update error handling

Reviewed-on: #28

.github/workflows/ci.yml

@@ -10,8 +10,8 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           targets: "thumbv6m-none-eabi"
-      - run: cargo check --target thumbv6m-none-eabi --release
-      - run: cargo check --target thumbv6m-none-eabi --examples --release
+      - run: cargo check --target thumbv6m-none-eabi
+      - run: cargo check --target thumbv6m-none-eabi --examples
 
   test:
     name: Run Tests
@@ -21,7 +21,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - name: Install nextest
         uses: taiki-e/install-action@nextest
-      - run: cargo nextest run --all-features -p va108xx-hal
+      - run: cargo nextest run --all-features -p va108xx-hal --no-tests=pass
       # I think we can skip those on an embedded crate..
       # - run: cargo test --doc -p va108xx-hal
 

.gitignore

@@ -16,3 +16,5 @@ Cargo.lock
 # JetBrains IDEs
 /.idea
 *.iml
+
+/Embed.toml

Cargo.toml

@@ -1,9 +1,10 @@
 [workspace]
 resolver = "2"
 members = [
-	"vorago-reb1",
-	"va108xx",
-	"va108xx-hal",
+  "vorago-reb1",
+  "va108xx",
+  "va108xx-hal",
+  "va108xx-embassy",
   "examples/simple",
   "examples/rtic",
   "examples/embassy",
@@ -22,7 +23,7 @@ codegen-units = 1
 debug = 2
 debug-assertions = true # <-
 incremental = false
-# 1 instead of 0, the flashloader is too larger otherwise.. 
+# 1 instead of 0, the flashloader is too larger otherwise..
 # opt-level = 1         # <-
 overflow-checks = true  # <-
 

Embed.toml.sample

@@ -0,0 +1,12 @@
+[default.probe]
+protocol = "Jtag"
+
+[default.general]
+chip = "VA108xx_RAM"
+
+[default.rtt]
+enabled = true
+
+[default.gdb]
+# Whether or not a GDB server should be opened after flashing.
+enabled = false

board-tests/Cargo.toml

@@ -6,9 +6,9 @@ edition = "2021"
 [dependencies]
 cortex-m = { version = "0.7.6", features = ["critical-section-single-core"] }
 cortex-m-rt = "0.7"
-panic-halt = "0.2"
-rtt-target = "0.5"
-panic-rtt-target = "0.1.3"
+panic-halt = "1"
+rtt-target = "0.6"
+panic-rtt-target = "0.2"
 embedded-hal = "1"
 embedded-hal-nb = "1"
 embedded-io = "0.6"

board-tests/src/main.rs

@@ -99,9 +99,11 @@ fn main() -> ! {
         }
         TestCase::TestMask => {
             // Tie PORTA[0] to PORTA[1] for these tests!
-            let input = pinsa.pa1.into_pull_down_input().clear_datamask();
+            let mut input = pinsa.pa1.into_pull_down_input();
+            input.clear_datamask();
             assert!(!input.datamask());
-            let mut out = pinsa.pa0.into_push_pull_output().clear_datamask();
+            let mut out = pinsa.pa0.into_push_pull_output();
+            out.clear_datamask();
             assert!(input.is_low_masked().is_err());
             assert!(out.set_high_masked().is_err());
         }
@@ -119,17 +121,15 @@ fn main() -> ! {
             assert_eq!(PinsB::get_perid(), 0x004007e1);
         }
         TestCase::Pulse => {
-            let mut output_pulsed = pinsa
-                .pa0
-                .into_push_pull_output()
-                .pulse_mode(true, PinState::Low);
+            let mut output_pulsed = pinsa.pa0.into_push_pull_output();
+            output_pulsed.pulse_mode(true, PinState::Low);
             rprintln!("Pulsing high 10 times..");
             output_pulsed.set_low().unwrap();
             for _ in 0..10 {
                 output_pulsed.set_high().unwrap();
                 cortex_m::asm::delay(25_000_000);
             }
-            let mut output_pulsed = output_pulsed.pulse_mode(true, PinState::High);
+            output_pulsed.pulse_mode(true, PinState::High);
             rprintln!("Pulsing low 10 times..");
             for _ in 0..10 {
                 output_pulsed.set_low().unwrap();

bootloader/Cargo.toml

@@ -7,10 +7,11 @@ edition = "2021"
 cortex-m = "0.7"
 cortex-m-rt = "0.7"
 embedded-hal = "1"
-panic-rtt-target = { version = "0.1.3" }
-panic-halt = { version = "0.2" }
-rtt-target = { version = "0.5" }
+panic-rtt-target = "0.2"
+panic-halt = "1"
+rtt-target = "0.6"
 crc = "3"
+num_enum = { version = "0.7", default-features = false }
 static_assertions = "1"
 
 [dependencies.va108xx-hal]

bootloader/README.md

@@ -9,14 +9,15 @@ The bootloader uses the following memory map:
 
 | Address | Notes | Size |
 | ------ | ---- |  ---- |
-| 0x0 | Bootloader start | code up to 0x3FFC bytes |
-| 0x2FFE | Bootloader CRC | word |
-| 0x3000 | App image A start | code up to 0xE7F8 (~58K) bytes |
+| 0x0 | Bootloader start | code up to 0x2FFE bytes |
+| 0x2FFE | Bootloader CRC | half-word |
+| 0x3000 | App image A start | code up to 0xE7F4 (~59K) bytes |
 | 0x117F8 | App image A CRC check length | word |
 | 0x117FC | App image A CRC check value | word |
-| 0x11800 | App image B start | code up to 0xE7F8 (~58K) bytes |
-| 0x1FFF8 | App image B CRC check length | word |
-| 0x1FFFC | App image B CRC check value | word |
+| 0x117FC | App image B start | code up to 0xE7F4 (~59K) bytes |
+| 0x1FFF0 | App image B CRC check length | word |
+| 0x1FFF4 | App image B CRC check value | word |
+| 0x1FFF8 | Reserved section, contains boot select parameter | 8 bytes |
 | 0x20000 | End of NVM | end  |
 
 ## Additional Information
@@ -35,13 +36,15 @@ The bootloader performs the following steps:
 1. The application will calculate the checksum of itself if the bootloader CRC is blank (all zeroes
    or all ones). If the CRC is not blank and the checksum check fails, it will immediately boot
    application image A. Otherwise, it proceeds to the next step.
-2. Check the checksum of App A. If that checksum is valid, it will boot App A. If not, it will
-   proceed to the next step.
-3. Check the checksum of App B. If that checksum is valid, it will boot App B. If not, it will
-   boot App A as the fallback image.
+2. Read the boot slot from a reserved section at the end of the EEPROM. If no valid value is read,
+   select boot slot A.
+3. Check the checksum of the boot slot. If that checksum is valid, it will boot that slot. If not,
+   it will proceed to the next step.
+4. Check the checksum of the other slot . If that checksum is valid, it will boot that slot. If
+   not, it will boot App A as the fallback image.
 
-You could adapt and combine this bootloader with a non-volatile memory to select a prefered app
-image, which would be a first step towards an updatable flight software.
+In your actual production application, a command to update the preferred boot slot could be exposed
+to allow performing software updates in a safe way.
 
 Please note that you *MUST* compile the application at slot A and slot B with an appropriate
 `memory.x` file where the base address of the `FLASH` was adapted according to the base address

bootloader/src/main.rs

@@ -5,6 +5,7 @@ use bootloader::NvmInterface;
 use cortex_m_rt::entry;
 use crc::{Crc, CRC_16_IBM_3740};
 use embedded_hal::delay::DelayNs;
+use num_enum::TryFromPrimitive;
 #[cfg(not(feature = "rtt-panic"))]
 use panic_halt as _;
 #[cfg(feature = "rtt-panic")]
@@ -59,8 +60,9 @@ const APP_B_SIZE_ADDR: u32 = APP_B_END_ADDR - 8;
 // Four bytes reserved, even when only 2 byte CRC is used. Leaves flexibility to switch to CRC32.
 // 0x1FFFC
 const APP_B_CRC_ADDR: u32 = APP_B_END_ADDR - 4;
-// 0x20000
-pub const APP_B_END_ADDR: u32 = NVM_SIZE;
+// 0x20000. 8 bytes at end of EEPROM reserved for preferred image parameter. This reserved
+// size should be a multiple of 8 due to alignment requirements.
+pub const APP_B_END_ADDR: u32 = NVM_SIZE - 8;
 pub const APP_IMG_SZ: u32 = (APP_B_END_ADDR - APP_A_START_ADDR) / 2;
 
 static_assertions::const_assert!((APP_B_END_ADDR - BOOTLOADER_END_ADDR) % 2 == 0);
@@ -68,13 +70,15 @@ static_assertions::const_assert!((APP_B_END_ADDR - BOOTLOADER_END_ADDR) % 2 == 0
 pub const VECTOR_TABLE_OFFSET: u32 = 0x0;
 pub const VECTOR_TABLE_LEN: u32 = 0xC0;
 pub const RESET_VECTOR_OFFSET: u32 = 0x4;
+pub const PREFERRED_SLOT_OFFSET: u32 = 0x20000 - 1;
 
 const CRC_ALGO: Crc<u16> = Crc::<u16>::new(&CRC_16_IBM_3740);
 
-#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+#[derive(Debug, Copy, Clone, PartialEq, Eq, TryFromPrimitive)]
+#[repr(u8)]
 enum AppSel {
-    A,
-    B,
+    A = 0,
+    B = 1,
 }
 
 pub struct NvmWrapper(pub M95M01);
@@ -154,10 +158,20 @@ fn main() -> ! {
     // Check bootloader's CRC (and write it if blank)
     check_own_crc(&dp.sysconfig, &cp, &mut nvm, &mut timer);
 
-    if check_app_crc(AppSel::A) {
-        boot_app(&dp.sysconfig, &cp, AppSel::A, &mut timer)
-    } else if check_app_crc(AppSel::B) {
-        boot_app(&dp.sysconfig, &cp, AppSel::B, &mut timer)
+    let mut preferred_app_raw = [0; 1];
+    nvm.read(PREFERRED_SLOT_OFFSET as usize, &mut preferred_app_raw)
+        .expect("reading preferred slot failed");
+    let preferred_app = AppSel::try_from(preferred_app_raw[0]).unwrap_or(AppSel::A);
+    let other_app = if preferred_app == AppSel::A {
+        AppSel::B
+    } else {
+        AppSel::A
+    };
+
+    if check_app_crc(preferred_app) {
+        boot_app(&dp.sysconfig, &cp, preferred_app, &mut timer)
+    } else if check_app_crc(other_app) {
+        boot_app(&dp.sysconfig, &cp, other_app, &mut timer)
     } else {
         if DEBUG_PRINTOUTS && RTT_PRINTOUT {
             rprintln!("both images corrupt! booting image A");

examples/README.md

@@ -20,6 +20,14 @@ cargo run --bin rtic-example
 
 ## Embassy example
 
+Blinky with time driver IRQs in library
+
 ```rs
 cargo run --bin embassy-example
 ```
+
+Blinky with custom time driver IRQs
+
+```rs
+cargo run --bin embassy-example --no-default-features --features custom-irqs
+```

examples/embassy/Cargo.toml

@@ -4,37 +4,29 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
+cfg-if = "1"
 cortex-m = { version = "0.7", features = ["critical-section-single-core"] }
 cortex-m-rt = "0.7"
 embedded-hal = "1"
 
-rtt-target = { version = "0.5" }
-panic-rtt-target = { version = "0.1" }
+rtt-target = "0.6"
+panic-rtt-target = "0.2"
 critical-section = "1"
 portable-atomic = { version = "1", features = ["unsafe-assume-single-core"]}
 
-embassy-sync = { version = "0.6.0" }
-embassy-time = { version = "0.3.2" }
-embassy-time-driver = { version = "0.1" }
+embassy-sync = "0.6"
+embassy-time = "0.4"
+embassy-executor = { version = "0.7", features = [
+  "arch-cortex-m",
+  "executor-thread",
+  "executor-interrupt"
+]}
 
-[dependencies.once_cell]
-version = "1"
-default-features = false
-features = ["critical-section"]
-
-[dependencies.embassy-executor]
-version = "0.6.0"
-features = [
-    "arch-cortex-m",
-    "executor-thread",
-    "executor-interrupt",
-    "integrated-timers",
-]
-
-[dependencies.va108xx-hal]
-path = "../../va108xx-hal"
+va108xx-hal = { path = "../../va108xx-hal" }
+va108xx-embassy = { path = "../../va108xx-embassy", default-features = false }
 
 [features]
-default = ["ticks-hz-1_000"]
+default = ["ticks-hz-1_000", "va108xx-embassy/irq-oc30-oc31"]
+custom-irqs = []
 ticks-hz-1_000 = ["embassy-time/tick-hz-1_000"]
 ticks-hz-32_768 = ["embassy-time/tick-hz-32_768"]

examples/embassy/src/lib.rs

@@ -1,4 +0,0 @@
-#![no_std]
-pub mod time_driver;
-
-pub use time_driver::init;

examples/embassy/src/main.rs

@@ -5,6 +5,16 @@ use embassy_time::{Duration, Instant, Ticker};
 use embedded_hal::digital::StatefulOutputPin;
 use panic_rtt_target as _;
 use rtt_target::{rprintln, rtt_init_print};
+use va108xx_embassy::embassy;
+
+cfg_if::cfg_if! {
+    if #[cfg(feature = "custom-irqs")] {
+        use va108xx_embassy::embassy_time_driver_irqs;
+        use va108xx_hal::pac::interrupt;
+        embassy_time_driver_irqs!(timekeeper_irq = OC23, alarm_irq = OC24);
+    }
+}
+
 use va108xx_hal::{gpio::PinsA, pac, prelude::*};
 
 const SYSCLK_FREQ: Hertz = Hertz::from_raw(50_000_000);
@@ -19,14 +29,28 @@ async fn main(_spawner: Spawner) {
 
     // Safety: Only called once here.
     unsafe {
-        embassy_example::init(
-            &mut dp.sysconfig,
-            &dp.irqsel,
-            SYSCLK_FREQ,
-            dp.tim23,
-            dp.tim22,
-        )
-    };
+        cfg_if::cfg_if! {
+            if #[cfg(not(feature = "custom-irqs"))] {
+                embassy::init(
+                    &mut dp.sysconfig,
+                    &dp.irqsel,
+                    SYSCLK_FREQ,
+                    dp.tim23,
+                    dp.tim22,
+                );
+            } else {
+                embassy::init_with_custom_irqs(
+                    &mut dp.sysconfig,
+                    &dp.irqsel,
+                    SYSCLK_FREQ,
+                    dp.tim23,
+                    dp.tim22,
+                    pac::Interrupt::OC23,
+                    pac::Interrupt::OC24,
+                );
+            }
+        }
+    }
 
     let porta = PinsA::new(&mut dp.sysconfig, Some(dp.ioconfig), dp.porta);
     let mut led0 = porta.pa10.into_readable_push_pull_output();

