 0) << 8) | GET_BYTE(to_push, 1)) * 0.01 / 3.6 * VEHICLE_SPEED_FACTOR));
+    }
+
+    // Check vehicle speed against a second source
+    if (addr == FORD_EngVehicleSpThrottle2) {
+      // Disable controls if speeds from ABS and PCM ECUs are too far apart.
+      // Signal: Veh_V_ActlEng
+      float filtered_pcm_speed = ((GET_BYTE(to_push, 6) << 8) | GET_BYTE(to_push, 7)) * 0.01 / 3.6;
+      if (ABS(filtered_pcm_speed - ((float)vehicle_speed.values[0] / VEHICLE_SPEED_FACTOR)) > FORD_MAX_SPEED_DELTA) {
+        controls_allowed = 0;
+      }
+    }
+
+    // Update vehicle yaw rate
+    if (addr == FORD_Yaw_Data_FD1) {
+      // Signal: VehYaw_W_Actl
+      float ford_yaw_rate = (((GET_BYTE(to_push, 2) << 8U) | GET_BYTE(to_push, 3)) * 0.0002) - 6.5;
+      float current_curvature = ford_yaw_rate / MAX(vehicle_speed.values[0] / VEHICLE_SPEED_FACTOR, 0.1);
+      // convert current curvature into units on CAN for comparison with desired curvature
+      update_sample(&angle_meas, ROUND(current_curvature * FORD_STEERING_LIMITS.angle_deg_to_can));
+    }
+
+    // Update gas pedal
+    if (addr == FORD_EngVehicleSpThrottle) {
+      // Pedal position: (0.1 * val) in percent
+      // Signal: ApedPos_Pc_ActlArb
+      gas_pressed = (((GET_BYTE(to_push, 0) & 0x03U) << 8) | GET_BYTE(to_push, 1)) > 0U;
+    }
+
+    // Update brake pedal and cruise state
+    if (addr == FORD_EngBrakeData) {
+      // Signal: BpedDrvAppl_D_Actl
+      brake_pressed = ((GET_BYTE(to_push, 0) >> 4) & 0x3U) == 2U;
+
+      // Signal: CcStat_D_Actl
+      unsigned int cruise_state = GET_BYTE(to_push, 1) & 0x07U;
+      bool cruise_engaged = (cruise_state == 4U) || (cruise_state == 5U);
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    // If steering controls messages are received on the destination bus, it's an indication
+    // that the relay might be malfunctioning.
+    generic_rx_checks(ford_lkas_msg_check(addr));
+  }
+
+  return valid;
+}
+
+static int ford_tx_hook(CANPacket_t *to_send) {
+  int addr = GET_ADDR(to_send);
+  int tx;
+  if (ford_canfd) {
+    if (ford_longitudinal) {
+      tx = msg_allowed(to_send, FORD_CANFD_LONG_TX_MSGS, FORD_CANFD_LONG_TX_LEN);
+    } else {
+      tx = msg_allowed(to_send, FORD_CANFD_STOCK_TX_MSGS, FORD_CANFD_STOCK_TX_LEN);
+    }
+  } else {
+    if (ford_longitudinal) {
+      tx = msg_allowed(to_send, FORD_LONG_TX_MSGS, FORD_LONG_TX_LEN);
+    } else {
+      tx = msg_allowed(to_send, FORD_STOCK_TX_MSGS, FORD_STOCK_TX_LEN);
+    }
+  }
+
+  // Safety check for ACCDATA accel and brake requests
+  if (addr == FORD_ACCDATA) {
+    // Signal: AccPrpl_A_Rq
+    int gas = ((GET_BYTE(to_send, 6) & 0x3U) << 8) | GET_BYTE(to_send, 7);
+    // Signal: AccBrkTot_A_Rq
+    int accel = ((GET_BYTE(to_send, 0) & 0x1FU) << 8) | GET_BYTE(to_send, 1);
+    // Signal: CmbbDeny_B_Actl
+    int cmbb_deny = GET_BIT(to_send, 37U);
+
+    bool violation = false;
+    violation |= longitudinal_accel_checks(accel, FORD_LONG_LIMITS);
+    violation |= longitudinal_gas_checks(gas, FORD_LONG_LIMITS);
+
+    // Safety check for stock AEB
+    violation |= cmbb_deny != 0; // do not prevent stock AEB actuation
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for Steering_Data_FD1 button signals
+  // Note: Many other signals in this message are not relevant to safety (e.g. blinkers, wiper switches, high beam)
+  // which we passthru in OP.
+  if (addr == FORD_Steering_Data_FD1) {
+    // Violation if resume button is pressed while controls not allowed, or
+    // if cancel button is pressed when cruise isn't engaged.
+    bool violation = false;
+    violation |= (GET_BIT(to_send, 8U) == 1U) && !cruise_engaged_prev;   // Signal: CcAslButtnCnclPress (cancel)
+    violation |= (GET_BIT(to_send, 25U) == 1U) && !controls_allowed;     // Signal: CcAsllButtnResPress (resume)
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for Lane_Assist_Data1 action
+  if (addr == FORD_Lane_Assist_Data1) {
+    // Do not allow steering using Lane_Assist_Data1 (Lane-Departure Aid).
+    // This message must be sent for Lane Centering to work, and can include
+    // values such as the steering angle or lane curvature for debugging,
+    // but the action (LkaActvStats_D2_Req) must be set to zero.
+    unsigned int action = GET_BYTE(to_send, 0) >> 5;
+    if (action != 0U) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for LateralMotionControl action
+  if (addr == FORD_LateralMotionControl) {
+    // Signal: LatCtl_D_Rq
+    bool steer_control_enabled = ((GET_BYTE(to_send, 4) >> 2) & 0x7U) != 0U;
+    unsigned int raw_curvature = (GET_BYTE(to_send, 0) << 3) | (GET_BYTE(to_send, 1) >> 5);
+    unsigned int raw_curvature_rate = ((GET_BYTE(to_send, 1) & 0x1FU) << 8) | GET_BYTE(to_send, 2);
+    unsigned int raw_path_angle = (GET_BYTE(to_send, 3) << 3) | (GET_BYTE(to_send, 4) >> 5);
+    unsigned int raw_path_offset = (GET_BYTE(to_send, 5) << 2) | (GET_BYTE(to_send, 6) >> 6);
+
+    // These signals are not yet tested with the current safety limits
+    bool violation = (raw_curvature_rate != FORD_INACTIVE_CURVATURE_RATE) || (raw_path_angle != FORD_INACTIVE_PATH_ANGLE) || (raw_path_offset != FORD_INACTIVE_PATH_OFFSET);
+
+    // Check angle error and steer_control_enabled
+    int desired_curvature = raw_curvature - FORD_INACTIVE_CURVATURE;  // /FORD_STEERING_LIMITS.angle_deg_to_can to get real curvature
+    violation |= steer_angle_cmd_checks(desired_curvature, steer_control_enabled, FORD_STEERING_LIMITS);
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for LateralMotionControl2 action
+  if (addr == FORD_LateralMotionControl2) {
+    // Signal: LatCtl_D2_Rq
+    bool steer_control_enabled = ((GET_BYTE(to_send, 0) >> 4) & 0x7U) != 0U;
+    unsigned int raw_curvature = (GET_BYTE(to_send, 2) << 3) | (GET_BYTE(to_send, 3) >> 5);
+    unsigned int raw_curvature_rate = (GET_BYTE(to_send, 6) << 3) | (GET_BYTE(to_send, 7) >> 5);
+    unsigned int raw_path_angle = ((GET_BYTE(to_send, 3) & 0x1FU) << 6) | (GET_BYTE(to_send, 4) >> 2);
+    unsigned int raw_path_offset = ((GET_BYTE(to_send, 4) & 0x3U) << 8) | GET_BYTE(to_send, 5);
+
+    // These signals are not yet tested with the current safety limits
+    bool violation = (raw_curvature_rate != FORD_CANFD_INACTIVE_CURVATURE_RATE) || (raw_path_angle != FORD_INACTIVE_PATH_ANGLE) || (raw_path_offset != FORD_INACTIVE_PATH_OFFSET);
+
+    // Check angle error and steer_control_enabled
+    int desired_curvature = raw_curvature - FORD_INACTIVE_CURVATURE;  // /FORD_STEERING_LIMITS.angle_deg_to_can to get real curvature
+    violation |= steer_angle_cmd_checks(desired_curvature, steer_control_enabled, FORD_STEERING_LIMITS);
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // 1 allows the message through
+  return tx;
+}
+
+static int ford_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  switch (bus_num) {
+    case FORD_MAIN_BUS: {
+      // Forward all traffic from bus 0 onward
+      bus_fwd = FORD_CAM_BUS;
+      break;
+    }
+    case FORD_CAM_BUS: {
+      if (ford_lkas_msg_check(addr)) {
+        // Block stock LKAS and UI messages
+        bus_fwd = -1;
+      } else if (ford_longitudinal && (addr == FORD_ACCDATA)) {
+        // Block stock ACC message
+        bus_fwd = -1;
+      } else {
+        // Forward remaining traffic
+        bus_fwd = FORD_MAIN_BUS;
+      }
+      break;
+    }
+    default: {
+      // No other buses should be in use; fallback to do-not-forward
+      bus_fwd = -1;
+      break;
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* ford_init(uint16_t param) {
+  UNUSED(param);
+#ifdef ALLOW_DEBUG
+  ford_longitudinal = GET_FLAG(param, FORD_PARAM_LONGITUDINAL);
+  ford_canfd = GET_FLAG(param, FORD_PARAM_CANFD);
+#endif
+  return &ford_rx_checks;
+}
+
+const safety_hooks ford_hooks = {
+  .init = ford_init,
+  .rx = ford_rx_hook,
+  .tx = ford_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = ford_fwd_hook,
+};

panda/board/safety/safety_gm.h

@@ -0,0 +1,263 @@
+const SteeringLimits GM_STEERING_LIMITS = {
+  .max_steer = 300,
+  .max_rate_up = 10,
+  .max_rate_down = 15,
+  .driver_torque_allowance = 65,
+  .driver_torque_factor = 4,
+  .max_rt_delta = 128,
+  .max_rt_interval = 250000,
+  .type = TorqueDriverLimited,
+};
+
+const LongitudinalLimits GM_ASCM_LONG_LIMITS = {
+  .max_gas = 3072,
+  .min_gas = 1404,
+  .inactive_gas = 1404,
+  .max_brake = 400,
+};
+
+const LongitudinalLimits GM_CAM_LONG_LIMITS = {
+  .max_gas = 3400,
+  .min_gas = 1514,
+  .inactive_gas = 1554,
+  .max_brake = 400,
+};
+
+const LongitudinalLimits *gm_long_limits;
+
+const int GM_STANDSTILL_THRSLD = 10;  // 0.311kph
+
+const CanMsg GM_ASCM_TX_MSGS[] = {{384, 0, 4}, {1033, 0, 7}, {1034, 0, 7}, {715, 0, 8}, {880, 0, 6},  // pt bus
+                                  {161, 1, 7}, {774, 1, 8}, {776, 1, 7}, {784, 1, 2},   // obs bus
+                                  {789, 2, 5},  // ch bus
+                                  {0x104c006c, 3, 3}, {0x10400060, 3, 5}};  // gmlan
+
+const CanMsg GM_CAM_TX_MSGS[] = {{384, 0, 4},  // pt bus
+                                 {481, 2, 7}, {388, 2, 8}};  // camera bus
+
+const CanMsg GM_CAM_LONG_TX_MSGS[] = {{384, 0, 4}, {789, 0, 5}, {715, 0, 8}, {880, 0, 6},  // pt bus
+                                      {388, 2, 8}};  // camera bus
+
+// TODO: do checksum and counter checks. Add correct timestep, 0.1s for now.
+AddrCheckStruct gm_addr_checks[] = {
+  {.msg = {{388, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{842, 0, 5, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{481, 0, 7, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{190, 0, 6, .expected_timestep = 100000U},    // Volt, Silverado, Acadia Denali
+           {190, 0, 7, .expected_timestep = 100000U},    // Bolt EUV
+           {190, 0, 8, .expected_timestep = 100000U}}},  // Escalade
+  {.msg = {{452, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{201, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+};
+#define GM_RX_CHECK_LEN (sizeof(gm_addr_checks) / sizeof(gm_addr_checks[0]))
+addr_checks gm_rx_checks = {gm_addr_checks, GM_RX_CHECK_LEN};
+
+const uint16_t GM_PARAM_HW_CAM = 1;
+const uint16_t GM_PARAM_HW_CAM_LONG = 2;
+
+enum {
+  GM_BTN_UNPRESS = 1,
+  GM_BTN_RESUME = 2,
+  GM_BTN_SET = 3,
+  GM_BTN_CANCEL = 6,
+};
+
+enum {GM_ASCM, GM_CAM} gm_hw = GM_ASCM;
+bool gm_cam_long = false;
+bool gm_pcm_cruise = false;
+
+static int gm_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &gm_rx_checks, NULL, NULL, NULL, NULL);
+
+  if (valid && (GET_BUS(to_push) == 0U)) {
+    int addr = GET_ADDR(to_push);
+
+    if (addr == 388) {
+      int torque_driver_new = ((GET_BYTE(to_push, 6) & 0x7U) << 8) | GET_BYTE(to_push, 7);
+      torque_driver_new = to_signed(torque_driver_new, 11);
+      // update array of samples
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // sample rear wheel speeds
+    if (addr == 842) {
+      int left_rear_speed = (GET_BYTE(to_push, 0) << 8) | GET_BYTE(to_push, 1);
+      int right_rear_speed = (GET_BYTE(to_push, 2) << 8) | GET_BYTE(to_push, 3);
+      vehicle_moving = (left_rear_speed > GM_STANDSTILL_THRSLD) || (right_rear_speed > GM_STANDSTILL_THRSLD);
+    }
+
+    // ACC steering wheel buttons (GM_CAM is tied to the PCM)
+    if ((addr == 481) && !gm_pcm_cruise) {
+      int button = (GET_BYTE(to_push, 5) & 0x70U) >> 4;
+
+      // enter controls on falling edge of set or rising edge of resume (avoids fault)
+      bool set = (button != GM_BTN_SET) && (cruise_button_prev == GM_BTN_SET);
+      bool res = (button == GM_BTN_RESUME) && (cruise_button_prev != GM_BTN_RESUME);
+      if (set || res) {
+        controls_allowed = 1;
+      }
+
+      // exit controls on cancel press
+      if (button == GM_BTN_CANCEL) {
+        controls_allowed = 0;
+      }
+
+      cruise_button_prev = button;
+    }
+
+    // Reference for brake pressed signals:
+    // https://github.com/commaai/openpilot/blob/master/selfdrive/car/gm/carstate.py
+    if ((addr == 190) && (gm_hw == GM_ASCM)) {
+      brake_pressed = GET_BYTE(to_push, 1) >= 8U;
+    }
+
+    if ((addr == 201) && (gm_hw == GM_CAM)) {
+      brake_pressed = GET_BIT(to_push, 40U) != 0U;
+    }
+
+    if (addr == 452) {
+      gas_pressed = GET_BYTE(to_push, 5) != 0U;
+
+      // enter controls on rising edge of ACC, exit controls when ACC off
+      if (gm_pcm_cruise) {
+        bool cruise_engaged = (GET_BYTE(to_push, 1) >> 5) != 0U;
+        pcm_cruise_check(cruise_engaged);
+      }
+    }
+
+    if (addr == 189) {
+      regen_braking = (GET_BYTE(to_push, 0) >> 4) != 0U;
+    }
+
+    bool stock_ecu_detected = (addr == 384);  // ASCMLKASteeringCmd
+
+    // Check ASCMGasRegenCmd only if we're blocking it
+    if (!gm_pcm_cruise && (addr == 715)) {
+      stock_ecu_detected = true;
+    }
+    generic_rx_checks(stock_ecu_detected);
+  }
+  return valid;
+}
+
+// all commands: gas/regen, friction brake and steering
+// if controls_allowed and no pedals pressed
+//     allow all commands up to limit
+// else
+//     block all commands that produce actuation
+
+static int gm_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+
+  if (gm_hw == GM_CAM) {
+    if (gm_cam_long) {
+      tx = msg_allowed(to_send, GM_CAM_LONG_TX_MSGS, sizeof(GM_CAM_LONG_TX_MSGS)/sizeof(GM_CAM_LONG_TX_MSGS[0]));
+    } else {
+      tx = msg_allowed(to_send, GM_CAM_TX_MSGS, sizeof(GM_CAM_TX_MSGS)/sizeof(GM_CAM_TX_MSGS[0]));
+    }
+  } else {
+    tx = msg_allowed(to_send, GM_ASCM_TX_MSGS, sizeof(GM_ASCM_TX_MSGS)/sizeof(GM_ASCM_TX_MSGS[0]));
+  }
+
+  // BRAKE: safety check
+  if (addr == 789) {
+    int brake = ((GET_BYTE(to_send, 0) & 0xFU) << 8) + GET_BYTE(to_send, 1);
+    brake = (0x1000 - brake) & 0xFFF;
+    if (longitudinal_brake_checks(brake, *gm_long_limits)) {
+      tx = 0;
+    }
+  }
+
+  // LKA STEER: safety check
+  if (addr == 384) {
+    int desired_torque = ((GET_BYTE(to_send, 0) & 0x7U) << 8) + GET_BYTE(to_send, 1);
+    desired_torque = to_signed(desired_torque, 11);
+
+    if (steer_torque_cmd_checks(desired_torque, -1, GM_STEERING_LIMITS)) {
+      tx = 0;
+    }
+  }
+
+  // GAS/REGEN: safety check
+  if (addr == 715) {
+    bool apply = GET_BIT(to_send, 0U) != 0U;
+    int gas_regen = ((GET_BYTE(to_send, 2) & 0x7FU) << 5) + ((GET_BYTE(to_send, 3) & 0xF8U) >> 3);
+
+    bool violation = false;
+    // Allow apply bit in pre-enabled and overriding states
+    violation |= !controls_allowed && apply;
+    violation |= longitudinal_gas_checks(gas_regen, *gm_long_limits);
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // BUTTONS: used for resume spamming and cruise cancellation with stock longitudinal
+  if ((addr == 481) && gm_pcm_cruise) {
+    int button = (GET_BYTE(to_send, 5) >> 4) & 0x7U;
+
+    bool allowed_cancel = (button == 6) && cruise_engaged_prev;
+    if (!allowed_cancel) {
+      tx = 0;
+    }
+  }
+
+  // 1 allows the message through
+  return tx;
+}
+
+static int gm_fwd_hook(int bus_num, int addr) {
+
+  int bus_fwd = -1;
+
+  if (gm_hw == GM_CAM) {
+    if (bus_num == 0) {
+      // block PSCMStatus; forwarded through openpilot to hide an alert from the camera
+      bool is_pscm_msg = (addr == 388);
+      if (!is_pscm_msg) {
+        bus_fwd = 2;
+      }
+    }
+
+    if (bus_num == 2) {
+      // block lkas message and acc messages if gm_cam_long, forward all others
+      bool is_lkas_msg = (addr == 384);
+      bool is_acc_msg = (addr == 789) || (addr == 715) || (addr == 880);
+      int block_msg = is_lkas_msg || (is_acc_msg && gm_cam_long);
+      if (!block_msg) {
+        bus_fwd = 0;
+      }
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* gm_init(uint16_t param) {
+  gm_hw = GET_FLAG(param, GM_PARAM_HW_CAM) ? GM_CAM : GM_ASCM;
+
+  if (gm_hw == GM_ASCM) {
+    gm_long_limits = &GM_ASCM_LONG_LIMITS;
+  } else if (gm_hw == GM_CAM) {
+    gm_long_limits = &GM_CAM_LONG_LIMITS;
+  } else {
+  }
+
+#ifdef ALLOW_DEBUG
+  gm_cam_long = GET_FLAG(param, GM_PARAM_HW_CAM_LONG);
+#endif
+  gm_pcm_cruise = (gm_hw == GM_CAM) && !gm_cam_long;
+  return &gm_rx_checks;
+}
+
+const safety_hooks gm_hooks = {
+  .init = gm_init,
+  .rx = gm_rx_hook,
+  .tx = gm_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = gm_fwd_hook,
+};

