minor doc improvements

Reviewed-on: #45

.cargo/def-config.toml

@@ -1,13 +1,11 @@
 [target.'cfg(all(target_arch = "arm", target_os = "none"))']
-runner = "gdb-multiarch -q -x jlink/jlink.gdb"
+# runner = "gdb-multiarch -q -x jlink/jlink.gdb"
 # runner = "arm-none-eabi-gdb -q -x jlink/jlink-reva.gdb"
 # runner = "gdb-multiarch -q -x jlink/jlink-reva.gdb"
 
 # Probe-rs is currently problematic, possibly because of the
 # ROM protection?
-# runner = "probe-rs run --chip-description-path ./scripts/VA416xx_Series.yaml"
+runner = "probe-rs run --chip VA416xx_RAM --protocol swd"
-# runner = ["probe-rs", "run", "--chip", "$CHIP", "--log-format", "{L} {s}"]
-
 
 rustflags = [
   "-C",

Cargo.toml

@@ -3,6 +3,7 @@ resolver = "2"
 members = [
   "va416xx",
   "va416xx-hal",
+  "va416xx-embassy",
   "vorago-peb1",
   "bootloader",
   "flashloader",

README.md

@@ -14,6 +14,8 @@ This workspace contains the following crates:
   PAC crate containing basic low-level register definition
 - The [`va416xx-hal`](https://egit.irs.uni-stuttgart.de/rust/va416xx-rs/src/branch/main/va416xx-hal)
   HAL crate containing higher-level abstractions on top of the PAC register crate.
+- The [`va416xx-embassy`](https://egit.irs.uni-stuttgart.de/rust/va416xx-rs/src/branch/main/va108xx-embassy)
+  crate containing support for running the embassy-rs RTOS.
 - The [`vorago-peb1`](https://egit.irs.uni-stuttgart.de/rust/va416xx-rs/src/branch/main/vorago-peb1)
   BSP crate containing support for the PEB1 development board.
 
@@ -56,6 +58,25 @@ You can then adapt the files in `.vscode` to your needs.
 You can use CLI or VS Code for flashing, running and debugging. In any case, take
 care of installing the pre-requisites first.
 
+### Using CLI with probe-rs
+
+Install [probe-rs](https://probe.rs/docs/getting-started/installation/) first.
+
+You can use `probe-rs` to run the software and display RTT log output. However, debugging does not
+work yet.
+
+After installation, you can run the following command
+
+```sh
+probe-rs run --chip VA416xx_RAM --protocol jtag target/thumbv7em-none-eabihf/debug/examples/blinky
+```
+
+to flash and run the blinky program on the RAM. There is also a `VA416xx` chip target
+available for persistent flashing.
+
+Runner configuration avilable in the `.cargo/def-config.toml` file to use `probe-rs` for
+convenience.
+
 ### Pre-Requisites
 
 1. [SEGGER J-Link tools](https://www.segger.com/downloads/jlink/) installed
@@ -64,6 +85,38 @@ care of installing the pre-requisites first.
 
 ### Using CLI
 
+
+### Using VS Code
+
+Assuming a working debug connection to your VA416xx board, you can debug using VS Code with
+the [`Cortex-Debug` plugin](https://marketplace.visualstudio.com/items?itemName=marus25.cortex-debug).
+Please make sure that [`objdump-multiarch` and `nm-multiarch`](https://forums.raspberrypi.com/viewtopic.php?t=333146)
+are installed as well.
+
+Some sample configuration files for VS code were provided and can be used by running
+`cp -rT vscode .vscode` like specified above. After that, you can use `Run and Debug`
+to automatically rebuild and flash your application.
+
+If you would like to use a custom GDB application, you can specify the gdb binary in the following
+configuration variables in your `settings.json`:
+
+- `"cortex-debug.gdbPath"`
+- `"cortex-debug.gdbPath.linux"`
+- `"cortex-debug.gdbPath.windows"`
+- `"cortex-debug.gdbPath.osx"`
+
+The provided VS Code configurations also provide an integrated RTT logger, which you can access
+via the terminal at `RTT Ch:0 console`. In order for the RTT block address detection to
+work properly, `objdump-multiarch` and `nm-multiarch` need to be installed.
+
+### Using CLI with GDB and Segger J-Link Tools
+
+Install the following two tools first:
+
+1. [SEGGER J-Link tools](https://www.segger.com/downloads/jlink/) installed
+2. [gdb-multiarch](https://packages.debian.org/sid/gdb-multiarch) or similar
+   cross-architecture debugger installed. All commands here assume `gdb-multiarch`.
+
 You can build the blinky example application with the following command
 
 ```sh
@@ -97,25 +150,8 @@ runner = "gdb-multiarch -q -x jlink/jlink.gdb"
 After that, you can simply use `cargo run --example blinky` to flash the blinky
 example.
 
-### Using VS Code
+### Using the RTT Viewer
 
-Assuming a working debug connection to your VA416xx board, you can debug using VS Code with
+The Segger RTT viewer can be used to display log messages received from the target. The base
-the [`Cortex-Debug` plugin](https://marketplace.visualstudio.com/items?itemName=marus25.cortex-debug).
+address for the RTT block placement is 0x1fff8000. It is recommended to use a search range of
-Please make sure that [`objdump-multiarch` and `nm-multiarch`](https://forums.raspberrypi.com/viewtopic.php?t=333146)
+0x1000 around that base address when using the RTT viewer.
-are installed as well.
-
-Some sample configuration files for VS code were provided and can be used by running
-`cp -rT vscode .vscode` like specified above. After that, you can use `Run and Debug`
-to automatically rebuild and flash your application.
-
-If you would like to use a custom GDB application, you can specify the gdb binary in the following
-configuration variables in your `settings.json`:
-
-- `"cortex-debug.gdbPath"`
-- `"cortex-debug.gdbPath.linux"`
-- `"cortex-debug.gdbPath.windows"`
-- `"cortex-debug.gdbPath.osx"`
-
-The provided VS Code configurations also provide an integrated RTT logger, which you can access
-via the terminal at `RTT Ch:0 console`. In order for the RTT block address detection to
-work properly, `objdump-multiarch` and `nm-multiarch` need to be installed.

examples/README.md

@@ -20,6 +20,14 @@ cargo run --bin rtic-example
 
 ## Embassy example
 
+Blinky with time driver IRQs in library
+
 ```rs
 cargo run --bin embassy-example
 ```
+
+Blinky with custom time driver IRQs
+
+```rs
+cargo run --bin embassy-example --no-default-features --features custom-irqs
+```

examples/embassy/Cargo.toml

@@ -4,6 +4,7 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
+cfg-if = "1"
 cortex-m = { version = "0.7", features = ["critical-section-single-core"] }
 cortex-m-rt = "0.7"
 embedded-hal = "1"
@@ -13,9 +14,9 @@ rtt-target = { version = "0.5" }
 panic-rtt-target = { version = "0.1" }
 critical-section = "1"
 
-embassy-sync = { version = "0.6.0" }
+embassy-sync = { version = "0.6" }
-embassy-time = { version = "0.3.2" }
+embassy-time = { version = "0.4" }
-embassy-time-driver = { version = "0.1" }
+va416xx-embassy = { path = "../../va416xx-embassy", default-features = false }
 
 [dependencies.ringbuf]
 version = "0.4"
@@ -27,12 +28,11 @@ default-features = false
 features = ["critical-section"]
 
 [dependencies.embassy-executor]
-version = "0.6.0"
+version = "0.7"
 features = [
     "arch-cortex-m",
     "executor-thread",
     "executor-interrupt",
-    "integrated-timers",
 ]
 
 [dependencies.va416xx-hal]
@@ -40,6 +40,7 @@ path = "../../va416xx-hal"
 features = ["va41630"]
 
 [features]
-default = ["ticks-hz-1_000"]
+default = ["ticks-hz-1_000", "va416xx-embassy/irq-tim14-tim15"]
+custom-irqs = []
 ticks-hz-1_000 = ["embassy-time/tick-hz-1_000"]
 ticks-hz-32_768 = ["embassy-time/tick-hz-32_768"]

examples/embassy/src/bin/uart-echo-with-irq.rs

@@ -64,7 +64,7 @@ async fn main(spawner: Spawner) {
         .unwrap();
     // Safety: Only called once here.