examples/embassy/src/time_driver.rs

@@ -1,333 +0,0 @@
-//! This is a sample time driver implementation for the VA108xx family of devices, supporting
-//! one alarm and requiring/reserving 2 TIM peripherals. You could adapt this implementation to
-//! support more alarms.
-//!
-//! This driver implementation reserves interrupts OC31 and OC30 for the timekeeping.
-use core::{cell::Cell, mem, ptr};
-use critical_section::CriticalSection;
-use embassy_sync::blocking_mutex::raw::CriticalSectionRawMutex;
-use embassy_sync::blocking_mutex::Mutex;
-use portable_atomic::{AtomicU32, AtomicU8, Ordering};
-
-use embassy_time_driver::{time_driver_impl, AlarmHandle, Driver, TICK_HZ};
-use once_cell::sync::OnceCell;
-use va108xx_hal::{
-    clock::enable_peripheral_clock,
-    enable_interrupt,
-    pac::{self, interrupt},
-    prelude::*,
-    timer::{enable_tim_clk, ValidTim},
-    PeripheralSelect,
-};
-
-pub type TimekeeperClk = pac::Tim23;
-pub type AlarmClk0 = pac::Tim22;
-pub type AlarmClk1 = pac::Tim21;
-pub type AlarmClk2 = pac::Tim20;
-
-const TIMEKEEPER_IRQ: pac::Interrupt = pac::Interrupt::OC31;
-const ALARM_IRQ: pac::Interrupt = pac::Interrupt::OC30;
-
-/// Initialization method for embassy
-///
-/// # Safety
-/// This has to be called once at initialization time to initiate the time driver for
-/// embassy.
-pub unsafe fn init(
-    syscfg: &mut pac::Sysconfig,
-    irqsel: &pac::Irqsel,
-    sysclk: impl Into<Hertz>,
-    timekeeper: TimekeeperClk,
-    alarm_tim: AlarmClk0,
-) {
-    DRIVER.init(syscfg, irqsel, sysclk, timekeeper, alarm_tim)
-}
-
-time_driver_impl!(
-    static DRIVER: TimerDriverEmbassy = TimerDriverEmbassy {
-        periods: AtomicU32::new(0),
-        alarm_count: AtomicU8::new(0),
-        alarms: Mutex::const_new(CriticalSectionRawMutex::new(), [AlarmState::new(); ALARM_COUNT])
-});
-
-/// Timekeeper interrupt.
-#[interrupt]
-#[allow(non_snake_case)]
-fn OC31() {
-    DRIVER.on_interrupt_timekeeping()
-}
-
-/// Alarm timer interrupt.
-#[interrupt]
-#[allow(non_snake_case)]
-fn OC30() {
-    DRIVER.on_interrupt_alarm(0)
-}
-
-#[inline(always)]
-const fn alarm_tim(idx: usize) -> &'static pac::tim0::RegisterBlock {
-    // Safety: This is a static memory-mapped peripheral.
-    match idx {
-        0 => unsafe { &*AlarmClk0::ptr() },
-        1 => unsafe { &*AlarmClk1::ptr() },
-        2 => unsafe { &*AlarmClk2::ptr() },
-        _ => {
-            panic!("invalid alarm timer index")
-        }
-    }
-}
-
-#[inline(always)]
-const fn timekeeping_tim() -> &'static pac::tim0::RegisterBlock {
-    // Safety: This is a memory-mapped peripheral.
-    unsafe { &*TimekeeperClk::ptr() }
-}
-
-struct AlarmState {
-    timestamp: Cell<u64>,
-
-    // This is really a Option<(fn(*mut ()), *mut ())>
-    // but fn pointers aren't allowed in const yet
-    callback: Cell<*const ()>,
-    ctx: Cell<*mut ()>,
-}
-
-impl AlarmState {
-    const fn new() -> Self {
-        Self {
-            timestamp: Cell::new(u64::MAX),
-            callback: Cell::new(ptr::null()),
-            ctx: Cell::new(ptr::null_mut()),
-        }
-    }
-}
-
-unsafe impl Send for AlarmState {}
-
-const ALARM_COUNT: usize = 1;
-
-static SCALE: OnceCell<u64> = OnceCell::new();
-
-pub struct TimerDriverEmbassy {
-    periods: AtomicU32,
-    alarm_count: AtomicU8,
-    /// Timestamp at which to fire alarm. u64::MAX if no alarm is scheduled.
-    alarms: Mutex<CriticalSectionRawMutex, [AlarmState; ALARM_COUNT]>,
-}
-
-impl TimerDriverEmbassy {
-    fn init(
-        &self,
-        syscfg: &mut pac::Sysconfig,
-        irqsel: &pac::Irqsel,
-        sysclk: impl Into<Hertz>,
-        timekeeper: TimekeeperClk,
-        alarm_tim: AlarmClk0,
-    ) {
-        enable_peripheral_clock(syscfg, PeripheralSelect::Irqsel);
-        enable_tim_clk(syscfg, TimekeeperClk::TIM_ID);
-        let sysclk = sysclk.into();
-        // Initiate scale value here. This is required to convert timer ticks back to a timestamp.
-        SCALE.set((sysclk.raw() / TICK_HZ as u32) as u64).unwrap();
-        timekeeper
-            .rst_value()
-            .write(|w| unsafe { w.bits(u32::MAX) });
-        // Decrementing counter.
-        timekeeper
-            .cnt_value()
-            .write(|w| unsafe { w.bits(u32::MAX) });
-        // Switch on. Timekeeping should always be done.
-        irqsel
-            .tim0(TimekeeperClk::TIM_ID as usize)
-            .write(|w| unsafe { w.bits(TIMEKEEPER_IRQ as u32) });
-        unsafe {
-            enable_interrupt(TIMEKEEPER_IRQ);
-        }
-        timekeeper.ctrl().modify(|_, w| w.irq_enb().set_bit());
-        timekeeper.enable().write(|w| unsafe { w.bits(1) });
-
-        enable_tim_clk(syscfg, AlarmClk0::TIM_ID);
-
-        // Explicitely disable alarm timer until needed.
-        alarm_tim.ctrl().modify(|_, w| {
-            w.irq_enb().clear_bit();
-            w.enable().clear_bit()
-        });
-        // Enable general interrupts. The IRQ enable of the peripheral remains cleared.
-        unsafe {
-            enable_interrupt(ALARM_IRQ);
-        }
-        irqsel
-            .tim0(AlarmClk0::TIM_ID as usize)
-            .write(|w| unsafe { w.bits(ALARM_IRQ as u32) });
-    }
-
-    // Should be called inside the IRQ of the timekeeper timer.
-    fn on_interrupt_timekeeping(&self) {
-        self.next_period();
-    }
-
-    // Should be called inside the IRQ of the alarm timer.
-    fn on_interrupt_alarm(&self, idx: usize) {
-        critical_section::with(|cs| {
-            if self.alarms.borrow(cs)[idx].timestamp.get() <= self.now() {
-                self.trigger_alarm(idx, cs)
-            }
-        })
-    }
-
-    fn next_period(&self) {
-        let period = self.periods.fetch_add(1, Ordering::AcqRel) + 1;
-        let t = (period as u64) << 32;
-        critical_section::with(|cs| {
-            for i in 0..ALARM_COUNT {
-                let alarm = &self.alarms.borrow(cs)[i];
-                let at = alarm.timestamp.get();
-                let alarm_tim = alarm_tim(0);
-                if at < t {
-                    self.trigger_alarm(i, cs);
-                } else {
-                    let remaining_ticks = (at - t) * *SCALE.get().unwrap();
-                    if remaining_ticks <= u32::MAX as u64 {
-                        alarm_tim.enable().write(|w| unsafe { w.bits(0) });
-                        alarm_tim
-                            .cnt_value()
-                            .write(|w| unsafe { w.bits(remaining_ticks as u32) });
-                        alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
-                        alarm_tim.enable().write(|w| unsafe { w.bits(1) })
-                    }
-                }
-            }
-        })
-    }
-
-    fn get_alarm<'a>(&'a self, cs: CriticalSection<'a>, alarm: AlarmHandle) -> &'a AlarmState {
-        // safety: we're allowed to assume the AlarmState is created by us, and
-        // we never create one that's out of bounds.
-        unsafe { self.alarms.borrow(cs).get_unchecked(alarm.id() as usize) }
-    }
-
-    fn trigger_alarm(&self, n: usize, cs: CriticalSection) {
-        alarm_tim(n).ctrl().modify(|_, w| {
-            w.irq_enb().clear_bit();
-            w.enable().clear_bit()
-        });
-
-        let alarm = &self.alarms.borrow(cs)[n];
-        // Setting the maximum value disables the alarm.
-        alarm.timestamp.set(u64::MAX);
-
-        // Call after clearing alarm, so the callback can set another alarm.
-
-        // safety:
-        // - we can ignore the possiblity of `f` being unset (null) because of the safety contract of `allocate_alarm`.
-        // - other than that we only store valid function pointers into alarm.callback
-        let f: fn(*mut ()) = unsafe { mem::transmute(alarm.callback.get()) };
-        f(alarm.ctx.get());
-    }
-}
-
-impl Driver for TimerDriverEmbassy {
-    fn now(&self) -> u64 {
-        if SCALE.get().is_none() {
-            return 0;
-        }
-        let mut period1: u32;
-        let mut period2: u32;
-        let mut counter_val: u32;
-
-        loop {
-            // Acquire ensures that we get the latest value of `periods` and
-            // no instructions can be reordered before the load.
-            period1 = self.periods.load(Ordering::Acquire);
-
-            counter_val = u32::MAX - timekeeping_tim().cnt_value().read().bits();
-
-            // Double read to protect against race conditions when the counter is overflowing.
-            period2 = self.periods.load(Ordering::Relaxed);
-            if period1 == period2 {
-                let now = (((period1 as u64) << 32) | counter_val as u64) / *SCALE.get().unwrap();
-                return now;
-            }
-        }
-    }
-
-    unsafe fn allocate_alarm(&self) -> Option<AlarmHandle> {
-        let id = self
-            .alarm_count
-            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |x| {
-                if x < ALARM_COUNT as u8 {
-                    Some(x + 1)
-                } else {
-                    None
-                }
-            });
-
-        match id {
-            Ok(id) => Some(AlarmHandle::new(id)),
-            Err(_) => None,
-        }
-    }
-
-    fn set_alarm_callback(
-        &self,
-        alarm: embassy_time_driver::AlarmHandle,
-        callback: fn(*mut ()),
-        ctx: *mut (),
-    ) {
-        critical_section::with(|cs| {
-            let alarm = self.get_alarm(cs, alarm);
-
-            alarm.callback.set(callback as *const ());
-            alarm.ctx.set(ctx);
-        })
-    }
-
-    fn set_alarm(&self, alarm: embassy_time_driver::AlarmHandle, timestamp: u64) -> bool {
-        if SCALE.get().is_none() {
-            return false;
-        }
-        critical_section::with(|cs| {
-            let n = alarm.id();
-            let alarm_tim = alarm_tim(n.into());
-            alarm_tim.ctrl().modify(|_, w| {
-                w.irq_enb().clear_bit();
-                w.enable().clear_bit()
-            });
-
-            let alarm = self.get_alarm(cs, alarm);
-            alarm.timestamp.set(timestamp);
-
-            let t = self.now();
-            if timestamp <= t {
-                alarm.timestamp.set(u64::MAX);
-                return false;
-            }
-
-            // If it hasn't triggered yet, setup the relevant reset value, regardless of whether
-            // the interrupts are enabled or not. When they are enabled at a later point, the
-            // right value is already set.
-
-            // If the timestamp is in the next few ticks, add a bit of buffer to be sure the alarm
-            // is not missed.
-            //
-            // This means that an alarm can be delayed for up to 2 ticks (from t+1 to t+3), but this is allowed
-            // by the Alarm trait contract. What's not allowed is triggering alarms *before* their scheduled time,
-            // and we don't do that here.
-            let safe_timestamp = timestamp.max(t + 3);
-            let timer_ticks = (safe_timestamp - t) * *SCALE.get().unwrap();
-            alarm_tim.rst_value().write(|w| unsafe { w.bits(u32::MAX) });
-            if timer_ticks <= u32::MAX as u64 {
-                alarm_tim
-                    .cnt_value()
-                    .write(|w| unsafe { w.bits(timer_ticks as u32) });
-                alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
-                alarm_tim.enable().write(|w| unsafe { w.bits(1) });
-            }
-            // If it's too far in the future, don't enable timer yet.
-            // It will be enabled later by `next_period`.
-
-            true
-        })
-    }
-}

examples/rtic/Cargo.toml

@@ -8,37 +8,19 @@ cortex-m = { version = "0.7", features = ["critical-section-single-core"] }
 cortex-m-rt = "0.7"
 embedded-hal = "1"
 embedded-io = "0.6"
-rtt-target = { version = "0.5" }
-panic-rtt-target = { version = "0.1" }
+rtt-target = "0.6"
+panic-rtt-target = "0.2"
 
 # Even though we do not use this directly, we need to activate this feature explicitely
 # so that RTIC compiles because thumv6 does not have CAS operations natively.
 portable-atomic = { version = "1", features = ["unsafe-assume-single-core"]}
 
-[dependencies.rtic]
-version = "2"
-features = ["thumbv6-backend"]
+rtic = { version = "2", features = ["thumbv6-backend"] }
+rtic-monotonics = { version = "2", features = ["cortex-m-systick"] }
+rtic-sync = { version = "1.3", features = ["defmt-03"] }
 
-[dependencies.rtic-monotonics]
-version = "2"
-features = ["cortex-m-systick"]
+once_cell = {version = "1", default-features = false, features = ["critical-section"]}
+ringbuf = { version = "0.4.7", default-features = false, features = ["portable-atomic"] }
 
-[dependencies.rtic-sync]
-version = "1.3"
-features = ["defmt-03"]
-
-[dependencies.once_cell]
-version = "1"
-default-features = false
-features = ["critical-section"]
-
-[dependencies.ringbuf]
-version = "0.4.7"
-default-features = false
-features = ["portable-atomic"]
-
-[dependencies.va108xx-hal]
-path = "../../va108xx-hal"
-
-[dependencies.vorago-reb1]
-path = "../../vorago-reb1"
+va108xx-hal = "0.8"
+vorago-reb1 = { path = "../../vorago-reb1" }

examples/rtic/src/bin/uart-echo-rtic.rs

@@ -5,25 +5,17 @@
 #![no_main]
 #![no_std]
 
-use once_cell::sync::Lazy;
 use ringbuf::StaticRb;
 
 // Larger buffer for TC to be able to hold the possibly large memory write packets.
 const RX_RING_BUF_SIZE: usize = 1024;
 
-// Ring buffers to handling variable sized telemetry
-static mut RINGBUF: Lazy<StaticRb<u8, RX_RING_BUF_SIZE>> =
-    Lazy::new(StaticRb::<u8, RX_RING_BUF_SIZE>::default);
-
 #[rtic::app(device = pac, dispatchers = [OC4])]
 mod app {
     use super::*;
     use embedded_io::Write;
     use panic_rtt_target as _;
-    use ringbuf::{
-        traits::{Consumer, Observer, Producer, SplitRef},
-        CachingCons, StaticProd,
-    };
+    use ringbuf::traits::{Consumer, Observer, Producer};
     use rtic_example::SYSCLK_FREQ;
     use rtic_monotonics::Monotonic;
     use rtt_target::{rprintln, rtt_init_print};
@@ -36,14 +28,14 @@ mod app {
 
     #[local]
     struct Local {
-        data_producer: StaticProd<'static, u8, RX_RING_BUF_SIZE>,
-        data_consumer: CachingCons<&'static StaticRb<u8, RX_RING_BUF_SIZE>>,
         rx: RxWithIrq<pac::Uarta>,
         tx: Tx<pac::Uarta>,
     }
 
     #[shared]
-    struct Shared {}
+    struct Shared {
+        rb: StaticRb<u8, RX_RING_BUF_SIZE>,
+    }
 
     rtic_monotonics::systick_monotonic!(Mono, 1_000);
 
@@ -71,16 +63,12 @@ mod app {
 
         rx.start();
 
-        let (data_producer, data_consumer) = unsafe { RINGBUF.split_ref() };
         echo_handler::spawn().unwrap();
         (
-            Shared {},
-            Local {
-                data_producer,
-                data_consumer,
-                rx,
-                tx,
+            Shared {
+                rb: StaticRb::default(),
             },
+            Local { rx, tx },
         )
     }
 
@@ -94,24 +82,23 @@ mod app {
 
     #[task(
         binds = OC3,
-        shared = [],
+        shared = [rb],
         local = [
             rx,
-            data_producer
         ],
     )]
-    fn reception_task(cx: reception_task::Context) {
+    fn reception_task(mut cx: reception_task::Context) {
         let mut buf: [u8; 16] = [0; 16];
         let mut ringbuf_full = false;
         let result = cx.local.rx.irq_handler(&mut buf);
         if result.bytes_read > 0 && result.errors.is_none() {
-            if cx.local.data_producer.vacant_len() < result.bytes_read {
-                ringbuf_full = true;
-            } else {
-                cx.local
-                    .data_producer
-                    .push_slice(&buf[0..result.bytes_read]);
-            }
+            cx.shared.rb.lock(|rb| {
+                if rb.vacant_len() < result.bytes_read {
+                    ringbuf_full = true;
+                } else {
+                    rb.push_slice(&buf[0..result.bytes_read]);
+                }
+            });
         }
         if ringbuf_full {
             // Could also drop oldest data, but that would require the consumer to be shared.
@@ -119,24 +106,23 @@ mod app {
         }
     }
 
-    #[task(shared = [], local = [
+    #[task(shared = [rb], local = [
         buf: [u8; RX_RING_BUF_SIZE] = [0; RX_RING_BUF_SIZE],
-        data_consumer,
+
         tx
     ], priority=1)]
-    async fn echo_handler(cx: echo_handler::Context) {
+    async fn echo_handler(mut cx: echo_handler::Context) {
         loop {
-            let bytes_to_read = cx.local.data_consumer.occupied_len();
-            if bytes_to_read > 0 {
-                let actual_read_bytes = cx
-                    .local
-                    .data_consumer
-                    .pop_slice(&mut cx.local.buf[0..bytes_to_read]);
-                cx.local
-                    .tx
-                    .write_all(&cx.local.buf[0..actual_read_bytes])
-                    .expect("Failed to write to TX");
-            }
+            cx.shared.rb.lock(|rb| {
+                let bytes_to_read = rb.occupied_len();
+                if bytes_to_read > 0 {
+                    let actual_read_bytes = rb.pop_slice(&mut cx.local.buf[0..bytes_to_read]);
+                    cx.local
+                        .tx
+                        .write_all(&cx.local.buf[0..actual_read_bytes])
+                        .expect("Failed to write to TX");
+                }
+            });
             Mono::delay(50.millis()).await;
         }
     }

examples/simple/Cargo.toml

@@ -6,17 +6,17 @@ edition = "2021"
 [dependencies]
 cortex-m = {version = "0.7", features = ["critical-section-single-core"]}
 cortex-m-rt = "0.7"
-panic-halt = "0.2"
-panic-rtt-target = "0.1"
+panic-halt = "1"
+panic-rtt-target = "0.2"
 critical-section = "1"
-rtt-target = "0.5"
+rtt-target = "0.6"
 embedded-hal = "1"
 embedded-hal-nb = "1"
 embedded-io = "0.6"
 cortex-m-semihosting = "0.5.0"
 
 [dependencies.va108xx-hal]
-path = "../../va108xx-hal"
+version = "0.8"
 features = ["rt", "defmt"]
 
 [dependencies.vorago-reb1]

flashloader/Cargo.toml

@@ -9,54 +9,24 @@ cortex-m-rt = "0.7"
 embedded-hal = "1"
 embedded-hal-nb = "1"
 embedded-io = "0.6"
-panic-rtt-target = { version = "0.1.3" }
-rtt-target = { version = "0.5" }
+panic-rtt-target = "0.2"
+rtt-target = "0.6"
+num_enum = { version = "0.7", default-features = false }
 log = "0.4"
 crc = "3"
-
-[dependencies.satrs]
-version = "0.2"
-default-features = false
-
-[dependencies.rtt-log]
-version = "0.4"
-
-[dependencies.ringbuf]
-version = "0.4.7"
-default-features = false
-features = ["portable-atomic"]
-
-[dependencies.once_cell]
-version = "1"
-default-features = false
-features = ["critical-section"]
-
-[dependencies.spacepackets]
-version = "0.11"
-default-features = false
-
-[dependencies.cobs]
-git = "https://github.com/robamu/cobs.rs.git"
-branch = "all_features"
-default-features = false
-
+cobs = { version = "0.3", default-features = false }
+satrs = { version = "0.2", default-features = false }
+rtt-log = "0.5"
+ringbuf = { version = "0.4.7", default-features = false, features = ["portable-atomic"] }
+once_cell = { version = "1", default-features = false, features = ["critical-section"] }
+spacepackets = { version = "0.11", default-features = false }
 # Even though we do not use this directly, we need to activate this feature explicitely
 # so that RTIC compiles because thumv6 does not have CAS operations natively.
-[dependencies.portable-atomic]
-version = "1"
-features = ["unsafe-assume-single-core"]
+portable-atomic = {version = "1", features = ["unsafe-assume-single-core"]}
 
-[dependencies.rtic]
-version = "2"
-features = ["thumbv6-backend"]
-
-[dependencies.rtic-monotonics]
-version = "2"
-features = ["cortex-m-systick"]
-
-[dependencies.rtic-sync]
-version = "1"
-features = ["defmt-03"]
+rtic = { version = "2", features = ["thumbv6-backend"] }
+rtic-monotonics = { version = "2", features = ["cortex-m-systick"] }
+rtic-sync = {version = "1", features = ["defmt-03"]}
 
 [dependencies.va108xx-hal]
 path = "../va108xx-hal"

flashloader/README.md

@@ -59,6 +59,15 @@ to write it to slot A.
 