panda/board/safety/safety_honda.h

@@ -0,0 +1,471 @@
+// board enforces
+//   in-state
+//      accel set/resume
+//   out-state
+//      cancel button
+//      accel rising edge
+//      brake rising edge
+//      brake > 0mph
+const CanMsg HONDA_N_TX_MSGS[] = {{0xE4, 0, 5}, {0x194, 0, 4}, {0x1FA, 0, 8}, {0x200, 0, 6}, {0x30C, 0, 8}, {0x33D, 0, 5}};
+const CanMsg HONDA_BOSCH_TX_MSGS[] = {{0xE4, 0, 5}, {0xE5, 0, 8}, {0x296, 1, 4}, {0x33D, 0, 5}, {0x33DA, 0, 5}, {0x33DB, 0, 8}};  // Bosch
+const CanMsg HONDA_BOSCH_LONG_TX_MSGS[] = {{0xE4, 1, 5}, {0x1DF, 1, 8}, {0x1EF, 1, 8}, {0x1FA, 1, 8}, {0x30C, 1, 8}, {0x33D, 1, 5}, {0x33DA, 1, 5}, {0x33DB, 1, 8}, {0x39F, 1, 8}, {0x18DAB0F1, 1, 8}};  // Bosch w/ gas and brakes
+const CanMsg HONDA_RADARLESS_TX_MSGS[] = {{0xE4, 0, 5}, {0x296, 2, 4}, {0x33D, 0, 8}};  // Bosch radarless
+const CanMsg HONDA_RADARLESS_LONG_TX_MSGS[] = {{0xE4, 0, 5}, {0x33D, 0, 8}, {0x1C8, 0, 8}, {0x30C, 0, 8}};  // Bosch radarless w/ gas and brakes
+
+// panda interceptor threshold needs to be equivalent to openpilot threshold to avoid controls mismatches
+// If thresholds are mismatched then it is possible for panda to see the gas fall and rise while openpilot is in the pre-enabled state
+// Threshold calculated from DBC gains: round(((83.3 / 0.253984064) + (83.3 / 0.126992032)) / 2) = 492
+const int HONDA_GAS_INTERCEPTOR_THRESHOLD = 492;
+#define HONDA_GET_INTERCEPTOR(msg) (((GET_BYTE((msg), 0) << 8) + GET_BYTE((msg), 1) + (GET_BYTE((msg), 2) << 8) + GET_BYTE((msg), 3)) / 2U)  // avg between 2 tracks
+
+const LongitudinalLimits HONDA_BOSCH_LONG_LIMITS = {
+  .max_accel = 200,   // accel is used for brakes
+  .min_accel = -350,
+
+  .max_gas = 2000,
+  .inactive_gas = -30000,
+};
+
+const LongitudinalLimits HONDA_NIDEC_LONG_LIMITS = {
+  .max_gas = 198,  // 0xc6
+  .max_brake = 255,
+
+  .inactive_speed = 0,
+};
+
+// Nidec and bosch radarless has the powertrain bus on bus 0
+AddrCheckStruct honda_common_addr_checks[] = {
+  {.msg = {{0x1A6, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U},                   // SCM_BUTTONS
+           {0x296, 0, 4, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U}, { 0 }}},
+  {.msg = {{0x158, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U}, { 0 }, { 0 }}},   // ENGINE_DATA
+  {.msg = {{0x17C, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},                   // POWERTRAIN_DATA
+           {0x1BE, 0, 3, .check_checksum = true, .max_counter = 3U, .expected_timestep = 20000U}, { 0 }}},          // BRAKE_MODULE (for bosch radarless)
+  {.msg = {{0x326, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 100000U}, { 0 }, { 0 }}},  // SCM_FEEDBACK
+};
+#define HONDA_COMMON_ADDR_CHECKS_LEN (sizeof(honda_common_addr_checks) / sizeof(honda_common_addr_checks[0]))
+
+// For Nidecs with main on signal on an alternate msg
+AddrCheckStruct honda_nidec_alt_addr_checks[] = {
+  {.msg = {{0x1A6, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U},
+           {0x296, 0, 4, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U}, { 0 }}},
+  {.msg = {{0x158, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{0x17C, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+};
+#define HONDA_NIDEC_ALT_ADDR_CHECKS_LEN (sizeof(honda_nidec_alt_addr_checks) / sizeof(honda_nidec_alt_addr_checks[0]))
+
+// Bosch has pt on bus 1
+AddrCheckStruct honda_bosch_addr_checks[] = {
+  {.msg = {{0x296, 1, 4, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U}, { 0 }, { 0 }}},
+  {.msg = {{0x158, 1, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{0x17C, 1, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+           {0x1BE, 1, 3, .check_checksum = true, .max_counter = 3U, .expected_timestep = 20000U}, { 0 }}},
+  {.msg = {{0x326, 1, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+};
+#define HONDA_BOSCH_ADDR_CHECKS_LEN (sizeof(honda_bosch_addr_checks) / sizeof(honda_bosch_addr_checks[0]))
+
+const uint16_t HONDA_PARAM_ALT_BRAKE = 1;
+const uint16_t HONDA_PARAM_BOSCH_LONG = 2;
+const uint16_t HONDA_PARAM_NIDEC_ALT = 4;
+const uint16_t HONDA_PARAM_RADARLESS = 8;
+
+enum {
+  HONDA_BTN_NONE = 0,
+  HONDA_BTN_MAIN = 1,
+  HONDA_BTN_CANCEL = 2,
+  HONDA_BTN_SET = 3,
+  HONDA_BTN_RESUME = 4,
+};
+
+int honda_brake = 0;
+bool honda_brake_switch_prev = false;
+bool honda_alt_brake_msg = false;
+bool honda_fwd_brake = false;
+bool honda_bosch_long = false;
+bool honda_bosch_radarless = false;
+enum {HONDA_NIDEC, HONDA_BOSCH} honda_hw = HONDA_NIDEC;
+addr_checks honda_rx_checks = {honda_common_addr_checks, HONDA_COMMON_ADDR_CHECKS_LEN};
+
+
+int honda_get_pt_bus(void) {
+  return ((honda_hw == HONDA_BOSCH) && !honda_bosch_radarless) ? 1 : 0;
+}
+
+static uint32_t honda_get_checksum(CANPacket_t *to_push) {
+  int checksum_byte = GET_LEN(to_push) - 1U;
+  return (uint8_t)(GET_BYTE(to_push, checksum_byte)) & 0xFU;
+}
+
+static uint32_t honda_compute_checksum(CANPacket_t *to_push) {
+  int len = GET_LEN(to_push);
+  uint8_t checksum = 0U;
+  unsigned int addr = GET_ADDR(to_push);
+  while (addr > 0U) {
+    checksum += (addr & 0xFU); addr >>= 4;
+  }
+  for (int j = 0; j < len; j++) {
+    uint8_t byte = GET_BYTE(to_push, j);
+    checksum += (byte & 0xFU) + (byte >> 4U);
+    if (j == (len - 1)) {
+      checksum -= (byte & 0xFU);  // remove checksum in message
+    }
+  }
+  return (uint8_t)((8U - checksum) & 0xFU);
+}
+
+static uint8_t honda_get_counter(CANPacket_t *to_push) {
+  int counter_byte = GET_LEN(to_push) - 1U;
+  return ((uint8_t)(GET_BYTE(to_push, counter_byte)) >> 4U) & 0x3U;
+}
+
+static int honda_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &honda_rx_checks,
+                                 honda_get_checksum, honda_compute_checksum, honda_get_counter, NULL);
+
+  if (valid) {
+    const bool pcm_cruise = ((honda_hw == HONDA_BOSCH) && !honda_bosch_long) || \
+                            ((honda_hw == HONDA_NIDEC) && !gas_interceptor_detected);
+    int pt_bus = honda_get_pt_bus();
+
+    int addr = GET_ADDR(to_push);
+    int len = GET_LEN(to_push);
+    int bus = GET_BUS(to_push);
+
+    // sample speed
+    if (addr == 0x158) {
+      // first 2 bytes
+      vehicle_moving = GET_BYTE(to_push, 0) | GET_BYTE(to_push, 1);
+    }
+
+    // check ACC main state
+    // 0x326 for all Bosch and some Nidec, 0x1A6 for some Nidec
+    if ((addr == 0x326) || (addr == 0x1A6)) {
+      acc_main_on = GET_BIT(to_push, ((addr == 0x326) ? 28U : 47U));
+      if (!acc_main_on) {
+        controls_allowed = 0;
+      }
+    }
+
+    // enter controls when PCM enters cruise state
+    if (pcm_cruise && (addr == 0x17C)) {
+      const bool cruise_engaged = GET_BIT(to_push, 38U) != 0U;
+      // engage on rising edge
+      if (cruise_engaged && !cruise_engaged_prev) {
+        controls_allowed = 1;
+      }
+
+      // Since some Nidec cars can brake down to 0 after the PCM disengages,
+      // we don't disengage when the PCM does.
+      if (!cruise_engaged && (honda_hw != HONDA_NIDEC)) {
+        controls_allowed = 0;
+      }
+      cruise_engaged_prev = cruise_engaged;
+    }
+
+    // state machine to enter and exit controls for button enabling
+    // 0x1A6 for the ILX, 0x296 for the Civic Touring
+    if (((addr == 0x1A6) || (addr == 0x296)) && (bus == pt_bus)) {
+      int button = (GET_BYTE(to_push, 0) & 0xE0U) >> 5;
+
+      // exit controls once main or cancel are pressed
+      if ((button == HONDA_BTN_MAIN) || (button == HONDA_BTN_CANCEL)) {
+        controls_allowed = 0;
+      }
+
+      // enter controls on the falling edge of set or resume
+      bool set = (button == HONDA_BTN_NONE) && (cruise_button_prev == HONDA_BTN_SET);
+      bool res = (button == HONDA_BTN_NONE) && (cruise_button_prev == HONDA_BTN_RESUME);
+      if (acc_main_on && !pcm_cruise && (set || res)) {
+        controls_allowed = 1;
+      }
+      cruise_button_prev = button;
+    }
+
+    // user brake signal on 0x17C reports applied brake from computer brake on accord
+    // and crv, which prevents the usual brake safety from working correctly. these
+    // cars have a signal on 0x1BE which only detects user's brake being applied so
+    // in these cases, this is used instead.
+    // most hondas: 0x17C
+    // accord, crv: 0x1BE
+    if (honda_alt_brake_msg) {
+      if (addr == 0x1BE) {
+        brake_pressed = GET_BIT(to_push, 4U) != 0U;
+      }
+    } else {
+      if (addr == 0x17C) {
+        // also if brake switch is 1 for two CAN frames, as brake pressed is delayed
+        const bool brake_switch = GET_BIT(to_push, 32U) != 0U;
+        brake_pressed = (GET_BIT(to_push, 53U) != 0U) || (brake_switch && honda_brake_switch_prev);
+        honda_brake_switch_prev = brake_switch;
+      }
+    }
+
+    // length check because bosch hardware also uses this id (0x201 w/ len = 8)
+    if ((addr == 0x201) && (len == 6)) {
+      gas_interceptor_detected = 1;
+      int gas_interceptor = HONDA_GET_INTERCEPTOR(to_push);
+      gas_pressed = gas_interceptor > HONDA_GAS_INTERCEPTOR_THRESHOLD;
+      gas_interceptor_prev = gas_interceptor;
+    }
+
+    if (!gas_interceptor_detected) {
+      if (addr == 0x17C) {
+        gas_pressed = GET_BYTE(to_push, 0) != 0U;
+      }
+    }
+
+    // disable stock Honda AEB in alternative experience
+    if (!(alternative_experience & ALT_EXP_DISABLE_STOCK_AEB)) {
+      if ((bus == 2) && (addr == 0x1FA)) {
+        bool honda_stock_aeb = GET_BYTE(to_push, 3) & 0x20U;
+        int honda_stock_brake = (GET_BYTE(to_push, 0) << 2) + ((GET_BYTE(to_push, 1) >> 6) & 0x3U);
+
+        // Forward AEB when stock braking is higher than openpilot braking
+        // only stop forwarding when AEB event is over
+        if (!honda_stock_aeb) {
+          honda_fwd_brake = false;
+        } else if (honda_stock_brake >= honda_brake) {
+          honda_fwd_brake = true;
+        } else {
+          // Leave Honda forward brake as is
+        }
+      }
+    }
+
+    int bus_rdr_car = (honda_hw == HONDA_BOSCH) ? 0 : 2;  // radar bus, car side
+    bool stock_ecu_detected = false;
+
+    if (safety_mode_cnt > RELAY_TRNS_TIMEOUT) {
+      // If steering controls messages are received on the destination bus, it's an indication
+      // that the relay might be malfunctioning
+      if ((addr == 0xE4) || (addr == 0x194)) {
+        if (((honda_hw != HONDA_NIDEC) && (bus == bus_rdr_car)) || ((honda_hw == HONDA_NIDEC) && (bus == 0))) {
+          stock_ecu_detected = true;
+        }
+      }
+      // If Honda Bosch longitudinal mode is selected we need to ensure the radar is turned off
+      // Verify this by ensuring ACC_CONTROL (0x1DF) is not received on the PT bus
+      if (honda_bosch_long && !honda_bosch_radarless && (bus == pt_bus) && (addr == 0x1DF)) {
+        stock_ecu_detected = true;
+      }
+    }
+
+    generic_rx_checks(stock_ecu_detected);
+  }
+  return valid;
+}
+
+// all commands: gas, brake and steering
+// if controls_allowed and no pedals pressed
+//     allow all commands up to limit
+// else
+//     block all commands that produce actuation
+
+static int honda_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  int bus = GET_BUS(to_send);
+
+  if ((honda_hw == HONDA_BOSCH) && honda_bosch_radarless && !honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_RADARLESS_TX_MSGS, sizeof(HONDA_RADARLESS_TX_MSGS)/sizeof(HONDA_RADARLESS_TX_MSGS[0]));
+  } else if ((honda_hw == HONDA_BOSCH) && honda_bosch_radarless && honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_RADARLESS_LONG_TX_MSGS, sizeof(HONDA_RADARLESS_LONG_TX_MSGS)/sizeof(HONDA_RADARLESS_LONG_TX_MSGS[0]));
+  } else if ((honda_hw == HONDA_BOSCH) && !honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_BOSCH_TX_MSGS, sizeof(HONDA_BOSCH_TX_MSGS)/sizeof(HONDA_BOSCH_TX_MSGS[0]));
+  } else if ((honda_hw == HONDA_BOSCH) && honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_BOSCH_LONG_TX_MSGS, sizeof(HONDA_BOSCH_LONG_TX_MSGS)/sizeof(HONDA_BOSCH_LONG_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, HONDA_N_TX_MSGS, sizeof(HONDA_N_TX_MSGS)/sizeof(HONDA_N_TX_MSGS[0]));
+  }
+
+  int bus_pt = honda_get_pt_bus();
+  int bus_buttons = (honda_bosch_radarless) ? 2 : bus_pt;  // the camera controls ACC on radarless Bosch cars
+
+  // ACC_HUD: safety check (nidec w/o pedal)
+  if ((addr == 0x30C) && (bus == bus_pt)) {
+    int pcm_speed = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
+    int pcm_gas = GET_BYTE(to_send, 2);
+
+    bool violation = false;
+    violation |= longitudinal_speed_checks(pcm_speed, HONDA_NIDEC_LONG_LIMITS);
+    violation |= longitudinal_gas_checks(pcm_gas, HONDA_NIDEC_LONG_LIMITS);
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // BRAKE: safety check (nidec)
+  if ((addr == 0x1FA) && (bus == bus_pt)) {
+    honda_brake = (GET_BYTE(to_send, 0) << 2) + ((GET_BYTE(to_send, 1) >> 6) & 0x3U);
+    if (longitudinal_brake_checks(honda_brake, HONDA_NIDEC_LONG_LIMITS)) {
+      tx = 0;
+    }
+    if (honda_fwd_brake) {
+      tx = 0;
+    }
+  }
+
+  // BRAKE/GAS: safety check (bosch)
+  if ((addr == 0x1DF) && (bus == bus_pt)) {
+    int accel = (GET_BYTE(to_send, 3) << 3) | ((GET_BYTE(to_send, 4) >> 5) & 0x7U);
+    accel = to_signed(accel, 11);
+
+    int gas = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
+    gas = to_signed(gas, 16);
+
+    bool violation = false;
+    violation |= longitudinal_accel_checks(accel, HONDA_BOSCH_LONG_LIMITS);
+    violation |= longitudinal_gas_checks(gas, HONDA_BOSCH_LONG_LIMITS);
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // ACCEL: safety check (radarless)
+  if ((addr == 0x1C8) && (bus == bus_pt)) {
+    int accel = (GET_BYTE(to_send, 0) << 4) | (GET_BYTE(to_send, 1) >> 4);
+    accel = to_signed(accel, 12);
+
+    bool violation = false;
+    violation |= longitudinal_accel_checks(accel, HONDA_BOSCH_LONG_LIMITS);
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // STEER: safety check
+  if ((addr == 0xE4) || (addr == 0x194)) {
+    if (!controls_allowed) {
+      bool steer_applied = GET_BYTE(to_send, 0) | GET_BYTE(to_send, 1);
+      if (steer_applied) {
+        tx = 0;
+      }
+    }
+  }
+
+  // Bosch supplemental control check
+  if (addr == 0xE5) {
+    if ((GET_BYTES(to_send, 0, 4) != 0x10800004U) || ((GET_BYTES(to_send, 4, 4) & 0x00FFFFFFU) != 0x0U)) {
+      tx = 0;
+    }
+  }
+
+  // GAS: safety check (interceptor)
+  if (addr == 0x200) {
+    if (longitudinal_interceptor_checks(to_send)) {
+      tx = 0;
+    }
+  }
+
+  // FORCE CANCEL: safety check only relevant when spamming the cancel button in Bosch HW
+  // ensuring that only the cancel button press is sent (VAL 2) when controls are off.
+  // This avoids unintended engagements while still allowing resume spam
+  if ((addr == 0x296) && !controls_allowed && (bus == bus_buttons)) {
+    if (((GET_BYTE(to_send, 0) >> 5) & 0x7U) != 2U) {
+      tx = 0;
+    }
+  }
+
+  // Only tester present ("\x02\x3E\x80\x00\x00\x00\x00\x00") allowed on diagnostics address
+  if (addr == 0x18DAB0F1) {
+    if ((GET_BYTES(to_send, 0, 4) != 0x00803E02U) || (GET_BYTES(to_send, 4, 4) != 0x0U)) {
+      tx = 0;
+    }
+  }
+
+  // 1 allows the message through
+  return tx;
+}
+
+static const addr_checks* honda_nidec_init(uint16_t param) {
+  gas_interceptor_detected = 0;
+  honda_hw = HONDA_NIDEC;
+  honda_alt_brake_msg = false;
+  honda_bosch_long = false;
+  honda_bosch_radarless = false;
+
+  if (GET_FLAG(param, HONDA_PARAM_NIDEC_ALT)) {
+    honda_rx_checks = (addr_checks){honda_nidec_alt_addr_checks, HONDA_NIDEC_ALT_ADDR_CHECKS_LEN};
+  } else {
+    honda_rx_checks = (addr_checks){honda_common_addr_checks, HONDA_COMMON_ADDR_CHECKS_LEN};
+  }
+  return &honda_rx_checks;
+}
+
+static const addr_checks* honda_bosch_init(uint16_t param) {
+  honda_hw = HONDA_BOSCH;
+  honda_bosch_radarless = GET_FLAG(param, HONDA_PARAM_RADARLESS);
+  // Checking for alternate brake override from safety parameter
+  honda_alt_brake_msg = GET_FLAG(param, HONDA_PARAM_ALT_BRAKE);
+
+  // radar disabled so allow gas/brakes
+#ifdef ALLOW_DEBUG
+  honda_bosch_long = GET_FLAG(param, HONDA_PARAM_BOSCH_LONG);
+#endif
+
+  if (honda_bosch_radarless) {
+    honda_rx_checks = (addr_checks){honda_common_addr_checks, HONDA_COMMON_ADDR_CHECKS_LEN};
+  } else {
+    honda_rx_checks = (addr_checks){honda_bosch_addr_checks, HONDA_BOSCH_ADDR_CHECKS_LEN};
+  }
+  return &honda_rx_checks;
+}
+
+static int honda_nidec_fwd_hook(int bus_num, int addr) {
+  // fwd from car to camera. also fwd certain msgs from camera to car
+  // 0xE4 is steering on all cars except CRV and RDX, 0x194 for CRV and RDX,
+  // 0x1FA is brake control, 0x30C is acc hud, 0x33D is lkas hud
+  int bus_fwd = -1;
+
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+
+  if (bus_num == 2) {
+    // block stock lkas messages and stock acc messages (if OP is doing ACC)
+    bool is_lkas_msg = (addr == 0xE4) || (addr == 0x194) || (addr == 0x33D);
+    bool is_acc_hud_msg = addr == 0x30C;
+    bool is_brake_msg = addr == 0x1FA;
+    bool block_fwd = is_lkas_msg || is_acc_hud_msg || (is_brake_msg && !honda_fwd_brake);
+    if (!block_fwd) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+static int honda_bosch_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+  if (bus_num == 2)  {
+    int is_lkas_msg = (addr == 0xE4) || (addr == 0xE5) || (addr == 0x33D) || (addr == 0x33DA) || (addr == 0x33DB);
+    int is_acc_msg = ((addr == 0x1C8) || (addr == 0x30C)) && honda_bosch_radarless && honda_bosch_long;
+    bool block_msg = is_lkas_msg || is_acc_msg;
+    if (!block_msg) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+const safety_hooks honda_nidec_hooks = {
+  .init = honda_nidec_init,
+  .rx = honda_rx_hook,
+  .tx = honda_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = honda_nidec_fwd_hook,
+};
+
+const safety_hooks honda_bosch_hooks = {
+  .init = honda_bosch_init,
+  .rx = honda_rx_hook,
+  .tx = honda_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = honda_bosch_fwd_hook,
+};

panda/board/safety/safety_hyundai.h

@@ -0,0 +1,365 @@
+#include "safety_hyundai_common.h"
+
+#define HYUNDAI_LIMITS(steer, rate_up, rate_down) { \
+  .max_steer = (steer), \
+  .max_rate_up = (rate_up), \
+  .max_rate_down = (rate_down), \
+  .max_rt_delta = 112, \
+  .max_rt_interval = 250000, \
+  .driver_torque_allowance = 50, \
+  .driver_torque_factor = 2, \
+  .type = TorqueDriverLimited, \
+   /* the EPS faults when the steering angle is above a certain threshold for too long. to prevent this, */ \
+   /* we allow setting CF_Lkas_ActToi bit to 0 while maintaining the requested torque value for two consecutive frames */ \
+  .min_valid_request_frames = 89, \
+  .max_invalid_request_frames = 2, \
+  .min_valid_request_rt_interval = 810000,  /* 810ms; a ~10% buffer on cutting every 90 frames */ \
+  .has_steer_req_tolerance = true, \
+}
+
+const SteeringLimits HYUNDAI_STEERING_LIMITS = HYUNDAI_LIMITS(384, 3, 7);
+const SteeringLimits HYUNDAI_STEERING_LIMITS_ALT = HYUNDAI_LIMITS(270, 2, 3);
+
+const LongitudinalLimits HYUNDAI_LONG_LIMITS = {
+  .max_accel = 200,   // 1/100 m/s2
+  .min_accel = -350,  // 1/100 m/s2
+};
+
+const CanMsg HYUNDAI_TX_MSGS[] = {
+  {832, 0, 8},  // LKAS11 Bus 0
+  {1265, 0, 4}, // CLU11 Bus 0
+  {1157, 0, 4}, // LFAHDA_MFC Bus 0
+};
+
+const CanMsg HYUNDAI_LONG_TX_MSGS[] = {
+  {832, 0, 8},  // LKAS11 Bus 0
+  {1265, 0, 4}, // CLU11 Bus 0
+  {1157, 0, 4}, // LFAHDA_MFC Bus 0
+  {1056, 0, 8}, // SCC11 Bus 0
+  {1057, 0, 8}, // SCC12 Bus 0
+  {1290, 0, 8}, // SCC13 Bus 0
+  {905, 0, 8},  // SCC14 Bus 0
+  {1186, 0, 2}, // FRT_RADAR11 Bus 0
+  {909, 0, 8},  // FCA11 Bus 0
+  {1155, 0, 8}, // FCA12 Bus 0
+  {2000, 0, 8}, // radar UDS TX addr Bus 0 (for radar disable)
+};
+
+const CanMsg HYUNDAI_CAMERA_SCC_TX_MSGS[] = {
+  {832, 0, 8},  // LKAS11 Bus 0
+  {1265, 2, 4}, // CLU11 Bus 2
+  {1157, 0, 4}, // LFAHDA_MFC Bus 0
+};
+
+AddrCheckStruct hyundai_addr_checks[] = {
+  {.msg = {{608, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+           {881, 0, 8, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{902, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{916, 0, 8, .check_checksum = true, .max_counter = 7U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{1057, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define HYUNDAI_ADDR_CHECK_LEN (sizeof(hyundai_addr_checks) / sizeof(hyundai_addr_checks[0]))
+
+AddrCheckStruct hyundai_cam_scc_addr_checks[] = {
+  {.msg = {{608, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+           {881, 0, 8, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{902, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{916, 0, 8, .check_checksum = true, .max_counter = 7U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{1057, 2, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define HYUNDAI_CAM_SCC_ADDR_CHECK_LEN (sizeof(hyundai_cam_scc_addr_checks) / sizeof(hyundai_cam_scc_addr_checks[0]))
+
+AddrCheckStruct hyundai_long_addr_checks[] = {
+  {.msg = {{608, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+           {881, 0, 8, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{902, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{916, 0, 8, .check_checksum = true, .max_counter = 7U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{1265, 0, 4, .check_checksum = false, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define HYUNDAI_LONG_ADDR_CHECK_LEN (sizeof(hyundai_long_addr_checks) / sizeof(hyundai_long_addr_checks[0]))
+
+// older hyundai models have less checks due to missing counters and checksums
+AddrCheckStruct hyundai_legacy_addr_checks[] = {
+  {.msg = {{608, 0, 8, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+           {881, 0, 8, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{902, 0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{916, 0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{1057, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define HYUNDAI_LEGACY_ADDR_CHECK_LEN (sizeof(hyundai_legacy_addr_checks) / sizeof(hyundai_legacy_addr_checks[0]))
+
+bool hyundai_legacy = false;
+
+addr_checks hyundai_rx_checks = {hyundai_addr_checks, HYUNDAI_ADDR_CHECK_LEN};
+
+static uint8_t hyundai_get_counter(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t cnt;
+  if (addr == 608) {
+    cnt = (GET_BYTE(to_push, 7) >> 4) & 0x3U;
+  } else if (addr == 902) {
+    cnt = ((GET_BYTE(to_push, 3) >> 6) << 2) | (GET_BYTE(to_push, 1) >> 6);
+  } else if (addr == 916) {
+    cnt = (GET_BYTE(to_push, 1) >> 5) & 0x7U;
+  } else if (addr == 1057) {
+    cnt = GET_BYTE(to_push, 7) & 0xFU;
+  } else if (addr == 1265) {
+    cnt = (GET_BYTE(to_push, 3) >> 4) & 0xFU;
+  } else {
+    cnt = 0;
+  }
+  return cnt;
+}
+
+static uint32_t hyundai_get_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t chksum;
+  if (addr == 608) {
+    chksum = GET_BYTE(to_push, 7) & 0xFU;
+  } else if (addr == 902) {
+    chksum = ((GET_BYTE(to_push, 7) >> 6) << 2) | (GET_BYTE(to_push, 5) >> 6);
+  } else if (addr == 916) {
+    chksum = GET_BYTE(to_push, 6) & 0xFU;
+  } else if (addr == 1057) {
+    chksum = GET_BYTE(to_push, 7) >> 4;
+  } else {
+    chksum = 0;
+  }
+  return chksum;
+}
+
+static uint32_t hyundai_compute_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  uint8_t chksum = 0;
+  if (addr == 902) {
+    // count the bits
+    for (int i = 0; i < 8; i++) {
+      uint8_t b = GET_BYTE(to_push, i);
+      for (int j = 0; j < 8; j++) {
+        uint8_t bit = 0;
+        // exclude checksum and counter
+        if (((i != 1) || (j < 6)) && ((i != 3) || (j < 6)) && ((i != 5) || (j < 6)) && ((i != 7) || (j < 6))) {
+          bit = (b >> (uint8_t)j) & 1U;
+        }
+        chksum += bit;
+      }
+    }
+    chksum = (chksum ^ 9U) & 15U;
+  } else {
+    // sum of nibbles
+    for (int i = 0; i < 8; i++) {
+      if ((addr == 916) && (i == 7)) {
+        continue; // exclude
+      }
+      uint8_t b = GET_BYTE(to_push, i);
+      if (((addr == 608) && (i == 7)) || ((addr == 916) && (i == 6)) || ((addr == 1057) && (i == 7))) {
+        b &= (addr == 1057) ? 0x0FU : 0xF0U; // remove checksum
+      }
+      chksum += (b % 16U) + (b / 16U);
+    }
+    chksum = (16U - (chksum %  16U)) % 16U;
+  }
+
+  return chksum;
+}
+
+static int hyundai_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &hyundai_rx_checks,
+                                 hyundai_get_checksum, hyundai_compute_checksum,
+                                 hyundai_get_counter, NULL);
+
+  int bus = GET_BUS(to_push);
+  int addr = GET_ADDR(to_push);
+
+  // SCC12 is on bus 2 for camera-based SCC cars, bus 0 on all others
+  if (valid && (addr == 1057) && (((bus == 0) && !hyundai_camera_scc) || ((bus == 2) && hyundai_camera_scc))) {
+    // 2 bits: 13-14
+    int cruise_engaged = (GET_BYTES(to_push, 0, 4) >> 13) & 0x3U;
+    hyundai_common_cruise_state_check(cruise_engaged);
+  }
+
+  if (valid && (bus == 0)) {
+    if (addr == 593) {
+      int torque_driver_new = ((GET_BYTES(to_push, 0, 4) & 0x7ffU) * 0.79) - 808; // scale down new driver torque signal to match previous one
+      // update array of samples
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // ACC steering wheel buttons
+    if (addr == 1265) {
+      int cruise_button = GET_BYTE(to_push, 0) & 0x7U;
+      int main_button = GET_BIT(to_push, 3U);
+      hyundai_common_cruise_buttons_check(cruise_button, main_button);
+    }
+
+    // gas press, different for EV, hybrid, and ICE models
+    if ((addr == 881) && hyundai_ev_gas_signal) {
+      gas_pressed = (((GET_BYTE(to_push, 4) & 0x7FU) << 1) | GET_BYTE(to_push, 3) >> 7) != 0U;
+    } else if ((addr == 881) && hyundai_hybrid_gas_signal) {
+      gas_pressed = GET_BYTE(to_push, 7) != 0U;
+    } else if ((addr == 608) && !hyundai_ev_gas_signal && !hyundai_hybrid_gas_signal) {
+      gas_pressed = (GET_BYTE(to_push, 7) >> 6) != 0U;
+    } else {
+    }
+
+    // sample wheel speed, averaging opposite corners
+    if (addr == 902) {
+      uint32_t hyundai_speed = (GET_BYTES(to_push, 0, 4) & 0x3FFFU) + ((GET_BYTES(to_push, 4, 4) >> 16) & 0x3FFFU);  // FL + RR
+      hyundai_speed /= 2;
+      vehicle_moving = hyundai_speed > HYUNDAI_STANDSTILL_THRSLD;
+    }
+
+    if (addr == 916) {
+      brake_pressed = GET_BIT(to_push, 55U) != 0U;
+    }
+
+    bool stock_ecu_detected = (addr == 832);
+
+    // If openpilot is controlling longitudinal we need to ensure the radar is turned off
+    // Enforce by checking we don't see SCC12
+    if (hyundai_longitudinal && (addr == 1057)) {
+      stock_ecu_detected = true;
+    }
+    generic_rx_checks(stock_ecu_detected);
+  }
+  return valid;
+}
+
+static int hyundai_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+
+  if (hyundai_longitudinal) {
+    tx = msg_allowed(to_send, HYUNDAI_LONG_TX_MSGS, sizeof(HYUNDAI_LONG_TX_MSGS)/sizeof(HYUNDAI_LONG_TX_MSGS[0]));
+  } else if (hyundai_camera_scc) {
+    tx = msg_allowed(to_send, HYUNDAI_CAMERA_SCC_TX_MSGS, sizeof(HYUNDAI_CAMERA_SCC_TX_MSGS)/sizeof(HYUNDAI_CAMERA_SCC_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, HYUNDAI_TX_MSGS, sizeof(HYUNDAI_TX_MSGS)/sizeof(HYUNDAI_TX_MSGS[0]));
+  }
+
+  // FCA11: Block any potential actuation
+  if (addr == 909) {
+    int CR_VSM_DecCmd = GET_BYTE(to_send, 1);
+    int FCA_CmdAct = GET_BIT(to_send, 20U);
+    int CF_VSM_DecCmdAct = GET_BIT(to_send, 31U);
+
+    if ((CR_VSM_DecCmd != 0) || (FCA_CmdAct != 0) || (CF_VSM_DecCmdAct != 0)) {
+      tx = 0;
+    }
+  }
+
+  // ACCEL: safety check
+  if (addr == 1057) {
+    int desired_accel_raw = (((GET_BYTE(to_send, 4) & 0x7U) << 8) | GET_BYTE(to_send, 3)) - 1023U;
+    int desired_accel_val = ((GET_BYTE(to_send, 5) << 3) | (GET_BYTE(to_send, 4) >> 5)) - 1023U;
+
+    int aeb_decel_cmd = GET_BYTE(to_send, 2);
+    int aeb_req = GET_BIT(to_send, 54U);
+
+    bool violation = false;
+
+    violation |= longitudinal_accel_checks(desired_accel_raw, HYUNDAI_LONG_LIMITS);
+    violation |= longitudinal_accel_checks(desired_accel_val, HYUNDAI_LONG_LIMITS);
+    violation |= (aeb_decel_cmd != 0);
+    violation |= (aeb_req != 0);
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // LKA STEER: safety check
+  if (addr == 832) {
+    int desired_torque = ((GET_BYTES(to_send, 0, 4) >> 16) & 0x7ffU) - 1024U;
+    bool steer_req = GET_BIT(to_send, 27U) != 0U;
+
+    const SteeringLimits limits = hyundai_alt_limits ? HYUNDAI_STEERING_LIMITS_ALT : HYUNDAI_STEERING_LIMITS;
+    if (steer_torque_cmd_checks(desired_torque, steer_req, limits)) {
+      tx = 0;
+    }
+  }
+
+  // UDS: Only tester present ("\x02\x3E\x80\x00\x00\x00\x00\x00") allowed on diagnostics address
+  if (addr == 2000) {
+    if ((GET_BYTES(to_send, 0, 4) != 0x00803E02U) || (GET_BYTES(to_send, 4, 4) != 0x0U)) {
+      tx = 0;
+    }
+  }
+
+  // BUTTONS: used for resume spamming and cruise cancellation
+  if ((addr == 1265) && !hyundai_longitudinal) {
+    int button = GET_BYTE(to_send, 0) & 0x7U;
+
+    bool allowed_resume = (button == 1) && controls_allowed;
+    bool allowed_cancel = (button == 4) && cruise_engaged_prev;
+    if (!(allowed_resume || allowed_cancel)) {
+      tx = 0;
+    }
+  }
+
+  return tx;
+}
+
+static int hyundai_fwd_hook(int bus_num, int addr) {
+
+  int bus_fwd = -1;
+
+  // forward cam to ccan and viceversa, except lkas cmd
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+  if ((bus_num == 2) && (addr != 832) && (addr != 1157)) {
+    bus_fwd = 0;
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* hyundai_init(uint16_t param) {
+  hyundai_common_init(param);
+  hyundai_legacy = false;
+
+  if (hyundai_camera_scc) {
+    hyundai_longitudinal = false;
+  }
+
+  if (hyundai_longitudinal) {
+    hyundai_rx_checks = (addr_checks){hyundai_long_addr_checks, HYUNDAI_LONG_ADDR_CHECK_LEN};
+  } else if (hyundai_camera_scc) {
+    hyundai_rx_checks = (addr_checks){hyundai_cam_scc_addr_checks, HYUNDAI_CAM_SCC_ADDR_CHECK_LEN};
+  } else {
+    hyundai_rx_checks = (addr_checks){hyundai_addr_checks, HYUNDAI_ADDR_CHECK_LEN};
+  }
+  return &hyundai_rx_checks;
+}
+
+static const addr_checks* hyundai_legacy_init(uint16_t param) {
+  hyundai_common_init(param);
+  hyundai_legacy = true;
+  hyundai_longitudinal = false;
+  hyundai_camera_scc = false;
+
+  hyundai_rx_checks = (addr_checks){hyundai_legacy_addr_checks, HYUNDAI_LEGACY_ADDR_CHECK_LEN};
+  return &hyundai_rx_checks;
+}
+
+const safety_hooks hyundai_hooks = {
+  .init = hyundai_init,
+  .rx = hyundai_rx_hook,
+  .tx = hyundai_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = hyundai_fwd_hook,
+};
+
+const safety_hooks hyundai_legacy_hooks = {
+  .init = hyundai_legacy_init,
+  .rx = hyundai_rx_hook,
+  .tx = hyundai_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = hyundai_fwd_hook,
+};