     unsafe {
-        embassy_example::init(
+        va416xx_embassy::init(
             &mut dp.sysconfig,
             &dp.irq_router,
             dp.tim15,

examples/embassy/src/lib.rs

@@ -1,6 +1,2 @@
 #![no_std]
-pub mod time_driver;
-
 pub const EXTCLK_FREQ: u32 = 40_000_000;
-
-pub use time_driver::init;

examples/embassy/src/main.rs

@@ -8,6 +8,13 @@ use panic_rtt_target as _;
 use rtt_target::{rprintln, rtt_init_print};
 use va416xx_hal::{gpio::PinsG, pac, prelude::*, time::Hertz};
 
+cfg_if::cfg_if! {
+    if #[cfg(feature = "custom-irqs")] {
+        use va416xx_hal::pac::interrupt;
+        va416xx_embassy::embassy_time_driver_irqs!(timekeeper_irq = TIM12, alarm_irq = TIM11);
+    }
+}
+
 // main is itself an async function.
 #[embassy_executor::main]
 async fn main(_spawner: Spawner) {
@@ -26,14 +33,26 @@ async fn main(_spawner: Spawner) {
         .unwrap();
     // Safety: Only called once here.
     unsafe {
-        embassy_example::init(
+        cfg_if::cfg_if! {
+            if #[cfg(not(feature = "custom-irqs"))] {
+                va416xx_embassy::init(
                     &mut dp.sysconfig,
                     &dp.irq_router,
                     dp.tim15,
                     dp.tim14,
-            &clocks,
+                    &clocks
-        )
+                );
-    };
+            } else {
+                va416xx_embassy::init(
+                    &mut dp.sysconfig,
+                    &dp.irq_router,
+                    dp.tim12,
+                    dp.tim11,
+                    &clocks
+                );
+            }
+        }
+    }
     let portg = PinsG::new(&mut dp.sysconfig, dp.portg);
     let mut led = portg.pg5.into_readable_push_pull_output();
     let mut ticker = Ticker::every(Duration::from_secs(1));

examples/embassy/src/time_driver.rs

@@ -1,323 +0,0 @@
-//! This is a sample time driver implementation for the VA416xx family of devices, supporting
-//! one alarm and requiring/reserving 2 TIM peripherals. You could adapt this implementation to
-//! support more alarms.
-use core::{
-    cell::Cell,
-    mem, ptr,
-    sync::atomic::{AtomicU32, AtomicU8, Ordering},
-};
-use critical_section::CriticalSection;
-use embassy_sync::blocking_mutex::raw::CriticalSectionRawMutex;
-use embassy_sync::blocking_mutex::Mutex;
-
-use embassy_time_driver::{time_driver_impl, AlarmHandle, Driver, TICK_HZ};
-use once_cell::sync::OnceCell;
-use va416xx_hal::{
-    clock::Clocks,
-    enable_interrupt,
-    irq_router::enable_and_init_irq_router,
-    pac::{self, interrupt},
-    timer::{assert_tim_reset_for_two_cycles, enable_tim_clk, ValidTim},
-};
-
-pub type TimekeeperClk = pac::Tim15;
-pub type AlarmClk0 = pac::Tim14;
-pub type AlarmClk1 = pac::Tim13;
-pub type AlarmClk2 = pac::Tim12;
-
-/// Initialization method for embassy
-///
-/// # Safety
-/// This has to be called once at initialization time to initiate the time driver for
-/// embassy.
-pub unsafe fn init(
-    syscfg: &mut pac::Sysconfig,
-    irq_router: &pac::IrqRouter,
-    timekeeper: TimekeeperClk,
-    alarm: AlarmClk0,
-    clocks: &Clocks,
-) {
-    enable_and_init_irq_router(syscfg, irq_router);
-    DRIVER.init(syscfg, timekeeper, alarm, clocks)
-}
-
-const fn alarm_tim(idx: usize) -> &'static pac::tim0::RegisterBlock {
-    // Safety: This is a static memory-mapped peripheral.
-    match idx {
-        0 => unsafe { &*AlarmClk0::ptr() },
-        1 => unsafe { &*AlarmClk1::ptr() },
-        2 => unsafe { &*AlarmClk2::ptr() },
-        _ => {
-            panic!("invalid alarm timer index")
-        }
-    }
-}
-
-const fn timekeeping_tim() -> &'static pac::tim0::RegisterBlock {
-    // Safety: This is a memory-mapped peripheral.
-    unsafe { &*TimekeeperClk::ptr() }
-}
-
-struct AlarmState {
-    timestamp: Cell<u64>,
-
-    // This is really a Option<(fn(*mut ()), *mut ())>
-    // but fn pointers aren't allowed in const yet
-    callback: Cell<*const ()>,
-    ctx: Cell<*mut ()>,
-}
-
-impl AlarmState {
-    const fn new() -> Self {
-        Self {
-            timestamp: Cell::new(u64::MAX),
-            callback: Cell::new(ptr::null()),
-            ctx: Cell::new(ptr::null_mut()),
-        }
-    }
-}
-
-unsafe impl Send for AlarmState {}
-
-const ALARM_COUNT: usize = 1;
-
-static SCALE: OnceCell<u64> = OnceCell::new();
-
-pub struct TimerDriverEmbassy {
-    periods: AtomicU32,
-    alarm_count: AtomicU8,
-    /// Timestamp at which to fire alarm. u64::MAX if no alarm is scheduled.
-    alarms: Mutex<CriticalSectionRawMutex, [AlarmState; ALARM_COUNT]>,
-}
-
-impl TimerDriverEmbassy {
-    fn init(
-        &self,
-        syscfg: &mut pac::Sysconfig,
-        timekeeper: TimekeeperClk,
-        alarm_tim: AlarmClk0,
-        clocks: &Clocks,
-    ) {
-        enable_tim_clk(syscfg, TimekeeperClk::TIM_ID);
-        assert_tim_reset_for_two_cycles(syscfg, TimekeeperClk::TIM_ID);
-
-        // Initiate scale value here. This is required to convert timer ticks back to a timestamp.
-        SCALE
-            .set((TimekeeperClk::clock(clocks).raw() / TICK_HZ as u32) as u64)
-            .unwrap();
-        timekeeper
-            .rst_value()
-            .write(|w| unsafe { w.bits(u32::MAX) });
-        // Decrementing counter.
-        timekeeper
-            .cnt_value()
-            .write(|w| unsafe { w.bits(u32::MAX) });
-        // Switch on. Timekeeping should always be done.
-        unsafe {
-            enable_interrupt(TimekeeperClk::IRQ);
-        }
-        timekeeper.ctrl().modify(|_, w| w.irq_enb().set_bit());
-        timekeeper.enable().write(|w| unsafe { w.bits(1) });
-
-        enable_tim_clk(syscfg, AlarmClk0::TIM_ID);
-        assert_tim_reset_for_two_cycles(syscfg, AlarmClk0::TIM_ID);
-
-        // Explicitely disable alarm timer until needed.
-        alarm_tim.ctrl().modify(|_, w| {
-            w.irq_enb().clear_bit();
-            w.enable().clear_bit()
-        });
-        // Enable general interrupts. The IRQ enable of the peripheral remains cleared.