 You can use
 
+```sh
+./image-loader.py -s a
+```
+
+to select the Slot A as a boot slot. The boot slot is stored in a reserved section in EEPROM
+and will be read and used by the bootloader to determine which slot to boot.
+
+You can use
+
 ```sh
 ./image-loader.py -c -t a
 ```

flashloader/image-loader.py

@@ -30,20 +30,21 @@ BOOTLOADER_CRC_ADDR = BOOTLOADER_END_ADDR - 2
 BOOTLOADER_MAX_SIZE = BOOTLOADER_END_ADDR - BOOTLOADER_START_ADDR - 2
 
 APP_A_START_ADDR = 0x3000
-APP_A_END_ADDR = 0x11800
+APP_B_END_ADDR = 0x20000 - 8
+IMG_SLOT_SIZE = (APP_B_END_ADDR - APP_A_START_ADDR) // 2
+
+APP_A_END_ADDR = APP_A_START_ADDR + IMG_SLOT_SIZE
 # The actual size of the image which is relevant for CRC calculation.
 APP_A_SIZE_ADDR = APP_A_END_ADDR - 8
 APP_A_CRC_ADDR = APP_A_END_ADDR - 4
 APP_A_MAX_SIZE = APP_A_END_ADDR - APP_A_START_ADDR - 8
 
 APP_B_START_ADDR = APP_A_END_ADDR
-APP_B_END_ADDR = 0x20000
 # The actual size of the image which is relevant for CRC calculation.
 APP_B_SIZE_ADDR = APP_B_END_ADDR - 8
 APP_B_CRC_ADDR = APP_B_END_ADDR - 4
 APP_B_MAX_SIZE = APP_A_END_ADDR - APP_A_START_ADDR - 8
 
-APP_IMG_SZ = (APP_B_END_ADDR - APP_A_START_ADDR) // 2
 
 CHUNK_SIZE = 400
 
@@ -58,6 +59,7 @@ PING_PAYLOAD_SIZE = 0
 class ActionId(enum.IntEnum):
     CORRUPT_APP_A = 128
     CORRUPT_APP_B = 129
+    SET_BOOT_SLOT = 130
 
 
 _LOGGER = logging.getLogger(__name__)
@@ -78,11 +80,37 @@ class Target(enum.Enum):
     APP_B = 2
 
 
+class AppSel(enum.IntEnum):
+    APP_A = 0
+    APP_B = 1
+
+
 class ImageLoader:
     def __init__(self, com_if: ComInterface, verificator: PusVerificator) -> None:
         self.com_if = com_if
         self.verificator = verificator
 
+    def handle_boot_sel_cmd(self, target: AppSel):
+        _LOGGER.info("Sending ping command")
+        action_tc = PusTc(
+            apid=0x00,
+            service=PusService.S8_FUNC_CMD,
+            subservice=ActionId.SET_BOOT_SLOT,
+            seq_count=SEQ_PROVIDER.get_and_increment(),
+            app_data=bytes([target]),
+        )
+        self.verificator.add_tc(action_tc)
+        self.com_if.send(bytes(action_tc.pack()))
+        data_available = self.com_if.data_available(0.4)
+        if not data_available:
+            _LOGGER.warning("no reply received for boot image selection command")
+        for reply in self.com_if.receive():
+            result = self.verificator.add_tm(
+                Service1Tm.from_tm(PusTm.unpack(reply, 0), UnpackParams(0))
+            )
+            if result is not None and result.completed:
+                _LOGGER.info("received boot image selection command confirmation")
+
     def handle_ping_cmd(self):
         _LOGGER.info("Sending ping command")
         ping_tc = PusTc(
@@ -106,7 +134,6 @@ class ImageLoader:
                 _LOGGER.info("received ping completion reply")
 
     def handle_corruption_cmd(self, target: Target):
-
         if target == Target.BOOTLOADER:
             _LOGGER.error("can not corrupt bootloader")
         if target == Target.APP_A:
@@ -131,7 +158,8 @@ class ImageLoader:
         _LOGGER.info("Parsing ELF file for loadable sections")
         total_size = 0
         loadable_segments, total_size = create_loadable_segments(target, file_path)
-        segments_info_str(target, loadable_segments, total_size, file_path)
+        check_segments(target, total_size)
+        print_segments_info(target, loadable_segments, total_size, file_path)
         result = self._perform_flashing_algorithm(loadable_segments)
         if result != 0:
             return result
@@ -251,6 +279,9 @@ def main() -> int:
         prog="image-loader", description="Python VA416XX Image Loader Application"
     )
     parser.add_argument("-p", "--ping", action="store_true", help="Send ping command")
+    parser.add_argument(
+        "-s", "--sel", choices=["a", "b"], help="Set boot slot (Slot A or B)"
+    )
     parser.add_argument("-c", "--corrupt", action="store_true", help="Corrupt a target")
     parser.add_argument(
         "-t",
@@ -286,6 +317,14 @@ def main() -> int:
         target = Target.APP_A
     elif args.target == "b":
         target = Target.APP_B
+
+    boot_sel = None
+    if args.sel:
+        if args.sel == "a":
+            boot_sel = AppSel.APP_A
+        elif args.sel == "b":
+            boot_sel = AppSel.APP_B
+
     image_loader = ImageLoader(com_if, verificator)
     file_path = None
     result = -1
@@ -293,6 +332,8 @@ def main() -> int:
         image_loader.handle_ping_cmd()
         com_if.close()
         return 0
+    if args.sel and boot_sel is not None:
+        image_loader.handle_boot_sel_cmd(boot_sel)
     if target:
         if not args.corrupt:
             if not args.path:
@@ -307,9 +348,9 @@ def main() -> int:
             return -1
         image_loader.handle_corruption_cmd(target)
     else:
-        assert file_path is not None
-        assert target is not None
-        result = image_loader.handle_flash_cmd(target, file_path)
+        if file_path is not None:
+            assert target is not None
+            result = image_loader.handle_flash_cmd(target, file_path)
 
     com_if.close()
     return result
@@ -377,7 +418,22 @@ def create_loadable_segments(
     return loadable_segments, total_size
 
 
-def segments_info_str(
+def check_segments(
+    target: Target,
+    total_size: int,
+):
+    # Set context string and perform basic sanity checks.
+    if target == Target.BOOTLOADER and total_size > BOOTLOADER_MAX_SIZE:
+        raise ValueError(
+            f"provided bootloader app larger than allowed {total_size} bytes"
+        )
+    elif target == Target.APP_A and total_size > APP_A_MAX_SIZE:
+        raise ValueError(f"provided App A larger than allowed {total_size} bytes")
+    elif target == Target.APP_B and total_size > APP_B_MAX_SIZE:
+        raise ValueError(f"provided App B larger than allowed {total_size} bytes")
+
+
+def print_segments_info(
     target: Target,
     loadable_segments: List[LoadableSegment],
     total_size: int,
@@ -385,21 +441,10 @@ def segments_info_str(
 ):
     # Set context string and perform basic sanity checks.
     if target == Target.BOOTLOADER:
-        if total_size > BOOTLOADER_MAX_SIZE:
-            _LOGGER.error(
-                f"provided bootloader app larger than allowed {total_size} bytes"
-            )
-            return -1
         context_str = "Bootloader"
     elif target == Target.APP_A:
-        if total_size > APP_A_MAX_SIZE:
-            _LOGGER.error(f"provided App A larger than allowed {total_size} bytes")
-            return -1
         context_str = "App Slot A"
     elif target == Target.APP_B:
-        if total_size > APP_B_MAX_SIZE:
-            _LOGGER.error(f"provided App B larger than allowed {total_size} bytes")
-            return -1
         context_str = "App Slot B"
     _LOGGER.info(f"Flashing {context_str} with image {file_path} (size {total_size})")
     for idx, segment in enumerate(loadable_segments):

flashloader/slot-a-blinky/memory.x

@@ -1,7 +1,7 @@
 /* Special linker script for application slot A with an offset at address 0x3000 */
 MEMORY
 {
-	FLASH : ORIGIN = 0x00003000, LENGTH = 0xE800
+	FLASH : ORIGIN = 0x00003000, LENGTH = 0xE7FC
 	RAM : ORIGIN = 0x10000000, LENGTH = 0x08000 /* 32K */
 }
 

flashloader/slot-b-blinky/memory.x

@@ -1,7 +1,7 @@
-/* Special linker script for application slot B with an offset at address 0x11800 */
+/* Special linker script for application slot B */
 MEMORY
 {
-	FLASH : ORIGIN = 0x00011800, LENGTH = 0xE800
+	FLASH : ORIGIN = 0x000117FC, LENGTH = 0xE7FC
 	RAM : ORIGIN = 0x10000000, LENGTH = 0x08000 /* 32K */
 }
 

flashloader/src/main.rs

@@ -3,11 +3,11 @@
 #![no_main]
 #![no_std]
 
-use once_cell::sync::Lazy;
+use num_enum::TryFromPrimitive;
 use panic_rtt_target as _;
 use ringbuf::{
-    traits::{Consumer, Observer, Producer, SplitRef},
-    CachingCons, StaticProd, StaticRb,
+    traits::{Consumer, Observer, Producer},
+    StaticRb,
 };
 use va108xx_hal::prelude::*;
 
@@ -26,6 +26,14 @@ const RX_DEBUGGING: bool = false;
 pub enum ActionId {
     CorruptImageA = 128,
     CorruptImageB = 129,
+    SetBootSlot = 130,
+}
+
+#[derive(Debug, Copy, Clone, PartialEq, Eq, TryFromPrimitive)]
+#[repr(u8)]
+enum AppSel {
+    A = 0,
+    B = 1,
 }
 
 // Larger buffer for TC to be able to hold the possibly large memory write packets.
@@ -35,33 +43,18 @@ const SIZES_RB_SIZE_TC: usize = 16;
 const BUF_RB_SIZE_TM: usize = 256;
 const SIZES_RB_SIZE_TM: usize = 16;
 
-// Ring buffers to handling variable sized telemetry
-static mut BUF_RB_TM: Lazy<StaticRb<u8, BUF_RB_SIZE_TM>> =
-    Lazy::new(StaticRb::<u8, BUF_RB_SIZE_TM>::default);
-static mut SIZES_RB_TM: Lazy<StaticRb<usize, SIZES_RB_SIZE_TM>> =
-    Lazy::new(StaticRb::<usize, SIZES_RB_SIZE_TM>::default);
-
-// Ring buffers to handling variable sized telecommands
-static mut BUF_RB_TC: Lazy<StaticRb<u8, BUF_RB_SIZE_TC>> =
-    Lazy::new(StaticRb::<u8, BUF_RB_SIZE_TC>::default);
-static mut SIZES_RB_TC: Lazy<StaticRb<usize, SIZES_RB_SIZE_TC>> =
-    Lazy::new(StaticRb::<usize, SIZES_RB_SIZE_TC>::default);
-
-pub struct DataProducer<const BUF_SIZE: usize, const SIZES_LEN: usize> {
-    pub buf_prod: StaticProd<'static, u8, BUF_SIZE>,
-    pub sizes_prod: StaticProd<'static, usize, SIZES_LEN>,
-}
-
-pub struct DataConsumer<const BUF_SIZE: usize, const SIZES_LEN: usize> {
-    pub buf_cons: CachingCons<&'static StaticRb<u8, BUF_SIZE>>,
-    pub sizes_cons: CachingCons<&'static StaticRb<usize, SIZES_LEN>>,
+pub struct RingBufWrapper<const BUF_SIZE: usize, const SIZES_LEN: usize> {
+    pub buf: StaticRb<u8, BUF_SIZE>,
+    pub sizes: StaticRb<usize, SIZES_LEN>,
 }
 
 pub const APP_A_START_ADDR: u32 = 0x3000;
-pub const APP_A_END_ADDR: u32 = 0x11800;
+pub const APP_A_END_ADDR: u32 = 0x117FC;
 pub const APP_B_START_ADDR: u32 = APP_A_END_ADDR;
 pub const APP_B_END_ADDR: u32 = 0x20000;
 
+pub const PREFERRED_SLOT_OFFSET: u32 = 0x20000 - 1;
+
 #[rtic::app(device = pac, dispatchers = [OC20, OC21, OC22])]
 mod app {
     use super::*;
@@ -94,12 +87,6 @@ mod app {
         uart_rx: uart::RxWithIrq<pac::Uarta>,
         uart_tx: uart::Tx<pac::Uarta>,
         rx_context: IrqContextTimeoutOrMaxSize,
-        // We handle all TM in one task.
-        tm_cons: DataConsumer<BUF_RB_SIZE_TM, SIZES_RB_SIZE_TM>,
-        // We consume all TC in one task.
-        tc_cons: DataConsumer<BUF_RB_SIZE_TC, SIZES_RB_SIZE_TC>,
-        // We produce all TC in one task.
-        tc_prod: DataProducer<BUF_RB_SIZE_TC, SIZES_RB_SIZE_TC>,
         verif_reporter: VerificationReportCreator,
         nvm: M95M01,
     }
@@ -107,7 +94,8 @@ mod app {
     #[shared]
     struct Shared {
         // Having this shared allows multiple tasks to generate telemetry.
-        tm_prod: DataProducer<BUF_RB_SIZE_TM, SIZES_RB_SIZE_TM>,
+        tm_rb: RingBufWrapper<BUF_RB_SIZE_TM, SIZES_RB_SIZE_TM>,
+        tc_rb: RingBufWrapper<BUF_RB_SIZE_TC, SIZES_RB_SIZE_TC>,
     }
 
     rtic_monotonics::systick_monotonic!(Mono, 1000);
@@ -138,12 +126,6 @@ mod app {
 
         let verif_reporter = VerificationReportCreator::new(0).unwrap();
 
-        let (buf_prod_tm, buf_cons_tm) = unsafe { BUF_RB_TM.split_ref() };
-        let (sizes_prod_tm, sizes_cons_tm) = unsafe { SIZES_RB_TM.split_ref() };
-
-        let (buf_prod_tc, buf_cons_tc) = unsafe { BUF_RB_TC.split_ref() };
-        let (sizes_prod_tc, sizes_cons_tc) = unsafe { SIZES_RB_TC.split_ref() };
-
         let mut rx_context = IrqContextTimeoutOrMaxSize::new(MAX_TC_FRAME_SIZE);
         rx.read_fixed_len_or_timeout_based_using_irq(&mut rx_context)
             .expect("initiating UART RX failed");
@@ -151,27 +133,19 @@ mod app {
         pus_tm_tx_handler::spawn().unwrap();
         (
             Shared {
-                tm_prod: DataProducer {
-                    buf_prod: buf_prod_tm,
-                    sizes_prod: sizes_prod_tm,
+                tc_rb: RingBufWrapper {
+                    buf: StaticRb::default(),
+                    sizes: StaticRb::default(),
+                },
+                tm_rb: RingBufWrapper {
+                    buf: StaticRb::default(),
+                    sizes: StaticRb::default(),
                 },
             },
             Local {
                 uart_rx: rx,
                 uart_tx: tx,
                 rx_context,
-                tm_cons: DataConsumer {
-                    buf_cons: buf_cons_tm,
-                    sizes_cons: sizes_cons_tm,
-                },
-                tc_cons: DataConsumer {
-                    buf_cons: buf_cons_tc,
-                    sizes_cons: sizes_cons_tc,
-                },
-                tc_prod: DataProducer {
-                    buf_prod: buf_prod_tc,
-                    sizes_prod: sizes_prod_tc,
-                },
                 verif_reporter,
                 nvm,
             },
@@ -194,10 +168,10 @@ mod app {
             rx_buf: [u8; MAX_TC_FRAME_SIZE] = [0; MAX_TC_FRAME_SIZE],
             rx_context,
             uart_rx,
-            tc_prod
         ],
+        shared = [tc_rb]
     )]
-    fn uart_rx_irq(cx: uart_rx_irq::Context) {
+    fn uart_rx_irq(mut cx: uart_rx_irq::Context) {
         match cx
             .local
             .uart_rx
@@ -220,16 +194,17 @@ mod app {
                             log::warn!("COBS decoding failed");
                         } else {
                             let decoded_size = decoded_size.unwrap();
-                            if cx.local.tc_prod.sizes_prod.vacant_len() >= 1
-                                && cx.local.tc_prod.buf_prod.vacant_len() >= decoded_size
-                            {
-                                // Should never fail, we checked there is enough space.
-                                cx.local.tc_prod.sizes_prod.try_push(decoded_size).unwrap();
-                                cx.local
-                                    .tc_prod
-                                    .buf_prod
-                                    .push_slice(&cx.local.rx_buf[1..1 + decoded_size]);
-                            } else {
+                            let mut tc_rb_full = false;
+                            cx.shared.tc_rb.lock(|rb| {
+                                if rb.sizes.vacant_len() >= 1 && rb.buf.vacant_len() >= decoded_size
+                                {
+                                    rb.sizes.try_push(decoded_size).unwrap();
+                                    rb.buf.push_slice(&cx.local.rx_buf[1..1 + decoded_size]);
+                                } else {
+                                    tc_rb_full = true;
+                                }
+                            });
+                            if tc_rb_full {
                                 log::warn!("COBS TC queue full");
                             }
                         }
@@ -260,16 +235,15 @@ mod app {
             readback_buf: [u8; MAX_TC_SIZE] = [0; MAX_TC_SIZE],
             src_data_buf: [u8; 16] = [0; 16],
             verif_buf: [u8; 32] = [0; 32],
-            tc_cons,
             nvm,
             verif_reporter
         ],
-        shared=[tm_prod]
+        shared=[tm_rb, tc_rb]
     )]
     async fn pus_tc_handler(mut cx: pus_tc_handler::Context) {
         loop {
             // Try to read a TC from the ring buffer.
-            let packet_len = cx.local.tc_cons.sizes_cons.try_pop();
+            let packet_len = cx.shared.tc_rb.lock(|rb| rb.sizes.try_pop());
             if packet_len.is_none() {
                 // Small delay, TCs might arrive very quickly.
                 Mono::delay(20.millis()).await;
@@ -277,13 +251,11 @@ mod app {
             }
             let packet_len = packet_len.unwrap();
             log::info!(target: "TC Handler", "received packet with length {}", packet_len);
-            assert_eq!(
-                cx.local
-                    .tc_cons
-                    .buf_cons
-                    .pop_slice(&mut cx.local.tc_buf[0..packet_len]),
-                packet_len
-            );
+            let popped_packet_len = cx
+                .shared
+                .tc_rb
+                .lock(|rb| rb.buf.pop_slice(&mut cx.local.tc_buf[0..packet_len]));
+            assert_eq!(popped_packet_len, packet_len);
             // Read a telecommand, now handle it.
             handle_valid_pus_tc(&mut cx);
         }
@@ -298,10 +270,9 @@ mod app {
         let (pus_tc, _) = pus_tc.unwrap();
         let mut write_and_send = |tm: &PusTmCreator| {
             let written_size = tm.write_to_bytes(cx.local.verif_buf).unwrap();
-            cx.shared.tm_prod.lock(|prod| {
-                prod.sizes_prod.try_push(tm.len_written()).unwrap();
-                prod.buf_prod
-                    .push_slice(&cx.local.verif_buf[0..written_size]);
+            cx.shared.tm_rb.lock(|prod| {
+                prod.sizes.try_push(tm.len_written()).unwrap();
+                prod.buf.push_slice(&cx.local.verif_buf[0..written_size]);
             });
         };
         let token = cx.local.verif_reporter.add_tc(&pus_tc);
@@ -346,6 +317,26 @@ mod app {
                 rprintln!("corrupting App Image B");
                 corrupt_image(APP_B_START_ADDR);
             }
+            if pus_tc.subservice() == ActionId::SetBootSlot as u8 {
+                if pus_tc.app_data().is_empty() {
+                    log::warn!(target: "TC Handler", "App data for preferred image command too short");
+                }
+                let app_sel_result = AppSel::try_from(pus_tc.app_data()[0]);
+                if app_sel_result.is_err() {
+                    log::warn!("Invalid app selection value: {}", pus_tc.app_data()[0]);
+                }
+                log::info!(target: "TC Handler", "received boot selection command with app select: {:?}", app_sel_result.unwrap());
+                cx.local
+                    .nvm
+                    .write(PREFERRED_SLOT_OFFSET as usize, &[pus_tc.app_data()[0]])
+                    .expect("writing to NVM failed");
+                let tm = cx
+                    .local
+                    .verif_reporter
+                    .completion_success(cx.local.src_data_buf, started_token, 0, 0, &[])
+                    .expect("completion success failed");
+                write_and_send(&tm);
+            }
         }
         if pus_tc.service() == PusServiceId::Test as u8 && pus_tc.subservice() == 1 {
             log::info!(target: "TC Handler", "received ping TC");
@@ -444,18 +435,18 @@ mod app {
             read_buf: [u8;MAX_TM_SIZE] = [0; MAX_TM_SIZE],
             encoded_buf: [u8;MAX_TM_FRAME_SIZE] = [0; MAX_TM_FRAME_SIZE],
             uart_tx,
-            tm_cons
         ],
-        shared=[]
+        shared=[tm_rb]
     )]
-    async fn pus_tm_tx_handler(cx: pus_tm_tx_handler::Context) {
+    async fn pus_tm_tx_handler(mut cx: pus_tm_tx_handler::Context) {
         loop {
-            while cx.local.tm_cons.sizes_cons.occupied_len() > 0 {
-                let next_size = cx.local.tm_cons.sizes_cons.try_pop().unwrap();
-                cx.local
-                    .tm_cons
-                    .buf_cons
-                    .pop_slice(&mut cx.local.read_buf[0..next_size]);
+            let mut occupied_len = cx.shared.tm_rb.lock(|rb| rb.sizes.occupied_len());
+            while occupied_len > 0 {
+                let next_size = cx.shared.tm_rb.lock(|rb| {
+                    let next_size = rb.sizes.try_pop().unwrap();
+                    rb.buf.pop_slice(&mut cx.local.read_buf[0..next_size]);
+                    next_size
+                });
                 cx.local.encoded_buf[0] = 0;
                 let send_size = cobs::encode(
                     &cx.local.read_buf[0..next_size],
@@ -466,6 +457,7 @@ mod app {
                     .uart_tx
                     .write(&cx.local.encoded_buf[0..send_size + 2])
                     .unwrap();
+                occupied_len -= 1;
                 Mono::delay(2.millis()).await;
             }
             Mono::delay(50.millis()).await;