panda/board/safety/safety_hyundai_canfd.h

@@ -0,0 +1,374 @@
+#include "safety_hyundai_common.h"
+
+const SteeringLimits HYUNDAI_CANFD_STEERING_LIMITS = {
+  .max_steer = 270,
+  .max_rt_delta = 112,
+  .max_rt_interval = 250000,
+  .max_rate_up = 2,
+  .max_rate_down = 3,
+  .driver_torque_allowance = 250,
+  .driver_torque_factor = 2,
+  .type = TorqueDriverLimited,
+
+  // the EPS faults when the steering angle is above a certain threshold for too long. to prevent this,
+  // we allow setting torque actuation bit to 0 while maintaining the requested torque value for two consecutive frames
+  .min_valid_request_frames = 89,
+  .max_invalid_request_frames = 2,
+  .min_valid_request_rt_interval = 810000,  // 810ms; a ~10% buffer on cutting every 90 frames
+  .has_steer_req_tolerance = true,
+};
+
+const CanMsg HYUNDAI_CANFD_HDA2_TX_MSGS[] = {
+  {0x50, 0, 16},  // LKAS
+  {0x1CF, 1, 8},  // CRUISE_BUTTON
+  {0x2A4, 0, 24}, // CAM_0x2A4
+};
+
+const CanMsg HYUNDAI_CANFD_HDA2_LONG_TX_MSGS[] = {
+  {0x50, 0, 16},  // LKAS
+  {0x1CF, 1, 8},  // CRUISE_BUTTON
+  {0x2A4, 0, 24}, // CAM_0x2A4
+  {0x51, 0, 32},  // ADRV_0x51
+  {0x730, 1, 8},  // tester present for ADAS ECU disable
+  {0x12A, 1, 16}, // LFA
+  {0x160, 1, 16}, // ADRV_0x160
+  {0x1E0, 1, 16}, // LFAHDA_CLUSTER
+  {0x1A0, 1, 32}, // CRUISE_INFO
+  {0x1EA, 1, 32}, // ADRV_0x1ea
+  {0x200, 1, 8},  // ADRV_0x200
+  {0x345, 1, 8},  // ADRV_0x345
+  {0x1DA, 1, 32}, // ADRV_0x1da
+};
+
+const CanMsg HYUNDAI_CANFD_HDA1_TX_MSGS[] = {
+  {0x12A, 0, 16}, // LFA
+  {0x1A0, 0, 32}, // CRUISE_INFO
+  {0x1CF, 2, 8},  // CRUISE_BUTTON
+  {0x1E0, 0, 16}, // LFAHDA_CLUSTER
+};
+
+AddrCheckStruct hyundai_canfd_addr_checks[] = {
+  {.msg = {{0x35, 1, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x35, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x105, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}}},
+  {.msg = {{0x175, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U},
+           {0x175, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }}},
+  {.msg = {{0xa0, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xa0, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0xea, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xea, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0x1a0, 1, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U},
+           {0x1a0, 2, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }}},
+  {.msg = {{0x1cf, 1, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1cf, 0, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1aa, 0, 16, .check_checksum = false, .max_counter = 0xffU, .expected_timestep = 20000U}}},
+};
+#define HYUNDAI_CANFD_ADDR_CHECK_LEN (sizeof(hyundai_canfd_addr_checks) / sizeof(hyundai_canfd_addr_checks[0]))
+
+// 0x1a0 is on bus 0
+AddrCheckStruct hyundai_canfd_radar_scc_addr_checks[] = {
+  {.msg = {{0x35, 1, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x35, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x105, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}}},
+  {.msg = {{0x175, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U},
+           {0x175, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }}},
+  {.msg = {{0xa0, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xa0, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0xea, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xea, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0x1a0, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{0x1cf, 1, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1cf, 0, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1aa, 0, 16, .check_checksum = false, .max_counter = 0xffU, .expected_timestep = 20000U}}},
+};
+#define HYUNDAI_CANFD_RADAR_SCC_ADDR_CHECK_LEN (sizeof(hyundai_canfd_radar_scc_addr_checks) / sizeof(hyundai_canfd_radar_scc_addr_checks[0]))
+
+AddrCheckStruct hyundai_canfd_long_addr_checks[] = {
+  {.msg = {{0x35, 1, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x35, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0x105, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}}},
+  {.msg = {{0x175, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U},
+           {0x175, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }}},
+  {.msg = {{0xa0, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xa0, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0xea, 1, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U},
+           {0xea, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }}},
+  {.msg = {{0x1cf, 1, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1cf, 0, 8, .check_checksum = false, .max_counter = 0xfU, .expected_timestep = 20000U},
+           {0x1aa, 0, 16, .check_checksum = false, .max_counter = 0xffU, .expected_timestep = 20000U}}},
+};
+#define HYUNDAI_CANFD_LONG_ADDR_CHECK_LEN (sizeof(hyundai_canfd_long_addr_checks) / sizeof(hyundai_canfd_long_addr_checks[0]))
+
+AddrCheckStruct hyundai_canfd_ice_addr_checks[] = {
+  {.msg = {{0x100, 0, 32, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{0xa0, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{0xea, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{0x175, 0, 24, .check_checksum = true, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{0x1aa, 0, 16, .check_checksum = false, .max_counter = 0xffU, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define HYUNDAI_CANFD_ICE_ADDR_CHECK_LEN (sizeof(hyundai_canfd_ice_addr_checks) / sizeof(hyundai_canfd_ice_addr_checks[0]))
+
+addr_checks hyundai_canfd_rx_checks = {hyundai_canfd_addr_checks, HYUNDAI_CANFD_ADDR_CHECK_LEN};
+
+
+uint16_t hyundai_canfd_crc_lut[256];
+
+
+const int HYUNDAI_PARAM_CANFD_HDA2 = 16;
+const int HYUNDAI_PARAM_CANFD_ALT_BUTTONS = 32;
+bool hyundai_canfd_hda2 = false;
+bool hyundai_canfd_alt_buttons = false;
+
+
+static uint8_t hyundai_canfd_get_counter(CANPacket_t *to_push) {
+  uint8_t ret = 0;
+  if (GET_LEN(to_push) == 8U) {
+    ret = GET_BYTE(to_push, 1) >> 4;
+  } else {
+    ret = GET_BYTE(to_push, 2);
+  }
+  return ret;
+}
+
+static uint32_t hyundai_canfd_get_checksum(CANPacket_t *to_push) {
+  uint32_t chksum = GET_BYTE(to_push, 0) | (GET_BYTE(to_push, 1) << 8);
+  return chksum;
+}
+
+static uint32_t hyundai_canfd_compute_checksum(CANPacket_t *to_push) {
+  int len = GET_LEN(to_push);
+  uint32_t address = GET_ADDR(to_push);
+
+  uint16_t crc = 0;
+
+  for (int i = 2; i < len; i++) {
+    crc = (crc << 8U) ^ hyundai_canfd_crc_lut[(crc >> 8U) ^ GET_BYTE(to_push, i)];
+  }
+
+  // Add address to crc
+  crc = (crc << 8U) ^ hyundai_canfd_crc_lut[(crc >> 8U) ^ ((address >> 0U) & 0xFFU)];
+  crc = (crc << 8U) ^ hyundai_canfd_crc_lut[(crc >> 8U) ^ ((address >> 8U) & 0xFFU)];
+
+  if (len == 8) {
+    crc ^= 0x5f29U;
+  } else if (len == 16) {
+    crc ^= 0x041dU;
+  } else if (len == 24) {
+    crc ^= 0x819dU;
+  } else if (len == 32) {
+    crc ^= 0x9f5bU;
+  } else {
+
+  }
+
+  return crc;
+}
+
+static int hyundai_canfd_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &hyundai_canfd_rx_checks,
+                                 hyundai_canfd_get_checksum, hyundai_canfd_compute_checksum, hyundai_canfd_get_counter, NULL);
+
+  int bus = GET_BUS(to_push);
+  int addr = GET_ADDR(to_push);
+
+  const int pt_bus = hyundai_canfd_hda2 ? 1 : 0;
+  const int scc_bus = hyundai_camera_scc ? 2 : pt_bus;
+
+  if (valid && (bus == pt_bus)) {
+    // driver torque
+    if (addr == 0xea) {
+      int torque_driver_new = ((GET_BYTE(to_push, 11) & 0x1fU) << 8U) | GET_BYTE(to_push, 10);
+      torque_driver_new -= 4095;
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // cruise buttons
+    const int button_addr = hyundai_canfd_alt_buttons ? 0x1aa : 0x1cf;
+    if (addr == button_addr) {
+      int main_button = 0;
+      int cruise_button = 0;
+      if (addr == 0x1cf) {
+        cruise_button = GET_BYTE(to_push, 2) & 0x7U;
+        main_button = GET_BIT(to_push, 19U);
+      } else {
+        cruise_button = (GET_BYTE(to_push, 4) >> 4) & 0x7U;
+        main_button = GET_BIT(to_push, 34U);
+      }
+      hyundai_common_cruise_buttons_check(cruise_button, main_button);
+    }
+
+    // gas press, different for EV, hybrid, and ICE models
+    if ((addr == 0x35) && hyundai_ev_gas_signal) {
+      gas_pressed = GET_BYTE(to_push, 5) != 0U;
+    } else if ((addr == 0x105) && hyundai_hybrid_gas_signal) {
+      gas_pressed = (GET_BIT(to_push, 103U) != 0U) || (GET_BYTE(to_push, 13) != 0U) || (GET_BIT(to_push, 112U) != 0U);
+    } else if ((addr == 0x100) && !hyundai_ev_gas_signal && !hyundai_hybrid_gas_signal) {
+      gas_pressed = GET_BIT(to_push, 176U) != 0U;
+    } else {
+    }
+
+    // brake press
+    if (addr == 0x175) {
+      brake_pressed = GET_BIT(to_push, 81U) != 0U;
+    }
+
+    // vehicle moving
+    if (addr == 0xa0) {
+      uint32_t speed = 0;
+      for (int i = 8; i < 15; i+=2) {
+        speed += GET_BYTE(to_push, i) | (GET_BYTE(to_push, i + 1) << 8U);
+      }
+      vehicle_moving = (speed / 4U) > HYUNDAI_STANDSTILL_THRSLD;
+    }
+  }
+
+  if (valid && (bus == scc_bus)) {
+    // cruise state
+    if ((addr == 0x1a0) && !hyundai_longitudinal) {
+      bool cruise_engaged = ((GET_BYTE(to_push, 8) >> 4) & 0x3U) != 0U;
+      hyundai_common_cruise_state_check(cruise_engaged);
+    }
+  }
+
+  const int steer_addr = hyundai_canfd_hda2 ? 0x50 : 0x12a;
+  bool stock_ecu_detected = (addr == steer_addr) && (bus == 0);
+  if (hyundai_longitudinal) {
+    // on HDA2, ensure ADRV ECU is still knocked out
+    // on others, ensure accel msg is blocked from camera
+    const int stock_scc_bus = hyundai_canfd_hda2 ? 1 : 0;
+    stock_ecu_detected = stock_ecu_detected || ((addr == 0x1a0) && (bus == stock_scc_bus));
+  }
+  generic_rx_checks(stock_ecu_detected);
+
+  return valid;
+}
+
+static int hyundai_canfd_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 0;
+  int addr = GET_ADDR(to_send);
+
+  if (hyundai_canfd_hda2 && !hyundai_longitudinal) {
+    tx = msg_allowed(to_send, HYUNDAI_CANFD_HDA2_TX_MSGS, sizeof(HYUNDAI_CANFD_HDA2_TX_MSGS)/sizeof(HYUNDAI_CANFD_HDA2_TX_MSGS[0]));
+  } else if (hyundai_canfd_hda2 && hyundai_longitudinal) {
+    tx = msg_allowed(to_send, HYUNDAI_CANFD_HDA2_LONG_TX_MSGS, sizeof(HYUNDAI_CANFD_HDA2_LONG_TX_MSGS)/sizeof(HYUNDAI_CANFD_HDA2_LONG_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, HYUNDAI_CANFD_HDA1_TX_MSGS, sizeof(HYUNDAI_CANFD_HDA1_TX_MSGS)/sizeof(HYUNDAI_CANFD_HDA1_TX_MSGS[0]));
+  }
+
+  // steering
+  const int steer_addr = (hyundai_canfd_hda2 && !hyundai_longitudinal) ? 0x50 : 0x12a;
+  if (addr == steer_addr) {
+    int desired_torque = (((GET_BYTE(to_send, 6) & 0xFU) << 7U) | (GET_BYTE(to_send, 5) >> 1U)) - 1024U;
+    bool steer_req = GET_BIT(to_send, 52U) != 0U;
+
+    if (steer_torque_cmd_checks(desired_torque, steer_req, HYUNDAI_CANFD_STEERING_LIMITS)) {
+      tx = 0;
+    }
+  }
+
+  // cruise buttons check
+  if (addr == 0x1cf) {
+    int button = GET_BYTE(to_send, 2) & 0x7U;
+    bool is_cancel = (button == HYUNDAI_BTN_CANCEL);
+    bool is_resume = (button == HYUNDAI_BTN_RESUME);
+
+    bool allowed = (is_cancel && cruise_engaged_prev) || (is_resume && controls_allowed);
+    if (!allowed) {
+      tx = 0;
+    }
+  }
+
+  // UDS: only tester present ("\x02\x3E\x80\x00\x00\x00\x00\x00") allowed on diagnostics address
+  if ((addr == 0x730) && hyundai_canfd_hda2) {
+    if ((GET_BYTES(to_send, 0, 4) != 0x00803E02U) || (GET_BYTES(to_send, 4, 4) != 0x0U)) {
+      tx = 0;
+    }
+  }
+
+  // ACCEL: safety check
+  if (addr == 0x1a0) {
+    int desired_accel_raw = (((GET_BYTE(to_send, 17) & 0x7U) << 8) | GET_BYTE(to_send, 16)) - 1023U;
+    int desired_accel_val = ((GET_BYTE(to_send, 18) << 4) | (GET_BYTE(to_send, 17) >> 4)) - 1023U;
+
+    bool violation = false;
+
+    if (hyundai_longitudinal) {
+      violation |= longitudinal_accel_checks(desired_accel_raw, HYUNDAI_LONG_LIMITS);
+      violation |= longitudinal_accel_checks(desired_accel_val, HYUNDAI_LONG_LIMITS);
+    } else {
+      // only used to cancel on here
+      if ((desired_accel_raw != 0) || (desired_accel_val != 0)) {
+        violation = true;
+      }
+    }
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  return tx;
+}
+
+static int hyundai_canfd_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+  if (bus_num == 2) {
+    // LKAS for HDA2, LFA for HDA1
+    int is_lkas_msg = (((addr == 0x50) || (addr == 0x2a4)) && hyundai_canfd_hda2);
+    int is_lfa_msg = ((addr == 0x12a) && !hyundai_canfd_hda2);
+
+    // HUD icons
+    int is_lfahda_msg = ((addr == 0x1e0) && !hyundai_canfd_hda2);
+
+    // CRUISE_INFO for non-HDA2, we send our own longitudinal commands
+    int is_scc_msg = ((addr == 0x1a0) && hyundai_longitudinal && !hyundai_canfd_hda2);
+
+    int block_msg = is_lkas_msg || is_lfa_msg || is_lfahda_msg || is_scc_msg;
+    if (!block_msg) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* hyundai_canfd_init(uint16_t param) {
+  hyundai_common_init(param);
+
+  gen_crc_lookup_table_16(0x1021, hyundai_canfd_crc_lut);
+  hyundai_canfd_hda2 = GET_FLAG(param, HYUNDAI_PARAM_CANFD_HDA2);
+  hyundai_canfd_alt_buttons = GET_FLAG(param, HYUNDAI_PARAM_CANFD_ALT_BUTTONS);
+
+  // no long for ICE yet
+  if (!hyundai_ev_gas_signal && !hyundai_hybrid_gas_signal) {
+    hyundai_longitudinal = false;
+  }
+
+  if (hyundai_longitudinal) {
+    hyundai_canfd_rx_checks = (addr_checks){hyundai_canfd_long_addr_checks, HYUNDAI_CANFD_LONG_ADDR_CHECK_LEN};
+  } else {
+    if (!hyundai_ev_gas_signal && !hyundai_hybrid_gas_signal) {
+      hyundai_canfd_rx_checks = (addr_checks){hyundai_canfd_ice_addr_checks, HYUNDAI_CANFD_ICE_ADDR_CHECK_LEN};
+    } else if (!hyundai_camera_scc && !hyundai_canfd_hda2) {
+      hyundai_canfd_rx_checks = (addr_checks){hyundai_canfd_radar_scc_addr_checks, HYUNDAI_CANFD_RADAR_SCC_ADDR_CHECK_LEN};
+    } else {
+      hyundai_canfd_rx_checks = (addr_checks){hyundai_canfd_addr_checks, HYUNDAI_CANFD_ADDR_CHECK_LEN};
+    }
+  }
+
+  return &hyundai_canfd_rx_checks;
+}
+
+const safety_hooks hyundai_canfd_hooks = {
+  .init = hyundai_canfd_init,
+  .rx = hyundai_canfd_rx_hook,
+  .tx = hyundai_canfd_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = hyundai_canfd_fwd_hook,
+};