-        unsafe {
-            enable_interrupt(AlarmClk0::IRQ);
-        }
-    }
-
-    // Should be called inside the IRQ of the timekeeper timer.
-    fn on_interrupt_timekeeping(&self) {
-        self.next_period();
-    }
-
-    // Should be called inside the IRQ of the alarm timer.
-    fn on_interrupt_alarm(&self, idx: usize) {
-        critical_section::with(|cs| {
-            if self.alarms.borrow(cs)[idx].timestamp.get() <= self.now() {
-                self.trigger_alarm(idx, cs)
-            }
-        })
-    }
-
-    fn next_period(&self) {
-        let period = self.periods.fetch_add(1, Ordering::AcqRel) + 1;
-        let t = (period as u64) << 32;
-        critical_section::with(|cs| {
-            for i in 0..ALARM_COUNT {
-                let alarm = &self.alarms.borrow(cs)[i];
-                let at = alarm.timestamp.get();
-                let alarm_tim = alarm_tim(0);
-                if at < t {
-                    self.trigger_alarm(i, cs);
-                } else {
-                    let remaining_ticks = (at - t) * *SCALE.get().unwrap();
-                    if remaining_ticks <= u32::MAX as u64 {
-                        alarm_tim.enable().write(|w| unsafe { w.bits(0) });
-                        alarm_tim
-                            .cnt_value()
-                            .write(|w| unsafe { w.bits(remaining_ticks as u32) });
-                        alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
-                        alarm_tim.enable().write(|w| unsafe { w.bits(1) })
-                    }
-                }
-            }
-        })
-    }
-
-    fn get_alarm<'a>(&'a self, cs: CriticalSection<'a>, alarm: AlarmHandle) -> &'a AlarmState {
-        // safety: we're allowed to assume the AlarmState is created by us, and
-        // we never create one that's out of bounds.
-        unsafe { self.alarms.borrow(cs).get_unchecked(alarm.id() as usize) }
-    }
-
-    fn trigger_alarm(&self, n: usize, cs: CriticalSection) {
-        alarm_tim(n).ctrl().modify(|_, w| {
-            w.irq_enb().clear_bit();
-            w.enable().clear_bit()
-        });
-
-        let alarm = &self.alarms.borrow(cs)[n];
-        // Setting the maximum value disables the alarm.
-        alarm.timestamp.set(u64::MAX);
-
-        // Call after clearing alarm, so the callback can set another alarm.
-
-        // safety:
-        // - we can ignore the possiblity of `f` being unset (null) because of the safety contract of `allocate_alarm`.
-        // - other than that we only store valid function pointers into alarm.callback
-        let f: fn(*mut ()) = unsafe { mem::transmute(alarm.callback.get()) };
-        f(alarm.ctx.get());
-    }
-}
-
-impl Driver for TimerDriverEmbassy {
-    fn now(&self) -> u64 {
-        if SCALE.get().is_none() {
-            return 0;
-        }
-        let mut period1: u32;
-        let mut period2: u32;
-        let mut counter_val: u32;
-
-        loop {
-            // Acquire ensures that we get the latest value of `periods` and
-            // no instructions can be reordered before the load.
-            period1 = self.periods.load(Ordering::Acquire);
-
-            counter_val = u32::MAX - timekeeping_tim().cnt_value().read().bits();
-
-            // Double read to protect against race conditions when the counter is overflowing.
-            period2 = self.periods.load(Ordering::Relaxed);
-            if period1 == period2 {
-                let now = (((period1 as u64) << 32) | counter_val as u64) / *SCALE.get().unwrap();
-                return now;
-            }
-        }
-    }
-
-    unsafe fn allocate_alarm(&self) -> Option<AlarmHandle> {
-        let id = self
-            .alarm_count
-            .fetch_update(Ordering::AcqRel, Ordering::Acquire, |x| {
-                if x < ALARM_COUNT as u8 {
-                    Some(x + 1)
-                } else {
-                    None
-                }
-            });
-
-        match id {
-            Ok(id) => Some(AlarmHandle::new(id)),
-            Err(_) => None,
-        }
-    }
-
-    fn set_alarm_callback(
-        &self,
-        alarm: embassy_time_driver::AlarmHandle,
-        callback: fn(*mut ()),
-        ctx: *mut (),
-    ) {
-        critical_section::with(|cs| {
-            let alarm = self.get_alarm(cs, alarm);
-
-            alarm.callback.set(callback as *const ());
-            alarm.ctx.set(ctx);
-        })
-    }
-
-    fn set_alarm(&self, alarm: embassy_time_driver::AlarmHandle, timestamp: u64) -> bool {
-        if SCALE.get().is_none() {
-            return false;
-        }
-        critical_section::with(|cs| {
-            let n = alarm.id();
-            let alarm_tim = alarm_tim(n.into());
-            alarm_tim.ctrl().modify(|_, w| {
-                w.irq_enb().clear_bit();
-                w.enable().clear_bit()
-            });
-
-            let alarm = self.get_alarm(cs, alarm);
-            alarm.timestamp.set(timestamp);
-
-            let t = self.now();
-            if timestamp <= t {
-                alarm.timestamp.set(u64::MAX);
-                return false;
-            }
-
-            // If it hasn't triggered yet, setup the relevant reset value, regardless of whether
-            // the interrupts are enabled or not. When they are enabled at a later point, the
-            // right value is already set.
-
-            // If the timestamp is in the next few ticks, add a bit of buffer to be sure the alarm
-            // is not missed.
-            //
-            // This means that an alarm can be delayed for up to 2 ticks (from t+1 to t+3), but this is allowed
-            // by the Alarm trait contract. What's not allowed is triggering alarms *before* their scheduled time,
-            // and we don't do that here.
-            let safe_timestamp = timestamp.max(t + 3);
-            let timer_ticks = (safe_timestamp - t) * *SCALE.get().unwrap();
-            alarm_tim.rst_value().write(|w| unsafe { w.bits(u32::MAX) });
-            if timer_ticks <= u32::MAX as u64 {
-                alarm_tim
-                    .cnt_value()
-                    .write(|w| unsafe { w.bits(timer_ticks as u32) });
-                alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
-                alarm_tim.enable().write(|w| unsafe { w.bits(1) });
-            }
-            // If it's too far in the future, don't enable timer yet.
-            // It will be enabled later by `next_period`.
-
-            true
-        })
-    }
-}
-
-time_driver_impl!(
-    static DRIVER: TimerDriverEmbassy = TimerDriverEmbassy {
-        periods: AtomicU32::new(0),
-        alarm_count: AtomicU8::new(0),
-        alarms: Mutex::const_new(CriticalSectionRawMutex::new(), [AlarmState::new(); ALARM_COUNT])
-});
-
-#[interrupt]
-#[allow(non_snake_case)]
-fn TIM15() {
-    DRIVER.on_interrupt_timekeeping()
-}
-
-#[interrupt]
-#[allow(non_snake_case)]
-fn TIM14() {
-    DRIVER.on_interrupt_alarm(0)
-}

flashloader/Cargo.toml

@@ -15,6 +15,7 @@ rtt-log = "0.3"
 log = "0.4"
 crc = "3"
 rtic-sync = "1"
+static_cell = "2"
 
 [dependencies.satrs]
 version = "0.2"

flashloader/src/main.rs

@@ -52,11 +52,11 @@ impl WdtInterface for OptWdt {
     }
 }
 
-use once_cell::sync::Lazy;
 use ringbuf::{
     traits::{Consumer, Observer, Producer, SplitRef},
     CachingCons, StaticProd, StaticRb,
 };
+use static_cell::StaticCell;
 
 // Larger buffer for TC to be able to hold the possibly large memory write packets.