jlink-gdb.sh

@@ -1,3 +1,3 @@
 #!/bin/bash
-JLinkGDBServer -select USB -device Cortex-M0 -endian little -if JTAG-speed auto \
+JLinkGDBServer -select USB -device Cortex-M0 -endian little -if JTAG -speed auto \
   -LocalhostOnly

scripts/VA108xx_Series.yaml

@@ -9,6 +9,7 @@ variants:
     core_access_options: !Arm
       ap: 0
       psel: 0x0
+      jtag_tap: 1
   memory_map:
   - !Ram
     name: DRAM
@@ -22,9 +23,11 @@ variants:
     range:
       start: 0x0
       end: 0x20000
-    is_boot_memory: true
     cores:
     - main
+    access:
+      write: false
+      boot: true
   flash_algorithms:
   - va108xx_fm25v20a_fram_128kb_prog
   - va108xx_m95m01_128kb_prog
@@ -37,6 +40,7 @@ variants:
     core_access_options: !Arm
       ap: 0
       psel: 0x0
+      jtag_tap: 1
   memory_map:
   - !Ram
     name: DRAM
@@ -50,9 +54,11 @@ variants:
     range:
       start: 0x0
       end: 0x20000
-    is_boot_memory: true
     cores:
     - main
+    access:
+      write: false
+      boot: true
 flash_algorithms:
 - name: va108xx_fm25v20a_fram_128kb_prog
   description: VA108_FM25V20A_FRAM_128KB

va108xx-embassy/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "va108xx-embassy"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+critical-section = "1"
+portable-atomic = { version = "1", features = ["unsafe-assume-single-core"]}
+
+embassy-sync = "0.6"
+embassy-executor = "0.7"
+embassy-time-driver = "0.2"
+embassy-time-queue-utils = "0.1"
+
+once_cell = { version = "1", default-features = false, features = ["critical-section"] }
+
+[dependencies.va108xx-hal]
+path = "../va108xx-hal"
+
+[features]
+default = ["irq-oc30-oc31"]
+irqs-in-lib = []
+# This determines the reserved interrupt functions for the embassy time drivers. Only one
+# is allowed to be selected!
+irq-oc28-oc29 = ["irqs-in-lib"]
+irq-oc29-oc30 = ["irqs-in-lib"]
+irq-oc30-oc31 = ["irqs-in-lib"]

va108xx-embassy/README.md

@@ -0,0 +1,10 @@
+[![Crates.io](https://img.shields.io/crates/v/va108xx-embassy)](https://crates.io/crates/va108xx-embassy)
+[![docs.rs](https://img.shields.io/docsrs/va108xx-embassy)](https://docs.rs/va108xx-embassy)
+
+# Embassy-rs support for the Vorago VA108xx MCU family
+
+This repository contains the [embassy-rs](https://github.com/embassy-rs/embassy) support for the
+VA108xx family. Currently, it contains the time driver to allow using embassy-rs. It uses the TIM
+peripherals provided by the VA108xx family for this purpose.
+
+The documentation contains more information on how to use this crate.

va108xx-embassy/src/lib.rs

@@ -0,0 +1,416 @@
+//! # Embassy-rs support for the Vorago VA108xx MCU family
+//!
+//! This repository contains the [embassy-rs](https://github.com/embassy-rs/embassy) support for the
+//! VA108xx family. Currently, it contains the time driver to allow using embassy-rs. It uses the TIM
+//! peripherals provided by the VA108xx family for this purpose.
+//!
+//! ## Usage
+//!
+//! This library only exposes the [embassy::init] method which sets up the time driver. This
+//! function must be called once at the start of the application.
+//!
+//! This implementation requires two TIM peripherals provided by the VA108xx device.
+//! The user can freely specify the two used TIM peripheral by passing the concrete TIM instances
+//! into the [embassy::init_with_custom_irqs] and [embassy::init] method.
+//!
+//! The application also requires two interrupt handlers to handle the timekeeper and alarm
+//! interrupts. By default, this library will define the interrupt handler inside the library
+//! itself by using the `irq-oc30-oc31` feature flag. This library exposes three combinations:
+//!
+//! - `irq-oc30-oc31`: Uses [pac::Interrupt::OC30] and [pac::Interrupt::OC31]
+//! - `irq-oc29-oc30`: Uses [pac::Interrupt::OC29] and [pac::Interrupt::OC30]
+//! - `irq-oc28-oc29`: Uses [pac::Interrupt::OC28] and [pac::Interrupt::OC20]
+//!
+//! You can disable the default features and then specify one of the features above to use the
+//! documented combination of IRQs. It is also possible to specify custom IRQs by importing and
+//! using the [embassy::embassy_time_driver_irqs] macro to declare the IRQ handlers in the
+//! application code. If this is done, [embassy::init_with_custom_irqs] must be used
+//! method to pass the IRQ numbers to the library.
+//!
+//! ## Examples
+//!
+//! [embassy example project](https://egit.irs.uni-stuttgart.de/rust/va108xx-rs/src/branch/main/examples/embassy)
+#![no_std]
+use core::cell::{Cell, RefCell};
+use critical_section::CriticalSection;
+use embassy_sync::blocking_mutex::CriticalSectionMutex as Mutex;
+use portable_atomic::{AtomicU32, Ordering};
+
+use embassy_time_driver::{time_driver_impl, Driver, TICK_HZ};
+use embassy_time_queue_utils::Queue;
+use once_cell::sync::OnceCell;
+#[cfg(feature = "irqs-in-lib")]
+use va108xx_hal::pac::interrupt;
+use va108xx_hal::{
+    clock::enable_peripheral_clock,
+    enable_interrupt, pac,
+    prelude::*,
+    timer::{enable_tim_clk, get_tim_raw, TimRegInterface},
+    PeripheralSelect,
+};
+
+time_driver_impl!(
+    static TIME_DRIVER: TimerDriver = TimerDriver {
+        periods: AtomicU32::new(0),
+        alarms: Mutex::new(AlarmState::new()),
+        queue: Mutex::new(RefCell::new(Queue::new())),
+});
+
+/// Macro to define the IRQ handlers for the time driver.
+///
+/// By default, the code generated by this macro will be defined inside the library depending on
+/// the feature flags specified. However, the macro is exported to allow users to specify the
+/// interrupt handlers themselves.
+///
+/// Please note that you have to explicitely import the [va108xx_hal::pac::interrupt]
+/// macro in the application code in case this macro is used there.
+#[macro_export]
+macro_rules! embassy_time_driver_irqs {
+    (
+        timekeeper_irq = $timekeeper_irq:ident,
+        alarm_irq = $alarm_irq:ident
+    ) => {
+        const TIMEKEEPER_IRQ: pac::Interrupt = pac::Interrupt::$timekeeper_irq;
+
+        #[interrupt]
+        #[allow(non_snake_case)]
+        fn $timekeeper_irq() {
+            // Safety: We call it once here.
+            unsafe { $crate::embassy::time_driver().on_interrupt_timekeeping() }
+        }
+
+        const ALARM_IRQ: pac::Interrupt = pac::Interrupt::$alarm_irq;
+
+        #[interrupt]
+        #[allow(non_snake_case)]
+        fn $alarm_irq() {
+            // Safety: We call it once here.
+            unsafe { $crate::embassy::time_driver().on_interrupt_alarm() }
+        }
+    };
+}
+
+// Provide three combinations of IRQs for the time driver by default.
+
+#[cfg(feature = "irq-oc30-oc31")]
+embassy_time_driver_irqs!(timekeeper_irq = OC31, alarm_irq = OC30);
+#[cfg(feature = "irq-oc29-oc30")]
+embassy_time_driver_irqs!(timekeeper_irq = OC30, alarm_irq = OC29);
+#[cfg(feature = "irq-oc28-oc29")]
+embassy_time_driver_irqs!(timekeeper_irq = OC29, alarm_irq = OC28);
+
+pub mod embassy {
+    use super::*;
+    use va108xx_hal::{pac, timer::TimRegInterface};
+
+    /// Expose the time driver so the user can specify the IRQ handlers themselves.
+    pub fn time_driver() -> &'static TimerDriver {
+        &TIME_DRIVER
+    }
+
+    /// Initialization method for embassy
+    ///
+    /// # Safety
+    ///
+    /// This has to be called once at initialization time to initiate the time driver for
+    /// embassy.
+    #[cfg(feature = "irqs-in-lib")]
+    pub unsafe fn init(
+        syscfg: &mut pac::Sysconfig,
+        irqsel: &pac::Irqsel,
+        sysclk: impl Into<Hertz>,
+        timekeeper_tim: impl TimRegInterface,
+        alarm_tim: impl TimRegInterface,
+    ) {
+        TIME_DRIVER.init(
+            syscfg,
+            irqsel,
+            sysclk,
+            timekeeper_tim,
+            alarm_tim,
+            TIMEKEEPER_IRQ,
+            ALARM_IRQ,
+        )
+    }
+
+    /// Initialization method for embassy
+    ///
+    /// # Safety
+    ///
+    /// This has to be called once at initialization time to initiate the time driver for
+    /// embassy.
+    pub unsafe fn init_with_custom_irqs(
+        syscfg: &mut pac::Sysconfig,
+        irqsel: &pac::Irqsel,
+        sysclk: impl Into<Hertz>,
+        timekeeper_tim: impl TimRegInterface,
+        alarm_tim: impl TimRegInterface,
+        timekeeper_irq: pac::Interrupt,
+        alarm_irq: pac::Interrupt,
+    ) {
+        TIME_DRIVER.init(
+            syscfg,
+            irqsel,
+            sysclk,
+            timekeeper_tim,
+            alarm_tim,
+            timekeeper_irq,
+            alarm_irq,
+        )
+    }
+}
+
+struct AlarmState {
+    timestamp: Cell<u64>,
+}
+
+impl AlarmState {
+    const fn new() -> Self {
+        Self {
+            timestamp: Cell::new(u64::MAX),
+        }
+    }
+}
+
+unsafe impl Send for AlarmState {}
+
+static SCALE: OnceCell<u64> = OnceCell::new();
+static TIMEKEEPER_TIM: OnceCell<u8> = OnceCell::new();
+static ALARM_TIM: OnceCell<u8> = OnceCell::new();
+
+pub struct TimerDriver {
+    periods: AtomicU32,
+    /// Timestamp at which to fire alarm. u64::MAX if no alarm is scheduled.
+    alarms: Mutex<AlarmState>,
+    queue: Mutex<RefCell<Queue>>,
+}
+
+impl TimerDriver {
+    #[allow(clippy::too_many_arguments)]
+    fn init(
+        &self,
+        syscfg: &mut pac::Sysconfig,
+        irqsel: &pac::Irqsel,
+        sysclk: impl Into<Hertz>,
+        timekeeper_tim: impl TimRegInterface,
+        alarm_tim: impl TimRegInterface,
+        timekeeper_irq: pac::Interrupt,
+        alarm_irq: pac::Interrupt,
+    ) {
+        if ALARM_TIM.get().is_some() {
+            return;
+        }
+        ALARM_TIM.set(alarm_tim.tim_id()).ok();
+        TIMEKEEPER_TIM.set(timekeeper_tim.tim_id()).ok();
+        enable_peripheral_clock(syscfg, PeripheralSelect::Irqsel);
+        enable_tim_clk(syscfg, timekeeper_tim.tim_id());
+        let timekeeper_reg_block = timekeeper_tim.reg_block();
+        let alarm_tim_reg_block = alarm_tim.reg_block();
+        let sysclk = sysclk.into();
+        // Initiate scale value here. This is required to convert timer ticks back to a timestamp.
+        SCALE.set((sysclk.raw() / TICK_HZ as u32) as u64).unwrap();
+        timekeeper_reg_block
+            .rst_value()
+            .write(|w| unsafe { w.bits(u32::MAX) });
+        // Decrementing counter.
+        timekeeper_reg_block
+            .cnt_value()
+            .write(|w| unsafe { w.bits(u32::MAX) });
+        // Switch on. Timekeeping should always be done.
+        irqsel
+            .tim0(timekeeper_tim.tim_id() as usize)
+            .write(|w| unsafe { w.bits(timekeeper_irq as u32) });
+        unsafe {
+            enable_interrupt(timekeeper_irq);
+        }
+        timekeeper_reg_block
+            .ctrl()
+            .modify(|_, w| w.irq_enb().set_bit());
+        timekeeper_reg_block
+            .enable()
+            .write(|w| unsafe { w.bits(1) });
+
+        enable_tim_clk(syscfg, alarm_tim.tim_id());
+
+        // Explicitely disable alarm timer until needed.
+        alarm_tim_reg_block.ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+        // Enable general interrupts. The IRQ enable of the peripheral remains cleared.
+        unsafe {
+            enable_interrupt(alarm_irq);
+        }
+        irqsel
+            .tim0(alarm_tim.tim_id() as usize)
+            .write(|w| unsafe { w.bits(alarm_irq as u32) });
+    }
+
+    /// Should be called inside the IRQ of the timekeeper timer.
+    ///
+    /// # Safety
+    ///
+    /// This function has to be called once by the TIM IRQ used for the timekeeping.
+    pub unsafe fn on_interrupt_timekeeping(&self) {
+        self.next_period();
+    }
+
+    /// Should be called inside the IRQ of the alarm timer.
+    ///
+    /// # Safety
+    ///
+    ///This function has to be called once by the TIM IRQ used for the timekeeping.
+    pub unsafe fn on_interrupt_alarm(&self) {
+        critical_section::with(|cs| {
+            if self.alarms.borrow(cs).timestamp.get() <= self.now() {
+                self.trigger_alarm(cs)
+            }
+        })
+    }
+
+    fn timekeeper_tim() -> &'static pac::tim0::RegisterBlock {
+        TIMEKEEPER_TIM
+            .get()
+            .map(|idx| unsafe { get_tim_raw(*idx as usize) })
+            .unwrap()
+    }
+    fn alarm_tim() -> &'static pac::tim0::RegisterBlock {
+        ALARM_TIM
+            .get()
+            .map(|idx| unsafe { get_tim_raw(*idx as usize) })
+            .unwrap()
+    }
+
+    fn next_period(&self) {
+        let period = self.periods.fetch_add(1, Ordering::AcqRel) + 1;
+        let t = (period as u64) << 32;
+        critical_section::with(|cs| {
+            let alarm = &self.alarms.borrow(cs);
+            let at = alarm.timestamp.get();
+            if at < t {
+                self.trigger_alarm(cs);
+            } else {
+                let alarm_tim = Self::alarm_tim();
+
+                let remaining_ticks = (at - t).checked_mul(*SCALE.get().unwrap());
+                if remaining_ticks.is_some_and(|v| v <= u32::MAX as u64) {
+                    alarm_tim.enable().write(|w| unsafe { w.bits(0) });
+                    alarm_tim
+                        .cnt_value()
+                        .write(|w| unsafe { w.bits(remaining_ticks.unwrap() as u32) });
+                    alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
+                    alarm_tim.enable().write(|w| unsafe { w.bits(1) })
+                }
+            }
+        })
+    }
+
+    fn trigger_alarm(&self, cs: CriticalSection) {
+        Self::alarm_tim().ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+
+        let alarm = &self.alarms.borrow(cs);
+        // Setting the maximum value disables the alarm.
+        alarm.timestamp.set(u64::MAX);
+
+        // Call after clearing alarm, so the callback can set another alarm.
+        let mut next = self
+            .queue
+            .borrow(cs)
+            .borrow_mut()
+            .next_expiration(self.now());
+        while !self.set_alarm(cs, next) {
+            next = self
+                .queue
+                .borrow(cs)
+                .borrow_mut()
+                .next_expiration(self.now());
+        }
+    }
+
+    fn set_alarm(&self, cs: CriticalSection, timestamp: u64) -> bool {
+        if SCALE.get().is_none() {
+            return false;
+        }
+        let alarm_tim = Self::alarm_tim();
+        alarm_tim.ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+
+        let alarm = self.alarms.borrow(cs);
+        alarm.timestamp.set(timestamp);
+
+        let t = self.now();
+        if timestamp <= t {
+            alarm.timestamp.set(u64::MAX);
+            return false;
+        }
+
+        // If it hasn't triggered yet, setup the relevant reset value, regardless of whether
+        // the interrupts are enabled or not. When they are enabled at a later point, the
+        // right value is already set.
+
+        // If the timestamp is in the next few ticks, add a bit of buffer to be sure the alarm
+        // is not missed.
+        //
+        // This means that an alarm can be delayed for up to 2 ticks (from t+1 to t+3), but this is allowed
+        // by the Alarm trait contract. What's not allowed is triggering alarms *before* their scheduled time,
+        // and we don't do that here.
+        let safe_timestamp = timestamp.max(t + 3);
+        let timer_ticks = (safe_timestamp - t).checked_mul(*SCALE.get().unwrap());
+        alarm_tim.rst_value().write(|w| unsafe { w.bits(u32::MAX) });
+        if timer_ticks.is_some_and(|v| v <= u32::MAX as u64) {
+            alarm_tim
+                .cnt_value()
+                .write(|w| unsafe { w.bits(timer_ticks.unwrap() as u32) });
+            alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
+            alarm_tim.enable().write(|w| unsafe { w.bits(1) });
+        }
+        // If it's too far in the future, don't enable timer yet.
+        // It will be enabled later by `next_period`.
+
+        true
+    }
+}
+
+impl Driver for TimerDriver {
+    fn now(&self) -> u64 {
+        if SCALE.get().is_none() {
+            return 0;
+        }
+        let mut period1: u32;
+        let mut period2: u32;
+        let mut counter_val: u32;
+
+        loop {
+            // Acquire ensures that we get the latest value of `periods` and
+            // no instructions can be reordered before the load.
+            period1 = self.periods.load(Ordering::Acquire);
+
+            counter_val = u32::MAX - Self::timekeeper_tim().cnt_value().read().bits();
+
+            // Double read to protect against race conditions when the counter is overflowing.
+            period2 = self.periods.load(Ordering::Relaxed);
+            if period1 == period2 {
+                let now = (((period1 as u64) << 32) | counter_val as u64) / *SCALE.get().unwrap();
+                return now;
+            }
+        }
+    }
+
+    fn schedule_wake(&self, at: u64, waker: &core::task::Waker) {
+        critical_section::with(|cs| {
+            let mut queue = self.queue.borrow(cs).borrow_mut();
+
+            if queue.schedule_wake(at, waker) {
+                let mut next = queue.next_expiration(self.now());
+                while !self.set_alarm(cs, next) {
+                    next = queue.next_expiration(self.now());
+                }
+            }
+        })
+    }
+}

va108xx-hal/CHANGELOG.md

@@ -8,6 +8,28 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [unreleased]
 