panda/board/safety/safety_hyundai_common.h

@@ -0,0 +1,85 @@
+#ifndef SAFETY_HYUNDAI_COMMON_H
+#define SAFETY_HYUNDAI_COMMON_H
+
+const int HYUNDAI_PARAM_EV_GAS = 1;
+const int HYUNDAI_PARAM_HYBRID_GAS = 2;
+const int HYUNDAI_PARAM_LONGITUDINAL = 4;
+const int HYUNDAI_PARAM_CAMERA_SCC = 8;
+const int HYUNDAI_PARAM_ALT_LIMITS = 64; // TODO: shift this down with the rest of the common flags
+
+const uint8_t HYUNDAI_PREV_BUTTON_SAMPLES = 8;  // roughly 160 ms
+const uint32_t HYUNDAI_STANDSTILL_THRSLD = 30;  // ~1kph
+
+enum {
+  HYUNDAI_BTN_NONE = 0,
+  HYUNDAI_BTN_RESUME = 1,
+  HYUNDAI_BTN_SET = 2,
+  HYUNDAI_BTN_CANCEL = 4,
+};
+
+// common state
+bool hyundai_ev_gas_signal = false;
+bool hyundai_hybrid_gas_signal = false;
+bool hyundai_longitudinal = false;
+bool hyundai_camera_scc = false;
+bool hyundai_alt_limits = false;
+uint8_t hyundai_last_button_interaction;  // button messages since the user pressed an enable button
+
+void hyundai_common_init(uint16_t param) {
+  hyundai_ev_gas_signal = GET_FLAG(param, HYUNDAI_PARAM_EV_GAS);
+  hyundai_hybrid_gas_signal = !hyundai_ev_gas_signal && GET_FLAG(param, HYUNDAI_PARAM_HYBRID_GAS);
+  hyundai_camera_scc = GET_FLAG(param, HYUNDAI_PARAM_CAMERA_SCC);
+  hyundai_alt_limits = GET_FLAG(param, HYUNDAI_PARAM_ALT_LIMITS);
+
+  hyundai_last_button_interaction = HYUNDAI_PREV_BUTTON_SAMPLES;
+
+#ifdef ALLOW_DEBUG
+  hyundai_longitudinal = GET_FLAG(param, HYUNDAI_PARAM_LONGITUDINAL);
+#else
+  hyundai_longitudinal = false;
+#endif
+}
+
+void hyundai_common_cruise_state_check(const int cruise_engaged) {
+  // some newer HKG models can re-enable after spamming cancel button,
+  // so keep track of user button presses to deny engagement if no interaction
+
+  // enter controls on rising edge of ACC and recent user button press, exit controls when ACC off
+  if (!hyundai_longitudinal) {
+    if (cruise_engaged && !cruise_engaged_prev && (hyundai_last_button_interaction < HYUNDAI_PREV_BUTTON_SAMPLES)) {
+      controls_allowed = 1;
+    }
+
+    if (!cruise_engaged) {
+      controls_allowed = 0;
+    }
+    cruise_engaged_prev = cruise_engaged;
+  }
+}
+
+void hyundai_common_cruise_buttons_check(const int cruise_button, const int main_button) {
+  if ((cruise_button == HYUNDAI_BTN_RESUME) || (cruise_button == HYUNDAI_BTN_SET) || (cruise_button == HYUNDAI_BTN_CANCEL) ||
+      (main_button != 0)) {
+    hyundai_last_button_interaction = 0U;
+  } else {
+    hyundai_last_button_interaction = MIN(hyundai_last_button_interaction + 1U, HYUNDAI_PREV_BUTTON_SAMPLES);
+  }
+
+  if (hyundai_longitudinal) {
+    // enter controls on falling edge of resume or set
+    bool set = (cruise_button != HYUNDAI_BTN_SET) && (cruise_button_prev == HYUNDAI_BTN_SET);
+    bool res = (cruise_button != HYUNDAI_BTN_RESUME) && (cruise_button_prev == HYUNDAI_BTN_RESUME);
+    if (set || res) {
+      controls_allowed = 1;
+    }
+
+    // exit controls on cancel press
+    if (cruise_button == HYUNDAI_BTN_CANCEL) {
+      controls_allowed = 0;
+    }
+
+    cruise_button_prev = cruise_button;
+  }
+}
+
+#endif

panda/board/safety/safety_mazda.h

@@ -0,0 +1,139 @@
+// CAN msgs we care about
+#define MAZDA_LKAS          0x243
+#define MAZDA_LKAS_HUD      0x440
+#define MAZDA_CRZ_CTRL      0x21c
+#define MAZDA_CRZ_BTNS      0x09d
+#define MAZDA_STEER_TORQUE  0x240
+#define MAZDA_ENGINE_DATA   0x202
+#define MAZDA_PEDALS        0x165
+
+// CAN bus numbers
+#define MAZDA_MAIN 0
+#define MAZDA_AUX  1
+#define MAZDA_CAM  2
+
+const SteeringLimits MAZDA_STEERING_LIMITS = {
+  .max_steer = 800,
+  .max_rate_up = 10,
+  .max_rate_down = 25,
+  .max_rt_delta = 300,
+  .max_rt_interval = 250000,
+  .driver_torque_factor = 1,
+  .driver_torque_allowance = 15,
+  .type = TorqueDriverLimited,
+};
+
+const CanMsg MAZDA_TX_MSGS[] = {{MAZDA_LKAS, 0, 8}, {MAZDA_CRZ_BTNS, 0, 8}, {MAZDA_LKAS_HUD, 0, 8}};
+
+AddrCheckStruct mazda_addr_checks[] = {
+  {.msg = {{MAZDA_CRZ_CTRL,     0, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MAZDA_CRZ_BTNS,     0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+  {.msg = {{MAZDA_STEER_TORQUE, 0, 8, .expected_timestep = 12000U}, { 0 }, { 0 }}},
+  {.msg = {{MAZDA_ENGINE_DATA,  0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MAZDA_PEDALS,       0, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+};
+#define MAZDA_ADDR_CHECKS_LEN (sizeof(mazda_addr_checks) / sizeof(mazda_addr_checks[0]))
+addr_checks mazda_rx_checks = {mazda_addr_checks, MAZDA_ADDR_CHECKS_LEN};
+
+// track msgs coming from OP so that we know what CAM msgs to drop and what to forward
+static int mazda_rx_hook(CANPacket_t *to_push) {
+  bool valid = addr_safety_check(to_push, &mazda_rx_checks, NULL, NULL, NULL, NULL);
+  if (valid && ((int)GET_BUS(to_push) == MAZDA_MAIN)) {
+    int addr = GET_ADDR(to_push);
+
+    if (addr == MAZDA_ENGINE_DATA) {
+      // sample speed: scale by 0.01 to get kph
+      int speed = (GET_BYTE(to_push, 2) << 8) | GET_BYTE(to_push, 3);
+      vehicle_moving = speed > 10; // moving when speed > 0.1 kph
+    }
+
+    if (addr == MAZDA_STEER_TORQUE) {
+      int torque_driver_new = GET_BYTE(to_push, 0) - 127U;
+      // update array of samples
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // enter controls on rising edge of ACC, exit controls on ACC off
+    if (addr == MAZDA_CRZ_CTRL) {
+      bool cruise_engaged = GET_BYTE(to_push, 0) & 0x8U;
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    if (addr == MAZDA_ENGINE_DATA) {
+      gas_pressed = (GET_BYTE(to_push, 4) || (GET_BYTE(to_push, 5) & 0xF0U));
+    }
+
+    if (addr == MAZDA_PEDALS) {
+      brake_pressed = (GET_BYTE(to_push, 0) & 0x10U);
+    }
+
+    generic_rx_checks((addr == MAZDA_LKAS));
+  }
+  return valid;
+}
+
+static int mazda_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  int bus = GET_BUS(to_send);
+
+  if (!msg_allowed(to_send, MAZDA_TX_MSGS, sizeof(MAZDA_TX_MSGS)/sizeof(MAZDA_TX_MSGS[0]))) {
+    tx = 0;
+  }
+
+  // Check if msg is sent on the main BUS
+  if (bus == MAZDA_MAIN) {
+
+    // steer cmd checks
+    if (addr == MAZDA_LKAS) {
+      int desired_torque = (((GET_BYTE(to_send, 0) & 0x0FU) << 8) | GET_BYTE(to_send, 1)) - 2048U;
+
+      if (steer_torque_cmd_checks(desired_torque, -1, MAZDA_STEERING_LIMITS)) {
+        tx = 0;
+      }
+    }
+
+    // cruise buttons check
+    if (addr == MAZDA_CRZ_BTNS) {
+      // allow resume spamming while controls allowed, but
+      // only allow cancel while contrls not allowed
+      bool cancel_cmd = (GET_BYTE(to_send, 0) == 0x1U);
+      if (!controls_allowed && !cancel_cmd) {
+        tx = 0;
+      }
+    }
+  }
+
+  return tx;
+}
+
+static int mazda_fwd_hook(int bus, int addr) {
+  int bus_fwd = -1;
+
+  if (bus == MAZDA_MAIN) {
+    bus_fwd = MAZDA_CAM;
+  } else if (bus == MAZDA_CAM) {
+    bool block = (addr == MAZDA_LKAS) || (addr == MAZDA_LKAS_HUD);
+    if (!block) {
+      bus_fwd = MAZDA_MAIN;
+    }
+  } else {
+    // don't fwd
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* mazda_init(uint16_t param) {
+  UNUSED(param);
+  return &mazda_rx_checks;
+}
+
+const safety_hooks mazda_hooks = {
+  .init = mazda_init,
+  .rx = mazda_rx_hook,
+  .tx = mazda_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = mazda_fwd_hook,
+};

panda/board/safety/safety_nissan.h

@@ -0,0 +1,171 @@
+const SteeringLimits NISSAN_STEERING_LIMITS = {
+  .angle_deg_to_can = 100,
+  .angle_rate_up_lookup = {
+    {0., 5., 15.},
+    {5., .8, .15}
+  },
+  .angle_rate_down_lookup = {
+    {0., 5., 15.},
+    {5., 3.5, .4}
+  },
+};
+
+const CanMsg NISSAN_TX_MSGS[] = {
+  {0x169, 0, 8},  // LKAS
+  {0x2b1, 0, 8},  // PROPILOT_HUD
+  {0x4cc, 0, 8},  // PROPILOT_HUD_INFO_MSG
+  {0x20b, 2, 6},  // CRUISE_THROTTLE (X-Trail)
+  {0x20b, 1, 6},  // CRUISE_THROTTLE (Altima)
+  {0x280, 2, 8}   // CANCEL_MSG (Leaf)
+};
+
+// Signals duplicated below due to the fact that these messages can come in on either CAN bus, depending on car model.
+AddrCheckStruct nissan_addr_checks[] = {
+  {.msg = {{0x2, 0, 5, .expected_timestep = 10000U},
+           {0x2, 1, 5, .expected_timestep = 10000U}, { 0 }}},  // STEER_ANGLE_SENSOR (100Hz)
+  {.msg = {{0x285, 0, 8, .expected_timestep = 20000U},
+           {0x285, 1, 8, .expected_timestep = 20000U}, { 0 }}}, // WHEEL_SPEEDS_REAR (50Hz)
+  {.msg = {{0x30f, 2, 3, .expected_timestep = 100000U},
+           {0x30f, 1, 3, .expected_timestep = 100000U}, { 0 }}}, // CRUISE_STATE (10Hz)
+  {.msg = {{0x15c, 0, 8, .expected_timestep = 20000U},
+           {0x15c, 1, 8, .expected_timestep = 20000U},
+           {0x239, 0, 8, .expected_timestep = 20000U}}}, // GAS_PEDAL (100Hz / 50Hz)
+  {.msg = {{0x454, 0, 8, .expected_timestep = 100000U},
+           {0x454, 1, 8, .expected_timestep = 100000U},
+           {0x1cc, 0, 4, .expected_timestep = 10000U}}}, // DOORS_LIGHTS (10Hz) / BRAKE (100Hz)
+};
+#define NISSAN_ADDR_CHECK_LEN (sizeof(nissan_addr_checks) / sizeof(nissan_addr_checks[0]))
+addr_checks nissan_rx_checks = {nissan_addr_checks, NISSAN_ADDR_CHECK_LEN};
+
+// EPS Location. false = V-CAN, true = C-CAN
+bool nissan_alt_eps = false;
+
+static int nissan_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &nissan_rx_checks, NULL, NULL, NULL, NULL);
+
+  if (valid) {
+    int bus = GET_BUS(to_push);
+    int addr = GET_ADDR(to_push);
+
+    if (((bus == 0) && (!nissan_alt_eps)) || ((bus == 1) && (nissan_alt_eps))) {
+      if (addr == 0x2) {
+        // Current steering angle
+        // Factor -0.1, little endian
+        int angle_meas_new = (GET_BYTES(to_push, 0, 4) & 0xFFFFU);
+        // Need to multiply by 10 here as LKAS and Steering wheel are different base unit
+        angle_meas_new = to_signed(angle_meas_new, 16) * 10;
+
+        // update array of samples
+        update_sample(&angle_meas, angle_meas_new);
+      }
+
+      if (addr == 0x285) {
+        // Get current speed and standstill
+        uint16_t right_rear = (GET_BYTE(to_push, 0) << 8) | (GET_BYTE(to_push, 1));
+        uint16_t left_rear = (GET_BYTE(to_push, 2) << 8) | (GET_BYTE(to_push, 3));
+        vehicle_moving = (right_rear | left_rear) != 0U;
+        update_sample(&vehicle_speed, ROUND((right_rear + left_rear) / 2.0 * 0.005 / 3.6 * VEHICLE_SPEED_FACTOR));
+      }
+
+      // X-Trail 0x15c, Leaf 0x239
+      if ((addr == 0x15c) || (addr == 0x239)) {
+        if (addr == 0x15c){
+          gas_pressed = ((GET_BYTE(to_push, 5) << 2) | ((GET_BYTE(to_push, 6) >> 6) & 0x3U)) > 3U;
+        } else {
+          gas_pressed = GET_BYTE(to_push, 0) > 3U;
+        }
+      }
+    }
+
+    // X-trail 0x454, Leaf  0x239
+    if ((addr == 0x454) || (addr == 0x239)) {
+      if (addr == 0x454){
+        brake_pressed = (GET_BYTE(to_push, 2) & 0x80U) != 0U;
+      } else {
+        brake_pressed = ((GET_BYTE(to_push, 4) >> 5) & 1U) != 0U;
+      }
+    }
+
+    // Handle cruise enabled
+    if ((addr == 0x30f) && (((bus == 2) && (!nissan_alt_eps)) || ((bus == 1) && (nissan_alt_eps)))) {
+      bool cruise_engaged = (GET_BYTE(to_push, 0) >> 3) & 1U;
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    generic_rx_checks((addr == 0x169) && (bus == 0));
+  }
+  return valid;
+}
+
+
+static int nissan_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  bool violation = false;
+
+  if (!msg_allowed(to_send, NISSAN_TX_MSGS, sizeof(NISSAN_TX_MSGS) / sizeof(NISSAN_TX_MSGS[0]))) {
+    tx = 0;
+  }
+
+  // steer cmd checks
+  if (addr == 0x169) {
+    int desired_angle = ((GET_BYTE(to_send, 0) << 10) | (GET_BYTE(to_send, 1) << 2) | ((GET_BYTE(to_send, 2) >> 6) & 0x3U));
+    bool lka_active = (GET_BYTE(to_send, 6) >> 4) & 1U;
+
+    // offeset 1310 * NISSAN_STEERING_LIMITS.angle_deg_to_can
+    desired_angle =  desired_angle - 131000;
+
+    if (steer_angle_cmd_checks(desired_angle, lka_active, NISSAN_STEERING_LIMITS)) {
+      violation = true;
+    }
+  }
+
+  // acc button check, only allow cancel button to be sent
+  if (addr == 0x20b) {
+    // Violation of any button other than cancel is pressed
+    violation |= ((GET_BYTE(to_send, 1) & 0x3dU) > 0U);
+  }
+
+  if (violation) {
+    tx = 0;
+  }
+
+  return tx;
+}
+
+
+static int nissan_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if (bus_num == 0) {
+    int block_msg = (addr == 0x280); // CANCEL_MSG
+    if (!block_msg) {
+      bus_fwd = 2;  // ADAS
+    }
+  }
+
+  if (bus_num == 2) {
+    // 0x169 is LKAS, 0x2b1 LKAS_HUD, 0x4cc LKAS_HUD_INFO_MSG
+    int block_msg = ((addr == 0x169) || (addr == 0x2b1) || (addr == 0x4cc));
+    if (!block_msg) {
+      bus_fwd = 0;  // V-CAN
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* nissan_init(uint16_t param) {
+  nissan_alt_eps = param ? 1 : 0;
+  return &nissan_rx_checks;
+}
+
+const safety_hooks nissan_hooks = {
+  .init = nissan_init,
+  .rx = nissan_rx_hook,
+  .tx = nissan_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = nissan_fwd_hook,
+};

panda/board/safety/safety_subaru.h

@@ -0,0 +1,199 @@
+#define SUBARU_STEERING_LIMITS_GENERATOR(steer_max, rate_up, rate_down)          \
+  {                                                                              \
+    .max_steer = (steer_max),                                                    \
+    .max_rt_delta = 940,                                                         \
+    .max_rt_interval = 250000,                                                   \
+    .max_rate_up = (rate_up),                                                    \
+    .max_rate_down = (rate_down),                                                \
+    .driver_torque_factor = 50,                                                  \
+    .driver_torque_allowance = 60,                                               \
+    .type = TorqueDriverLimited,                                                 \
+  }                                                                              \
+
+const SteeringLimits SUBARU_STEERING_LIMITS = SUBARU_STEERING_LIMITS_GENERATOR(2047, 50, 70);
+const SteeringLimits SUBARU_GEN2_STEERING_LIMITS = SUBARU_STEERING_LIMITS_GENERATOR(1000, 40, 40);
+
+
+#define MSG_SUBARU_Brake_Status          0x13c
+#define MSG_SUBARU_CruiseControl         0x240
+#define MSG_SUBARU_Throttle              0x40
+#define MSG_SUBARU_Steering_Torque       0x119
+#define MSG_SUBARU_Wheel_Speeds          0x13a
+
+#define MSG_SUBARU_ES_LKAS               0x122
+#define MSG_SUBARU_ES_Brake              0x220
+#define MSG_SUBARU_ES_Distance           0x221
+#define MSG_SUBARU_ES_Status             0x222
+#define MSG_SUBARU_ES_DashStatus         0x321
+#define MSG_SUBARU_ES_LKAS_State         0x322
+#define MSG_SUBARU_ES_Infotainment       0x323
+
+#define SUBARU_MAIN_BUS 0
+#define SUBARU_ALT_BUS  1
+#define SUBARU_CAM_BUS  2
+
+#define SUBARU_COMMON_TX_MSGS(alt_bus)              \
+  {MSG_SUBARU_ES_LKAS,         SUBARU_MAIN_BUS, 8}, \
+  {MSG_SUBARU_ES_Distance,     alt_bus,         8}, \
+  {MSG_SUBARU_ES_DashStatus,   SUBARU_MAIN_BUS, 8}, \
+  {MSG_SUBARU_ES_LKAS_State,   SUBARU_MAIN_BUS, 8}, \
+  {MSG_SUBARU_ES_Infotainment, SUBARU_MAIN_BUS, 8}, \
+
+#define SUBARU_COMMON_ADDR_CHECKS(alt_bus)                                                                                                            \
+  {.msg = {{MSG_SUBARU_Throttle,        SUBARU_MAIN_BUS, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}}, \
+  {.msg = {{MSG_SUBARU_Steering_Torque, SUBARU_MAIN_BUS, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}}, \
+  {.msg = {{MSG_SUBARU_Wheel_Speeds,    alt_bus,         8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}}, \
+  {.msg = {{MSG_SUBARU_Brake_Status,    alt_bus,         8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}}, \
+  {.msg = {{MSG_SUBARU_CruiseControl,   alt_bus,         8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 50000U}, { 0 }, { 0 }}}, \
+
+const CanMsg SUBARU_TX_MSGS[] = {
+  SUBARU_COMMON_TX_MSGS(SUBARU_MAIN_BUS)
+};
+#define SUBARU_TX_MSGS_LEN (sizeof(SUBARU_TX_MSGS) / sizeof(SUBARU_TX_MSGS[0]))
+
+const CanMsg SUBARU_GEN2_TX_MSGS[] = {
+  SUBARU_COMMON_TX_MSGS(SUBARU_ALT_BUS)
+};
+#define SUBARU_GEN2_TX_MSGS_LEN (sizeof(SUBARU_GEN2_TX_MSGS) / sizeof(SUBARU_GEN2_TX_MSGS[0]))
+
+AddrCheckStruct subaru_addr_checks[] = {
+  SUBARU_COMMON_ADDR_CHECKS(SUBARU_MAIN_BUS)
+};
+#define SUBARU_ADDR_CHECK_LEN (sizeof(subaru_addr_checks) / sizeof(subaru_addr_checks[0]))
+addr_checks subaru_rx_checks = {subaru_addr_checks, SUBARU_ADDR_CHECK_LEN};
+
+AddrCheckStruct subaru_gen2_addr_checks[] = {
+  SUBARU_COMMON_ADDR_CHECKS(SUBARU_ALT_BUS)
+};
+#define SUBARU_GEN2_ADDR_CHECK_LEN (sizeof(subaru_gen2_addr_checks) / sizeof(subaru_gen2_addr_checks[0]))
+addr_checks subaru_gen2_rx_checks = {subaru_gen2_addr_checks, SUBARU_GEN2_ADDR_CHECK_LEN};
+
+
+const uint16_t SUBARU_PARAM_GEN2 = 1;
+bool subaru_gen2 = false;
+
+
+static uint32_t subaru_get_checksum(CANPacket_t *to_push) {
+  return (uint8_t)GET_BYTE(to_push, 0);
+}
+
+static uint8_t subaru_get_counter(CANPacket_t *to_push) {
+  return (uint8_t)(GET_BYTE(to_push, 1) & 0xFU);
+}
+
+static uint32_t subaru_compute_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+  int len = GET_LEN(to_push);
+  uint8_t checksum = (uint8_t)(addr) + (uint8_t)((unsigned int)(addr) >> 8U);
+  for (int i = 1; i < len; i++) {
+    checksum += (uint8_t)GET_BYTE(to_push, i);
+  }
+  return checksum;
+}
+
+static int subaru_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &subaru_rx_checks,
+                                 subaru_get_checksum, subaru_compute_checksum, subaru_get_counter, NULL);
+
+  if (valid) {
+    const int bus = GET_BUS(to_push);
+    const int alt_bus = subaru_gen2 ? SUBARU_ALT_BUS : SUBARU_MAIN_BUS;
+
+    int addr = GET_ADDR(to_push);
+    if ((addr == MSG_SUBARU_Steering_Torque) && (bus == SUBARU_MAIN_BUS)) {
+      int torque_driver_new;
+      torque_driver_new = ((GET_BYTES(to_push, 0, 4) >> 16) & 0x7FFU);
+      torque_driver_new = -1 * to_signed(torque_driver_new, 11);
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // enter controls on rising edge of ACC, exit controls on ACC off
+    if ((addr == MSG_SUBARU_CruiseControl) && (bus == alt_bus)) {
+      bool cruise_engaged = GET_BIT(to_push, 41U) != 0U;
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    // update vehicle moving with any non-zero wheel speed
+    if ((addr == MSG_SUBARU_Wheel_Speeds) && (bus == alt_bus)) {
+      vehicle_moving = ((GET_BYTES(to_push, 0, 4) >> 12) != 0U) || (GET_BYTES(to_push, 4, 4) != 0U);
+    }
+
+    if ((addr == MSG_SUBARU_Brake_Status) && (bus == alt_bus)) {
+      brake_pressed = ((GET_BYTE(to_push, 7) >> 6) & 1U);
+    }
+
+    if ((addr == MSG_SUBARU_Throttle) && (bus == SUBARU_MAIN_BUS)) {
+      gas_pressed = GET_BYTE(to_push, 4) != 0U;
+    }
+
+    generic_rx_checks((addr == MSG_SUBARU_ES_LKAS) && (bus == SUBARU_MAIN_BUS));
+  }
+  return valid;
+}
+
+static int subaru_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+
+  if (subaru_gen2) {
+    tx = msg_allowed(to_send, SUBARU_GEN2_TX_MSGS, SUBARU_GEN2_TX_MSGS_LEN);
+  } else {
+    tx = msg_allowed(to_send, SUBARU_TX_MSGS, SUBARU_TX_MSGS_LEN);
+  }
+
+  // steer cmd checks
+  if (addr == MSG_SUBARU_ES_LKAS) {
+    int desired_torque = ((GET_BYTES(to_send, 0, 4) >> 16) & 0x1FFFU);
+    desired_torque = -1 * to_signed(desired_torque, 13);
+
+    const SteeringLimits limits = subaru_gen2 ? SUBARU_GEN2_STEERING_LIMITS : SUBARU_STEERING_LIMITS;
+    if (steer_torque_cmd_checks(desired_torque, -1, limits)) {
+      tx = 0;
+    }
+
+  }
+  return tx;
+}
+
+static int subaru_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if (bus_num == SUBARU_MAIN_BUS) {
+    bus_fwd = SUBARU_CAM_BUS;  // forward to camera
+  }
+
+  if (bus_num == SUBARU_CAM_BUS) {
+    // Global platform
+    bool block_lkas = ((addr == MSG_SUBARU_ES_LKAS) ||
+                       (addr == MSG_SUBARU_ES_DashStatus) ||
+                       (addr == MSG_SUBARU_ES_LKAS_State) ||
+                       (addr == MSG_SUBARU_ES_Infotainment));
+    if (!block_lkas) {
+      bus_fwd = SUBARU_MAIN_BUS;  // Main CAN
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* subaru_init(uint16_t param) {
+  subaru_gen2 = GET_FLAG(param, SUBARU_PARAM_GEN2);
+
+  if (subaru_gen2) {
+    subaru_rx_checks = (addr_checks){subaru_gen2_addr_checks, SUBARU_GEN2_ADDR_CHECK_LEN};
+  } else {
+    subaru_rx_checks = (addr_checks){subaru_addr_checks, SUBARU_ADDR_CHECK_LEN};
+  }
+
+  return &subaru_rx_checks;
+}
+
+const safety_hooks subaru_hooks = {
+  .init = subaru_init,
+  .rx = subaru_rx_hook,
+  .tx = subaru_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = subaru_fwd_hook,
+};