 const BUF_RB_SIZE_TC: usize = 2048;
@@ -66,16 +66,12 @@ const BUF_RB_SIZE_TM: usize = 512;
 const SIZES_RB_SIZE_TM: usize = 16;
 
 // Ring buffers to handling variable sized telemetry
-static mut BUF_RB_TM: Lazy<StaticRb<u8, BUF_RB_SIZE_TM>> =
+static BUF_RB_TM: StaticCell<StaticRb<u8, BUF_RB_SIZE_TM>> = StaticCell::new();
-    Lazy::new(StaticRb::<u8, BUF_RB_SIZE_TM>::default);
+static SIZES_RB_TM: StaticCell<StaticRb<usize, SIZES_RB_SIZE_TM>> = StaticCell::new();
-static mut SIZES_RB_TM: Lazy<StaticRb<usize, SIZES_RB_SIZE_TM>> =
-    Lazy::new(StaticRb::<usize, SIZES_RB_SIZE_TM>::default);
 
 // Ring buffers to handling variable sized telecommands
-static mut BUF_RB_TC: Lazy<StaticRb<u8, BUF_RB_SIZE_TC>> =
+static BUF_RB_TC: StaticCell<StaticRb<u8, BUF_RB_SIZE_TC>> = StaticCell::new();
-    Lazy::new(StaticRb::<u8, BUF_RB_SIZE_TC>::default);
+static SIZES_RB_TC: StaticCell<StaticRb<usize, SIZES_RB_SIZE_TC>> = StaticCell::new();
-static mut SIZES_RB_TC: Lazy<StaticRb<usize, SIZES_RB_SIZE_TC>> =
-    Lazy::new(StaticRb::<usize, SIZES_RB_SIZE_TC>::default);
 
 pub struct DataProducer<const BUF_SIZE: usize, const SIZES_LEN: usize> {
     pub buf_prod: StaticProd<'static, u8, BUF_SIZE>,
@@ -166,6 +162,7 @@ mod app {
             .xtal_n_clk_with_src_freq(Hertz::from_raw(EXTCLK_FREQ))
             .freeze(&mut cx.device.sysconfig)
             .unwrap();
+
         enable_and_init_irq_router(&mut cx.device.sysconfig, &cx.device.irq_router);
         setup_edac(&mut cx.device.sysconfig);
 
@@ -184,11 +181,19 @@ mod app {
 
         let verif_reporter = VerificationReportCreator::new(0).unwrap();
 
-        let (buf_prod_tm, buf_cons_tm) = unsafe { BUF_RB_TM.split_ref() };
+        let (buf_prod_tm, buf_cons_tm) = BUF_RB_TM
-        let (sizes_prod_tm, sizes_cons_tm) = unsafe { SIZES_RB_TM.split_ref() };
+            .init(StaticRb::<u8, BUF_RB_SIZE_TM>::default())
+            .split_ref();
+        let (sizes_prod_tm, sizes_cons_tm) = SIZES_RB_TM
+            .init(StaticRb::<usize, SIZES_RB_SIZE_TM>::default())
+            .split_ref();
 
-        let (buf_prod_tc, buf_cons_tc) = unsafe { BUF_RB_TC.split_ref() };
+        let (buf_prod_tc, buf_cons_tc) = BUF_RB_TC
-        let (sizes_prod_tc, sizes_cons_tc) = unsafe { SIZES_RB_TC.split_ref() };
+            .init(StaticRb::<u8, BUF_RB_SIZE_TC>::default())
+            .split_ref();
+        let (sizes_prod_tc, sizes_cons_tc) = SIZES_RB_TC
+            .init(StaticRb::<usize, SIZES_RB_SIZE_TC>::default())
+            .split_ref();
 
         Mono::start(cx.core.SYST, clocks.sysclk().raw());
         CLOCKS.set(clocks).unwrap();

jlink/jlink.gdb

@@ -1,6 +1,6 @@
 target remote localhost:2331
 
-monitor halt
+monitor reset
 
 # *try* to stop at the user entry point (it might be gone due to inlining)
 break main

va416xx-embassy/CHANGELOG.md

@@ -0,0 +1,13 @@
+Change Log
+=======
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](http://keepachangelog.com/)
+and this project adheres to [Semantic Versioning](http://semver.org/).
+
+## [unreleased]
+
+## [v0.1.0] 2025-02-13
+
+Initial release

va416xx-embassy/Cargo.toml

@@ -0,0 +1,37 @@
+[package]
+name = "va416xx-embassy"
+version = "0.1.0"
+edition = "2021"
+authors = ["Robin Mueller <muellerr@irs.uni-stuttgart.de>"]
+description = "Embassy-rs support for the Vorago VA416xx family of microcontrollers"
+homepage = "https://egit.irs.uni-stuttgart.de/rust/va416xx-rs"
+repository = "https://egit.irs.uni-stuttgart.de/rust/va416xx-rs"
+license = "Apache-2.0"
+keywords = ["no-std", "hal", "cortex-m", "vorago", "va416xx"]
+categories = ["aerospace", "embedded", "no-std", "hardware-support"]
+
+[dependencies]
+critical-section = "1"
+
+embassy-sync = "0.6"
+embassy-executor = "0.7"
+embassy-time-driver = "0.2"
+embassy-time-queue-utils = "0.1"
+portable-atomic = "1"
+
+once_cell = { version = "1", default-features = false, features = ["critical-section"] }
+
+va416xx-hal = { version = "0.3", path = "../va416xx-hal" }
+
+[features]
+default = ["irq-tim14-tim15"]
+irqs-in-lib = []
+# This determines the reserved interrupt functions for the embassy time drivers. Only one
+# is allowed to be selected!
+irq-tim14-tim15 = ["irqs-in-lib"]
+irq-tim13-tim14 = ["irqs-in-lib"]
+# These TIMs are clocked slower!
+irq-tim22-tim23 = ["irqs-in-lib"]
+
+[package.metadata.docs.rs]
+rustdoc-args = ["--generate-link-to-definition"]

va416xx-embassy/README.md

@@ -0,0 +1,10 @@
+[![Crates.io](https://img.shields.io/crates/v/va416xx-embassy)](https://crates.io/crates/va416xx-embassy)
+[![docs.rs](https://img.shields.io/docsrs/va416xx-embassy)](https://docs.rs/va416xx-embassy)
+
+# Embassy-rs support for the Vorago VA416xx MCU family
+
+This repository contains the [embassy-rs](https://github.com/embassy-rs/embassy) support for the
+VA416xx family. Currently, it contains the time driver to allow using embassy-rs. It uses the TIM
+peripherals provided by the VA416xx family for this purpose.
+
+The documentation contains more information on how to use this crate.

va416xx-embassy/docs.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+export RUSTDOCFLAGS="--cfg docsrs --generate-link-to-definition -Z unstable-options"
+cargo +nightly doc --open

va416xx-embassy/src/lib.rs

@@ -0,0 +1,398 @@
+//! # Embassy-rs support for the Vorago VA416xx MCU family
+//!
+//! This repository contains the [embassy-rs](https://github.com/embassy-rs/embassy) support for the
+//! VA416xx family. Currently, it contains the time driver to allow using embassy-rs. It uses the TIM
+//! peripherals provided by the VA416xx family for this purpose.
+//!
+//! ## Usage
+//!
+//! This library only exposes the [embassy::init] method which sets up the time driver. This
+//! function must be called once at the start of the application.
+//!
+//! This implementation requires two TIM peripherals provided by the VA108xx device.
+//! The user can freely specify the two used TIM peripheral by passing the concrete TIM instances
+//! into the [init] method. If the interrupt handlers are provided by the library, the ID of the
+//! used TIM peripherals has to match the ID of the passed timer peripherals. Currently, this
+//! can only be checked at run-time, and a run-time assertion will panic on the embassy
+//! initialization in case of a missmatch.