+## [v0.9.0]
+
+## Removed
+
+- Deleted some HAL re-exports in the PWM module
+
+## Changed
+
+- GPIO API: Interrupt, pulse and filter and `set_datamask` and `clear_datamask` APIs are now
+  methods which mutable modify the pin instead of consuming and returning it.
+- Simplified PWM module implementation.
+- All error types now implement `core::error::Error` by using the `thiserror::Error` derive.
+- `InvalidPinTypeError` now wraps the pin mode.
+- I2C `TimingCfg` constructor now returns explicit error instead of generic Error.
+  Removed the timing configuration error type from the generic I2C error enumeration.
+
+## Added
+
+- Add `downgrade` method for `Pin` and `upgrade` method for `DynPin` as explicit conversion
+  methods.
+- Add new `get_tim_raw` unsafe method to retrieve TIM peripheral blocks.
+
 ## [v0.8.0] 2024-09-30
 
 ## Changed

va108xx-hal/Cargo.toml

@@ -15,32 +15,19 @@ cortex-m = { version = "0.7", features = ["critical-section-single-core"]}
 cortex-m-rt = "0.7"
 nb = "1"
 paste = "1"
+embedded-hal = "1"
 embedded-hal-nb = "1"
 embedded-io = "0.6"
 fugit = "0.3"
 typenum = "1"
 critical-section = "1"
-delegate = "0.12"
+delegate = ">=0.12, <=0.13"
+thiserror = { version = "2", default-features = false }
+void = { version = "1", default-features = false }
+once_cell = {version = "1", default-features = false }
+va108xx = { version = "0.3", default-features = false, features = ["critical-section"]}
 
-[dependencies.va108xx]
-version = "0.3"
-default-features = false
-features = ["critical-section"]
-
-[dependencies.embedded-hal]
-version = "1"
-
-[dependencies.void]
-version = "1"
-default-features = false
-
-[dependencies.once_cell]
-version = "1.14"
-default-features = false
-
-[dependencies.defmt]
-version = "0.3"
-optional = true
+defmt = { version = "0.3", optional = true }
 
 [features]
 default = ["rt"]

va108xx-hal/src/gpio/dynpin.rs

@@ -75,7 +75,7 @@ pub enum DynDisabled {
 }
 
 /// Value-level `enum` for input configurations
-#[derive(PartialEq, Eq, Clone, Copy)]
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
 pub enum DynInput {
     Floating,
     PullDown,
@@ -83,7 +83,7 @@ pub enum DynInput {
 }
 
 /// Value-level `enum` for output configurations
-#[derive(PartialEq, Eq, Clone, Copy)]
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
 pub enum DynOutput {
     PushPull,
     OpenDrain,
@@ -101,9 +101,10 @@ pub type DynAlternate = FunSel;
 ///
 /// [`DynPin`]s are not tracked and verified at compile-time, so run-time
 /// operations are fallible. This `enum` represents the corresponding errors.
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
-pub struct InvalidPinTypeError;
+#[error("Invalid pin type for operation: {0:?}")]
+pub struct InvalidPinTypeError(DynPinMode);
 
 impl embedded_hal::digital::Error for InvalidPinTypeError {
     fn kind(&self) -> embedded_hal::digital::ErrorKind {
@@ -116,7 +117,7 @@ impl embedded_hal::digital::Error for InvalidPinTypeError {
 //==================================================================================================
 
 /// Value-level `enum` representing pin modes
-#[derive(PartialEq, Eq, Clone, Copy)]
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
 pub enum DynPinMode {
     Input(DynInput),
     Output(DynOutput),
@@ -172,7 +173,7 @@ pub struct DynPinId {
 ///
 /// This `struct` takes ownership of a [`DynPinId`] and provides an API to
 /// access the corresponding regsiters.
-struct DynRegisters {
+pub(crate) struct DynRegisters {
     id: DynPinId,
 }
 
@@ -207,7 +208,7 @@ impl DynRegisters {
 /// This type acts as a type-erased version of [`Pin`]. Every pin is represented
 /// by the same type, and pins are tracked and distinguished at run-time.
 pub struct DynPin {
-    regs: DynRegisters,
+    pub(crate) regs: DynRegisters,
     mode: DynPinMode,
 }
 
@@ -220,7 +221,7 @@ impl DynPin {
     /// must be at most one corresponding [`DynPin`] in existence at any given
     /// time.  Violating this requirement is `unsafe`.
     #[inline]
-    unsafe fn new(id: DynPinId, mode: DynPinMode) -> Self {
+    pub(crate) unsafe fn new(id: DynPinId, mode: DynPinMode) -> Self {
         DynPin {
             regs: DynRegisters::new(id),
             mode,
@@ -306,7 +307,69 @@ impl DynPin {
         self.into_mode(DYN_RD_OPEN_DRAIN_OUTPUT);
     }
 
-    common_reg_if_functions!();
+    #[inline]
+    pub fn datamask(&self) -> bool {
+        self.regs.datamask()
+    }
+
+    #[inline]
+    pub fn clear_datamask(&mut self) {
+        self.regs.clear_datamask();
+    }
+
+    #[inline]
+    pub fn set_datamask(&mut self) {
+        self.regs.set_datamask();
+    }
+
+    #[inline]
+    pub fn is_high_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
+        self.regs.read_pin_masked()
+    }
+
+    #[inline]
+    pub fn is_low_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
+        self.regs.read_pin_masked().map(|v| !v)
+    }
+
+    #[inline]
+    pub fn set_high_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
+        self.regs.write_pin_masked(true)
+    }
+
+    #[inline]
+    pub fn set_low_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
+        self.regs.write_pin_masked(false)
+    }
+
+    pub(crate) fn irq_enb(
+        &mut self,
+        irq_cfg: crate::IrqCfg,
+        syscfg: Option<&mut va108xx::Sysconfig>,
+        irqsel: Option<&mut va108xx::Irqsel>,
+    ) {
+        if let Some(syscfg) = syscfg {
+            crate::clock::enable_peripheral_clock(syscfg, crate::clock::PeripheralClocks::Irqsel);
+        }
+        self.regs.enable_irq();
+        if let Some(irqsel) = irqsel {
+            if irq_cfg.route {
+                match self.regs.id().group {
+                    // Set the correct interrupt number in the IRQSEL register
+                    DynGroup::A => {
+                        irqsel
+                            .porta0(self.regs.id().num as usize)
+                            .write(|w| unsafe { w.bits(irq_cfg.irq as u32) });
+                    }
+                    DynGroup::B => {
+                        irqsel
+                            .portb0(self.regs.id().num as usize)
+                            .write(|w| unsafe { w.bits(irq_cfg.irq as u32) });
+                    }
+                }
+            }
+        }
+    }
 
     /// See p.53 of the programmers guide for more information.
     /// Possible delays in clock cycles:
@@ -320,74 +383,77 @@ impl DynPin {
                 self.regs.delay(delay_1, delay_2);
                 Ok(self)
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
     /// See p.52 of the programmers guide for more information.
     /// When configured for pulse mode, a given pin will set the non-default state for exactly
     /// one clock cycle before returning to the configured default state
+    #[inline]
     pub fn pulse_mode(
-        self,
+        &mut self,
         enable: bool,
         default_state: PinState,
-    ) -> Result<Self, InvalidPinTypeError> {
+    ) -> Result<(), InvalidPinTypeError> {
         match self.mode {
             DynPinMode::Output(_) => {
                 self.regs.pulse_mode(enable, default_state);
-                Ok(self)
+                Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
     /// See p.37 and p.38 of the programmers guide for more information.
     #[inline]
     pub fn filter_type(
-        self,
+        &mut self,
         filter: FilterType,
         clksel: FilterClkSel,
-    ) -> Result<Self, InvalidPinTypeError> {
+    ) -> Result<(), InvalidPinTypeError> {
         match self.mode {
             DynPinMode::Input(_) => {
                 self.regs.filter_type(filter, clksel);
-                Ok(self)
+                Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
+    #[inline]
     pub fn interrupt_edge(
-        mut self,
+        &mut self,
         edge_type: InterruptEdge,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut pac::Sysconfig>,
         irqsel: Option<&mut pac::Irqsel>,
-    ) -> Result<Self, InvalidPinTypeError> {
+    ) -> Result<(), InvalidPinTypeError> {
         match self.mode {
             DynPinMode::Input(_) | DynPinMode::Output(_) => {
                 self.regs.interrupt_edge(edge_type);
                 self.irq_enb(irq_cfg, syscfg, irqsel);
-                Ok(self)
+                Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
+    #[inline]
     pub fn interrupt_level(
-        mut self,
+        &mut self,
         level_type: InterruptLevel,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut pac::Sysconfig>,
         irqsel: Option<&mut pac::Irqsel>,
-    ) -> Result<Self, InvalidPinTypeError> {
+    ) -> Result<(), InvalidPinTypeError> {
         match self.mode {
             DynPinMode::Input(_) | DynPinMode::Output(_) => {
                 self.regs.interrupt_level(level_type);
                 self.irq_enb(irq_cfg, syscfg, irqsel);
-                Ok(self)
+                Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
@@ -398,7 +464,7 @@ impl DynPin {
                 self.regs.toggle();
                 Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
@@ -408,7 +474,7 @@ impl DynPin {
             DynPinMode::Input(_) | DYN_RD_OPEN_DRAIN_OUTPUT | DYN_RD_PUSH_PULL_OUTPUT => {
                 Ok(self.regs.read_pin())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
     #[inline]
@@ -418,7 +484,7 @@ impl DynPin {
                 self.regs.write_pin(bit);
                 Ok(())
             }
-            _ => Err(InvalidPinTypeError),
+            _ => Err(InvalidPinTypeError(self.mode)),
         }
     }
 
@@ -438,6 +504,21 @@ impl DynPin {
     fn _set_high(&mut self) -> Result<(), InvalidPinTypeError> {
         self._write(true)
     }
+
+    /// Try to recreate a type-level [`Pin`] from a value-level [`DynPin`]
+    ///
+    /// There is no way for the compiler to know if the conversion will be
+    /// successful at compile-time. We must verify the conversion at run-time
+    /// or refuse to perform it.
+    #[inline]
+    pub fn upgrade<I: PinId, M: PinMode>(self) -> Result<Pin<I, M>, InvalidPinTypeError> {
+        if self.regs.id == I::DYN && self.mode == M::DYN {
+            // The `DynPin` is consumed, so it is safe to replace it with the
+            // corresponding `Pin`
+            return Ok(unsafe { Pin::new() });
+        }
+        Err(InvalidPinTypeError(self.mode))
+    }
 }
 
 //==================================================================================================
@@ -448,10 +529,8 @@ impl<I: PinId, M: PinMode> From<Pin<I, M>> for DynPin {
     /// Erase the type-level information in a [`Pin`] and return a value-level
     /// [`DynPin`]
     #[inline]
-    fn from(_pin: Pin<I, M>) -> Self {
-        // The `Pin` is consumed, so it is safe to replace it with the
-        // corresponding `DynPin`
-        unsafe { DynPin::new(I::DYN, M::DYN) }
+    fn from(pin: Pin<I, M>) -> Self {
+        pin.downgrade()
     }
 }
 
@@ -465,13 +544,7 @@ impl<I: PinId, M: PinMode> TryFrom<DynPin> for Pin<I, M> {
     /// or refuse to perform it.
     #[inline]
     fn try_from(pin: DynPin) -> Result<Self, Self::Error> {
-        if pin.regs.id == I::DYN && pin.mode == M::DYN {
-            // The `DynPin` is consumed, so it is safe to replace it with the
-            // corresponding `Pin`
-            Ok(unsafe { Self::new() })
-        } else {
-            Err(InvalidPinTypeError)
-        }
+        pin.upgrade()
     }
 }
 
@@ -506,10 +579,12 @@ impl embedded_hal::digital::InputPin for DynPin {
 }
 
 impl embedded_hal::digital::StatefulOutputPin for DynPin {
+    #[inline]
     fn is_set_high(&mut self) -> Result<bool, Self::Error> {
         self._is_high()
     }
 
+    #[inline]
     fn is_set_low(&mut self) -> Result<bool, Self::Error> {
         self._is_low()
     }

va108xx-hal/src/gpio/mod.rs

@@ -22,85 +22,11 @@
 //!
 //! - [Blinky example](https://egit.irs.uni-stuttgart.de/rust/va108xx-rs/src/branch/main/examples/simple/examples/blinky.rs)
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[error("The pin is masked")]
 pub struct IsMaskedError;
 
-macro_rules! common_reg_if_functions {
-    () => {
-        paste::paste!(
-            #[inline]
-            pub fn datamask(&self) -> bool {
-                self.regs.datamask()
-            }
-
-            #[inline]
-            pub fn clear_datamask(self) -> Self {
-                self.regs.clear_datamask();
-                self
-            }
-
-            #[inline]
-            pub fn set_datamask(self) -> Self {
-                self.regs.set_datamask();
-                self
-            }
-
-            #[inline]
-            pub fn is_high_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
-                self.regs.read_pin_masked()
-            }
-
-            #[inline]
-            pub fn is_low_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
-                self.regs.read_pin_masked().map(|v| !v)
-            }
-
-            #[inline]
-            pub fn set_high_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
-                self.regs.write_pin_masked(true)
-            }
-
-            #[inline]
-            pub fn set_low_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
-                self.regs.write_pin_masked(false)
-            }
-
-            fn irq_enb(
-                &mut self,
-                irq_cfg: crate::IrqCfg,
-                syscfg: Option<&mut va108xx::Sysconfig>,
-                irqsel: Option<&mut va108xx::Irqsel>,
-            ) {
-                if syscfg.is_some() {
-                    crate::clock::enable_peripheral_clock(
-                        syscfg.unwrap(),
-                        crate::clock::PeripheralClocks::Irqsel,
-                    );
-                }
-                self.regs.enable_irq();
-                if let Some(irqsel) = irqsel {
-                    if irq_cfg.route {
-                        match self.regs.id().group {
-                            // Set the correct interrupt number in the IRQSEL register
-                            DynGroup::A => {
-                                irqsel
-                                    .porta0(self.regs.id().num as usize)
-                                    .write(|w| unsafe { w.bits(irq_cfg.irq as u32) });
-                            }
-                            DynGroup::B => {
-                                irqsel
-                                    .portb0(self.regs.id().num as usize)
-                                    .write(|w| unsafe { w.bits(irq_cfg.irq as u32) });
-                            }
-                        }
-                    }
-                }
-            }
-        );
-    };
-}
-
 pub mod dynpin;
 pub use dynpin::*;
 

va108xx-hal/src/gpio/pin.rs

@@ -72,6 +72,7 @@
 //! and [`StatefulOutputPin`].
 use super::dynpin::{DynAlternate, DynGroup, DynInput, DynOutput, DynPinId, DynPinMode};
 use super::reg::RegisterInterface;
+use super::DynPin;
 use crate::{
     pac::{Irqsel, Porta, Portb, Sysconfig},
     typelevel::Sealed,
@@ -320,10 +321,9 @@ macro_rules! pin_id {
 //==================================================================================================
 
 /// A type-level GPIO pin, parameterized by [PinId] and [PinMode] types
-
 pub struct Pin<I: PinId, M: PinMode> {
-    pub(in crate::gpio) regs: Registers<I>,
-    mode: PhantomData<M>,
+    inner: DynPin,
+    phantom: PhantomData<(I, M)>,
 }
 
 impl<I: PinId, M: PinMode> Pin<I, M> {
@@ -337,8 +337,8 @@ impl<I: PinId, M: PinMode> Pin<I, M> {
     #[inline]
     pub(crate) unsafe fn new() -> Pin<I, M> {
         Pin {
-            regs: Registers::new(),
-            mode: PhantomData,
+            inner: DynPin::new(I::DYN, M::DYN),
+            phantom: PhantomData,
         }
     }
 
@@ -348,7 +348,7 @@ impl<I: PinId, M: PinMode> Pin<I, M> {
         // Only modify registers if we are actually changing pin mode
         // This check should compile away
         if N::DYN != M::DYN {
-            self.regs.change_mode::<N>();
+            self.inner.regs.change_mode(N::DYN);
         }
         // Safe because we drop the existing Pin
         unsafe { Pin::new() }
@@ -408,31 +408,78 @@ impl<I: PinId, M: PinMode> Pin<I, M> {
         self.into_mode()
     }
 
-    common_reg_if_functions!();
+    #[inline]
+    pub fn datamask(&self) -> bool {
+        self.inner.datamask()
+    }
+
+    #[inline]
+    pub fn clear_datamask(&mut self) {
+        self.inner.clear_datamask()
+    }
+
+    #[inline]
+    pub fn set_datamask(&mut self) {
+        self.inner.set_datamask()
+    }
+
+    #[inline]
+    pub fn is_high_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
+        self.inner.is_high_masked()
+    }
+
+    #[inline]
+    pub fn is_low_masked(&self) -> Result<bool, crate::gpio::IsMaskedError> {
+        self.inner.is_low_masked()
+    }
+
+    #[inline]
+    pub fn set_high_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
+        self.inner.set_high_masked()
+    }
+
+    #[inline]
+    pub fn set_low_masked(&mut self) -> Result<(), crate::gpio::IsMaskedError> {
+        self.inner.set_low_masked()
+    }
+
+    #[inline]
+    pub fn downgrade(self) -> DynPin {
+        self.inner
+    }
+
+    fn irq_enb(
+        &mut self,
+        irq_cfg: crate::IrqCfg,
+        syscfg: Option<&mut va108xx::Sysconfig>,
+        irqsel: Option<&mut va108xx::Irqsel>,
+    ) {
+        self.inner.irq_enb(irq_cfg, syscfg, irqsel);
+    }
 