panda/board/safety/safety_subaru_preglobal.h

@@ -0,0 +1,131 @@
+const SteeringLimits SUBARU_PG_STEERING_LIMITS = {
+  .max_steer = 2047,
+  .max_rt_delta = 940,
+  .max_rt_interval = 250000,
+  .max_rate_up = 50,
+  .max_rate_down = 70,
+  .driver_torque_factor = 10,
+  .driver_torque_allowance = 75,
+  .type = TorqueDriverLimited,
+};
+
+// Preglobal platform
+// 0x161 is ES_CruiseThrottle
+// 0x164 is ES_LKAS
+
+#define MSG_SUBARU_PG_CruiseControl         0x144
+#define MSG_SUBARU_PG_Throttle              0x140
+#define MSG_SUBARU_PG_Wheel_Speeds          0xD4
+#define MSG_SUBARU_PG_Brake_Pedal           0xD1
+#define MSG_SUBARU_PG_ES_LKAS               0x164
+#define MSG_SUBARU_PG_ES_Distance           0x161
+#define MSG_SUBARU_PG_Steering_Torque       0x371
+
+#define SUBARU_PG_MAIN_BUS 0
+#define SUBARU_PG_CAM_BUS  2
+
+const CanMsg SUBARU_PG_TX_MSGS[] = {
+  {MSG_SUBARU_PG_ES_Distance, SUBARU_PG_MAIN_BUS, 8},
+  {MSG_SUBARU_PG_ES_LKAS,     SUBARU_PG_MAIN_BUS, 8}
+};
+#define SUBARU_PG_TX_MSGS_LEN (sizeof(SUBARU_PG_TX_MSGS) / sizeof(SUBARU_PG_TX_MSGS[0]))
+
+// TODO: do checksum and counter checks after adding the signals to the outback dbc file
+AddrCheckStruct subaru_preglobal_addr_checks[] = {
+  {.msg = {{MSG_SUBARU_PG_Throttle,        SUBARU_PG_MAIN_BUS, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_SUBARU_PG_Steering_Torque, SUBARU_PG_MAIN_BUS, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_SUBARU_PG_CruiseControl,   SUBARU_PG_MAIN_BUS, 8, .expected_timestep = 50000U}, { 0 }, { 0 }}},
+};
+#define SUBARU_PG_ADDR_CHECK_LEN (sizeof(subaru_preglobal_addr_checks) / sizeof(subaru_preglobal_addr_checks[0]))
+addr_checks subaru_preglobal_rx_checks = {subaru_preglobal_addr_checks, SUBARU_PG_ADDR_CHECK_LEN};
+
+static int subaru_preglobal_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &subaru_preglobal_rx_checks, NULL, NULL, NULL, NULL);
+
+  const int bus = GET_BUS(to_push);
+
+  if (valid && (bus == SUBARU_PG_MAIN_BUS)) {
+    int addr = GET_ADDR(to_push);
+    if (addr == MSG_SUBARU_PG_Steering_Torque) {
+      int torque_driver_new;
+      torque_driver_new = (GET_BYTE(to_push, 3) >> 5) + (GET_BYTE(to_push, 4) << 3);
+      torque_driver_new = to_signed(torque_driver_new, 11);
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    // enter controls on rising edge of ACC, exit controls on ACC off
+    if (addr == MSG_SUBARU_PG_CruiseControl) {
+      bool cruise_engaged = GET_BIT(to_push, 49U) != 0U;
+      pcm_cruise_check(cruise_engaged);
+    }
+
+    // update vehicle moving with any non-zero wheel speed
+    if (addr == MSG_SUBARU_PG_Wheel_Speeds) {
+      vehicle_moving = ((GET_BYTES(to_push, 0, 4) >> 12) != 0U) || (GET_BYTES(to_push, 4, 4) != 0U);
+    }
+
+    if (addr == MSG_SUBARU_PG_Brake_Pedal) {
+      brake_pressed = ((GET_BYTES(to_push, 0, 4) >> 16) & 0xFFU) > 0U;
+    }
+
+    if (addr == MSG_SUBARU_PG_Throttle) {
+      gas_pressed = GET_BYTE(to_push, 0) != 0U;
+    }
+
+    generic_rx_checks((addr == MSG_SUBARU_PG_ES_LKAS));
+  }
+  return valid;
+}
+
+static int subaru_preglobal_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+
+  if (!msg_allowed(to_send, SUBARU_PG_TX_MSGS, SUBARU_PG_TX_MSGS_LEN)) {
+    tx = 0;
+  }
+
+  // steer cmd checks
+  if (addr == MSG_SUBARU_PG_ES_LKAS) {
+    int desired_torque = ((GET_BYTES(to_send, 0, 4) >> 8) & 0x1FFFU);
+    desired_torque = -1 * to_signed(desired_torque, 13);
+
+    if (steer_torque_cmd_checks(desired_torque, -1, SUBARU_PG_STEERING_LIMITS)) {
+      tx = 0;
+    }
+
+  }
+  return tx;
+}
+
+static int subaru_preglobal_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if (bus_num == SUBARU_PG_MAIN_BUS) {
+    bus_fwd = SUBARU_PG_CAM_BUS;  // Camera CAN
+  }
+
+  if (bus_num == SUBARU_PG_CAM_BUS) {
+    int block_msg = ((addr == MSG_SUBARU_PG_ES_Distance) || (addr == MSG_SUBARU_PG_ES_LKAS));
+    if (!block_msg) {
+      bus_fwd = SUBARU_PG_MAIN_BUS;  // Main CAN
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* subaru_preglobal_init(uint16_t param) {
+  UNUSED(param);
+  return &subaru_preglobal_rx_checks;
+}
+
+const safety_hooks subaru_preglobal_hooks = {
+  .init = subaru_preglobal_init,
+  .rx = subaru_preglobal_rx_hook,
+  .tx = subaru_preglobal_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = subaru_preglobal_fwd_hook,
+};

panda/board/safety/safety_tesla.h

@@ -0,0 +1,238 @@
+const SteeringLimits TESLA_STEERING_LIMITS = {
+  .angle_deg_to_can = 10,
+  .angle_rate_up_lookup = {
+    {0., 5., 15.},
+    {10., 1.6, .3}
+  },
+  .angle_rate_down_lookup = {
+    {0., 5., 15.},
+    {10., 7.0, .8}
+  },
+};
+
+const LongitudinalLimits TESLA_LONG_LIMITS = {
+  .max_accel = 425,       // 2. m/s^2
+  .min_accel = 287,       // -3.52 m/s^2  // TODO: limit to -3.48
+  .inactive_accel = 375,  // 0. m/s^2
+};
+
+
+const int TESLA_FLAG_POWERTRAIN = 1;
+const int TESLA_FLAG_LONGITUDINAL_CONTROL = 2;
+
+const CanMsg TESLA_TX_MSGS[] = {
+  {0x488, 0, 4},  // DAS_steeringControl
+  {0x45, 0, 8},   // STW_ACTN_RQ
+  {0x45, 2, 8},   // STW_ACTN_RQ
+  {0x2b9, 0, 8},  // DAS_control
+};
+#define TESLA_TX_LEN (sizeof(TESLA_TX_MSGS) / sizeof(TESLA_TX_MSGS[0]))
+
+const CanMsg TESLA_PT_TX_MSGS[] = {
+  {0x2bf, 0, 8},  // DAS_control
+};
+#define TESLA_PT_TX_LEN (sizeof(TESLA_PT_TX_MSGS) / sizeof(TESLA_PT_TX_MSGS[0]))
+
+AddrCheckStruct tesla_addr_checks[] = {
+  {.msg = {{0x2b9, 2, 8, .expected_timestep = 40000U}, { 0 }, { 0 }}},   // DAS_control (25Hz)
+  {.msg = {{0x370, 0, 8, .expected_timestep = 40000U}, { 0 }, { 0 }}},   // EPAS_sysStatus (25Hz)
+  {.msg = {{0x108, 0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},   // DI_torque1 (100Hz)
+  {.msg = {{0x118, 0, 6, .expected_timestep = 10000U}, { 0 }, { 0 }}},   // DI_torque2 (100Hz)
+  {.msg = {{0x20a, 0, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},   // BrakeMessage (50Hz)
+  {.msg = {{0x368, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},  // DI_state (10Hz)
+  {.msg = {{0x318, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},  // GTW_carState (10Hz)
+};
+#define TESLA_ADDR_CHECK_LEN (sizeof(tesla_addr_checks) / sizeof(tesla_addr_checks[0]))
+addr_checks tesla_rx_checks = {tesla_addr_checks, TESLA_ADDR_CHECK_LEN};
+
+AddrCheckStruct tesla_pt_addr_checks[] = {
+  {.msg = {{0x106, 0, 8, .expected_timestep = 10000U}, { 0 }, { 0 }}},   // DI_torque1 (100Hz)
+  {.msg = {{0x116, 0, 6, .expected_timestep = 10000U}, { 0 }, { 0 }}},   // DI_torque2 (100Hz)
+  {.msg = {{0x1f8, 0, 8, .expected_timestep = 20000U}, { 0 }, { 0 }}},   // BrakeMessage (50Hz)
+  {.msg = {{0x2bf, 2, 8, .expected_timestep = 40000U}, { 0 }, { 0 }}},   // DAS_control (25Hz)
+  {.msg = {{0x256, 0, 8, .expected_timestep = 100000U}, { 0 }, { 0 }}},  // DI_state (10Hz)
+};
+#define TESLA_PT_ADDR_CHECK_LEN (sizeof(tesla_pt_addr_checks) / sizeof(tesla_pt_addr_checks[0]))
+addr_checks tesla_pt_rx_checks = {tesla_pt_addr_checks, TESLA_PT_ADDR_CHECK_LEN};
+
+bool tesla_longitudinal = false;
+bool tesla_powertrain = false;  // Are we the second panda intercepting the powertrain bus?
+
+bool tesla_stock_aeb = false;
+
+static int tesla_rx_hook(CANPacket_t *to_push) {
+  bool valid = addr_safety_check(to_push, tesla_powertrain ? (&tesla_pt_rx_checks) : (&tesla_rx_checks),
+                                 NULL, NULL, NULL, NULL);
+
+  if(valid) {
+    int bus = GET_BUS(to_push);
+    int addr = GET_ADDR(to_push);
+
+    if(bus == 0) {
+      if (!tesla_powertrain) {
+        if(addr == 0x370) {
+          // Steering angle: (0.1 * val) - 819.2 in deg.
+          // Store it 1/10 deg to match steering request
+          int angle_meas_new = (((GET_BYTE(to_push, 4) & 0x3FU) << 8) | GET_BYTE(to_push, 5)) - 8192U;
+          update_sample(&angle_meas, angle_meas_new);
+        }
+      }
+
+      if(addr == (tesla_powertrain ? 0x116 : 0x118)) {
+        // Vehicle speed: ((0.05 * val) - 25) * MPH_TO_MPS
+        float speed = (((((GET_BYTE(to_push, 3) & 0x0FU) << 8) | (GET_BYTE(to_push, 2))) * 0.05) - 25) * 0.447;
+        vehicle_moving = ABS(speed) > 0.1;
+        update_sample(&vehicle_speed, ROUND(speed * VEHICLE_SPEED_FACTOR));
+      }
+
+      if(addr == (tesla_powertrain ? 0x106 : 0x108)) {
+        // Gas pressed
+        gas_pressed = (GET_BYTE(to_push, 6) != 0U);
+      }
+
+      if(addr == (tesla_powertrain ? 0x1f8 : 0x20a)) {
+        // Brake pressed
+        brake_pressed = (((GET_BYTE(to_push, 0) & 0x0CU) >> 2) != 1U);
+      }
+
+      if(addr == (tesla_powertrain ? 0x256 : 0x368)) {
+        // Cruise state
+        int cruise_state = (GET_BYTE(to_push, 1) >> 4);
+        bool cruise_engaged = (cruise_state == 2) ||  // ENABLED
+                              (cruise_state == 3) ||  // STANDSTILL
+                              (cruise_state == 4) ||  // OVERRIDE
+                              (cruise_state == 6) ||  // PRE_FAULT
+                              (cruise_state == 7);    // PRE_CANCEL
+        pcm_cruise_check(cruise_engaged);
+      }
+    }
+
+    if (bus == 2) {
+      int das_control_addr = (tesla_powertrain ? 0x2bf : 0x2b9);
+      if (tesla_longitudinal && (addr == das_control_addr)) {
+        // "AEB_ACTIVE"
+        tesla_stock_aeb = ((GET_BYTE(to_push, 2) & 0x03U) == 1U);
+      }
+    }
+
+    if (tesla_powertrain) {
+      // 0x2bf: DAS_control should not be received on bus 0
+      generic_rx_checks((addr == 0x2bf) && (bus == 0));
+    } else {
+      // 0x488: DAS_steeringControl should not be received on bus 0
+      generic_rx_checks((addr == 0x488) && (bus == 0));
+    }
+  }
+
+  return valid;
+}
+
+
+static int tesla_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  bool violation = false;
+
+  if(!msg_allowed(to_send,
+                  tesla_powertrain ? TESLA_PT_TX_MSGS : TESLA_TX_MSGS,
+                  tesla_powertrain ? TESLA_PT_TX_LEN : TESLA_TX_LEN)) {
+    tx = 0;
+  }
+
+  if(!tesla_powertrain && (addr == 0x488)) {
+    // Steering control: (0.1 * val) - 1638.35 in deg.
+    // We use 1/10 deg as a unit here
+    int raw_angle_can = (((GET_BYTE(to_send, 0) & 0x7FU) << 8) | GET_BYTE(to_send, 1));
+    int desired_angle = raw_angle_can - 16384;
+    int steer_control_type = GET_BYTE(to_send, 2) >> 6;
+    bool steer_control_enabled = (steer_control_type != 0) &&  // NONE
+                                 (steer_control_type != 3);    // DISABLED
+
+    if (steer_angle_cmd_checks(desired_angle, steer_control_enabled, TESLA_STEERING_LIMITS)) {
+      violation = true;
+    }
+  }
+
+  if (!tesla_powertrain && (addr == 0x45)) {
+    // No button other than cancel can be sent by us
+    int control_lever_status = (GET_BYTE(to_send, 0) & 0x3FU);
+    if (control_lever_status != 1) {
+      violation = true;
+    }
+  }
+
+  if(addr == (tesla_powertrain ? 0x2bf : 0x2b9)) {
+    // DAS_control: longitudinal control message
+    if (tesla_longitudinal) {
+      // No AEB events may be sent by openpilot
+      int aeb_event = GET_BYTE(to_send, 2) & 0x03U;
+      if (aeb_event != 0) {
+        violation = true;
+      }
+
+      // Don't send messages when the stock AEB system is active
+      if (tesla_stock_aeb) {
+        violation = true;
+      }
+
+      // Don't allow any acceleration limits above the safety limits
+      int raw_accel_max = ((GET_BYTE(to_send, 6) & 0x1FU) << 4) | (GET_BYTE(to_send, 5) >> 4);
+      int raw_accel_min = ((GET_BYTE(to_send, 5) & 0x0FU) << 5) | (GET_BYTE(to_send, 4) >> 3);
+      violation |= longitudinal_accel_checks(raw_accel_max, TESLA_LONG_LIMITS);
+      violation |= longitudinal_accel_checks(raw_accel_min, TESLA_LONG_LIMITS);
+    } else {
+      violation = true;
+    }
+  }
+
+  if (violation) {
+    tx = 0;
+  }
+
+  return tx;
+}
+
+static int tesla_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  if(bus_num == 0) {
+    // Chassis/PT to autopilot
+    bus_fwd = 2;
+  }
+
+  if(bus_num == 2) {
+    // Autopilot to chassis/PT
+    int das_control_addr = (tesla_powertrain ? 0x2bf : 0x2b9);
+
+    bool block_msg = false;
+    if (!tesla_powertrain && (addr == 0x488)) {
+      block_msg = true;
+    }
+
+    if (tesla_longitudinal && (addr == das_control_addr) && !tesla_stock_aeb) {
+      block_msg = true;
+    }
+
+    if(!block_msg) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+static const addr_checks* tesla_init(uint16_t param) {
+  tesla_powertrain = GET_FLAG(param, TESLA_FLAG_POWERTRAIN);
+  tesla_longitudinal = GET_FLAG(param, TESLA_FLAG_LONGITUDINAL_CONTROL);
+
+  return tesla_powertrain ? (&tesla_pt_rx_checks) : (&tesla_rx_checks);
+}
+
+const safety_hooks tesla_hooks = {
+  .init = tesla_init,
+  .rx = tesla_rx_hook,
+  .tx = tesla_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = tesla_fwd_hook,
+};

panda/board/safety/safety_toyota.h

@@ -0,0 +1,267 @@
+const SteeringLimits TOYOTA_STEERING_LIMITS = {
+  .max_steer = 1500,
+  .max_rate_up = 15,          // ramp up slow
+  .max_rate_down = 25,        // ramp down fast
+  .max_torque_error = 350,    // max torque cmd in excess of motor torque
+  .max_rt_delta = 450,        // the real time limit is 1800/sec, a 20% buffer
+  .max_rt_interval = 250000,
+  .type = TorqueMotorLimited,
+
+  // the EPS faults when the steering angle rate is above a certain threshold for too long. to prevent this,
+  // we allow setting STEER_REQUEST bit to 0 while maintaining the requested torque value for a single frame
+  .min_valid_request_frames = 18,
+  .max_invalid_request_frames = 1,
+  .min_valid_request_rt_interval = 170000,  // 170ms; a ~10% buffer on cutting every 19 frames
+  .has_steer_req_tolerance = true,
+};
+
+// longitudinal limits
+const LongitudinalLimits TOYOTA_LONG_LIMITS = {
+  .max_accel = 2000,   // 2.0 m/s2
+  .min_accel = -3500,  // -3.5 m/s2
+};
+
+// panda interceptor threshold needs to be equivalent to openpilot threshold to avoid controls mismatches
+// If thresholds are mismatched then it is possible for panda to see the gas fall and rise while openpilot is in the pre-enabled state
+// Threshold calculated from DBC gains: round((((15 + 75.555) / 0.159375) + ((15 + 151.111) / 0.159375)) / 2) = 805
+const int TOYOTA_GAS_INTERCEPTOR_THRSLD = 805;
+#define TOYOTA_GET_INTERCEPTOR(msg) (((GET_BYTE((msg), 0) << 8) + GET_BYTE((msg), 1) + (GET_BYTE((msg), 2) << 8) + GET_BYTE((msg), 3)) / 2U) // avg between 2 tracks
+
+const CanMsg TOYOTA_TX_MSGS[] = {{0x283, 0, 7}, {0x2E6, 0, 8}, {0x2E7, 0, 8}, {0x33E, 0, 7}, {0x344, 0, 8}, {0x365, 0, 7}, {0x366, 0, 7}, {0x4CB, 0, 8},  // DSU bus 0
+                                 {0x128, 1, 6}, {0x141, 1, 4}, {0x160, 1, 8}, {0x161, 1, 7}, {0x470, 1, 4},  // DSU bus 1
+                                 {0x2E4, 0, 5}, {0x191, 0, 8}, {0x411, 0, 8}, {0x412, 0, 8}, {0x343, 0, 8}, {0x1D2, 0, 8},  // LKAS + ACC
+                                 {0x200, 0, 6}};  // interceptor
+
+AddrCheckStruct toyota_addr_checks[] = {
+  {.msg = {{ 0xaa, 0, 8, .check_checksum = false, .expected_timestep = 12000U}, { 0 }, { 0 }}},
+  {.msg = {{0x260, 0, 8, .check_checksum = true, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{0x1D2, 0, 8, .check_checksum = true, .expected_timestep = 30000U}, { 0 }, { 0 }}},
+  {.msg = {{0x224, 0, 8, .check_checksum = false, .expected_timestep = 25000U},
+           {0x226, 0, 8, .check_checksum = false, .expected_timestep = 25000U}, { 0 }}},
+};
+#define TOYOTA_ADDR_CHECKS_LEN (sizeof(toyota_addr_checks) / sizeof(toyota_addr_checks[0]))
+addr_checks toyota_rx_checks = {toyota_addr_checks, TOYOTA_ADDR_CHECKS_LEN};
+
+// safety param flags
+// first byte is for eps factor, second is for flags
+const uint32_t TOYOTA_PARAM_OFFSET = 8U;
+const uint32_t TOYOTA_EPS_FACTOR = (1U << TOYOTA_PARAM_OFFSET) - 1U;
+const uint32_t TOYOTA_PARAM_ALT_BRAKE = 1U << TOYOTA_PARAM_OFFSET;
+const uint32_t TOYOTA_PARAM_STOCK_LONGITUDINAL = 2U << TOYOTA_PARAM_OFFSET;
+const uint32_t TOYOTA_PARAM_LTA = 4U << TOYOTA_PARAM_OFFSET;
+
+bool toyota_alt_brake = false;
+bool toyota_stock_longitudinal = false;
+bool toyota_lta = false;
+int toyota_dbc_eps_torque_factor = 100;   // conversion factor for STEER_TORQUE_EPS in %: see dbc file
+
+static uint32_t toyota_compute_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+  int len = GET_LEN(to_push);
+  uint8_t checksum = (uint8_t)(addr) + (uint8_t)((unsigned int)(addr) >> 8U) + (uint8_t)(len);
+  for (int i = 0; i < (len - 1); i++) {
+    checksum += (uint8_t)GET_BYTE(to_push, i);
+  }
+  return checksum;
+}
+
+static uint32_t toyota_get_checksum(CANPacket_t *to_push) {
+  int checksum_byte = GET_LEN(to_push) - 1U;
+  return (uint8_t)(GET_BYTE(to_push, checksum_byte));
+}
+
+static int toyota_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &toyota_rx_checks,
+                                 toyota_get_checksum, toyota_compute_checksum, NULL, NULL);
+
+  if (valid && (GET_BUS(to_push) == 0U)) {
+    int addr = GET_ADDR(to_push);
+
+    // get eps motor torque (0.66 factor in dbc)
+    if (addr == 0x260) {
+      int torque_meas_new = (GET_BYTE(to_push, 5) << 8) | GET_BYTE(to_push, 6);
+      torque_meas_new = to_signed(torque_meas_new, 16);
+
+      // scale by dbc_factor
+      torque_meas_new = (torque_meas_new * toyota_dbc_eps_torque_factor) / 100;
+
+      // update array of sample
+      update_sample(&torque_meas, torque_meas_new);
+
+      // increase torque_meas by 1 to be conservative on rounding
+      torque_meas.min--;
+      torque_meas.max++;
+    }
+
+    // enter controls on rising edge of ACC, exit controls on ACC off
+    // exit controls on rising edge of gas press
+    if (addr == 0x1D2) {
+      // 5th bit is CRUISE_ACTIVE
+      bool cruise_engaged = GET_BIT(to_push, 5U) != 0U;
+      pcm_cruise_check(cruise_engaged);
+
+      // sample gas pedal
+      if (!gas_interceptor_detected) {
+        gas_pressed = GET_BIT(to_push, 4U) == 0U;
+      }
+    }
+
+    if (addr == 0xaa) {
+      // check that all wheel speeds are at zero value with offset
+      bool standstill = (GET_BYTES(to_push, 0, 4) == 0x6F1A6F1AU) && (GET_BYTES(to_push, 4, 4) == 0x6F1A6F1AU);
+      vehicle_moving = !standstill;
+    }
+
+    // most cars have brake_pressed on 0x226, corolla and rav4 on 0x224
+    if (((addr == 0x224) && toyota_alt_brake) || ((addr == 0x226) && !toyota_alt_brake)) {
+      uint8_t bit = (addr == 0x224) ? 5U : 37U;
+      brake_pressed = GET_BIT(to_push, bit) != 0U;
+    }
+
+    // sample gas interceptor
+    if (addr == 0x201) {
+      gas_interceptor_detected = 1;
+      int gas_interceptor = TOYOTA_GET_INTERCEPTOR(to_push);
+      gas_pressed = gas_interceptor > TOYOTA_GAS_INTERCEPTOR_THRSLD;
+
+      // TODO: remove this, only left in for gas_interceptor_prev test
+      gas_interceptor_prev = gas_interceptor;
+    }
+
+    generic_rx_checks((addr == 0x2E4));
+  }
+  return valid;
+}
+
+static int toyota_tx_hook(CANPacket_t *to_send) {
+
+  int tx = 1;
+  int addr = GET_ADDR(to_send);
+  int bus = GET_BUS(to_send);
+
+  if (!msg_allowed(to_send, TOYOTA_TX_MSGS, sizeof(TOYOTA_TX_MSGS)/sizeof(TOYOTA_TX_MSGS[0]))) {
+    tx = 0;
+  }
+
+  // Check if msg is sent on BUS 0
+  if (bus == 0) {
+
+    // GAS PEDAL: safety check
+    if (addr == 0x200) {
+      if (longitudinal_interceptor_checks(to_send)) {
+        tx = 0;
+      }
+    }
+
+    // ACCEL: safety check on byte 1-2
+    if (addr == 0x343) {
+      int desired_accel = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
+      desired_accel = to_signed(desired_accel, 16);
+
+      bool violation = false;
+      violation |= longitudinal_accel_checks(desired_accel, TOYOTA_LONG_LIMITS);
+
+      // only ACC messages that cancel are allowed when openpilot is not controlling longitudinal
+      if (toyota_stock_longitudinal) {
+        bool cancel_req = GET_BIT(to_send, 24U) != 0U;
+        if (!cancel_req) {
+          violation = true;
+        }
+        if (desired_accel != TOYOTA_LONG_LIMITS.inactive_accel) {
+          violation = true;
+        }
+      }
+
+      if (violation) {
+        tx = 0;
+      }
+    }
+
+    // AEB: block all actuation. only used when DSU is unplugged
+    if (addr == 0x283) {
+      // only allow the checksum, which is the last byte
+      bool block = (GET_BYTES(to_send, 0, 4) != 0U) || (GET_BYTE(to_send, 4) != 0U) || (GET_BYTE(to_send, 5) != 0U);
+      if (block) {
+        tx = 0;
+      }
+    }
+
+    // LTA steering check
+    // only sent to prevent dash errors, no actuation is accepted
+    if (addr == 0x191) {
+      // check the STEER_REQUEST, STEER_REQUEST_2, SETME_X64 STEER_ANGLE_CMD signals
+      bool lta_request = GET_BIT(to_send, 0U) != 0U;
+      bool lta_request2 = GET_BIT(to_send, 25U) != 0U;
+      int setme_x64 = GET_BYTE(to_send, 5);
+      int lta_angle = (GET_BYTE(to_send, 1) << 8) | GET_BYTE(to_send, 2);
+      lta_angle = to_signed(lta_angle, 16);
+
+      // block LTA msgs with actuation requests
+      if (lta_request || lta_request2 || (lta_angle != 0) || (setme_x64 != 0)) {
+        tx = 0;
+      }
+    }
+
+    // STEER: safety check on bytes 2-3
+    if (addr == 0x2E4) {
+      int desired_torque = (GET_BYTE(to_send, 1) << 8) | GET_BYTE(to_send, 2);
+      desired_torque = to_signed(desired_torque, 16);
+      bool steer_req = GET_BIT(to_send, 0U) != 0U;
+      if (steer_torque_cmd_checks(desired_torque, steer_req, TOYOTA_STEERING_LIMITS)) {
+        tx = 0;
+      }
+      // When using LTA (angle control), assert no actuation on LKA message
+      if (toyota_lta && ((desired_torque != 0) || steer_req)) {
+        tx = 0;
+      }
+    }
+  }
+
+  return tx;
+}
+
+static const addr_checks* toyota_init(uint16_t param) {
+  gas_interceptor_detected = 0;
+  toyota_alt_brake = GET_FLAG(param, TOYOTA_PARAM_ALT_BRAKE);
+  toyota_stock_longitudinal = GET_FLAG(param, TOYOTA_PARAM_STOCK_LONGITUDINAL);
+  toyota_dbc_eps_torque_factor = param & TOYOTA_EPS_FACTOR;
+
+#ifdef ALLOW_DEBUG
+  toyota_lta = GET_FLAG(param, TOYOTA_PARAM_LTA);
+#else
+  toyota_lta = false;
+#endif
+  return &toyota_rx_checks;
+}
+
+static int toyota_fwd_hook(int bus_num, int addr) {
+
+  int bus_fwd = -1;
+
+  if (bus_num == 0) {
+    bus_fwd = 2;
+  }
+
+  if (bus_num == 2) {
+    // block stock lkas messages and stock acc messages (if OP is doing ACC)
+    // in TSS2, 0x191 is LTA which we need to block to avoid controls collision
+    int is_lkas_msg = ((addr == 0x2E4) || (addr == 0x412) || (addr == 0x191));
+    // in TSS2 the camera does ACC as well, so filter 0x343
+    int is_acc_msg = (addr == 0x343);
+    int block_msg = is_lkas_msg || (is_acc_msg && !toyota_stock_longitudinal);
+    if (!block_msg) {
+      bus_fwd = 0;
+    }
+  }
+
+  return bus_fwd;
+}
+
+const safety_hooks toyota_hooks = {
+  .init = toyota_init,
+  .rx = toyota_rx_hook,
+  .tx = toyota_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = toyota_fwd_hook,
+};