+//!
+//! The application also requires two interrupt handlers to handle the timekeeper and alarm
+//! interrupts. By default, this library will define the interrupt handler inside the library
+//! itself by using the `irq-tim14-tim15` feature flag. This library exposes three combinations:
+//!
+//! - `irq-tim14-tim15`: Uses [pac::Interrupt::TIM14] for alarm and [pac::Interrupt::TIM15]
+//!    for timekeeper
+//! - `irq-tim13-tim14`: Uses [pac::Interrupt::TIM13] for alarm and [pac::Interrupt::TIM14]
+//!    for timekeeper
+//! - `irq-tim22-tim23`: Uses [pac::Interrupt::TIM22] for alarm and [pac::Interrupt::TIM23]
+//!    for timekeeper
+//!
+//! You can disable the default features and then specify one of the features above to use the
+//! documented combination of IRQs. It is also possible to specify custom IRQs by importing and
+//! using the [embassy_time_driver_irqs] macro to declare the IRQ handlers in the
+//! application code. If this is done, [embassy::init_with_custom_irqs] must be used
+//! method to pass the IRQ numbers to the library.
+//!
+//! ## Examples
+//!
+//! [embassy example projects](https://egit.irs.uni-stuttgart.de/rust/va108xx-rs/src/branch/main/examples/embassy)
+#![no_std]
+#![cfg_attr(docsrs, feature(doc_auto_cfg))]
+use core::{
+    cell::{Cell, RefCell},
+    sync::atomic::{AtomicU32, Ordering},
+};
+
+use critical_section::{CriticalSection, Mutex};
+
+use embassy_time_driver::{time_driver_impl, Driver, TICK_HZ};
+use embassy_time_queue_utils::Queue;
+use once_cell::sync::OnceCell;
+use va416xx_hal::{
+    clock::Clocks,
+    enable_interrupt,
+    irq_router::enable_and_init_irq_router,
+    pac::{self, interrupt},
+    pwm::ValidTim,
+    timer::{
+        assert_tim_reset_for_two_cycles, enable_tim_clk, get_tim_raw, TimRegInterface,
+        TIM_IRQ_OFFSET,
+    },
+};
+
+time_driver_impl!(
+    static TIME_DRIVER: TimerDriver = TimerDriver {
+        periods: AtomicU32::new(0),
+        alarms: Mutex::new(AlarmState::new()),
+        queue: Mutex::new(RefCell::new(Queue::new())),
+});
+
+/// Macro to define the IRQ handlers for the time driver.
+///
+/// By default, the code generated by this macro will be defined inside the library depending on
+/// the feature flags specified. However, the macro is exported to allow users to specify the
+/// interrupt handlers themselves.
+///
+/// Please note that you have to explicitely import the [macro@va108xx_hal::pac::interrupt]
+/// macro in the application code in case this macro is used there.
+#[macro_export]
+macro_rules! embassy_time_driver_irqs {
+    (
+        timekeeper_irq = $timekeeper_irq:ident,
+        alarm_irq = $alarm_irq:ident
+    ) => {
+        const TIMEKEEPER_IRQ: pac::Interrupt = pac::Interrupt::$timekeeper_irq;
+
+        #[interrupt]
+        #[allow(non_snake_case)]
+        fn $timekeeper_irq() {
+            // Safety: We call it once here.
+            unsafe { $crate::time_driver().on_interrupt_timekeeping() }
+        }
+
+        const ALARM_IRQ: pac::Interrupt = pac::Interrupt::$alarm_irq;
+
+        #[interrupt]
+        #[allow(non_snake_case)]
+        fn $alarm_irq() {
+            // Safety: We call it once here.
+            unsafe { $crate::time_driver().on_interrupt_alarm() }
+        }
+    };
+}
+
+// Provide three combinations of IRQs for the time driver by default.
+
+#[cfg(feature = "irq-tim14-tim15")]
+embassy_time_driver_irqs!(timekeeper_irq = TIM15, alarm_irq = TIM14);
+#[cfg(feature = "irq-tim13-tim14")]
+embassy_time_driver_irqs!(timekeeper_irq = TIM14, alarm_irq = TIM13);
+#[cfg(feature = "irq-tim22-tim23")]
+embassy_time_driver_irqs!(timekeeper_irq = TIM23, alarm_irq = TIM22);
+
+/// Expose the time driver so the user can specify the IRQ handlers themselves.
+pub fn time_driver() -> &'static TimerDriver {
+    &TIME_DRIVER
+}
+
+/// Initialization method for embassy
+///
+/// If the interrupt handlers are provided by the library, the ID of the
+/// used TIM peripherals has to match the ID of the passed timer peripherals. Currently, this
+/// can only be checked at run-time, and a run-time assertion will panic on the embassy
+/// initialization in case of a missmatch.
+///
+/// # Safety
+///
+/// This has to be called once at initialization time to initiate the time driver for
+/// embassy.
+pub unsafe fn init<
+    TimekeeperTim: TimRegInterface + ValidTim,
+    AlarmTim: TimRegInterface + ValidTim,
+>(
+    syscfg: &mut pac::Sysconfig,
+    irq_router: &pac::IrqRouter,
+    timekeeper: TimekeeperTim,
+    alarm: AlarmTim,
+    clocks: &Clocks,
+) {
+    #[cfg(feature = "irqs-in-lib")]
+    assert_eq!(
+        TimekeeperTim::ID,
+        TIMEKEEPER_IRQ as u8 - TIM_IRQ_OFFSET as u8,
+        "Timekeeper TIM and IRQ missmatch"
+    );
+    #[cfg(feature = "irqs-in-lib")]
+    assert_eq!(
+        AlarmTim::ID,
+        ALARM_IRQ as u8 - TIM_IRQ_OFFSET as u8,
+        "Alarm TIM and IRQ missmatch"
+    );
+    enable_and_init_irq_router(syscfg, irq_router);
+    TIME_DRIVER.init(syscfg, timekeeper, alarm, clocks)
+}
+
+struct AlarmState {
+    timestamp: Cell<u64>,
+}
+
+impl AlarmState {
+    const fn new() -> Self {
+        Self {
+            timestamp: Cell::new(u64::MAX),
+        }
+    }
+}
+
+unsafe impl Send for AlarmState {}
+
+static SCALE: OnceCell<u64> = OnceCell::new();
+static TIMEKEEPER_TIM: OnceCell<u8> = OnceCell::new();
+static ALARM_TIM: OnceCell<u8> = OnceCell::new();
+
+pub struct TimerDriver {
+    periods: AtomicU32,
+    /// Timestamp at which to fire alarm. u64::MAX if no alarm is scheduled.
+    alarms: Mutex<AlarmState>,
+    queue: Mutex<RefCell<Queue>>,
+}
+
+impl TimerDriver {
+    fn init<TimekeeperTim: TimRegInterface + ValidTim, AlarmTim: TimRegInterface + ValidTim>(
+        &self,
+        syscfg: &mut pac::Sysconfig,
+        timekeeper_tim: TimekeeperTim,
+        alarm_tim: AlarmTim,
+        clocks: &Clocks,
+    ) {
+        if ALARM_TIM.get().is_some() || TIMEKEEPER_TIM.get().is_some() {
+            return;
+        }
+        ALARM_TIM.set(alarm_tim.tim_id()).ok();
+        TIMEKEEPER_TIM.set(timekeeper_tim.tim_id()).ok();
+        enable_tim_clk(syscfg, timekeeper_tim.tim_id());
+        assert_tim_reset_for_two_cycles(syscfg, alarm_tim.tim_id());
+
+        // Initiate scale value here. This is required to convert timer ticks back to a timestamp.