     #[inline]
     pub(crate) fn _set_high(&mut self) {
-        self.regs.write_pin(true)
+        self.inner.regs.write_pin(true)
     }
 
     #[inline]
     pub(crate) fn _set_low(&mut self) {
-        self.regs.write_pin(false)
+        self.inner.regs.write_pin(false)
     }
 
     #[inline]
     pub(crate) fn _toggle_with_toggle_reg(&mut self) {
-        self.regs.toggle();
+        self.inner.regs.toggle();
     }
 
     #[inline]
     pub(crate) fn _is_low(&self) -> bool {
-        !self.regs.read_pin()
+        !self.inner.regs.read_pin()
     }
 
     #[inline]
     pub(crate) fn _is_high(&self) -> bool {
-        self.regs.read_pin()
+        self.inner.regs.read_pin()
     }
 }
 
@@ -525,27 +572,25 @@ impl<P: AnyPin> AsMut<P> for SpecificPin<P> {
 
 impl<I: PinId, C: InputConfig> Pin<I, Input<C>> {
     pub fn interrupt_edge(
-        mut self,
+        &mut self,
         edge_type: InterruptEdge,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut Sysconfig>,
         irqsel: Option<&mut Irqsel>,
-    ) -> Self {
-        self.regs.interrupt_edge(edge_type);
+    ) {
+        self.inner.regs.interrupt_edge(edge_type);
         self.irq_enb(irq_cfg, syscfg, irqsel);
-        self
     }
 
     pub fn interrupt_level(
-        mut self,
+        &mut self,
         level_type: InterruptLevel,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut Sysconfig>,
         irqsel: Option<&mut Irqsel>,
-    ) -> Self {
-        self.regs.interrupt_level(level_type);
+    ) {
+        self.inner.regs.interrupt_level(level_type);
         self.irq_enb(irq_cfg, syscfg, irqsel);
-        self
     }
 }
 
@@ -557,7 +602,7 @@ impl<I: PinId, C: OutputConfig> Pin<I, Output<C>> {
     ///  - Delay 1 + Delay 2: 3
     #[inline]
     pub fn delay(self, delay_1: bool, delay_2: bool) -> Self {
-        self.regs.delay(delay_1, delay_2);
+        self.inner.regs.delay(delay_1, delay_2);
         self
     }
 
@@ -569,42 +614,38 @@ impl<I: PinId, C: OutputConfig> Pin<I, Output<C>> {
     /// See p.52 of the programmers guide for more information.
     /// When configured for pulse mode, a given pin will set the non-default state for exactly
     /// one clock cycle before returning to the configured default state
-    pub fn pulse_mode(self, enable: bool, default_state: PinState) -> Self {
-        self.regs.pulse_mode(enable, default_state);
-        self
+    pub fn pulse_mode(&mut self, enable: bool, default_state: PinState) {
+        self.inner.regs.pulse_mode(enable, default_state);
     }
 
     pub fn interrupt_edge(
-        mut self,
+        &mut self,
         edge_type: InterruptEdge,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut Sysconfig>,
         irqsel: Option<&mut Irqsel>,
-    ) -> Self {
-        self.regs.interrupt_edge(edge_type);
+    ) {
+        self.inner.regs.interrupt_edge(edge_type);
         self.irq_enb(irq_cfg, syscfg, irqsel);
-        self
     }
 
     pub fn interrupt_level(
-        mut self,
+        &mut self,
         level_type: InterruptLevel,
         irq_cfg: IrqCfg,
         syscfg: Option<&mut Sysconfig>,
         irqsel: Option<&mut Irqsel>,
-    ) -> Self {
-        self.regs.interrupt_level(level_type);
+    ) {
+        self.inner.regs.interrupt_level(level_type);
         self.irq_enb(irq_cfg, syscfg, irqsel);
-        self
     }
 }
 
 impl<I: PinId, C: InputConfig> Pin<I, Input<C>> {
     /// See p.37 and p.38 of the programmers guide for more information.
     #[inline]
-    pub fn filter_type(self, filter: FilterType, clksel: FilterClkSel) -> Self {
-        self.regs.filter_type(filter, clksel);
-        self
+    pub fn filter_type(&mut self, filter: FilterType, clksel: FilterClkSel) {
+        self.inner.regs.filter_type(filter, clksel);
     }
 }
 
@@ -680,47 +721,6 @@ where
     }
 }
 
-//==================================================================================================
-//  Registers
-//==================================================================================================
-
-/// Provide a safe register interface for [`Pin`]s
-///
-/// This `struct` takes ownership of a [`PinId`] and provides an API to
-/// access the corresponding registers.
-pub(in crate::gpio) struct Registers<I: PinId> {
-    id: PhantomData<I>,
-}
-
-// [`Registers`] takes ownership of the [`PinId`], and [`Pin`] guarantees that
-// each pin is a singleton, so this implementation is safe.
-unsafe impl<I: PinId> RegisterInterface for Registers<I> {
-    #[inline]
-    fn id(&self) -> DynPinId {
-        I::DYN
-    }
-}
-
-impl<I: PinId> Registers<I> {
-    /// Create a new instance of [`Registers`]
-    ///
-    /// # Safety
-    ///
-    /// Users must never create two simultaneous instances of this `struct` with
-    /// the same [`PinId`]
-    #[inline]
-    unsafe fn new() -> Self {
-        Registers { id: PhantomData }
-    }
-
-    /// Provide a type-level equivalent for the
-    /// [`RegisterInterface::change_mode`] method.
-    #[inline]
-    pub(in crate::gpio) fn change_mode<M: PinMode>(&mut self) {
-        RegisterInterface::change_mode(self, M::DYN);
-    }
-}
-
 //==================================================================================================
 //  Pin definitions
 //==================================================================================================

va108xx-hal/src/gpio/reg.rs

@@ -293,7 +293,7 @@ pub(super) unsafe trait RegisterInterface {
 
     /// Only useful for input pins
     #[inline]
-    fn filter_type(&self, filter: FilterType, clksel: FilterClkSel) {
+    fn filter_type(&mut self, filter: FilterType, clksel: FilterClkSel) {
         self.iocfg_port().modify(|_, w| {
             // Safety: Only write to register for this Pin ID
             unsafe {
@@ -331,7 +331,7 @@ pub(super) unsafe trait RegisterInterface {
     /// See p.52 of the programmers guide for more information.
     /// When configured for pulse mode, a given pin will set the non-default state for exactly
     /// one clock cycle before returning to the configured default state
-    fn pulse_mode(&self, enable: bool, default_state: PinState) {
+    fn pulse_mode(&mut self, enable: bool, default_state: PinState) {
         let portreg = self.port_reg();
         unsafe {
             if enable {

va108xx-hal/src/i2c.rs

@@ -23,37 +23,44 @@ pub enum FifoEmptyMode {
     EndTransaction = 1,
 }
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
-pub struct ClockTooSlowForFastI2c;
+#[error("clock too slow for fast I2C mode")]
+pub struct ClockTooSlowForFastI2cError;
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
+#[error("invalid timing parameters")]
+pub struct InvalidTimingParamsError;
+
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Error {
-    InvalidTimingParams,
+    //#[error("Invalid timing parameters")]
+    //InvalidTimingParams,
+    #[error("arbitration lost")]
     ArbitrationLost,
+    #[error("nack address")]
     NackAddr,
     /// Data not acknowledged in write operation
+    #[error("data not acknowledged in write operation")]
     NackData,
     /// Not enough data received in read operation
+    #[error("insufficient data received")]
     InsufficientDataReceived,
     /// Number of bytes in transfer too large (larger than 0x7fe)
+    #[error("data too large (larger than 0x7fe)")]
     DataTooLarge,
 }
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum InitError {
     /// Wrong address used in constructor
+    #[error("wrong address mode")]
     WrongAddrMode,
     /// APB1 clock is too slow for fast I2C mode.
-    ClkTooSlow(ClockTooSlowForFastI2c),
-}
-
-impl From<ClockTooSlowForFastI2c> for InitError {
-    fn from(value: ClockTooSlowForFastI2c) -> Self {
-        Self::ClkTooSlow(value)
-    }
+    #[error("clock too slow for fast I2C mode: {0}")]
+    ClkTooSlow(#[from] ClockTooSlowForFastI2cError),
 }
 
 impl embedded_hal::i2c::Error for Error {
@@ -66,7 +73,7 @@ impl embedded_hal::i2c::Error for Error {
             Error::NackData => {
                 embedded_hal::i2c::ErrorKind::NoAcknowledge(i2c::NoAcknowledgeSource::Data)
             }
-            Error::DataTooLarge | Error::InsufficientDataReceived | Error::InvalidTimingParams => {
+            Error::DataTooLarge | Error::InsufficientDataReceived => {
                 embedded_hal::i2c::ErrorKind::Other
             }
         }
@@ -160,7 +167,7 @@ impl TimingCfg {
     pub fn new(
         first_16_bits: TrTfThighTlow,
         second_16_bits: TsuStoTsuStaThdStaTBuf,
-    ) -> Result<Self, Error> {
+    ) -> Result<Self, InvalidTimingParamsError> {
         if first_16_bits.0 > 0xf
             || first_16_bits.1 > 0xf
             || first_16_bits.2 > 0xf
@@ -170,7 +177,7 @@ impl TimingCfg {
             || second_16_bits.2 > 0xf
             || second_16_bits.3 > 0xf
         {
-            return Err(Error::InvalidTimingParams);
+            return Err(InvalidTimingParamsError);
         }
         Ok(TimingCfg {
             tr: first_16_bits.0,
@@ -299,7 +306,7 @@ impl<I2c: Instance> I2cBase<I2c> {
         speed_mode: I2cSpeed,
         ms_cfg: Option<&MasterConfig>,
         sl_cfg: Option<&SlaveConfig>,
-    ) -> Result<Self, ClockTooSlowForFastI2c> {
+    ) -> Result<Self, ClockTooSlowForFastI2cError> {
         enable_peripheral_clock(syscfg, I2c::PERIPH_SEL);
 
         let mut i2c_base = I2cBase {
@@ -402,19 +409,22 @@ impl<I2c: Instance> I2cBase<I2c> {
         });
     }
 
-    fn calc_clk_div(&self, speed_mode: I2cSpeed) -> Result<u8, ClockTooSlowForFastI2c> {
+    fn calc_clk_div(&self, speed_mode: I2cSpeed) -> Result<u8, ClockTooSlowForFastI2cError> {
         if speed_mode == I2cSpeed::Regular100khz {
             Ok(((self.sys_clk.raw() / CLK_100K.raw() / 20) - 1) as u8)
         } else {
             if self.sys_clk.raw() < MIN_CLK_400K.raw() {
-                return Err(ClockTooSlowForFastI2c);
+                return Err(ClockTooSlowForFastI2cError);
             }
             Ok(((self.sys_clk.raw() / CLK_400K.raw() / 25) - 1) as u8)
         }
     }
 
     /// Configures the clock scale for a given speed mode setting
-    pub fn cfg_clk_scale(&mut self, speed_mode: I2cSpeed) -> Result<(), ClockTooSlowForFastI2c> {
+    pub fn cfg_clk_scale(
+        &mut self,
+        speed_mode: I2cSpeed,
+    ) -> Result<(), ClockTooSlowForFastI2cError> {
         let clk_div = self.calc_clk_div(speed_mode)?;
         self.i2c
             .clkscale()
@@ -460,7 +470,7 @@ impl<I2c: Instance, Addr> I2cMaster<I2c, Addr> {
         i2c: I2c,
         cfg: MasterConfig,
         speed_mode: I2cSpeed,
-    ) -> Result<Self, ClockTooSlowForFastI2c> {
+    ) -> Result<Self, ClockTooSlowForFastI2cError> {
         Ok(I2cMaster {
             i2c_base: I2cBase::new(syscfg, sysclk, i2c, speed_mode, Some(&cfg), None)?,
             addr: PhantomData,
@@ -990,7 +1000,7 @@ impl<I2c: Instance, Addr> I2cSlave<I2c, Addr> {
         i2c: I2c,
         cfg: SlaveConfig,
         speed_mode: I2cSpeed,
-    ) -> Result<Self, ClockTooSlowForFastI2c> {
+    ) -> Result<Self, ClockTooSlowForFastI2cError> {
         Ok(I2cSlave {
             i2c_base: I2cBase::new(sys_cfg, sys_clk, i2c, speed_mode, None, Some(&cfg))?,
             addr: PhantomData,
@@ -1152,7 +1162,7 @@ impl<I2c: Instance> I2cSlave<I2c, TenBitAddress> {
         i2c: I2c,
         cfg: SlaveConfig,
         speed_mode: I2cSpeed,
-    ) -> Result<Self, ClockTooSlowForFastI2c> {
+    ) -> Result<Self, ClockTooSlowForFastI2cError> {
         Self::new_generic(sys_cfg, sys_clk, i2c, cfg, speed_mode)
     }
 }

va108xx-hal/src/pwm.rs

@@ -9,15 +9,13 @@ use core::convert::Infallible;
 use core::marker::PhantomData;
 
 use crate::pac;
-use crate::timer::{
-    TimAndPinRegister, TimDynRegister, TimPin, TimRegInterface, ValidTim, ValidTimAndPin,
-};
+use crate::time::Hertz;
+use crate::timer::{TimDynRegister, TimPin, TimRegInterface, ValidTim, ValidTimAndPin};
 use crate::{clock::enable_peripheral_clock, gpio::DynPinId};
-pub use crate::{gpio::PinId, time::Hertz};
 
 const DUTY_MAX: u16 = u16::MAX;
 
-pub struct PwmBase {
+pub struct PwmCommon {
     sys_clk: Hertz,
     /// For PWMB, this is the upper limit
     current_duty: u16,
@@ -35,123 +33,13 @@ enum StatusSelPwm {
 pub struct PwmA {}
 pub struct PwmB {}
 
-//==================================================================================================
-// Common
-//==================================================================================================
-
-macro_rules! pwm_common_func {
-    () => {
-        #[inline]
-        fn enable_pwm_a(&mut self) {
-            self.reg
-                .reg()
-                .ctrl()
-                .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmA as u8) });
-        }
-
-        #[inline]
-        fn enable_pwm_b(&mut self) {
-            self.reg
-                .reg()
-                .ctrl()
-                .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmB as u8) });
-        }
-
-        #[inline]
-        pub fn get_period(&self) -> Hertz {
-            self.pwm_base.current_period
-        }
-
-        #[inline]
-        pub fn set_period(&mut self, period: impl Into<Hertz>) {
-            self.pwm_base.current_period = period.into();
-            // Avoid division by 0
-            if self.pwm_base.current_period.raw() == 0 {
-                return;
-            }
-            self.pwm_base.current_rst_val =
-                self.pwm_base.sys_clk.raw() / self.pwm_base.current_period.raw();
-            self.reg
-                .reg()
-                .rst_value()
-                .write(|w| unsafe { w.bits(self.pwm_base.current_rst_val) });
-        }
-
-        #[inline]
-        pub fn disable(&mut self) {
-            self.reg.reg().ctrl().modify(|_, w| w.enable().clear_bit());
-        }
-
-        #[inline]
-        pub fn enable(&mut self) {
-            self.reg.reg().ctrl().modify(|_, w| w.enable().set_bit());
-        }
-
-        #[inline]
-        pub fn period(&self) -> Hertz {
-            self.pwm_base.current_period
-        }
-
-        #[inline(always)]
-        pub fn duty(&self) -> u16 {
-            self.pwm_base.current_duty
-        }
-    };
-}
-
-macro_rules! pwmb_func {
-    () => {
-        pub fn pwmb_lower_limit(&self) -> u16 {
-            self.pwm_base.current_lower_limit
-        }
-
-        pub fn pwmb_upper_limit(&self) -> u16 {
-            self.pwm_base.current_duty
-        }
-
-        /// Set the lower limit for PWMB
-        ///
-        /// The PWM signal will be 1 as long as the current RST counter is larger than
-        /// the lower limit. For example, with a lower limit of 0.5 and and an upper limit
-        /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
-        /// state
-        pub fn set_pwmb_lower_limit(&mut self, duty: u16) {
-            self.pwm_base.current_lower_limit = duty;
-            let pwmb_val: u64 = (self.pwm_base.current_rst_val as u64
-                * self.pwm_base.current_lower_limit as u64)
-                / DUTY_MAX as u64;
-            self.reg
-                .reg()
-                .pwmb_value()
-                .write(|w| unsafe { w.bits(pwmb_val as u32) });
-        }
-
-        /// Set the higher limit for PWMB
-        ///
-        /// The PWM signal will be 1 as long as the current RST counter is smaller than
-        /// the higher limit. For example, with a lower limit of 0.5 and and an upper limit
-        /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
-        /// state
-        pub fn set_pwmb_upper_limit(&mut self, duty: u16) {
-            self.pwm_base.current_duty = duty;
-            let pwma_val: u64 = (self.pwm_base.current_rst_val as u64
-                * self.pwm_base.current_duty as u64)
-                / DUTY_MAX as u64;
-            self.reg
-                .reg()
-                .pwma_value()
-                .write(|w| unsafe { w.bits(pwma_val as u32) });
-        }
-    };
-}
-
 //==================================================================================================
 // Strongly typed PWM pin
 //==================================================================================================
 
 pub struct PwmPin<Pin: TimPin, Tim: ValidTim, Mode = PwmA> {
-    reg: TimAndPinRegister<Pin, Tim>,
-    pwm_base: PwmBase,
+    pin_and_tim: (Pin, Tim),
+    inner: ReducedPwmPin<Mode>,
     mode: PhantomData<Mode>,
 }
 
@@ -163,34 +51,82 @@ where
     pub fn new(
         sys_cfg: &mut pac::Sysconfig,
         sys_clk: impl Into<Hertz> + Copy,
-        tim_and_pin: (Pin, Tim),
+        pin_and_tim: (Pin, Tim),
         initial_period: impl Into<Hertz> + Copy,
     ) -> Self {
         let mut pin = PwmPin {
-            pwm_base: PwmBase {
-                current_duty: 0,
-                current_lower_limit: 0,
-                current_period: initial_period.into(),
-                current_rst_val: 0,
-                sys_clk: sys_clk.into(),
-            },
-            reg: unsafe { TimAndPinRegister::new(tim_and_pin.0, tim_and_pin.1) },
+            pin_and_tim,
+            inner: ReducedPwmPin::<Mode>::new(
+                Tim::TIM_ID,
+                Pin::DYN,
+                PwmCommon {
+                    current_duty: 0,
+                    current_lower_limit: 0,
+                    current_period: initial_period.into(),
+                    current_rst_val: 0,
+                    sys_clk: sys_clk.into(),
+                },
+            ),
+            //unsafe { TimAndPin::new(tim_and_pin.0, tim_and_pin.1) },
             mode: PhantomData,
         };
         enable_peripheral_clock(sys_cfg, crate::clock::PeripheralClocks::Gpio);
         enable_peripheral_clock(sys_cfg, crate::clock::PeripheralClocks::Ioconfig);
         sys_cfg
             .tim_clk_enable()
-            .modify(|r, w| unsafe { w.bits(r.bits() | pin.reg.mask_32()) });
+            .modify(|r, w| unsafe { w.bits(r.bits() | pin.pin_and_tim.1.mask_32()) });
         pin.enable_pwm_a();
         pin.set_period(initial_period);
         pin
     }
-    pub fn release(self) -> (Pin, Tim) {
-        self.reg.release()
+
+    pub fn reduce(self) -> ReducedPwmPin<Mode> {
+        self.inner
     }
 