panda/board/safety/safety_volkswagen_common.h

@@ -0,0 +1,10 @@
+#ifndef SAFETY_VOLKSWAGEN_COMMON_H
+#define SAFETY_VOLKSWAGEN_COMMON_H
+
+const uint16_t FLAG_VOLKSWAGEN_LONG_CONTROL = 1;
+
+bool volkswagen_longitudinal = false;
+bool volkswagen_set_button_prev = false;
+bool volkswagen_resume_button_prev = false;
+
+#endif

panda/board/safety/safety_volkswagen_mqb.h

@@ -0,0 +1,303 @@
+#include "safety_volkswagen_common.h"
+
+// lateral limits
+const SteeringLimits VOLKSWAGEN_MQB_STEERING_LIMITS = {
+  .max_steer = 300,              // 3.0 Nm (EPS side max of 3.0Nm with fault if violated)
+  .max_rt_delta = 75,            // 4 max rate up * 50Hz send rate * 250000 RT interval / 1000000 = 50 ; 50 * 1.5 for safety pad = 75
+  .max_rt_interval = 250000,     // 250ms between real time checks
+  .max_rate_up = 4,              // 2.0 Nm/s RoC limit (EPS rack has own soft-limit of 5.0 Nm/s)
+  .max_rate_down = 10,           // 5.0 Nm/s RoC limit (EPS rack has own soft-limit of 5.0 Nm/s)
+  .driver_torque_allowance = 80,
+  .driver_torque_factor = 3,
+  .type = TorqueDriverLimited,
+};
+
+// longitudinal limits
+// acceleration in m/s2 * 1000 to avoid floating point math
+const LongitudinalLimits VOLKSWAGEN_MQB_LONG_LIMITS = {
+  .max_accel = 2000,
+  .min_accel = -3500,
+  .inactive_accel = 3010,  // VW sends one increment above the max range when inactive
+};
+
+#define MSG_ESP_19      0x0B2   // RX from ABS, for wheel speeds
+#define MSG_LH_EPS_03   0x09F   // RX from EPS, for driver steering torque
+#define MSG_ESP_05      0x106   // RX from ABS, for brake switch state
+#define MSG_TSK_06      0x120   // RX from ECU, for ACC status from drivetrain coordinator
+#define MSG_MOTOR_20    0x121   // RX from ECU, for driver throttle input
+#define MSG_ACC_06      0x122   // TX by OP, ACC control instructions to the drivetrain coordinator
+#define MSG_HCA_01      0x126   // TX by OP, Heading Control Assist steering torque
+#define MSG_GRA_ACC_01  0x12B   // TX by OP, ACC control buttons for cancel/resume
+#define MSG_ACC_07      0x12E   // TX by OP, ACC control instructions to the drivetrain coordinator
+#define MSG_ACC_02      0x30C   // TX by OP, ACC HUD data to the instrument cluster
+#define MSG_MOTOR_14    0x3BE   // RX from ECU, for brake switch status
+#define MSG_LDW_02      0x397   // TX by OP, Lane line recognition and text alerts
+
+// Transmit of GRA_ACC_01 is allowed on bus 0 and 2 to keep compatibility with gateway and camera integration
+const CanMsg VOLKSWAGEN_MQB_STOCK_TX_MSGS[] = {{MSG_HCA_01, 0, 8}, {MSG_GRA_ACC_01, 0, 8}, {MSG_GRA_ACC_01, 2, 8}, {MSG_LDW_02, 0, 8}};
+const CanMsg VOLKSWAGEN_MQB_LONG_TX_MSGS[] = {{MSG_HCA_01, 0, 8}, {MSG_LDW_02, 0, 8},
+                                              {MSG_ACC_02, 0, 8}, {MSG_ACC_06, 0, 8}, {MSG_ACC_07, 0, 8}};
+
+AddrCheckStruct volkswagen_mqb_addr_checks[] = {
+  {.msg = {{MSG_ESP_19, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_LH_EPS_03, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_ESP_05, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_TSK_06, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_MOTOR_20, 0, 8, .check_checksum = true, .max_counter = 15U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_MOTOR_14, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 100000U}, { 0 }, { 0 }}},
+};
+#define VOLKSWAGEN_MQB_ADDR_CHECKS_LEN (sizeof(volkswagen_mqb_addr_checks) / sizeof(volkswagen_mqb_addr_checks[0]))
+addr_checks volkswagen_mqb_rx_checks = {volkswagen_mqb_addr_checks, VOLKSWAGEN_MQB_ADDR_CHECKS_LEN};
+
+uint8_t volkswagen_crc8_lut_8h2f[256]; // Static lookup table for CRC8 poly 0x2F, aka 8H2F/AUTOSAR
+bool volkswagen_mqb_brake_pedal_switch = false;
+bool volkswagen_mqb_brake_pressure_detected = false;
+
+static uint32_t volkswagen_mqb_get_checksum(CANPacket_t *to_push) {
+  return (uint8_t)GET_BYTE(to_push, 0);
+}
+
+static uint8_t volkswagen_mqb_get_counter(CANPacket_t *to_push) {
+  // MQB message counters are consistently found at LSB 8.
+  return (uint8_t)GET_BYTE(to_push, 1) & 0xFU;
+}
+
+static uint32_t volkswagen_mqb_compute_crc(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+  int len = GET_LEN(to_push);
+
+  // This is CRC-8H2F/AUTOSAR with a twist. See the OpenDBC implementation
+  // of this algorithm for a version with explanatory comments.
+
+  uint8_t crc = 0xFFU;
+  for (int i = 1; i < len; i++) {
+    crc ^= (uint8_t)GET_BYTE(to_push, i);
+    crc = volkswagen_crc8_lut_8h2f[crc];
+  }
+
+  uint8_t counter = volkswagen_mqb_get_counter(to_push);
+  switch(addr) {
+    case MSG_LH_EPS_03:
+      crc ^= (uint8_t[]){0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5,0xF5}[counter];
+      break;
+    case MSG_ESP_05:
+      crc ^= (uint8_t[]){0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07,0x07}[counter];
+      break;
+    case MSG_TSK_06:
+      crc ^= (uint8_t[]){0xC4,0xE2,0x4F,0xE4,0xF8,0x2F,0x56,0x81,0x9F,0xE5,0x83,0x44,0x05,0x3F,0x97,0xDF}[counter];
+      break;
+    case MSG_MOTOR_20:
+      crc ^= (uint8_t[]){0xE9,0x65,0xAE,0x6B,0x7B,0x35,0xE5,0x5F,0x4E,0xC7,0x86,0xA2,0xBB,0xDD,0xEB,0xB4}[counter];
+      break;
+    default: // Undefined CAN message, CRC check expected to fail
+      break;
+  }
+  crc = volkswagen_crc8_lut_8h2f[crc];
+
+  return (uint8_t)(crc ^ 0xFFU);
+}
+
+static const addr_checks* volkswagen_mqb_init(uint16_t param) {
+  UNUSED(param);
+
+  volkswagen_set_button_prev = false;
+  volkswagen_resume_button_prev = false;
+  volkswagen_mqb_brake_pedal_switch = false;
+  volkswagen_mqb_brake_pressure_detected = false;
+
+#ifdef ALLOW_DEBUG
+  volkswagen_longitudinal = GET_FLAG(param, FLAG_VOLKSWAGEN_LONG_CONTROL);
+#endif
+  gen_crc_lookup_table_8(0x2F, volkswagen_crc8_lut_8h2f);
+  return &volkswagen_mqb_rx_checks;
+}
+
+static int volkswagen_mqb_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &volkswagen_mqb_rx_checks,
+                                 volkswagen_mqb_get_checksum, volkswagen_mqb_compute_crc, volkswagen_mqb_get_counter, NULL);
+
+  if (valid && (GET_BUS(to_push) == 0U)) {
+    int addr = GET_ADDR(to_push);
+
+    // Update in-motion state by sampling wheel speeds
+    if (addr == MSG_ESP_19) {
+      // sum 4 wheel speeds
+      int speed = 0;
+      for (uint8_t i = 0U; i < 8U; i += 2U) {
+        int wheel_speed = GET_BYTE(to_push, i) | (GET_BYTE(to_push, i + 1U) << 8);
+        speed += wheel_speed;
+      }
+      // Check all wheel speeds for any movement
+      vehicle_moving = speed > 0;
+    }
+
+    // Update driver input torque samples
+    // Signal: LH_EPS_03.EPS_Lenkmoment (absolute torque)
+    // Signal: LH_EPS_03.EPS_VZ_Lenkmoment (direction)
+    if (addr == MSG_LH_EPS_03) {
+      int torque_driver_new = GET_BYTE(to_push, 5) | ((GET_BYTE(to_push, 6) & 0x1FU) << 8);
+      int sign = (GET_BYTE(to_push, 6) & 0x80U) >> 7;
+      if (sign == 1) {
+        torque_driver_new *= -1;
+      }
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    if (addr == MSG_TSK_06) {
+      // When using stock ACC, enter controls on rising edge of stock ACC engage, exit on disengage
+      // Always exit controls on main switch off
+      // Signal: TSK_06.TSK_Status
+      int acc_status = (GET_BYTE(to_push, 3) & 0x7U);
+      bool cruise_engaged = (acc_status == 3) || (acc_status == 4) || (acc_status == 5);
+      acc_main_on = cruise_engaged || (acc_status == 2);
+
+      if (!volkswagen_longitudinal) {
+        pcm_cruise_check(cruise_engaged);
+      }
+
+      if (!acc_main_on) {
+        controls_allowed = false;
+      }
+    }
+
+    if (addr == MSG_GRA_ACC_01) {
+      // If using openpilot longitudinal, enter controls on falling edge of Set or Resume with main switch on
+      // Signal: GRA_ACC_01.GRA_Tip_Setzen
+      // Signal: GRA_ACC_01.GRA_Tip_Wiederaufnahme
+      if (volkswagen_longitudinal) {
+        bool set_button = GET_BIT(to_push, 16U);
+        bool resume_button = GET_BIT(to_push, 19U);
+        if ((volkswagen_set_button_prev && !set_button) || (volkswagen_resume_button_prev && !resume_button)) {
+          controls_allowed = acc_main_on;
+        }
+        volkswagen_set_button_prev = set_button;
+        volkswagen_resume_button_prev = resume_button;
+      }
+      // Always exit controls on rising edge of Cancel
+      // Signal: GRA_ACC_01.GRA_Abbrechen
+      if (GET_BIT(to_push, 13U) == 1U) {
+        controls_allowed = false;
+      }
+    }
+
+    // Signal: Motor_20.MO_Fahrpedalrohwert_01
+    if (addr == MSG_MOTOR_20) {
+      gas_pressed = ((GET_BYTES(to_push, 0, 4) >> 12) & 0xFFU) != 0U;
+    }
+
+    // Signal: Motor_14.MO_Fahrer_bremst (ECU detected brake pedal switch F63)
+    if (addr == MSG_MOTOR_14) {
+      volkswagen_mqb_brake_pedal_switch = (GET_BYTE(to_push, 3) & 0x10U) >> 4;
+    }
+
+    // Signal: ESP_05.ESP_Fahrer_bremst (ESP detected driver brake pressure above platform specified threshold)
+    if (addr == MSG_ESP_05) {
+      volkswagen_mqb_brake_pressure_detected = (GET_BYTE(to_push, 3) & 0x4U) >> 2;
+    }
+
+    brake_pressed = volkswagen_mqb_brake_pedal_switch || volkswagen_mqb_brake_pressure_detected;
+
+    generic_rx_checks((addr == MSG_HCA_01));
+  }
+  return valid;
+}
+
+static int volkswagen_mqb_tx_hook(CANPacket_t *to_send) {
+  int addr = GET_ADDR(to_send);
+  int tx = 1;
+
+  if (volkswagen_longitudinal) {
+    tx = msg_allowed(to_send, VOLKSWAGEN_MQB_LONG_TX_MSGS, sizeof(VOLKSWAGEN_MQB_LONG_TX_MSGS) / sizeof(VOLKSWAGEN_MQB_LONG_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, VOLKSWAGEN_MQB_STOCK_TX_MSGS, sizeof(VOLKSWAGEN_MQB_STOCK_TX_MSGS) / sizeof(VOLKSWAGEN_MQB_STOCK_TX_MSGS[0]));
+  }
+
+  // Safety check for HCA_01 Heading Control Assist torque
+  // Signal: HCA_01.HCA_01_LM_Offset (absolute torque)
+  // Signal: HCA_01.HCA_01_LM_OffSign (direction)
+  if (addr == MSG_HCA_01) {
+    int desired_torque = GET_BYTE(to_send, 2) | ((GET_BYTE(to_send, 3) & 0x1U) << 8);
+    bool sign = GET_BIT(to_send, 31U);
+    if (sign) {
+      desired_torque *= -1;
+    }
+
+    if (steer_torque_cmd_checks(desired_torque, -1, VOLKSWAGEN_MQB_STEERING_LIMITS)) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for both ACC_06 and ACC_07 acceleration requests
+  // To avoid floating point math, scale upward and compare to pre-scaled safety m/s2 boundaries
+  if ((addr == MSG_ACC_06) || (addr == MSG_ACC_07)) {
+    bool violation = false;
+    int desired_accel = 0;
+
+    if (addr == MSG_ACC_06) {
+      // Signal: ACC_06.ACC_Sollbeschleunigung_02 (acceleration in m/s2, scale 0.005, offset -7.22)
+      desired_accel = ((((GET_BYTE(to_send, 4) & 0x7U) << 8) | GET_BYTE(to_send, 3)) * 5U) - 7220U;
+    } else {
+      // Signal: ACC_07.ACC_Folgebeschl (acceleration in m/s2, scale 0.03, offset -4.6)
+      int secondary_accel = (GET_BYTE(to_send, 4) * 30U) - 4600U;
+      violation |= (secondary_accel != 3020);  // enforce always inactive (one increment above max range) at this time
+      // Signal: ACC_07.ACC_Sollbeschleunigung_02 (acceleration in m/s2, scale 0.005, offset -7.22)
+      desired_accel = (((GET_BYTE(to_send, 7) << 3) | ((GET_BYTE(to_send, 6) & 0xE0U) >> 5)) * 5U) - 7220U;
+    }
+
+    violation |= longitudinal_accel_checks(desired_accel, VOLKSWAGEN_MQB_LONG_LIMITS);
+
+    if (violation) {
+      tx = 0;
+    }
+  }
+
+  // FORCE CANCEL: ensuring that only the cancel button press is sent when controls are off.
+  // This avoids unintended engagements while still allowing resume spam
+  if ((addr == MSG_GRA_ACC_01) && !controls_allowed) {
+    // disallow resume and set: bits 16 and 19
+    if ((GET_BYTE(to_send, 2) & 0x9U) != 0U) {
+      tx = 0;
+    }
+  }
+
+  // 1 allows the message through
+  return tx;
+}
+
+static int volkswagen_mqb_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  switch (bus_num) {
+    case 0:
+      // Forward all traffic from the Extended CAN onward
+      bus_fwd = 2;
+      break;
+    case 2:
+      if ((addr == MSG_HCA_01) || (addr == MSG_LDW_02)) {
+        // openpilot takes over LKAS steering control and related HUD messages from the camera
+        bus_fwd = -1;
+      } else if (volkswagen_longitudinal && ((addr == MSG_ACC_02) || (addr == MSG_ACC_06) || (addr == MSG_ACC_07))) {
+        // openpilot takes over acceleration/braking control and related HUD messages from the stock ACC radar
+        bus_fwd = -1;
+      } else {
+        // Forward all remaining traffic from Extended CAN devices to J533 gateway
+        bus_fwd = 0;
+      }
+      break;
+    default:
+      // No other buses should be in use; fallback to do-not-forward
+      bus_fwd = -1;
+      break;
+  }
+
+  return bus_fwd;
+}
+
+const safety_hooks volkswagen_mqb_hooks = {
+  .init = volkswagen_mqb_init,
+  .rx = volkswagen_mqb_rx_hook,
+  .tx = volkswagen_mqb_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = volkswagen_mqb_fwd_hook,
+};