+        SCALE
+            .set((TimekeeperTim::clock(clocks).raw() / TICK_HZ as u32) as u64)
+            .unwrap();
+        let timekeeper_tim_regs = timekeeper_tim.reg_block();
+        timekeeper_tim_regs
+            .rst_value()
+            .write(|w| unsafe { w.bits(u32::MAX) });
+        // Decrementing counter.
+        timekeeper_tim_regs
+            .cnt_value()
+            .write(|w| unsafe { w.bits(u32::MAX) });
+        // Switch on. Timekeeping should always be done.
+        unsafe {
+            enable_interrupt(TimekeeperTim::IRQ);
+        }
+        timekeeper_tim_regs
+            .ctrl()
+            .modify(|_, w| w.irq_enb().set_bit());
+        timekeeper_tim_regs.enable().write(|w| unsafe { w.bits(1) });
+
+        enable_tim_clk(syscfg, AlarmTim::ID);
+        assert_tim_reset_for_two_cycles(syscfg, AlarmTim::ID);
+        let alarm_tim_regs = alarm_tim.reg_block();
+        // Explicitely disable alarm timer until needed.
+        alarm_tim_regs.ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+        // Enable general interrupts. The IRQ enable of the peripheral remains cleared.
+        unsafe {
+            enable_interrupt(AlarmTim::IRQ);
+        }
+    }
+
+    fn timekeeper_tim() -> &'static pac::tim0::RegisterBlock {
+        TIMEKEEPER_TIM
+            .get()
+            .map(|idx| unsafe { get_tim_raw(*idx as usize) })
+            .unwrap()
+    }
+    fn alarm_tim() -> &'static pac::tim0::RegisterBlock {
+        ALARM_TIM
+            .get()
+            .map(|idx| unsafe { get_tim_raw(*idx as usize) })
+            .unwrap()
+    }
+
+    /// Should be called inside the IRQ of the timekeeper timer.
+    ///
+    /// # Safety
+    ///
+    /// This function has to be called once by the TIM IRQ used for the timekeeping.
+    pub unsafe fn on_interrupt_timekeeping(&self) {
+        self.next_period();
+    }
+
+    /// Should be called inside the IRQ of the alarm timer.
+    ///
+    /// # Safety
+    ///
+    ///This function has to be called once by the TIM IRQ used for the timekeeping.
+    pub unsafe fn on_interrupt_alarm(&self) {
+        critical_section::with(|cs| {
+            if self.alarms.borrow(cs).timestamp.get() <= self.now() {
+                self.trigger_alarm(cs)
+            }
+        })
+    }
+
+    fn next_period(&self) {
+        let period = self.periods.fetch_add(1, Ordering::AcqRel) + 1;
+        let t = (period as u64) << 32;
+        critical_section::with(|cs| {
+            let alarm = &self.alarms.borrow(cs);
+            let at = alarm.timestamp.get();
+            if at < t {
+                self.trigger_alarm(cs);
+            } else {
+                let alarm_tim = Self::alarm_tim();
+
+                let remaining_ticks = (at - t) * *SCALE.get().unwrap();
+                if remaining_ticks <= u32::MAX as u64 {
+                    alarm_tim.enable().write(|w| unsafe { w.bits(0) });
+                    alarm_tim
+                        .cnt_value()
+                        .write(|w| unsafe { w.bits(remaining_ticks as u32) });
+                    alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
+                    alarm_tim.enable().write(|w| unsafe { w.bits(1) });
+                }
+            }
+        })
+    }
+
+    fn trigger_alarm(&self, cs: CriticalSection) {
+        Self::alarm_tim().ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+
+        let alarm = &self.alarms.borrow(cs);
+        // Setting the maximum value disables the alarm.
+        alarm.timestamp.set(u64::MAX);
+
+        // Call after clearing alarm, so the callback can set another alarm.
+        let mut next = self
+            .queue
+            .borrow(cs)
+            .borrow_mut()
+            .next_expiration(self.now());
+        while !self.set_alarm(cs, next) {
+            next = self
+                .queue
+                .borrow(cs)
+                .borrow_mut()
+                .next_expiration(self.now());
+        }
+    }
+
+    fn set_alarm(&self, cs: CriticalSection, timestamp: u64) -> bool {
+        if SCALE.get().is_none() {
+            return false;
+        }
+        let alarm_tim = Self::alarm_tim();
+        alarm_tim.ctrl().modify(|_, w| {
+            w.irq_enb().clear_bit();
+            w.enable().clear_bit()
+        });
+
+        let alarm = self.alarms.borrow(cs);
+        alarm.timestamp.set(timestamp);
+
+        let t = self.now();
+        if timestamp <= t {
+            alarm.timestamp.set(u64::MAX);
+            return false;
+        }
+
+        // If it hasn't triggered yet, setup the relevant reset value, regardless of whether
+        // the interrupts are enabled or not. When they are enabled at a later point, the
+        // right value is already set.
+
+        // If the timestamp is in the next few ticks, add a bit of buffer to be sure the alarm
+        // is not missed.
+        //
+        // This means that an alarm can be delayed for up to 2 ticks (from t+1 to t+3), but this is allowed
+        // by the Alarm trait contract. What's not allowed is triggering alarms *before* their scheduled time,
+        // and we don't do that here.
+        let safe_timestamp = timestamp.max(t + 3);
+        let timer_ticks = (safe_timestamp - t).checked_mul(*SCALE.get().unwrap());
+        alarm_tim.rst_value().write(|w| unsafe { w.bits(u32::MAX) });
+        if timer_ticks.is_some_and(|v| v <= u32::MAX as u64) {
+            alarm_tim
+                .cnt_value()
+                .write(|w| unsafe { w.bits(timer_ticks.unwrap() as u32) });
+            alarm_tim.ctrl().modify(|_, w| w.irq_enb().set_bit());
+            alarm_tim.enable().write(|w| unsafe { w.bits(1) });
+        }
+        // If it's too far in the future, don't enable timer yet.
+        // It will be enabled later by `next_period`.
+
+        true
+    }
+}
+
+impl Driver for TimerDriver {
+    fn now(&self) -> u64 {
+        if SCALE.get().is_none() {
+            return 0;
+        }
+        let mut period1: u32;
+        let mut period2: u32;
+        let mut counter_val: u32;
+
+        loop {
+            // Acquire ensures that we get the latest value of `periods` and
+            // no instructions can be reordered before the load.
+            period1 = self.periods.load(Ordering::Acquire);
+
+            counter_val = u32::MAX - Self::timekeeper_tim().cnt_value().read().bits();
+
+            // Double read to protect against race conditions when the counter is overflowing.