-    pwm_common_func!();
+    pub fn release(self) -> (Pin, Tim) {
+        self.pin_and_tim
+    }
+
+    #[inline]
+    fn enable_pwm_a(&mut self) {
+        self.inner.enable_pwm_a();
+    }
+
+    #[inline]
+    fn enable_pwm_b(&mut self) {
+        self.inner.enable_pwm_b();
+    }
+
+    #[inline]
+    pub fn get_period(&self) -> Hertz {
+        self.inner.get_period()
+    }
+
+    #[inline]
+    pub fn set_period(&mut self, period: impl Into<Hertz>) {
+        self.inner.set_period(period);
+    }
+
+    #[inline]
+    pub fn disable(&mut self) {
+        self.inner.disable();
+    }
+
+    #[inline]
+    pub fn enable(&mut self) {
+        self.inner.enable();
+    }
+
+    #[inline]
+    pub fn period(&self) -> Hertz {
+        self.inner.period()
+    }
+
+    #[inline(always)]
+    pub fn duty(&self) -> u16 {
+        self.inner.duty()
+    }
 }
 
 impl<Pin: TimPin, Tim: ValidTim> From<PwmPin<Pin, Tim, PwmA>> for PwmPin<Pin, Tim, PwmB>
@@ -199,9 +135,9 @@ where
 {
     fn from(other: PwmPin<Pin, Tim, PwmA>) -> Self {
         let mut pwmb = Self {
-            reg: other.reg,
-            pwm_base: other.pwm_base,
             mode: PhantomData,
+            pin_and_tim: other.pin_and_tim,
+            inner: other.inner.into(),
         };
         pwmb.enable_pwm_b();
         pwmb
@@ -213,13 +149,13 @@ where
     (PIN, TIM): ValidTimAndPin<PIN, TIM>,
 {
     fn from(other: PwmPin<PIN, TIM, PwmB>) -> Self {
-        let mut pwmb = Self {
-            reg: other.reg,
-            pwm_base: other.pwm_base,
+        let mut pwma = Self {
             mode: PhantomData,
+            pin_and_tim: other.pin_and_tim,
+            inner: other.inner.into(),
         };
-        pwmb.enable_pwm_a();
-        pwmb
+        pwma.enable_pwm_a();
+        pwma
     }
 }
 
@@ -263,33 +199,105 @@ where
 
 /// Reduced version where type information is deleted
 pub struct ReducedPwmPin<Mode = PwmA> {
-    reg: TimDynRegister,
-    pwm_base: PwmBase,
-    pin_id: DynPinId,
+    dyn_reg: TimDynRegister,
+    common: PwmCommon,
     mode: PhantomData<Mode>,
 }
 
-impl<PIN: TimPin, TIM: ValidTim> From<PwmPin<PIN, TIM>> for ReducedPwmPin<PwmA> {
-    fn from(pwm_pin: PwmPin<PIN, TIM>) -> Self {
-        ReducedPwmPin {
-            reg: TimDynRegister::from(pwm_pin.reg),
-            pwm_base: pwm_pin.pwm_base,
-            pin_id: PIN::DYN,
+impl<Mode> ReducedPwmPin<Mode> {
+    pub(crate) fn new(tim_id: u8, pin_id: DynPinId, common: PwmCommon) -> Self {
+        Self {
+            dyn_reg: TimDynRegister { tim_id, pin_id },
+            common,
             mode: PhantomData,
         }
     }
 }
+/*
+impl<Pin: TimPin, Tim: ValidTim> From<PwmPin<Pin, Tim>> for ReducedPwmPin<PwmA> {
+    fn from(pwm_pin: PwmPin<Pin, Tim>) -> Self {
+        ReducedPwmPin {
+            dyn_reg: TimDynRegister {
 
-impl<MODE> ReducedPwmPin<MODE> {
-    pwm_common_func!();
+
+            }
+            // ::from(pwm_pin.reg),
+            common: pwm_pin.pwm_base,
+            pin_id: Pin::DYN,
+            mode: PhantomData,
+        }
+    }
+}
+*/
+
+impl<Mode> ReducedPwmPin<Mode> {
+    #[inline]
+    fn enable_pwm_a(&mut self) {
+        self.dyn_reg
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmA as u8) });
+    }
+
+    #[inline]
+    fn enable_pwm_b(&mut self) {
+        self.dyn_reg
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmB as u8) });
+    }
+
+    #[inline]
+    pub fn get_period(&self) -> Hertz {
+        self.common.current_period
+    }
+
+    #[inline]
+    pub fn set_period(&mut self, period: impl Into<Hertz>) {
+        self.common.current_period = period.into();
+        // Avoid division by 0
+        if self.common.current_period.raw() == 0 {
+            return;
+        }
+        self.common.current_rst_val = self.common.sys_clk.raw() / self.common.current_period.raw();
+        self.dyn_reg
+            .reg_block()
+            .rst_value()
+            .write(|w| unsafe { w.bits(self.common.current_rst_val) });
+    }
+
+    #[inline]
+    pub fn disable(&mut self) {
+        self.dyn_reg
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.enable().clear_bit());
+    }
+
+    #[inline]
+    pub fn enable(&mut self) {
+        self.dyn_reg
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.enable().set_bit());
+    }
+
+    #[inline]
+    pub fn period(&self) -> Hertz {
+        self.common.current_period
+    }
+
+    #[inline(always)]
+    pub fn duty(&self) -> u16 {
+        self.common.current_duty
+    }
 }
 
 impl From<ReducedPwmPin<PwmA>> for ReducedPwmPin<PwmB> {
     fn from(other: ReducedPwmPin<PwmA>) -> Self {
         let mut pwmb = Self {
-            reg: other.reg,
-            pwm_base: other.pwm_base,
-            pin_id: other.pin_id,
+            dyn_reg: other.dyn_reg,
+            common: other.common,
             mode: PhantomData,
         };
         pwmb.enable_pwm_b();
@@ -300,9 +308,8 @@ impl From<ReducedPwmPin<PwmA>> for ReducedPwmPin<PwmB> {
 impl From<ReducedPwmPin<PwmB>> for ReducedPwmPin<PwmA> {
     fn from(other: ReducedPwmPin<PwmB>) -> Self {
         let mut pwmb = Self {
-            reg: other.reg,
-            pwm_base: other.pwm_base,
-            pin_id: other.pin_id,
+            dyn_reg: other.dyn_reg,
+            common: other.common,
             mode: PhantomData,
         };
         pwmb.enable_pwm_a();
@@ -314,15 +321,83 @@ impl From<ReducedPwmPin<PwmB>> for ReducedPwmPin<PwmA> {
 // PWMB implementations
 //==================================================================================================
 
-impl<PIN: TimPin, TIM: ValidTim> PwmPin<PIN, TIM, PwmB>
+impl<Pin: TimPin, Tim: ValidTim> PwmPin<Pin, Tim, PwmB>
 where
-    (PIN, TIM): ValidTimAndPin<PIN, TIM>,
+    (Pin, Tim): ValidTimAndPin<Pin, Tim>,
 {
-    pwmb_func!();
+    pub fn pwmb_lower_limit(&self) -> u16 {
+        self.inner.pwmb_lower_limit()
+    }
+
+    pub fn pwmb_upper_limit(&self) -> u16 {
+        self.inner.pwmb_upper_limit()
+    }
+
+    /// Set the lower limit for PWMB
+    ///
+    /// The PWM signal will be 1 as long as the current RST counter is larger than
+    /// the lower limit. For example, with a lower limit of 0.5 and and an upper limit
+    /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
+    /// state
+    pub fn set_pwmb_lower_limit(&mut self, duty: u16) {
+        self.inner.set_pwmb_lower_limit(duty);
+    }
+
+    /// Set the higher limit for PWMB
+    ///
+    /// The PWM signal will be 1 as long as the current RST counter is smaller than
+    /// the higher limit. For example, with a lower limit of 0.5 and and an upper limit
+    /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
+    /// state
+    pub fn set_pwmb_upper_limit(&mut self, duty: u16) {
+        self.inner.set_pwmb_upper_limit(duty);
+    }
 }
 
 impl ReducedPwmPin<PwmB> {
-    pwmb_func!();
+    #[inline(always)]
+    pub fn pwmb_lower_limit(&self) -> u16 {
+        self.common.current_lower_limit
+    }
+
+    #[inline(always)]
+    pub fn pwmb_upper_limit(&self) -> u16 {
+        self.common.current_duty
+    }
+
+    /// Set the lower limit for PWMB
+    ///
+    /// The PWM signal will be 1 as long as the current RST counter is larger than
+    /// the lower limit. For example, with a lower limit of 0.5 and and an upper limit
+    /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
+    /// state
+    #[inline(always)]
+    pub fn set_pwmb_lower_limit(&mut self, duty: u16) {
+        self.common.current_lower_limit = duty;
+        let pwmb_val: u64 = (self.common.current_rst_val as u64
+            * self.common.current_lower_limit as u64)
+            / DUTY_MAX as u64;
+        self.dyn_reg
+            .reg_block()
+            .pwmb_value()
+            .write(|w| unsafe { w.bits(pwmb_val as u32) });
+    }
+
+    /// Set the higher limit for PWMB
+    ///
+    /// The PWM signal will be 1 as long as the current RST counter is smaller than
+    /// the higher limit. For example, with a lower limit of 0.5 and and an upper limit
+    /// of 0.7, Only a fixed period between 0.5 * period and 0.7 * period will be in a high
+    /// state
+    pub fn set_pwmb_upper_limit(&mut self, duty: u16) {
+        self.common.current_duty = duty;
+        let pwma_val: u64 = (self.common.current_rst_val as u64 * self.common.current_duty as u64)
+            / DUTY_MAX as u64;
+        self.dyn_reg
+            .reg_block()
+            .pwma_value()
+            .write(|w| unsafe { w.bits(pwma_val as u32) });
+    }
 }
 
 //==================================================================================================
@@ -345,12 +420,12 @@ impl embedded_hal::pwm::SetDutyCycle for ReducedPwmPin {
 
     #[inline]
     fn set_duty_cycle(&mut self, duty: u16) -> Result<(), Self::Error> {
-        self.pwm_base.current_duty = duty;
-        let pwma_val: u64 = (self.pwm_base.current_rst_val as u64
-            * (DUTY_MAX as u64 - self.pwm_base.current_duty as u64))
+        self.common.current_duty = duty;
+        let pwma_val: u64 = (self.common.current_rst_val as u64
+            * (DUTY_MAX as u64 - self.common.current_duty as u64))
             / DUTY_MAX as u64;
-        self.reg
-            .reg()
+        self.dyn_reg
+            .reg_block()
             .pwma_value()
             .write(|w| unsafe { w.bits(pwma_val as u32) });
         Ok(())
@@ -365,15 +440,7 @@ impl<Pin: TimPin, Tim: ValidTim> embedded_hal::pwm::SetDutyCycle for PwmPin<Pin,
 
     #[inline]
     fn set_duty_cycle(&mut self, duty: u16) -> Result<(), Self::Error> {
-        self.pwm_base.current_duty = duty;
-        let pwma_val: u64 = (self.pwm_base.current_rst_val as u64
-            * (DUTY_MAX as u64 - self.pwm_base.current_duty as u64))
-            / DUTY_MAX as u64;
-        self.reg
-            .reg()
-            .pwma_value()
-            .write(|w| unsafe { w.bits(pwma_val as u32) });
-        Ok(())
+        self.inner.set_duty_cycle(duty)
     }
 }
 

va108xx-hal/src/spi.rs

@@ -571,10 +571,13 @@ impl SpiClkConfig {
     }
 }
 
-#[derive(Debug)]
+#[derive(Debug, thiserror::Error)]
 pub enum SpiClkConfigError {
+    #[error("division by zero")]
     DivIsZero,
+    #[error("divide value is not even")]
     DivideValueNotEven,
+    #[error("scrdv value is too large")]
     ScrdvValueTooLarge,
 }
 

va108xx-hal/src/timer.rs

@@ -26,6 +26,48 @@ use fugit::RateExtU32;
 const IRQ_DST_NONE: u32 = 0xffffffff;
 pub static MS_COUNTER: Mutex<Cell<u32>> = Mutex::new(Cell::new(0));
 
+/// Get the peripheral block of a TIM peripheral given the index.
+///
+/// This function panics if the given index is greater than 23.
+///
+/// # Safety
+///
+/// This returns a direct handle to the peripheral block, which allows to circumvent ownership
+/// rules for the peripheral block. You have to ensure that the retrieved peripheral block is not
+/// used by any other software component.
+#[inline(always)]
+pub const unsafe fn get_tim_raw(tim_idx: usize) -> &'static pac::tim0::RegisterBlock {
+    match tim_idx {
+        0 => unsafe { &*pac::Tim0::ptr() },
+        1 => unsafe { &*pac::Tim1::ptr() },
+        2 => unsafe { &*pac::Tim2::ptr() },
+        3 => unsafe { &*pac::Tim3::ptr() },
+        4 => unsafe { &*pac::Tim4::ptr() },
+        5 => unsafe { &*pac::Tim5::ptr() },
+        6 => unsafe { &*pac::Tim6::ptr() },
+        7 => unsafe { &*pac::Tim7::ptr() },
+        8 => unsafe { &*pac::Tim8::ptr() },
+        9 => unsafe { &*pac::Tim9::ptr() },
+        10 => unsafe { &*pac::Tim10::ptr() },
+        11 => unsafe { &*pac::Tim11::ptr() },
+        12 => unsafe { &*pac::Tim12::ptr() },
+        13 => unsafe { &*pac::Tim13::ptr() },
+        14 => unsafe { &*pac::Tim14::ptr() },
+        15 => unsafe { &*pac::Tim15::ptr() },
+        16 => unsafe { &*pac::Tim16::ptr() },
+        17 => unsafe { &*pac::Tim17::ptr() },
+        18 => unsafe { &*pac::Tim18::ptr() },
+        19 => unsafe { &*pac::Tim19::ptr() },
+        20 => unsafe { &*pac::Tim20::ptr() },
+        21 => unsafe { &*pac::Tim21::ptr() },
+        22 => unsafe { &*pac::Tim22::ptr() },
+        23 => unsafe { &*pac::Tim23::ptr() },
+        _ => {
+            panic!("invalid alarm timer index")
+        }
+    }
+}
+
 //==================================================================================================
 // Defintions
 //==================================================================================================
@@ -248,7 +290,7 @@ pub type TimRegBlock = tim0::RegisterBlock;
 /// implementations should be overridden. The implementing type must also have
 /// "control" over the corresponding pin ID, i.e. it must guarantee that a each
 /// pin ID is a singleton.
-pub(super) unsafe trait TimRegInterface {
+pub unsafe trait TimRegInterface {
     fn tim_id(&self) -> u8;
 
     const PORT_BASE: *const tim0::RegisterBlock = pac::Tim0::ptr() as *const _;
@@ -256,7 +298,7 @@ pub(super) unsafe trait TimRegInterface {
     /// All 24 TIM blocks are identical. This helper functions returns the correct
     /// memory mapped peripheral depending on the TIM ID.
     #[inline(always)]
-    fn reg(&self) -> &TimRegBlock {
+    fn reg_block(&self) -> &TimRegBlock {
         unsafe { &*Self::PORT_BASE.offset(self.tim_id() as isize) }
     }
 
@@ -293,70 +335,16 @@ pub(super) unsafe trait TimRegInterface {
     }
 }
 
-/// Provide a safe register interface for [`ValidTimAndPin`]s
-///
-/// This `struct` takes ownership of a [`ValidTimAndPin`] and provides an API to
-/// access the corresponding registers.
-pub(super) struct TimAndPinRegister<Pin: TimPin, Tim: ValidTim> {
-    pin: Pin,
-    tim: Tim,
-}
-
-pub(super) struct TimRegister<TIM: ValidTim> {
-    tim: TIM,
-}
-
-impl<TIM: ValidTim> TimRegister<TIM> {
-    #[inline]
-    pub(super) unsafe fn new(tim: TIM) -> Self {
-        TimRegister { tim }
-    }
-
-    pub(super) fn release(self) -> TIM {
-        self.tim
-    }
-}
-
-unsafe impl<TIM: ValidTim> TimRegInterface for TimRegister<TIM> {
+unsafe impl<Tim: ValidTim> TimRegInterface for Tim {
     fn tim_id(&self) -> u8 {
-        TIM::TIM_ID
+        Tim::TIM_ID
     }
 }
 
-impl<PIN: TimPin, TIM: ValidTim> TimAndPinRegister<PIN, TIM>
-where
-    (PIN, TIM): ValidTimAndPin<PIN, TIM>,
-{
-    #[inline]
-    pub(super) unsafe fn new(pin: PIN, tim: TIM) -> Self {
-        TimAndPinRegister { pin, tim }
-    }
-
-    pub(super) fn release(self) -> (PIN, TIM) {
-        (self.pin, self.tim)
-    }
-}
-
-unsafe impl<PIN: TimPin, TIM: ValidTim> TimRegInterface for TimAndPinRegister<PIN, TIM> {
-    #[inline(always)]
-    fn tim_id(&self) -> u8 {
-        TIM::TIM_ID
-    }
-}
-
-pub(super) struct TimDynRegister {
-    tim_id: u8,
+pub(crate) struct TimDynRegister {
+    pub(crate) tim_id: u8,
     #[allow(dead_code)]
-    pin_id: DynPinId,
-}
-
-impl<PIN: TimPin, TIM: ValidTim> From<TimAndPinRegister<PIN, TIM>> for TimDynRegister {
-    fn from(_reg: TimAndPinRegister<PIN, TIM>) -> Self {
-        Self {
-            tim_id: TIM::TIM_ID,
-            pin_id: PIN::DYN,
-        }
-    }
+    pub(crate) pin_id: DynPinId,
 }
 
 unsafe impl TimRegInterface for TimDynRegister {
@@ -371,8 +359,8 @@ unsafe impl TimRegInterface for TimDynRegister {
 //==================================================================================================
 
 /// Hardware timers
-pub struct CountdownTimer<TIM: ValidTim> {
-    tim: TimRegister<TIM>,
+pub struct CountdownTimer<Tim: ValidTim> {
+    tim: Tim,
     curr_freq: Hertz,
     irq_cfg: Option<IrqCfg>,
     sys_clk: Hertz,
@@ -401,12 +389,12 @@ unsafe impl<TIM: ValidTim> TimRegInterface for CountdownTimer<TIM> {
     }
 }
 