panda/board/safety/safety_volkswagen_pq.h

@@ -0,0 +1,264 @@
+#include "safety_volkswagen_common.h"
+
+// lateral limits
+const SteeringLimits VOLKSWAGEN_PQ_STEERING_LIMITS = {
+  .max_steer = 300,                // 3.0 Nm (EPS side max of 3.0Nm with fault if violated)
+  .max_rt_delta = 113,             // 6 max rate up * 50Hz send rate * 250000 RT interval / 1000000 = 75 ; 125 * 1.5 for safety pad = 113
+  .max_rt_interval = 250000,       // 250ms between real time checks
+  .max_rate_up = 6,                // 3.0 Nm/s RoC limit (EPS rack has own soft-limit of 5.0 Nm/s)
+  .max_rate_down = 10,             // 5.0 Nm/s RoC limit (EPS rack has own soft-limit of 5.0 Nm/s)
+  .driver_torque_factor = 3,
+  .driver_torque_allowance = 80,
+  .type = TorqueDriverLimited,
+};
+
+// longitudinal limits
+// acceleration in m/s2 * 1000 to avoid floating point math
+const LongitudinalLimits VOLKSWAGEN_PQ_LONG_LIMITS = {
+  .max_accel = 2000,
+  .min_accel = -3500,
+  .inactive_accel = 3010,  // VW sends one increment above the max range when inactive
+};
+
+#define MSG_LENKHILFE_3         0x0D0   // RX from EPS, for steering angle and driver steering torque
+#define MSG_HCA_1               0x0D2   // TX by OP, Heading Control Assist steering torque
+#define MSG_BREMSE_1            0x1A0   // RX from ABS, for ego speed
+#define MSG_MOTOR_2             0x288   // RX from ECU, for CC state and brake switch state
+#define MSG_ACC_SYSTEM          0x368   // TX by OP, longitudinal acceleration controls
+#define MSG_MOTOR_3             0x380   // RX from ECU, for driver throttle input
+#define MSG_GRA_NEU             0x38A   // TX by OP, ACC control buttons for cancel/resume
+#define MSG_MOTOR_5             0x480   // RX from ECU, for ACC main switch state
+#define MSG_ACC_GRA_ANZEIGE     0x56A   // TX by OP, ACC HUD
+#define MSG_LDW_1               0x5BE   // TX by OP, Lane line recognition and text alerts
+
+// Transmit of GRA_Neu is allowed on bus 0 and 2 to keep compatibility with gateway and camera integration
+const CanMsg VOLKSWAGEN_PQ_STOCK_TX_MSGS[] = {{MSG_HCA_1, 0, 5}, {MSG_LDW_1, 0, 8},
+                                              {MSG_GRA_NEU, 0, 4}, {MSG_GRA_NEU, 2, 4}};
+const CanMsg VOLKSWAGEN_PQ_LONG_TX_MSGS[] =  {{MSG_HCA_1, 0, 5}, {MSG_LDW_1, 0, 8},
+                                              {MSG_ACC_SYSTEM, 0, 8}, {MSG_ACC_GRA_ANZEIGE, 0, 8}};
+
+AddrCheckStruct volkswagen_pq_addr_checks[] = {
+  {.msg = {{MSG_LENKHILFE_3, 0, 6, .check_checksum = true, .max_counter = 15U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_BREMSE_1, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_MOTOR_2, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_MOTOR_3, 0, 8, .check_checksum = false, .max_counter = 0U, .expected_timestep = 10000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_MOTOR_5, 0, 8, .check_checksum = true, .max_counter = 0U, .expected_timestep = 20000U}, { 0 }, { 0 }}},
+  {.msg = {{MSG_GRA_NEU, 0, 4, .check_checksum = true, .max_counter = 15U, .expected_timestep = 33000U}, { 0 }, { 0 }}},
+};
+#define VOLKSWAGEN_PQ_ADDR_CHECKS_LEN (sizeof(volkswagen_pq_addr_checks) / sizeof(volkswagen_pq_addr_checks[0]))
+addr_checks volkswagen_pq_rx_checks = {volkswagen_pq_addr_checks, VOLKSWAGEN_PQ_ADDR_CHECKS_LEN};
+
+static uint32_t volkswagen_pq_get_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+
+  return (uint32_t)GET_BYTE(to_push, (addr == MSG_MOTOR_5) ? 7 : 0);
+}
+
+static uint8_t volkswagen_pq_get_counter(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+  uint8_t counter = 0U;
+
+  if (addr == MSG_LENKHILFE_3) {
+    counter = (uint8_t)(GET_BYTE(to_push, 1) & 0xF0U) >> 4;
+  } else if (addr == MSG_GRA_NEU) {
+    counter = (uint8_t)(GET_BYTE(to_push, 2) & 0xF0U) >> 4;
+  } else {
+    counter = 0U;
+  }
+
+  return counter;
+}
+
+static uint32_t volkswagen_pq_compute_checksum(CANPacket_t *to_push) {
+  int addr = GET_ADDR(to_push);
+  int len = GET_LEN(to_push);
+  uint8_t checksum = 0U;
+  int checksum_byte = (addr == MSG_MOTOR_5) ? 7 : 0;
+
+  // Simple XOR over the payload, except for the byte where the checksum lives.
+  for (int i = 0; i < len; i++) {
+    if (i != checksum_byte) {
+      checksum ^= (uint8_t)GET_BYTE(to_push, i);
+    }
+  }
+
+  return checksum;
+}
+
+static const addr_checks* volkswagen_pq_init(uint16_t param) {
+  UNUSED(param);
+
+  volkswagen_set_button_prev = false;
+  volkswagen_resume_button_prev = false;
+
+#ifdef ALLOW_DEBUG
+  volkswagen_longitudinal = GET_FLAG(param, FLAG_VOLKSWAGEN_LONG_CONTROL);
+#endif
+  return &volkswagen_pq_rx_checks;
+}
+
+static int volkswagen_pq_rx_hook(CANPacket_t *to_push) {
+
+  bool valid = addr_safety_check(to_push, &volkswagen_pq_rx_checks,
+                                volkswagen_pq_get_checksum, volkswagen_pq_compute_checksum, volkswagen_pq_get_counter, NULL);
+
+  if (valid && (GET_BUS(to_push) == 0U)) {
+    int addr = GET_ADDR(to_push);
+
+    // Update in-motion state from speed value.
+    // Signal: Bremse_1.Geschwindigkeit_neu__Bremse_1_
+    if (addr == MSG_BREMSE_1) {
+      int speed = ((GET_BYTE(to_push, 2) & 0xFEU) >> 1) | (GET_BYTE(to_push, 3) << 7);
+      vehicle_moving = speed > 0;
+    }
+
+    // Update driver input torque samples
+    // Signal: Lenkhilfe_3.LH3_LM (absolute torque)
+    // Signal: Lenkhilfe_3.LH3_LMSign (direction)
+    if (addr == MSG_LENKHILFE_3) {
+      int torque_driver_new = GET_BYTE(to_push, 2) | ((GET_BYTE(to_push, 3) & 0x3U) << 8);
+      int sign = (GET_BYTE(to_push, 3) & 0x4U) >> 2;
+      if (sign == 1) {
+        torque_driver_new *= -1;
+      }
+      update_sample(&torque_driver, torque_driver_new);
+    }
+
+    if (volkswagen_longitudinal) {
+      if (addr == MSG_MOTOR_5) {
+        // ACC main switch on is a prerequisite to enter controls, exit controls immediately on main switch off
+        // Signal: Motor_5.GRA_Hauptschalter
+        acc_main_on = GET_BIT(to_push, 50U);
+        if (!acc_main_on) {
+          controls_allowed = 0;
+        }
+      }
+
+      if (addr == MSG_GRA_NEU) {
+        // If ACC main switch is on, enter controls on falling edge of Set or Resume
+        // Signal: GRA_Neu.GRA_Neu_Setzen
+        // Signal: GRA_Neu.GRA_Neu_Recall
+        bool set_button = GET_BIT(to_push, 16U);
+        bool resume_button = GET_BIT(to_push, 17U);
+        if ((volkswagen_set_button_prev && !set_button) || (volkswagen_resume_button_prev && !resume_button)) {
+          controls_allowed = acc_main_on;
+        }
+        volkswagen_set_button_prev = set_button;
+        volkswagen_resume_button_prev = resume_button;
+        // Exit controls on rising edge of Cancel, override Set/Resume if present simultaneously
+        // Signal: GRA_ACC_01.GRA_Abbrechen
+        if (GET_BIT(to_push, 9U) == 1U) {
+          controls_allowed = 0;
+        }
+      }
+    } else {
+      if (addr == MSG_MOTOR_2) {
+        // Enter controls on rising edge of stock ACC, exit controls if stock ACC disengages
+        // Signal: Motor_2.GRA_Status
+        int acc_status = (GET_BYTE(to_push, 2) & 0xC0U) >> 6;
+        bool cruise_engaged = (acc_status == 1) || (acc_status == 2);
+        pcm_cruise_check(cruise_engaged);
+      }
+    }
+
+    // Signal: Motor_3.Fahrpedal_Rohsignal
+    if (addr == MSG_MOTOR_3) {
+      gas_pressed = (GET_BYTE(to_push, 2));
+    }
+
+    // Signal: Motor_2.Bremslichtschalter
+    if (addr == MSG_MOTOR_2) {
+      brake_pressed = (GET_BYTE(to_push, 2) & 0x1U);
+    }
+
+    generic_rx_checks((addr == MSG_HCA_1));
+  }
+  return valid;
+}
+
+static int volkswagen_pq_tx_hook(CANPacket_t *to_send) {
+  int addr = GET_ADDR(to_send);
+  int tx = 1;
+
+  if (volkswagen_longitudinal) {
+    tx = msg_allowed(to_send, VOLKSWAGEN_PQ_LONG_TX_MSGS, sizeof(VOLKSWAGEN_PQ_LONG_TX_MSGS) / sizeof(VOLKSWAGEN_PQ_LONG_TX_MSGS[0]));
+  } else {
+    tx = msg_allowed(to_send, VOLKSWAGEN_PQ_STOCK_TX_MSGS, sizeof(VOLKSWAGEN_PQ_STOCK_TX_MSGS) / sizeof(VOLKSWAGEN_PQ_STOCK_TX_MSGS[0]));
+  }
+
+  // Safety check for HCA_1 Heading Control Assist torque
+  // Signal: HCA_1.LM_Offset (absolute torque)
+  // Signal: HCA_1.LM_Offsign (direction)
+  if (addr == MSG_HCA_1) {
+    int desired_torque = GET_BYTE(to_send, 2) | ((GET_BYTE(to_send, 3) & 0x7FU) << 8);
+    desired_torque = desired_torque / 32;  // DBC scale from PQ network to centi-Nm
+    int sign = (GET_BYTE(to_send, 3) & 0x80U) >> 7;
+    if (sign == 1) {
+      desired_torque *= -1;
+    }
+
+    if (steer_torque_cmd_checks(desired_torque, -1, VOLKSWAGEN_PQ_STEERING_LIMITS)) {
+      tx = 0;
+    }
+  }
+
+  // Safety check for acceleration commands
+  // To avoid floating point math, scale upward and compare to pre-scaled safety m/s2 boundaries
+  if (addr == MSG_ACC_SYSTEM) {
+    // Signal: ACC_System.ACS_Sollbeschl (acceleration in m/s2, scale 0.005, offset -7.22)
+    int desired_accel = ((((GET_BYTE(to_send, 4) & 0x7U) << 8) | GET_BYTE(to_send, 3)) * 5U) - 7220U;
+
+    if (longitudinal_accel_checks(desired_accel, VOLKSWAGEN_PQ_LONG_LIMITS)) {
+      tx = 0;
+    }
+  }
+
+  // FORCE CANCEL: ensuring that only the cancel button press is sent when controls are off.
+  // This avoids unintended engagements while still allowing resume spam
+  if ((addr == MSG_GRA_NEU) && !controls_allowed) {
+    // Signal: GRA_Neu.GRA_Neu_Setzen
+    // Signal: GRA_Neu.GRA_Neu_Recall
+    if (GET_BIT(to_send, 16U) || GET_BIT(to_send, 17U)) {
+      tx = 0;
+    }
+  }
+
+  // 1 allows the message through
+  return tx;
+}
+
+static int volkswagen_pq_fwd_hook(int bus_num, int addr) {
+  int bus_fwd = -1;
+
+  switch (bus_num) {
+    case 0:
+      // Forward all traffic from the Extended CAN onward
+      bus_fwd = 2;
+      break;
+    case 2:
+      if ((addr == MSG_HCA_1) || (addr == MSG_LDW_1)) {
+        // openpilot takes over LKAS steering control and related HUD messages from the camera
+        bus_fwd = -1;
+      } else if (volkswagen_longitudinal && ((addr == MSG_ACC_SYSTEM) || (addr == MSG_ACC_GRA_ANZEIGE))) {
+        // openpilot takes over acceleration/braking control and related HUD messages from the stock ACC radar
+      } else {
+        // Forward all remaining traffic from Extended CAN devices to J533 gateway
+        bus_fwd = 0;
+      }
+      break;
+    default:
+      // No other buses should be in use; fallback to do-not-forward
+      bus_fwd = -1;
+      break;
+  }
+
+  return bus_fwd;
+}
+
+const safety_hooks volkswagen_pq_hooks = {
+  .init = volkswagen_pq_init,
+  .rx = volkswagen_pq_rx_hook,
+  .tx = volkswagen_pq_tx_hook,
+  .tx_lin = nooutput_tx_lin_hook,
+  .fwd = volkswagen_pq_fwd_hook,
+};

panda/board/safety_declarations.h

@@ -0,0 +1,243 @@
+#pragma once
+
+#define GET_BIT(msg, b) (((msg)->data[((b) / 8U)] >> ((b) % 8U)) & 0x1U)
+#define GET_BYTE(msg, b) ((msg)->data[(b)])
+#define GET_FLAG(value, mask) (((__typeof__(mask))(value) & (mask)) == (mask))
+
+uint32_t GET_BYTES(const CANPacket_t *msg, int start, int len) {
+  uint32_t ret = 0U;
+  for (int i = 0; i < len; i++) {
+    const uint8_t shift = i * 8;
+    ret |= (((uint32_t)msg->data[start + i]) << shift);
+  }
+  return ret;
+}
+
+const int MAX_WRONG_COUNTERS = 5;
+const uint8_t MAX_MISSED_MSGS = 10U;
+#define MAX_ADDR_CHECK_MSGS 3U
+// used to represent floating point vehicle speed in a sample_t
+#define VEHICLE_SPEED_FACTOR 100.0
+
+// sample struct that keeps 6 samples in memory
+struct sample_t {
+  int values[6];
+  int min;
+  int max;
+} sample_t_default = {.values = {0}, .min = 0, .max = 0};
+
+// safety code requires floats
+struct lookup_t {
+  float x[3];
+  float y[3];
+};
+
+typedef struct {
+  int addr;
+  int bus;
+  int len;
+} CanMsg;
+
+typedef enum {
+  TorqueMotorLimited,   // torque steering command, limited by EPS output torque
+  TorqueDriverLimited,  // torque steering command, limited by driver's input torque
+} SteeringControlType;
+
+typedef struct {
+  // torque cmd limits
+  const int max_steer;
+  const int max_rate_up;
+  const int max_rate_down;
+  const int max_rt_delta;
+  const uint32_t max_rt_interval;
+
+  const SteeringControlType type;
+
+  // driver torque limits
+  const int driver_torque_allowance;
+  const int driver_torque_factor;
+
+  // motor torque limits
+  const int max_torque_error;
+
+  // safety around steer req bit
+  const int min_valid_request_frames;
+  const int max_invalid_request_frames;
+  const uint32_t min_valid_request_rt_interval;
+  const bool has_steer_req_tolerance;
+
+  // angle cmd limits
+  const float angle_deg_to_can;
+  const struct lookup_t angle_rate_up_lookup;
+  const struct lookup_t angle_rate_down_lookup;
+  const int max_angle_error;             // used to limit error between meas and cmd while enabled
+  const float angle_error_min_speed;     // minimum speed to start limiting angle error
+
+  const bool enforce_angle_error;        // enables max_angle_error check
+  const bool inactive_angle_is_zero;     // if false, enforces angle near meas when disabled (default)
+} SteeringLimits;
+
+typedef struct {
+  // acceleration cmd limits
+  const int max_accel;
+  const int min_accel;
+  const int inactive_accel;
+
+  // gas & brake cmd limits
+  // inactive and min gas are 0 on most safety modes
+  const int max_gas;
+  const int min_gas;
+  const int inactive_gas;
+  const int max_brake;
+
+  // speed cmd limits
+  const int inactive_speed;
+} LongitudinalLimits;
+
+typedef struct {
+  const int addr;
+  const int bus;
+  const int len;
+  const bool check_checksum;         // true is checksum check is performed
+  const uint8_t max_counter;         // maximum value of the counter. 0 means that the counter check is skipped
+  const bool quality_flag;           // true is quality flag check is performed
+  const uint32_t expected_timestep;  // expected time between message updates [us]
+} CanMsgCheck;
+
+// params and flags about checksum, counter and frequency checks for each monitored address
+typedef struct {
+  // const params
+  const CanMsgCheck msg[MAX_ADDR_CHECK_MSGS];  // check either messages (e.g. honda steer)
+  // dynamic flags
+  bool msg_seen;
+  int index;                         // if multiple messages are allowed to be checked, this stores the index of the first one seen. only msg[msg_index] will be used
+  bool valid_checksum;               // true if and only if checksum check is passed
+  int wrong_counters;                // counter of wrong counters, saturated between 0 and MAX_WRONG_COUNTERS
+  bool valid_quality_flag;           // true if the message's quality/health/status signals are valid
+  uint8_t last_counter;              // last counter value
+  uint32_t last_timestamp;           // micro-s
+  bool lagging;                      // true if and only if the time between updates is excessive
+} AddrCheckStruct;
+
+typedef struct {
+  AddrCheckStruct *check;
+  int len;
+} addr_checks;
+
+int safety_rx_hook(CANPacket_t *to_push);
+int safety_tx_hook(CANPacket_t *to_send);
+int safety_tx_lin_hook(int lin_num, uint8_t *data, int len);
+uint32_t get_ts_elapsed(uint32_t ts, uint32_t ts_last);
+int to_signed(int d, int bits);
+void update_sample(struct sample_t *sample, int sample_new);
+bool max_limit_check(int val, const int MAX, const int MIN);
+bool angle_dist_to_meas_check(int val, struct sample_t *val_meas,
+  const int MAX_ERROR, const int MAX_VAL);
+bool dist_to_meas_check(int val, int val_last, struct sample_t *val_meas,
+  const int MAX_RATE_UP, const int MAX_RATE_DOWN, const int MAX_ERROR);
+bool driver_limit_check(int val, int val_last, struct sample_t *val_driver,
+  const int MAX, const int MAX_RATE_UP, const int MAX_RATE_DOWN,
+  const int MAX_ALLOWANCE, const int DRIVER_FACTOR);
+bool get_longitudinal_allowed(void);
+bool rt_rate_limit_check(int val, int val_last, const int MAX_RT_DELTA);
+float interpolate(struct lookup_t xy, float x);
+int ROUND(float val);
+void gen_crc_lookup_table_8(uint8_t poly, uint8_t crc_lut[]);
+void gen_crc_lookup_table_16(uint16_t poly, uint16_t crc_lut[]);
+bool msg_allowed(CANPacket_t *to_send, const CanMsg msg_list[], int len);
+int get_addr_check_index(CANPacket_t *to_push, AddrCheckStruct addr_list[], const int len);
+void update_counter(AddrCheckStruct addr_list[], int index, uint8_t counter);
+void update_addr_timestamp(AddrCheckStruct addr_list[], int index);
+bool is_msg_valid(AddrCheckStruct addr_list[], int index);
+bool addr_safety_check(CANPacket_t *to_push,
+                       const addr_checks *rx_checks,
+                       uint32_t (*get_checksum)(CANPacket_t *to_push),
+                       uint32_t (*compute_checksum)(CANPacket_t *to_push),
+                       uint8_t (*get_counter)(CANPacket_t *to_push),
+                       bool (*get_quality_flag_valid)(CANPacket_t *to_push));
+void generic_rx_checks(bool stock_ecu_detected);
+void relay_malfunction_set(void);
+void relay_malfunction_reset(void);
+bool steer_torque_cmd_checks(int desired_torque, int steer_req, const SteeringLimits limits);
+bool steer_angle_cmd_checks(int desired_angle, bool steer_control_enabled, const SteeringLimits limits);
+bool longitudinal_accel_checks(int desired_accel, const LongitudinalLimits limits);
+bool longitudinal_speed_checks(int desired_speed, const LongitudinalLimits limits);
+bool longitudinal_gas_checks(int desired_gas, const LongitudinalLimits limits);
+bool longitudinal_brake_checks(int desired_brake, const LongitudinalLimits limits);
+bool longitudinal_interceptor_checks(CANPacket_t *to_send);
+void pcm_cruise_check(bool cruise_engaged);
+
+typedef const addr_checks* (*safety_hook_init)(uint16_t param);
+typedef int (*rx_hook)(CANPacket_t *to_push);
+typedef int (*tx_hook)(CANPacket_t *to_send);
+typedef int (*tx_lin_hook)(int lin_num, uint8_t *data, int len);
+typedef int (*fwd_hook)(int bus_num, int addr);
+
+typedef struct {
+  safety_hook_init init;
+  rx_hook rx;
+  tx_hook tx;
+  tx_lin_hook tx_lin;
+  fwd_hook fwd;
+} safety_hooks;
+
+void safety_tick(const addr_checks *addr_checks);
+
+// This can be set by the safety hooks
+bool controls_allowed = false;
+bool relay_malfunction = false;
+bool gas_interceptor_detected = false;
+int gas_interceptor_prev = 0;
+bool gas_pressed = false;
+bool gas_pressed_prev = false;
+bool brake_pressed = false;
+bool brake_pressed_prev = false;
+bool regen_braking = false;
+bool regen_braking_prev = false;
+bool cruise_engaged_prev = false;
+struct sample_t vehicle_speed;
+bool vehicle_moving = false;
+bool acc_main_on = false;  // referred to as "ACC off" in ISO 15622:2018
+int cruise_button_prev = 0;
+bool safety_rx_checks_invalid = false;
+
+// for safety modes with torque steering control
+int desired_torque_last = 0;       // last desired steer torque
+int rt_torque_last = 0;            // last desired torque for real time check
+int valid_steer_req_count = 0;     // counter for steer request bit matching non-zero torque
+int invalid_steer_req_count = 0;   // counter to allow multiple frames of mismatching torque request bit
+struct sample_t torque_meas;       // last 6 motor torques produced by the eps
+struct sample_t torque_driver;     // last 6 driver torques measured
+uint32_t ts_torque_check_last = 0;
+uint32_t ts_steer_req_mismatch_last = 0;  // last timestamp steer req was mismatched with torque
+
+// state for controls_allowed timeout logic
+bool heartbeat_engaged = false;             // openpilot enabled, passed in heartbeat USB command
+uint32_t heartbeat_engaged_mismatches = 0;  // count of mismatches between heartbeat_engaged and controls_allowed
+
+// for safety modes with angle steering control
+uint32_t ts_angle_last = 0;
+int desired_angle_last = 0;
+struct sample_t angle_meas;         // last 6 steer angles/curvatures
+
+// This can be set with a USB command
+// It enables features that allow alternative experiences, like not disengaging on gas press
+// It is only either 0 or 1 on mainline comma.ai openpilot
+
+#define ALT_EXP_DISABLE_DISENGAGE_ON_GAS 1
+
+// If using this flag, make sure to communicate to your users that a stock safety feature is now disabled.
+#define ALT_EXP_DISABLE_STOCK_AEB 2
+
+// If using this flag, be aware that harder braking is more likely to lead to rear endings,
+//   and that alone this flag doesn't make braking compliant because there's also a time element.
+// Setting this flag is used for allowing the full -5.0 to +4.0 m/s^2 at lower speeds
+// See ISO 15622:2018 for more information.
+#define ALT_EXP_RAISE_LONGITUDINAL_LIMITS_TO_ISO_MAX 8
+
+int alternative_experience = 0;
+
+// time since safety mode has been changed
+uint32_t safety_mode_cnt = 0U;
+// allow 1s of transition timeout after relay changes state before assessing malfunctioning
+const uint32_t RELAY_TRNS_TIMEOUT = 1U;

panda/board/stm32fx/board.h

@@ -0,0 +1,55 @@
+// ///////////////////////////////////////////////////////////// //
+// Hardware abstraction layer for all different supported boards //
+// ///////////////////////////////////////////////////////////// //
+#include "boards/board_declarations.h"
+#include "boards/unused_funcs.h"
+
+// ///// Board definition and detection ///// //
+#include "stm32fx/lladc.h"
+#include "drivers/harness.h"
+#ifdef PANDA
+  #include "drivers/fan.h"
+  #include "stm32fx/llfan.h"
+  #include "stm32fx/llrtc.h"
+  #include "drivers/rtc.h"
+  #include "drivers/clock_source.h"
+  #include "boards/white.h"
+  #include "boards/grey.h"
+  #include "boards/black.h"
+  #include "boards/uno.h"
+  #include "boards/dos.h"
+#else
+  #include "boards/pedal.h"
+#endif
+
+void detect_board_type(void) {
+  #ifdef PANDA
+    // SPI lines floating: white (TODO: is this reliable? Not really, we have to enable ESP/GPS to be able to detect this on the UART)
+    set_gpio_output(GPIOC, 14, 1);
+    set_gpio_output(GPIOC, 5, 1);
+    if(!detect_with_pull(GPIOB, 1, PULL_UP) && !detect_with_pull(GPIOB, 7, PULL_UP)){
+      hw_type = HW_TYPE_DOS;
+      current_board = &board_dos;
+    } else if((detect_with_pull(GPIOA, 4, PULL_DOWN)) || (detect_with_pull(GPIOA, 5, PULL_DOWN)) || (detect_with_pull(GPIOA, 6, PULL_DOWN)) || (detect_with_pull(GPIOA, 7, PULL_DOWN))){
+      hw_type = HW_TYPE_WHITE_PANDA;
+      current_board = &board_white;
+    } else if(detect_with_pull(GPIOA, 13, PULL_DOWN)) { // Rev AB deprecated, so no pullup means black. In REV C, A13 is pulled up to 5V with a 10K
+      hw_type = HW_TYPE_GREY_PANDA;
+      current_board = &board_grey;
+    } else if(!detect_with_pull(GPIOB, 15, PULL_UP)) {
+      hw_type = HW_TYPE_UNO;
+      current_board = &board_uno;
+    } else {
+      hw_type = HW_TYPE_BLACK_PANDA;
+      current_board = &board_black;
+    }
+  #else
+    #ifdef PEDAL
+      hw_type = HW_TYPE_PEDAL;
+      current_board = &board_pedal;
+    #else
+      hw_type = HW_TYPE_UNKNOWN;
+      print("Hardware type is UNKNOWN!\n");
+    #endif
+  #endif
+}

panda/board/stm32fx/clock.h

@@ -0,0 +1,34 @@
+void clock_init(void) {
+  // enable external oscillator
+  register_set_bits(&(RCC->CR), RCC_CR_HSEON);
+  while ((RCC->CR & RCC_CR_HSERDY) == 0);
+
+  // divide things
+  // AHB = 96MHz
+  // APB1 = 48MHz
+  // APB2 = 48MHz
+  register_set(&(RCC->CFGR), RCC_CFGR_HPRE_DIV1 | RCC_CFGR_PPRE2_DIV2 | RCC_CFGR_PPRE1_DIV2, 0xFF7FFCF3U);
+
+  // 16MHz crystal
+  // PLLM: 8
+  // PLLN: 96
+  // PLLP: 2
+  // PLLQ: 4
+  // P output: 96MHz
+  // Q output: 48MHz
+  register_set(&(RCC->PLLCFGR), RCC_PLLCFGR_PLLQ_2 | RCC_PLLCFGR_PLLM_3 | RCC_PLLCFGR_PLLN_6 | RCC_PLLCFGR_PLLN_5 | RCC_PLLCFGR_PLLSRC_HSE, 0x7F437FFFU);
+
+  // start PLL
+  register_set_bits(&(RCC->CR), RCC_CR_PLLON);
+  while ((RCC->CR & RCC_CR_PLLRDY) == 0);
+
+  // Configure Flash prefetch, Instruction cache, Data cache and wait state
+  // *** without this, it breaks ***
+  register_set(&(FLASH->ACR), FLASH_ACR_ICEN | FLASH_ACR_DCEN | FLASH_ACR_LATENCY_5WS, 0x1F0FU);
+
+  // switch to PLL
+  register_set_bits(&(RCC->CFGR), RCC_CFGR_SW_PLL);
+  while ((RCC->CFGR & RCC_CFGR_SWS) != RCC_CFGR_SWS_PLL);
+
+  // *** running on PLL ***
+}