+            period2 = self.periods.load(Ordering::Relaxed);
+            if period1 == period2 {
+                let now = (((period1 as u64) << 32) | counter_val as u64) / *SCALE.get().unwrap();
+                return now;
+            }
+        }
+    }
+
+    fn schedule_wake(&self, at: u64, waker: &core::task::Waker) {
+        critical_section::with(|cs| {
+            let mut queue = self.queue.borrow(cs).borrow_mut();
+
+            if queue.schedule_wake(at, waker) {
+                let mut next = queue.next_expiration(self.now());
+                while !self.set_alarm(cs, next) {
+                    next = queue.next_expiration(self.now());
+                }
+            }
+        })
+    }
+}

va416xx-hal/Cargo.toml

@@ -25,14 +25,11 @@ bitfield = "0.17"
 defmt = { version = "0.3", optional = true }
 fugit = "0.3"
 delegate = "0.12"
-
+void = { version = "1", default-features = false }
-[dependencies.void]
-version = "1"
-default-features = false
 
 [dependencies.va416xx]
 default-features = false
-version = "0.2"
+version = "0.3"
 features = ["critical-section"]
 
 [features]

va416xx-hal/src/clock.rs

@@ -431,7 +431,9 @@ impl ClkgenCfgr {
                     }
                 }
             }
-            None => self.clkgen.ctrl0().modify(|_, w| w.pll_pwdn().set_bit()),
+            None => {
+                self.clkgen.ctrl0().modify(|_, w| w.pll_pwdn().set_bit());
+            }
         }
 
         if self.clk_lost_detection {

va416xx-hal/src/edac.rs

@@ -4,21 +4,21 @@ use crate::{enable_interrupt, pac};
 pub fn enable_rom_scrub(syscfg: &mut pac::Sysconfig, counter_reset: u16) {
     syscfg
         .rom_scrub()
-        .write(|w| unsafe { w.bits(counter_reset as u32) })
+        .write(|w| unsafe { w.bits(counter_reset as u32) });
 }
 
 #[inline(always)]
 pub fn enable_ram0_scrub(syscfg: &mut pac::Sysconfig, counter_reset: u16) {
     syscfg
         .ram0_scrub()
-        .write(|w| unsafe { w.bits(counter_reset as u32) })
+        .write(|w| unsafe { w.bits(counter_reset as u32) });
 }
 
 #[inline(always)]
 pub fn enable_ram1_scrub(syscfg: &mut pac::Sysconfig, counter_reset: u16) {
     syscfg
         .ram1_scrub()
-        .write(|w| unsafe { w.bits(counter_reset as u32) })
+        .write(|w| unsafe { w.bits(counter_reset as u32) });
 }
 
 /// This function enables the SBE related interrupts. The user should also provide a

va416xx-hal/src/gpio/pin.rs

@@ -321,7 +321,6 @@ macro_rules! pin_id {
 //==================================================================================================
 
 /// A type-level GPIO pin, parameterized by [`PinId`] and [`PinMode`] types
-
 pub struct Pin<I: PinId, M: PinMode> {
     pub(in crate::gpio) regs: Registers<I>,
     mode: PhantomData<M>,

va416xx-hal/src/gpio/reg.rs

@@ -308,7 +308,7 @@ pub(super) unsafe trait RegisterInterface {
         unsafe {
             portreg
                 .datamask()
-                .modify(|r, w| w.bits(r.bits() | self.mask_32()))
+                .modify(|r, w| w.bits(r.bits() | self.mask_32()));
         }
     }
 
@@ -320,7 +320,7 @@ pub(super) unsafe trait RegisterInterface {
         unsafe {
             portreg
                 .datamask()
-                .modify(|r, w| w.bits(r.bits() & !self.mask_32()))
+                .modify(|r, w| w.bits(r.bits() & !self.mask_32()));
         }
     }
 

va416xx-hal/src/i2c.rs

@@ -396,12 +396,12 @@ impl<I2c: Instance> I2cBase<I2c> {
             let (addr, addr_mode_mask) = Self::unwrap_addr(addr_b);
             self.i2c
                 .s0_addressb()
-                .write(|w| unsafe { w.bits((addr << 1) as u32 | addr_mode_mask) })
+                .write(|w| unsafe { w.bits((addr << 1) as u32 | addr_mode_mask) });
         }
         if let Some(addr_b_mask) = sl_cfg.addr_b_mask {
             self.i2c
                 .s0_addressmaskb()
-                .write(|w| unsafe { w.bits((addr_b_mask << 1) as u32) })
+                .write(|w| unsafe { w.bits((addr_b_mask << 1) as u32) });
         }
     }
 

va416xx-hal/src/nvm.rs

@@ -136,14 +136,14 @@ impl Nvm {
 
     #[inline(always)]
     pub fn write_single(&self, word: u8) {
-        self.spi().data().write(|w| unsafe { w.bits(word as u32) })
+        self.spi().data().write(|w| unsafe { w.bits(word as u32) });
     }
 
     #[inline(always)]
     pub fn write_with_bmstop(&self, word: u8) {
         self.spi()
             .data()
-            .write(|w| unsafe { w.bits(BMSTART_BMSTOP_MASK | word as u32) })
+            .write(|w| unsafe { w.bits(BMSTART_BMSTOP_MASK | word as u32) });
     }
 
     #[inline(always)]
@@ -162,7 +162,7 @@ impl Nvm {
         self.spi().fifo_clr().write(|w| {
             w.rxfifo().set_bit();
             w.txfifo().set_bit()
-        })
+        });
     }
 
     #[inline(always)]

va416xx-hal/src/pwm.rs

@@ -43,7 +43,7 @@ macro_rules! pwm_common_func {
         #[inline]
         fn enable_pwm_a(&mut self) {
             self.reg
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmA as u8) });
         }
@@ -51,7 +51,7 @@ macro_rules! pwm_common_func {
         #[inline]
         fn enable_pwm_b(&mut self) {
             self.reg
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| unsafe { w.status_sel().bits(StatusSelPwm::PwmB as u8) });
         }
@@ -71,19 +71,25 @@ macro_rules! pwm_common_func {
             self.pwm_base.current_rst_val =
                 self.pwm_base.clock.raw() / self.pwm_base.current_period.raw();
             self.reg
-                .reg()
+                .reg_block()
                 .rst_value()
                 .write(|w| unsafe { w.bits(self.pwm_base.current_rst_val) });
         }
 
         #[inline]
         pub fn disable(&mut self) {
-            self.reg.reg().ctrl().modify(|_, w| w.enable().clear_bit());
+            self.reg
+                .reg_block()
+                .ctrl()
+                .modify(|_, w| w.enable().clear_bit());
         }
 
         #[inline]
         pub fn enable(&mut self) {
-            self.reg.reg().ctrl().modify(|_, w| w.enable().set_bit());
+            self.reg
+                .reg_block()
+                .ctrl()
+                .modify(|_, w| w.enable().set_bit());
         }
 
         #[inline]
@@ -120,7 +126,7 @@ macro_rules! pwmb_func {
                 * self.pwm_base.current_lower_limit as u64)
                 / DUTY_MAX as u64;
             self.reg
-                .reg()
+                .reg_block()
                 .pwmb_value()
                 .write(|w| unsafe { w.bits(pwmb_val as u32) });
         }
@@ -137,7 +143,7 @@ macro_rules! pwmb_func {
                 * self.pwm_base.current_duty as u64)
                 / DUTY_MAX as u64;
             self.reg
-                .reg()
+                .reg_block()
                 .pwma_value()
                 .write(|w| unsafe { w.bits(pwma_val as u32) });
         }
@@ -348,7 +354,7 @@ impl embedded_hal::pwm::SetDutyCycle for ReducedPwmPin {
             * (DUTY_MAX as u64 - self.pwm_base.current_duty as u64))
             / DUTY_MAX as u64;
         self.reg
-            .reg()
+            .reg_block()
             .pwma_value()
             .write(|w| unsafe { w.bits(pwma_val as u32) });
         Ok(())
@@ -368,7 +374,7 @@ impl<Pin: TimPin, Tim: ValidTim> embedded_hal::pwm::SetDutyCycle for PwmPin<Pin,
             * (DUTY_MAX as u64 - self.pwm_base.current_duty as u64))
             / DUTY_MAX as u64;
         self.reg
-            .reg()
+            .reg_block()
             .pwma_value()
             .write(|w| unsafe { w.bits(pwma_val as u32) });
         Ok(())

va416xx-hal/src/spi.rs

@@ -817,7 +817,7 @@ where
     // initialization. Returns the amount of written bytes.
     fn initial_send_fifo_pumping_with_words(&self, words: &[Word]) -> usize {
         if self.blockmode {
-            self.spi.ctrl1().modify(|_, w| w.mtxpause().set_bit())
+            self.spi.ctrl1().modify(|_, w| w.mtxpause().set_bit());
         }
         // Fill the first half of the write FIFO
         let mut current_write_idx = 0;
@@ -831,7 +831,7 @@ where
             current_write_idx += 1;
         }
         if self.blockmode {
-            self.spi.ctrl1().modify(|_, w| w.mtxpause().clear_bit())
+            self.spi.ctrl1().modify(|_, w| w.mtxpause().clear_bit());
         }
         current_write_idx
     }
@@ -840,7 +840,7 @@ where
     // initialization.