-impl<TIM: ValidTim> CountdownTimer<TIM> {
+impl<Tim: ValidTim> CountdownTimer<Tim> {
     /// Configures a TIM peripheral as a periodic count down timer
-    pub fn new(syscfg: &mut pac::Sysconfig, sys_clk: impl Into<Hertz>, tim: TIM) -> Self {
-        enable_tim_clk(syscfg, TIM::TIM_ID);
+    pub fn new(syscfg: &mut pac::Sysconfig, sys_clk: impl Into<Hertz>, tim: Tim) -> Self {
+        enable_tim_clk(syscfg, Tim::TIM_ID);
         let cd_timer = CountdownTimer {
-            tim: unsafe { TimRegister::new(tim) },
+            tim,
             sys_clk: sys_clk.into(),
             irq_cfg: None,
             rst_val: 0,
@@ -416,7 +404,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
         };
         cd_timer
             .tim
-            .reg()
+            .reg_block()
             .ctrl()
             .modify(|_, w| w.enable().set_bit());
         cd_timer
@@ -441,7 +429,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
                     }
                     if let Some(irq_sel) = irq_sel {
                         irq_sel
-                            .tim0(TIM::TIM_ID as usize)
+                            .tim0(Tim::TIM_ID as usize)
                             .write(|w| unsafe { w.bits(irq_cfg.irq as u32) });
                     }
                 }
@@ -460,7 +448,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
             Event::TimeOut => {
                 enable_peripheral_clock(syscfg, PeripheralClocks::Irqsel);
                 irqsel
-                    .tim0(TIM::TIM_ID as usize)
+                    .tim0(Tim::TIM_ID as usize)
                     .write(|w| unsafe { w.bits(IRQ_DST_NONE) });
                 self.disable_interrupt();
                 self.listening = false;
@@ -470,25 +458,37 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
 
     #[inline(always)]
     pub fn enable_interrupt(&mut self) {
-        self.tim.reg().ctrl().modify(|_, w| w.irq_enb().set_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.irq_enb().set_bit());
     }
 
     #[inline(always)]
     pub fn disable_interrupt(&mut self) {
-        self.tim.reg().ctrl().modify(|_, w| w.irq_enb().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.irq_enb().clear_bit());
     }
 
-    pub fn release(self, syscfg: &mut pac::Sysconfig) -> TIM {
-        self.tim.reg().ctrl().write(|w| w.enable().clear_bit());
+    pub fn release(self, syscfg: &mut pac::Sysconfig) -> Tim {
+        self.tim
+            .reg_block()
+            .ctrl()
+            .write(|w| w.enable().clear_bit());
         syscfg
             .tim_clk_enable()
-            .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << TIM::TIM_ID)) });
-        self.tim.release()
+            .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << Tim::TIM_ID)) });
+        self.tim
     }
 
     /// Load the count down timer with a timeout but do not start it.
     pub fn load(&mut self, timeout: impl Into<Hertz>) {
-        self.tim.reg().ctrl().modify(|_, w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.enable().clear_bit());
         self.curr_freq = timeout.into();
         self.rst_val = self.sys_clk.raw() / self.curr_freq.raw();
         self.set_reload(self.rst_val);
@@ -497,17 +497,23 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
 
     #[inline(always)]
     pub fn set_reload(&mut self, val: u32) {
-        self.tim.reg().rst_value().write(|w| unsafe { w.bits(val) });
+        self.tim
+            .reg_block()
+            .rst_value()
+            .write(|w| unsafe { w.bits(val) });
     }
 
     #[inline(always)]
     pub fn set_count(&mut self, val: u32) {
-        self.tim.reg().cnt_value().write(|w| unsafe { w.bits(val) });
+        self.tim
+            .reg_block()
+            .cnt_value()
+            .write(|w| unsafe { w.bits(val) });
     }
 
     #[inline(always)]
     pub fn count(&self) -> u32 {
-        self.tim.reg().cnt_value().read().bits()
+        self.tim.reg_block().cnt_value().read().bits()
     }
 
     #[inline(always)]
@@ -518,24 +524,30 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
                 unsafe { enable_interrupt(irq_cfg.irq) };
             }
         }
-        self.tim.reg().enable().write(|w| unsafe { w.bits(1) });
+        self.tim
+            .reg_block()
+            .enable()
+            .write(|w| unsafe { w.bits(1) });
     }
 
     #[inline(always)]
     pub fn disable(&mut self) {
-        self.tim.reg().enable().write(|w| unsafe { w.bits(0) });
+        self.tim
+            .reg_block()
+            .enable()
+            .write(|w| unsafe { w.bits(0) });
     }
 
     /// Disable the counter, setting both enable and active bit to 0
     pub fn auto_disable(self, enable: bool) -> Self {
         if enable {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_disable().set_bit());
         } else {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_disable().clear_bit());
         }
@@ -549,12 +561,12 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
     pub fn auto_deactivate(self, enable: bool) -> Self {
         if enable {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_deactivate().set_bit());
         } else {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_deactivate().clear_bit());
         }
@@ -563,7 +575,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
 
     /// Configure the cascade parameters
     pub fn cascade_control(&mut self, ctrl: CascadeCtrl) {
-        self.tim.reg().csd_ctrl().write(|w| {
+        self.tim.reg_block().csd_ctrl().write(|w| {
             w.csden0().bit(ctrl.enb_start_src_csd0);
             w.csdinv0().bit(ctrl.inv_csd0);
             w.csden1().bit(ctrl.enb_start_src_csd1);
@@ -580,7 +592,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
     pub fn cascade_0_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade0()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())
@@ -589,7 +601,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
     pub fn cascade_1_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade1()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())
@@ -598,7 +610,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
     pub fn cascade_2_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade2()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())
@@ -627,7 +639,7 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
     /// Return `Ok` if the timer has wrapped. Peripheral will automatically clear the
     /// flag and restart the time if configured correctly
     pub fn wait(&mut self) -> nb::Result<(), void::Void> {
-        let cnt = self.tim.reg().cnt_value().read().bits();
+        let cnt = self.tim.reg_block().cnt_value().read().bits();
         if (cnt > self.last_cnt) || cnt == 0 {
             self.last_cnt = self.rst_val;
             Ok(())
@@ -639,10 +651,13 @@ impl<TIM: ValidTim> CountdownTimer<TIM> {
 
     /// Returns [false] if the timer was not active, and true otherwise.
     pub fn cancel(&mut self) -> bool {
-        if !self.tim.reg().ctrl().read().enable().bit_is_set() {
+        if !self.tim.reg_block().ctrl().read().enable().bit_is_set() {
             return false;
         }
-        self.tim.reg().ctrl().write(|w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .write(|w| w.enable().clear_bit());
         true
     }
 }

va108xx-hal/src/uart.rs

@@ -48,30 +48,30 @@ impl Pins<pac::Uartb> for (Pin<PB21, AltFunc1>, Pin<PB20, AltFunc1>) {}
 // Regular Definitions
 //==================================================================================================
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[error("transer is pending")]
 pub struct TransferPendingError;
 
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum RxError {
+    #[error("overrun error")]
     Overrun,
+    #[error("framing error")]
     Framing,
+    #[error("parity error")]
     Parity,
 }
-#[derive(Debug, PartialEq, Eq)]
+#[derive(Debug, PartialEq, Eq, thiserror::Error)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Error {
-    Rx(RxError),
+    #[error("rx error: {0}")]
+    Rx(#[from] RxError),
+    #[error("break condition")]
     BreakCondition,
 }
 
-impl From<RxError> for Error {
-    fn from(value: RxError) -> Self {
-        Self::Rx(value)
-    }
-}
-
 impl embedded_io::Error for Error {
     fn kind(&self) -> embedded_io::ErrorKind {
         embedded_io::ErrorKind::Other
@@ -284,17 +284,17 @@ impl IrqResultMaxSizeOrTimeout {
 
     #[inline]
     pub fn overflow_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.overflow)
+        self.errors.is_some_and(|e| e.overflow)
     }
 
     #[inline]
     pub fn framing_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.framing)
+        self.errors.is_some_and(|e| e.framing)
     }
 
     #[inline]
     pub fn parity_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.parity)
+        self.errors.is_some_and(|e| e.parity)
     }
 
     #[inline]
@@ -1213,243 +1213,3 @@ impl<Uart: Instance> RxWithIrq<Uart> {
         self.rx.release()
     }
 }
-
-/*
-
-impl<UART: Instance, PINS> UartWithIrq<UART, PINS> {
-    /// See [`UartWithIrqBase::read_fixed_len_using_irq`] doc
-    pub fn read_fixed_len_using_irq(
-        &mut self,
-        max_len: usize,
-        enb_timeout_irq: bool,
-    ) -> Result<(), Error> {
-        self.irq_base
-            .read_fixed_len_using_irq(max_len, enb_timeout_irq)
-    }
-
-    pub fn cancel_transfer(&mut self) {
-        self.irq_base.cancel_transfer()
-    }
-
-    /// See [`UartWithIrqBase::irq_handler`] doc
-    pub fn irq_handler(&mut self, res: &mut IrqResult, buf: &mut [u8]) -> Result<(), Error> {
-        self.irq_base.irq_handler(res, buf)
-    }
-
-    pub fn release(self) -> (UART, PINS) {
-        (self.irq_base.release(), self.pins)
-    }
-
-    pub fn downgrade(self) -> (UartWithIrqBase<UART>, PINS) {
-        (self.irq_base, self.pins)
-    }
-}
-
-impl<Uart: Instance> UartWithIrqBase<Uart> {
-    fn init(self, sys_cfg: Option<&mut pac::Sysconfig>, irq_sel: Option<&mut pac::Irqsel>) -> Self {
-        if let Some(sys_cfg) = sys_cfg {
-            enable_peripheral_clock(sys_cfg, PeripheralClocks::Irqsel)
-        }
-        if let Some(irq_sel) = irq_sel {
-            if self.irq_info.irq_cfg.route {
-                irq_sel
-                    .uart0(Uart::IDX as usize)
-                    .write(|w| unsafe { w.bits(self.irq_info.irq_cfg.irq as u32) });
-            }
-        }
-        self
-    }
-
-    /// This initializes a non-blocking read transfer using the IRQ capabilities of the UART
-    /// peripheral.
-    ///
-    /// The only required information is the maximum length for variable sized reception
-    /// or the expected length for fixed length reception. If variable sized packets are expected,
-    /// the timeout functionality of the IRQ should be enabled as well. After calling this function,
-    /// the [`irq_handler`](Self::irq_handler) function should be called in the user interrupt
-    /// handler to read the received packets and reinitiate another transfer if desired.
-    pub fn read_fixed_len_using_irq(
-        &mut self,
-        max_len: usize,
-        enb_timeout_irq: bool,
-    ) -> Result<(), Error> {
-        if self.irq_info.mode != IrqReceptionMode::Idle {
-            return Err(Error::TransferPending);
-        }
-        self.irq_info.mode = IrqReceptionMode::Pending;
-        self.irq_info.rx_idx = 0;
-        self.irq_info.rx_len = max_len;
-        self.uart.enable_rx();
-        self.uart.enable_tx();
-        self.enable_rx_irq_sources(enb_timeout_irq);
-        if self.irq_info.irq_cfg.enable {
-            unsafe {
-                enable_interrupt(self.irq_info.irq_cfg.irq);
-            }
-        }
-        Ok(())
-    }
-
-    #[inline]
-    fn enable_rx_irq_sources(&mut self, timeout: bool) {
-        self.uart.uart.irq_enb().modify(|_, w| {
-            if timeout {
-                w.irq_rx_to().set_bit();
-            }
-            w.irq_rx_status().set_bit();
-            w.irq_rx().set_bit()
-        });
-    }
-
-    #[inline]
-    fn disable_rx_irq_sources(&mut self) {
-        self.uart.uart.irq_enb().modify(|_, w| {
-            w.irq_rx_to().clear_bit();
-            w.irq_rx_status().clear_bit();
-            w.irq_rx().clear_bit()
-        });
-    }
-
-    #[inline]
-    pub fn enable_tx(&mut self) {
-        self.uart.enable_tx()
-    }
-
-    #[inline]
-    pub fn disable_tx(&mut self) {
-        self.uart.disable_tx()
-    }
-
-    pub fn cancel_transfer(&mut self) {
-        // Disable IRQ
-        cortex_m::peripheral::NVIC::mask(self.irq_info.irq_cfg.irq);
-        self.disable_rx_irq_sources();
-        self.uart.clear_tx_fifo();
-        self.irq_info.rx_idx = 0;
-        self.irq_info.rx_len = 0;
-    }
-
-    /// Default IRQ handler which can be used to read the packets arriving on the UART peripheral.
-    ///
-    /// If passed buffer is equal to or larger than the specified maximum length, an
-    /// [`Error::BufferTooShort`] will be returned
-    pub fn irq_handler(&mut self, res: &mut IrqResult, buf: &mut [u8]) -> Result<(), Error> {
-        if buf.len() < self.irq_info.rx_len {
-            return Err(Error::BufferTooShort);
-        }
-
-        let irq_end = self.uart.uart.irq_end().read();
-        let enb_status = self.uart.uart.enable().read();
-        let rx_enabled = enb_status.rxenable().bit_is_set();
-        let _tx_enabled = enb_status.txenable().bit_is_set();
-        let read_handler =
-            |res: &mut IrqResult, read_res: nb::Result<u8, Error>| -> Result<Option<u8>, Error> {
-                match read_res {
-                    Ok(byte) => Ok(Some(byte)),
-                    Err(nb::Error::WouldBlock) => Ok(None),
-                    Err(nb::Error::Other(e)) => match e {
-                        Error::Overrun => {
-                            res.set_result(IrqResultMask::Overflow);
-                            Err(Error::IrqError)
-                        }
-                        Error::FramingError => {
-                            res.set_result(IrqResultMask::FramingError);
-                            Err(Error::IrqError)
-                        }
-                        Error::ParityError => {
-                            res.set_result(IrqResultMask::ParityError);
-                            Err(Error::IrqError)
-                        }
-                        _ => {
-                            res.set_result(IrqResultMask::Unknown);
-                            Err(Error::IrqError)
-                        }
-                    },
-                }
-            };
-        if irq_end.irq_rx().bit_is_set() {
-            // If this interrupt bit is set, the trigger level is available at the very least.
-            // Read everything as fast as possible
-            for _ in 0..core::cmp::min(
-                self.uart.uart.rxfifoirqtrg().read().bits() as usize,
-                self.irq_info.rx_len,
-            ) {
-                buf[self.irq_info.rx_idx] = (self.uart.uart.data().read().bits() & 0xff) as u8;
-                self.irq_info.rx_idx += 1;
-            }
-
-            // While there is data in the FIFO, write it into the reception buffer
-            loop {
-                if self.irq_info.rx_idx == self.irq_info.rx_len {
-                    self.irq_completion_handler(res);
-                    return Ok(());
-                }
-                if let Some(byte) = read_handler(res, self.uart.read())? {
-                    buf[self.irq_info.rx_idx] = byte;
-                    self.irq_info.rx_idx += 1;
-                } else {
-                    break;
-                }
-            }
-        }
-
-        // RX transfer not complete, check for RX errors
-        if (self.irq_info.rx_idx < self.irq_info.rx_len) && rx_enabled {
-            // Read status register again, might have changed since reading received data
-            let rx_status = self.uart.uart.rxstatus().read();
-            res.clear_result();
-            if rx_status.rxovr().bit_is_set() {
-                res.set_result(IrqResultMask::Overflow);
-            }
-            if rx_status.rxfrm().bit_is_set() {
-                res.set_result(IrqResultMask::FramingError);
-            }
-            if rx_status.rxpar().bit_is_set() {
-                res.set_result(IrqResultMask::ParityError);
-            }
-            if rx_status.rxbrk().bit_is_set() {
-                res.set_result(IrqResultMask::Break);
-            }
-            if rx_status.rxto().bit_is_set() {
-                // A timeout has occured but there might be some leftover data in the FIFO,
-                // so read that data as well
-                while let Some(byte) = read_handler(res, self.uart.read())? {
-                    buf[self.irq_info.rx_idx] = byte;
-                    self.irq_info.rx_idx += 1;
-                }
-                self.irq_completion_handler(res);
-                res.set_result(IrqResultMask::Timeout);
-                return Ok(());
-            }
-
-            // If it is not a timeout, it's an error
-            if res.raw_res != 0 {
-                self.disable_rx_irq_sources();
-                return Err(Error::IrqError);
-            }
-        }
-
-        // Clear the interrupt status bits
-        self.uart
-            .uart
-            .irq_clr()
-            .write(|w| unsafe { w.bits(irq_end.bits()) });
-        Ok(())
-    }
-
-    fn irq_completion_handler(&mut self, res: &mut IrqResult) {
-        self.disable_rx_irq_sources();
-        self.uart.disable_rx();
-        res.bytes_read = self.irq_info.rx_idx;
-        res.clear_result();
-        res.set_result(IrqResultMask::Complete);
-        self.irq_info.mode = IrqReceptionMode::Idle;
-        self.irq_info.rx_idx = 0;
-        self.irq_info.rx_len = 0;
-    }
-
-    pub fn release(self) -> Uart {
-        self.uart.release()
-    }
-}
-*/

va108xx/docs.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+export RUSTDOCFLAGS="--cfg docsrs --generate-link-to-definition -Z unstable-options"
+cargo +nightly doc --all-features --open

vorago-reb1/CHANGELOG.md

@@ -8,7 +8,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [unreleased]
 
+## [v0.6.0] 2024-09-30
+
 - Added M95M01 EEPROM module/API
+- Update `va108xx-hal` dependency to range >=v0.8, <0.9
 
 ## [v0.5.1] 2024-07-04
 

vorago-reb1/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "vorago-reb1"
-version = "0.5.1"
+version = "0.6.0"
 authors = ["Robin Mueller <muellerr@irs.uni-stuttgart.de>"]
 edition = "2021"
 description = "Board Support Crate for the Vorago REB1 development board"
@@ -15,25 +15,22 @@ cortex-m = { version = "0.7", features = ["critical-section-single-core"] }
 cortex-m-rt = "0.7"
 embedded-hal = "1"
 nb = "1"
-bitfield = "0.17"
-
-[dependencies.max116xx-10bit]
-version = "0.3"
+bitfield = ">=0.17, <=0.18"
+max116xx-10bit = "0.3"
 
 [dependencies.va108xx-hal]
-version = ">=0.7, <=0.8"
-path = "../va108xx-hal"
+version = ">=0.8, <0.9"
 features = ["rt"]
 
 [features]
 rt = ["va108xx-hal/rt"]
 
 [dev-dependencies]
-panic-halt = "0.2"
+panic-halt = "1"
 nb = "1"
-rtt-target = "0.5"
-panic-rtt-target = "0.1"
-embedded-hal-bus = "0.2"
+rtt-target = "0.6"
+panic-rtt-target = "0.2"
+embedded-hal-bus = "0.3"
 dummy-pin = "1"
 
 [package.metadata.docs.rs]