panda/board/stm32fx/inc/cmsis_compiler.h

@@ -0,0 +1,284 @@
+/**************************************************************************//**
+ * @file     cmsis_compiler.h
+ * @brief    CMSIS compiler generic header file
+ * @version  V5.1.0
+ * @date     09. October 2018
+ ******************************************************************************/
+/*
+ * Copyright (c) 2009-2018 Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the License); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an AS IS BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef __CMSIS_COMPILER_H
+#define __CMSIS_COMPILER_H
+
+#include <stdint.h>
+
+/*
+ * Arm Compiler 4/5
+ */
+#if   defined ( __CC_ARM )
+  #include "cmsis_armcc.h"
+
+
+/*
+ * Arm Compiler 6.6 LTM (armclang)
+ */
+#elif defined (__ARMCC_VERSION) && (__ARMCC_VERSION >= 6010050) && (__ARMCC_VERSION < 6100100)
+  #include "cmsis_armclang_ltm.h"
+
+  /*
+ * Arm Compiler above 6.10.1 (armclang)
+ */
+#elif defined (__ARMCC_VERSION) && (__ARMCC_VERSION >= 6100100)
+  #include "cmsis_armclang.h"
+
+
+/*
+ * GNU Compiler
+ */
+#elif defined ( __GNUC__ )
+  #include "cmsis_gcc.h"
+
+
+/*
+ * IAR Compiler
+ */
+#elif defined ( __ICCARM__ )
+  #include <cmsis_iccarm.h>
+
+
+/*
+ * TI Arm Compiler
+ */
+#elif defined ( __TI_ARM__ )
+  #include <cmsis_ccs.h>
+
+  #ifndef   __ASM
+    #define __ASM                                  __asm
+  #endif
+  #ifndef   __INLINE
+    #define __INLINE                               inline
+  #endif
+  #ifndef   __STATIC_INLINE
+    #define __STATIC_INLINE                        static inline
+  #endif
+  #ifndef   __STATIC_FORCEINLINE
+    #define __STATIC_FORCEINLINE                   __STATIC_INLINE
+  #endif
+  #ifndef   __NO_RETURN
+    #define __NO_RETURN                            __attribute__((noreturn))
+  #endif
+  #ifndef   __USED
+    #define __USED                                 __attribute__((used))
+  #endif
+  #ifndef   __WEAK
+    #define __WEAK                                 __attribute__((weak))
+  #endif
+  #ifndef   __PACKED
+    #define __PACKED                               __attribute__((packed))
+  #endif
+  #ifndef   __PACKED_STRUCT
+    #define __PACKED_STRUCT                        struct __attribute__((packed))
+  #endif
+  #ifndef   __PACKED_UNION
+    #define __PACKED_UNION                         union __attribute__((packed))
+  #endif
+  #ifndef   __UNALIGNED_UINT32        /* deprecated */
+    struct __attribute__((packed)) T_UINT32 { uint32_t v; };
+    #define __UNALIGNED_UINT32(x)                  (((struct T_UINT32 *)(x))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT16_WRITE
+    __PACKED_STRUCT T_UINT16_WRITE { uint16_t v; };
+    #define __UNALIGNED_UINT16_WRITE(addr, val)    (void)((((struct T_UINT16_WRITE *)(void*)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT16_READ
+    __PACKED_STRUCT T_UINT16_READ { uint16_t v; };
+    #define __UNALIGNED_UINT16_READ(addr)          (((const struct T_UINT16_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT32_WRITE
+    __PACKED_STRUCT T_UINT32_WRITE { uint32_t v; };
+    #define __UNALIGNED_UINT32_WRITE(addr, val)    (void)((((struct T_UINT32_WRITE *)(void *)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT32_READ
+    __PACKED_STRUCT T_UINT32_READ { uint32_t v; };
+    #define __UNALIGNED_UINT32_READ(addr)          (((const struct T_UINT32_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __ALIGNED
+    #define __ALIGNED(x)                           __attribute__((aligned(x)))
+  #endif
+  #ifndef   __RESTRICT
+    #define __RESTRICT                             __restrict
+  #endif
+  #ifndef   __COMPILER_BARRIER
+    #warning No compiler specific solution for __COMPILER_BARRIER. __COMPILER_BARRIER is ignored.
+    #define __COMPILER_BARRIER()                   (void)0
+  #endif
+
+
+/*
+ * TASKING Compiler
+ */
+#elif defined ( __TASKING__ )
+  /*
+   * The CMSIS functions have been implemented as intrinsics in the compiler.
+   * Please use "carm -?i" to get an up to date list of all intrinsics,
+   * Including the CMSIS ones.
+   */
+
+  #ifndef   __ASM
+    #define __ASM                                  __asm
+  #endif
+  #ifndef   __INLINE
+    #define __INLINE                               inline
+  #endif
+  #ifndef   __STATIC_INLINE
+    #define __STATIC_INLINE                        static inline
+  #endif
+  #ifndef   __STATIC_FORCEINLINE
+    #define __STATIC_FORCEINLINE                   __STATIC_INLINE
+  #endif
+  #ifndef   __NO_RETURN
+    #define __NO_RETURN                            __attribute__((noreturn))
+  #endif
+  #ifndef   __USED
+    #define __USED                                 __attribute__((used))
+  #endif
+  #ifndef   __WEAK
+    #define __WEAK                                 __attribute__((weak))
+  #endif
+  #ifndef   __PACKED
+    #define __PACKED                               __packed__
+  #endif
+  #ifndef   __PACKED_STRUCT
+    #define __PACKED_STRUCT                        struct __packed__
+  #endif
+  #ifndef   __PACKED_UNION
+    #define __PACKED_UNION                         union __packed__
+  #endif
+  #ifndef   __UNALIGNED_UINT32        /* deprecated */
+    struct __packed__ T_UINT32 { uint32_t v; };
+    #define __UNALIGNED_UINT32(x)                  (((struct T_UINT32 *)(x))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT16_WRITE
+    __PACKED_STRUCT T_UINT16_WRITE { uint16_t v; };
+    #define __UNALIGNED_UINT16_WRITE(addr, val)    (void)((((struct T_UINT16_WRITE *)(void *)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT16_READ
+    __PACKED_STRUCT T_UINT16_READ { uint16_t v; };
+    #define __UNALIGNED_UINT16_READ(addr)          (((const struct T_UINT16_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT32_WRITE
+    __PACKED_STRUCT T_UINT32_WRITE { uint32_t v; };
+    #define __UNALIGNED_UINT32_WRITE(addr, val)    (void)((((struct T_UINT32_WRITE *)(void *)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT32_READ
+    __PACKED_STRUCT T_UINT32_READ { uint32_t v; };
+    #define __UNALIGNED_UINT32_READ(addr)          (((const struct T_UINT32_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __ALIGNED
+    #define __ALIGNED(x)              __align(x)
+  #endif
+  #ifndef   __RESTRICT
+    #warning No compiler specific solution for __RESTRICT. __RESTRICT is ignored.
+    #define __RESTRICT
+  #endif
+  #ifndef   __COMPILER_BARRIER
+    #warning No compiler specific solution for __COMPILER_BARRIER. __COMPILER_BARRIER is ignored.
+    #define __COMPILER_BARRIER()                   (void)0
+  #endif
+
+
+/*
+ * COSMIC Compiler
+ */
+#elif defined ( __CSMC__ )
+   #include <cmsis_csm.h>
+
+ #ifndef   __ASM
+    #define __ASM                                  _asm
+  #endif
+  #ifndef   __INLINE
+    #define __INLINE                               inline
+  #endif
+  #ifndef   __STATIC_INLINE
+    #define __STATIC_INLINE                        static inline
+  #endif
+  #ifndef   __STATIC_FORCEINLINE
+    #define __STATIC_FORCEINLINE                   __STATIC_INLINE
+  #endif
+  #ifndef   __NO_RETURN
+    // NO RETURN is automatically detected hence no warning here
+    #define __NO_RETURN
+  #endif
+  #ifndef   __USED
+    #warning No compiler specific solution for __USED. __USED is ignored.
+    #define __USED
+  #endif
+  #ifndef   __WEAK
+    #define __WEAK                                 __weak
+  #endif
+  #ifndef   __PACKED
+    #define __PACKED                               @packed
+  #endif
+  #ifndef   __PACKED_STRUCT
+    #define __PACKED_STRUCT                        @packed struct
+  #endif
+  #ifndef   __PACKED_UNION
+    #define __PACKED_UNION                         @packed union
+  #endif
+  #ifndef   __UNALIGNED_UINT32        /* deprecated */
+    @packed struct T_UINT32 { uint32_t v; };
+    #define __UNALIGNED_UINT32(x)                  (((struct T_UINT32 *)(x))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT16_WRITE
+    __PACKED_STRUCT T_UINT16_WRITE { uint16_t v; };
+    #define __UNALIGNED_UINT16_WRITE(addr, val)    (void)((((struct T_UINT16_WRITE *)(void *)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT16_READ
+    __PACKED_STRUCT T_UINT16_READ { uint16_t v; };
+    #define __UNALIGNED_UINT16_READ(addr)          (((const struct T_UINT16_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __UNALIGNED_UINT32_WRITE
+    __PACKED_STRUCT T_UINT32_WRITE { uint32_t v; };
+    #define __UNALIGNED_UINT32_WRITE(addr, val)    (void)((((struct T_UINT32_WRITE *)(void *)(addr))->v) = (val))
+  #endif
+  #ifndef   __UNALIGNED_UINT32_READ
+    __PACKED_STRUCT T_UINT32_READ { uint32_t v; };
+    #define __UNALIGNED_UINT32_READ(addr)          (((const struct T_UINT32_READ *)(const void *)(addr))->v)
+  #endif
+  #ifndef   __ALIGNED
+    #warning No compiler specific solution for __ALIGNED. __ALIGNED is ignored.
+    #define __ALIGNED(x)
+  #endif
+  #ifndef   __RESTRICT
+    #warning No compiler specific solution for __RESTRICT. __RESTRICT is ignored.
+    #define __RESTRICT
+  #endif
+  #ifndef   __COMPILER_BARRIER
+    #warning No compiler specific solution for __COMPILER_BARRIER. __COMPILER_BARRIER is ignored.
+    #define __COMPILER_BARRIER()                   (void)0
+  #endif
+
+
+#else
+  #error Unknown compiler.
+#endif
+
+
+#endif /* __CMSIS_COMPILER_H */
+
+

panda/board/stm32fx/inc/cmsis_version.h

@@ -0,0 +1,40 @@
+/**************************************************************************//**
+ * @file     cmsis_version.h
+ * @brief    CMSIS Core(M) Version definitions
+ * @version  V5.0.3
+ * @date     24. June 2019
+ ******************************************************************************/
+/*
+ * Copyright (c) 2009-2019 ARM Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the License); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an AS IS BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if   defined ( __ICCARM__ )
+  #pragma system_include         /* treat file as system include file for MISRA check */
+#elif defined (__clang__)
+  #pragma clang system_header   /* treat file as system include file */
+#endif
+
+#ifndef __CMSIS_VERSION_H
+#define __CMSIS_VERSION_H
+
+/*  CMSIS Version definitions */
+#define __CM_CMSIS_VERSION_MAIN  ( 5U)                                      /*!< [31:16] CMSIS Core(M) main version */
+#define __CM_CMSIS_VERSION_SUB   ( 3U)                                      /*!< [15:0]  CMSIS Core(M) sub version */
+#define __CM_CMSIS_VERSION       ((__CM_CMSIS_VERSION_MAIN << 16U) | \
+                                   __CM_CMSIS_VERSION_SUB           )       /*!< CMSIS Core(M) version number */
+#endif
+

panda/board/stm32fx/inc/mpu_armv7.h

@@ -0,0 +1,273 @@
+/******************************************************************************
+ * @file     mpu_armv7.h
+ * @brief    CMSIS MPU API for Armv7-M MPU
+ * @version  V5.1.0
+ * @date     08. March 2019
+ ******************************************************************************/
+/*
+ * Copyright (c) 2017-2019 Arm Limited. All rights reserved.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the License); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an AS IS BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#if   defined ( __ICCARM__ )
+  #pragma system_include         /* treat file as system include file for MISRA check */
+#elif defined (__clang__)
+  #pragma clang system_header    /* treat file as system include file */
+#endif
+
+#ifndef ARM_MPU_ARMV7_H
+#define ARM_MPU_ARMV7_H
+
+#define ARM_MPU_REGION_SIZE_32B      ((uint8_t)0x04U) ///!< MPU Region Size 32 Bytes
+#define ARM_MPU_REGION_SIZE_64B      ((uint8_t)0x05U) ///!< MPU Region Size 64 Bytes
+#define ARM_MPU_REGION_SIZE_128B     ((uint8_t)0x06U) ///!< MPU Region Size 128 Bytes
+#define ARM_MPU_REGION_SIZE_256B     ((uint8_t)0x07U) ///!< MPU Region Size 256 Bytes
+#define ARM_MPU_REGION_SIZE_512B     ((uint8_t)0x08U) ///!< MPU Region Size 512 Bytes
+#define ARM_MPU_REGION_SIZE_1KB      ((uint8_t)0x09U) ///!< MPU Region Size 1 KByte
+#define ARM_MPU_REGION_SIZE_2KB      ((uint8_t)0x0AU) ///!< MPU Region Size 2 KBytes
+#define ARM_MPU_REGION_SIZE_4KB      ((uint8_t)0x0BU) ///!< MPU Region Size 4 KBytes
+#define ARM_MPU_REGION_SIZE_8KB      ((uint8_t)0x0CU) ///!< MPU Region Size 8 KBytes
+#define ARM_MPU_REGION_SIZE_16KB     ((uint8_t)0x0DU) ///!< MPU Region Size 16 KBytes
+#define ARM_MPU_REGION_SIZE_32KB     ((uint8_t)0x0EU) ///!< MPU Region Size 32 KBytes
+#define ARM_MPU_REGION_SIZE_64KB     ((uint8_t)0x0FU) ///!< MPU Region Size 64 KBytes
+#define ARM_MPU_REGION_SIZE_128KB    ((uint8_t)0x10U) ///!< MPU Region Size 128 KBytes
+#define ARM_MPU_REGION_SIZE_256KB    ((uint8_t)0x11U) ///!< MPU Region Size 256 KBytes
+#define ARM_MPU_REGION_SIZE_512KB    ((uint8_t)0x12U) ///!< MPU Region Size 512 KBytes
+#define ARM_MPU_REGION_SIZE_1MB      ((uint8_t)0x13U) ///!< MPU Region Size 1 MByte
+#define ARM_MPU_REGION_SIZE_2MB      ((uint8_t)0x14U) ///!< MPU Region Size 2 MBytes
+#define ARM_MPU_REGION_SIZE_4MB      ((uint8_t)0x15U) ///!< MPU Region Size 4 MBytes
+#define ARM_MPU_REGION_SIZE_8MB      ((uint8_t)0x16U) ///!< MPU Region Size 8 MBytes
+#define ARM_MPU_REGION_SIZE_16MB     ((uint8_t)0x17U) ///!< MPU Region Size 16 MBytes
+#define ARM_MPU_REGION_SIZE_32MB     ((uint8_t)0x18U) ///!< MPU Region Size 32 MBytes
+#define ARM_MPU_REGION_SIZE_64MB     ((uint8_t)0x19U) ///!< MPU Region Size 64 MBytes
+#define ARM_MPU_REGION_SIZE_128MB    ((uint8_t)0x1AU) ///!< MPU Region Size 128 MBytes
+#define ARM_MPU_REGION_SIZE_256MB    ((uint8_t)0x1BU) ///!< MPU Region Size 256 MBytes
+#define ARM_MPU_REGION_SIZE_512MB    ((uint8_t)0x1CU) ///!< MPU Region Size 512 MBytes
+#define ARM_MPU_REGION_SIZE_1GB      ((uint8_t)0x1DU) ///!< MPU Region Size 1 GByte
+#define ARM_MPU_REGION_SIZE_2GB      ((uint8_t)0x1EU) ///!< MPU Region Size 2 GBytes
+#define ARM_MPU_REGION_SIZE_4GB      ((uint8_t)0x1FU) ///!< MPU Region Size 4 GBytes
+
+#define ARM_MPU_AP_NONE 0U ///!< MPU Access Permission no access
+#define ARM_MPU_AP_PRIV 1U ///!< MPU Access Permission privileged access only
+#define ARM_MPU_AP_URO  2U ///!< MPU Access Permission unprivileged access read-only
+#define ARM_MPU_AP_FULL 3U ///!< MPU Access Permission full access
+#define ARM_MPU_AP_PRO  5U ///!< MPU Access Permission privileged access read-only
+#define ARM_MPU_AP_RO   6U ///!< MPU Access Permission read-only access
+
+/** MPU Region Base Address Register Value
+*
+* \param Region The region to be configured, number 0 to 15.
+* \param BaseAddress The base address for the region.
+*/
+#define ARM_MPU_RBAR(Region, BaseAddress) \
+  (((BaseAddress) & MPU_RBAR_ADDR_Msk) |  \
+   ((Region) & MPU_RBAR_REGION_Msk)    |  \
+   (MPU_RBAR_VALID_Msk))
+
+/**
+* MPU Memory Access Attributes
+*
+* \param TypeExtField      Type extension field, allows you to configure memory access type, for example strongly ordered, peripheral.
+* \param IsShareable       Region is shareable between multiple bus masters.
+* \param IsCacheable       Region is cacheable, i.e. its value may be kept in cache.
+* \param IsBufferable      Region is bufferable, i.e. using write-back caching. Cacheable but non-bufferable regions use write-through policy.
+*/
+#define ARM_MPU_ACCESS_(TypeExtField, IsShareable, IsCacheable, IsBufferable)   \
+  ((((TypeExtField) << MPU_RASR_TEX_Pos) & MPU_RASR_TEX_Msk)                  | \
+   (((IsShareable)  << MPU_RASR_S_Pos)   & MPU_RASR_S_Msk)                    | \
+   (((IsCacheable)  << MPU_RASR_C_Pos)   & MPU_RASR_C_Msk)                    | \
+   (((IsBufferable) << MPU_RASR_B_Pos)   & MPU_RASR_B_Msk))
+
+/**
+* MPU Region Attribute and Size Register Value
+*
+* \param DisableExec       Instruction access disable bit, 1= disable instruction fetches.
+* \param AccessPermission  Data access permissions, allows you to configure read/write access for User and Privileged mode.
+* \param AccessAttributes  Memory access attribution, see \ref ARM_MPU_ACCESS_.
+* \param SubRegionDisable  Sub-region disable field.
+* \param Size              Region size of the region to be configured, for example 4K, 8K.
+*/
+#define ARM_MPU_RASR_EX(DisableExec, AccessPermission, AccessAttributes, SubRegionDisable, Size)    \
+  ((((DisableExec)      << MPU_RASR_XN_Pos)   & MPU_RASR_XN_Msk)                                  | \
+   (((AccessPermission) << MPU_RASR_AP_Pos)   & MPU_RASR_AP_Msk)                                  | \
+   (((AccessAttributes) & (MPU_RASR_TEX_Msk | MPU_RASR_S_Msk | MPU_RASR_C_Msk | MPU_RASR_B_Msk))) | \
+   (((SubRegionDisable) << MPU_RASR_SRD_Pos)  & MPU_RASR_SRD_Msk)                                 | \
+   (((Size)             << MPU_RASR_SIZE_Pos) & MPU_RASR_SIZE_Msk)                                | \
+   (((MPU_RASR_ENABLE_Msk))))
+
+/**
+* MPU Region Attribute and Size Register Value
+*
+* \param DisableExec       Instruction access disable bit, 1= disable instruction fetches.
+* \param AccessPermission  Data access permissions, allows you to configure read/write access for User and Privileged mode.
+* \param TypeExtField      Type extension field, allows you to configure memory access type, for example strongly ordered, peripheral.
+* \param IsShareable       Region is shareable between multiple bus masters.
+* \param IsCacheable       Region is cacheable, i.e. its value may be kept in cache.
+* \param IsBufferable      Region is bufferable, i.e. using write-back caching. Cacheable but non-bufferable regions use write-through policy.
+* \param SubRegionDisable  Sub-region disable field.
+* \param Size              Region size of the region to be configured, for example 4K, 8K.
+*/
+#define ARM_MPU_RASR(DisableExec, AccessPermission, TypeExtField, IsShareable, IsCacheable, IsBufferable, SubRegionDisable, Size) \
+  ARM_MPU_RASR_EX(DisableExec, AccessPermission, ARM_MPU_ACCESS_(TypeExtField, IsShareable, IsCacheable, IsBufferable), SubRegionDisable, Size)
+
+/**
+* MPU Memory Access Attribute for strongly ordered memory.
+*  - TEX: 000b
+*  - Shareable
+*  - Non-cacheable
+*  - Non-bufferable
+*/
+#define ARM_MPU_ACCESS_ORDERED ARM_MPU_ACCESS_(0U, 1U, 0U, 0U)
+
+/**
+* MPU Memory Access Attribute for device memory.
+*  - TEX: 000b (if shareable) or 010b (if non-shareable)
+*  - Shareable or non-shareable
+*  - Non-cacheable
+*  - Bufferable (if shareable) or non-bufferable (if non-shareable)
+*
+* \param IsShareable Configures the device memory as shareable or non-shareable.
+*/
+#define ARM_MPU_ACCESS_DEVICE(IsShareable) ((IsShareable) ? ARM_MPU_ACCESS_(0U, 1U, 0U, 1U) : ARM_MPU_ACCESS_(2U, 0U, 0U, 0U))
+
+/**
+* MPU Memory Access Attribute for normal memory.
+*  - TEX: 1BBb (reflecting outer cacheability rules)
+*  - Shareable or non-shareable
+*  - Cacheable or non-cacheable (reflecting inner cacheability rules)
+*  - Bufferable or non-bufferable (reflecting inner cacheability rules)
+*
+* \param OuterCp Configures the outer cache policy.
+* \param InnerCp Configures the inner cache policy.
+* \param IsShareable Configures the memory as shareable or non-shareable.
+*/
+#define ARM_MPU_ACCESS_NORMAL(OuterCp, InnerCp, IsShareable) ARM_MPU_ACCESS_((4U | (OuterCp)), IsShareable, ((InnerCp) & 2U), ((InnerCp) & 1U))
+
+/**
+* MPU Memory Access Attribute non-cacheable policy.
+*/
+#define ARM_MPU_CACHEP_NOCACHE 0U
+
+/**
+* MPU Memory Access Attribute write-back, write and read allocate policy.
+*/
+#define ARM_MPU_CACHEP_WB_WRA 1U
+
+/**
+* MPU Memory Access Attribute write-through, no write allocate policy.
+*/
+#define ARM_MPU_CACHEP_WT_NWA 2U
+
+/**
+* MPU Memory Access Attribute write-back, no write allocate policy.
+*/
+#define ARM_MPU_CACHEP_WB_NWA 3U
+
+
+/**
+* Struct for a single MPU Region
+*/
+typedef struct {
+  uint32_t RBAR; //!< The region base address register value (RBAR)
+  uint32_t RASR; //!< The region attribute and size register value (RASR) \ref MPU_RASR
+} ARM_MPU_Region_t;
+
+/** Enable the MPU.
+* \param MPU_Control Default access permissions for unconfigured regions.
+*/
+__STATIC_INLINE void ARM_MPU_Enable(uint32_t MPU_Control)
+{
+  MPU->CTRL = MPU_Control | MPU_CTRL_ENABLE_Msk;
+#ifdef SCB_SHCSR_MEMFAULTENA_Msk
+  SCB->SHCSR |= SCB_SHCSR_MEMFAULTENA_Msk;
+#endif
+  __DSB();
+  __ISB();
+}
+
+/** Disable the MPU.
+*/
+__STATIC_INLINE void ARM_MPU_Disable(void)
+{
+  __DMB();
+#ifdef SCB_SHCSR_MEMFAULTENA_Msk
+  SCB->SHCSR &= ~SCB_SHCSR_MEMFAULTENA_Msk;
+#endif
+  MPU->CTRL  &= ~MPU_CTRL_ENABLE_Msk;
+}
+
+/** Clear and disable the given MPU region.
+* \param rnr Region number to be cleared.
+*/
+__STATIC_INLINE void ARM_MPU_ClrRegion(uint32_t rnr)
+{
+  MPU->RNR = rnr;
+  MPU->RASR = 0U;
+}
+
+/** Configure an MPU region.
+* \param rbar Value for RBAR register.
+* \param rsar Value for RSAR register.
+*/
+__STATIC_INLINE void ARM_MPU_SetRegion(uint32_t rbar, uint32_t rasr)
+{
+  MPU->RBAR = rbar;
+  MPU->RASR = rasr;
+}
+
+/** Configure the given MPU region.
+* \param rnr Region number to be configured.
+* \param rbar Value for RBAR register.
+* \param rsar Value for RSAR register.
+*/
+__STATIC_INLINE void ARM_MPU_SetRegionEx(uint32_t rnr, uint32_t rbar, uint32_t rasr)
+{
+  MPU->RNR = rnr;
+  MPU->RBAR = rbar;
+  MPU->RASR = rasr;
+}
+
+/** Memcopy with strictly ordered memory access, e.g. for register targets.
+* \param dst Destination data is copied to.
+* \param src Source data is copied from.
+* \param len Amount of data words to be copied.
+*/
+__STATIC_INLINE void ARM_MPU_OrderedMemcpy(volatile uint32_t* dst, const uint32_t* __RESTRICT src, uint32_t len)
+{
+  uint32_t i;
+  for (i = 0U; i < len; ++i)
+  {
+    dst[i] = src[i];
+  }
+}
+
+/** Load the given number of MPU regions from a table.
+* \param table Pointer to the MPU configuration table.
+* \param cnt Amount of regions to be configured.
+*/
+__STATIC_INLINE void ARM_MPU_Load(ARM_MPU_Region_t const* table, uint32_t cnt)
+{
+  const uint32_t rowWordSize = sizeof(ARM_MPU_Region_t)/4U;
+  while (cnt > MPU_TYPE_RALIASES) {
+    ARM_MPU_OrderedMemcpy(&(MPU->RBAR), &(table->RBAR), MPU_TYPE_RALIASES*rowWordSize);
+    table += MPU_TYPE_RALIASES;
+    cnt -= MPU_TYPE_RALIASES;
+  }
+  ARM_MPU_OrderedMemcpy(&(MPU->RBAR), &(table->RBAR), cnt*rowWordSize);
+}
+
+#endif
+