     fn initial_send_fifo_pumping_with_fill_words(&self, send_len: usize) -> usize {
         if self.blockmode {
-            self.spi.ctrl1().modify(|_, w| w.mtxpause().set_bit())
+            self.spi.ctrl1().modify(|_, w| w.mtxpause().set_bit());
         }
         // Fill the first half of the write FIFO
         let mut current_write_idx = 0;
@@ -854,7 +854,7 @@ where
             current_write_idx += 1;
         }
         if self.blockmode {
-            self.spi.ctrl1().modify(|_, w| w.mtxpause().clear_bit())
+            self.spi.ctrl1().modify(|_, w| w.mtxpause().clear_bit());
         }
         current_write_idx
     }

va416xx-hal/src/timer.rs

@@ -29,16 +29,54 @@ use crate::{enable_interrupt, pac};
 
 pub static MS_COUNTER: Mutex<Cell<u32>> = Mutex::new(Cell::new(0));
 
+pub const TIM_IRQ_OFFSET: usize = 48;
+
+/// Get the peripheral block of a TIM peripheral given the index.
+///
+/// This function panics if the given index is greater than 23.
+///
+/// # Safety
+///
+/// This returns a direct handle to the peripheral block, which allows to circumvent ownership
+/// rules for the peripheral block. You have to ensure that the retrieved peripheral block is not
+/// used by any other software component.
+#[inline(always)]
+pub const unsafe fn get_tim_raw(tim_idx: usize) -> &'static pac::tim0::RegisterBlock {
+    match tim_idx {
+        0 => unsafe { &*pac::Tim0::ptr() },
+        1 => unsafe { &*pac::Tim1::ptr() },
+        2 => unsafe { &*pac::Tim2::ptr() },
+        3 => unsafe { &*pac::Tim3::ptr() },
+        4 => unsafe { &*pac::Tim4::ptr() },
+        5 => unsafe { &*pac::Tim5::ptr() },
+        6 => unsafe { &*pac::Tim6::ptr() },
+        7 => unsafe { &*pac::Tim7::ptr() },
+        8 => unsafe { &*pac::Tim8::ptr() },
+        9 => unsafe { &*pac::Tim9::ptr() },
+        10 => unsafe { &*pac::Tim10::ptr() },
+        11 => unsafe { &*pac::Tim11::ptr() },
+        12 => unsafe { &*pac::Tim12::ptr() },
+        13 => unsafe { &*pac::Tim13::ptr() },
+        14 => unsafe { &*pac::Tim14::ptr() },
+        15 => unsafe { &*pac::Tim15::ptr() },
+        16 => unsafe { &*pac::Tim16::ptr() },
+        17 => unsafe { &*pac::Tim17::ptr() },
+        18 => unsafe { &*pac::Tim18::ptr() },
+        19 => unsafe { &*pac::Tim19::ptr() },
+        20 => unsafe { &*pac::Tim20::ptr() },
+        21 => unsafe { &*pac::Tim21::ptr() },
+        22 => unsafe { &*pac::Tim22::ptr() },
+        23 => unsafe { &*pac::Tim23::ptr() },
+        _ => {
+            panic!("invalid alarm timer index")
+        }
+    }
+}
+
 //==================================================================================================
 // Defintions
 //==================================================================================================
 
-/// Interrupt events
-//pub enum Event {
-/// Timer timed out / count down ended
-//TimeOut,
-//}
-
 #[derive(Default, Debug, PartialEq, Eq, Copy, Clone)]
 pub struct CascadeCtrl {
     /// Enable Cascade 0 signal active as a requirement for counting
@@ -143,11 +181,11 @@ pub trait TimPin {
 
 pub trait ValidTim {
     // TIM ID ranging from 0 to 23 for 24 TIM peripherals
-    const TIM_ID: u8;
+    const ID: u8;
     const IRQ: pac::Interrupt;
 
     fn clock(clocks: &Clocks) -> Hertz {
-        if Self::TIM_ID <= 15 {
+        if Self::ID <= 15 {
             clocks.apb1()
         } else {
             clocks.apb2()
@@ -163,7 +201,7 @@ macro_rules! tim_markers {
     ) => {
         $(
             impl ValidTim for $TimX {
-                const TIM_ID: u8 = $id;
+                const ID: u8 = $id;
                 const IRQ: pac::Interrupt = $Irq;
             }
         )+
@@ -171,7 +209,7 @@ macro_rules! tim_markers {
 }
 
 pub const fn const_clock<Tim: ValidTim + ?Sized>(_: &Tim, clocks: &Clocks) -> Hertz {
-    if Tim::TIM_ID <= 15 {
+    if Tim::ID <= 15 {
         clocks.apb1()
     } else {
         clocks.apb2()
@@ -340,14 +378,14 @@ valid_pin_and_tims!(
 pub fn assert_tim_reset(syscfg: &mut pac::Sysconfig, tim_id: u8) {
     syscfg
         .tim_reset()
-        .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << tim_id as u32)) })
+        .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << tim_id as u32)) });
 }
 
 #[inline]
 pub fn deassert_tim_reset(syscfg: &mut pac::Sysconfig, tim_id: u8) {
     syscfg
         .tim_reset()
-        .modify(|r, w| unsafe { w.bits(r.bits() | (1 << tim_id as u32)) })
+        .modify(|r, w| unsafe { w.bits(r.bits() | (1 << tim_id as u32)) });
 }
 
 #[inline]
@@ -371,7 +409,7 @@ pub type TimRegBlock = pac::tim0::RegisterBlock;
 /// implementations should be overridden. The implementing type must also have
 /// "control" over the corresponding pin ID, i.e. it must guarantee that a each
 /// pin ID is a singleton.
-pub(super) unsafe trait TimRegInterface {
+pub unsafe trait TimRegInterface {
     fn tim_id(&self) -> u8;
 
     const PORT_BASE: *const pac::tim0::RegisterBlock = pac::Tim0::ptr() as *const _;
@@ -379,7 +417,7 @@ pub(super) unsafe trait TimRegInterface {
     /// All 24 TIM blocks are identical. This helper functions returns the correct
     /// memory mapped peripheral depending on the TIM ID.
     #[inline(always)]
-    fn reg(&self) -> &TimRegBlock {
+    fn reg_block(&self) -> &TimRegBlock {
         unsafe { &*Self::PORT_BASE.offset(self.tim_id() as isize) }
     }
 
@@ -406,6 +444,12 @@ pub(super) unsafe trait TimRegInterface {
     }
 }
 
+unsafe impl<Tim: ValidTim> TimRegInterface for Tim {
+    fn tim_id(&self) -> u8 {
+        Tim::ID
+    }
+}
+
 /// Provide a safe register interface for [`ValidTimAndPin`]s
 ///
 /// This `struct` takes ownership of a [`ValidTimAndPin`] and provides an API to
@@ -433,7 +477,7 @@ impl<TIM: ValidTim> TimRegister<TIM> {
 unsafe impl<Tim: ValidTim> TimRegInterface for TimRegister<Tim> {
     #[inline(always)]
     fn tim_id(&self) -> u8 {
-        Tim::TIM_ID
+        Tim::ID
     }
 }
 
@@ -454,7 +498,7 @@ where
 unsafe impl<Pin: TimPin, Tim: ValidTim> TimRegInterface for TimAndPinRegister<Pin, Tim> {
     #[inline(always)]
     fn tim_id(&self) -> u8 {
-        Tim::TIM_ID
+        Tim::ID
     }
 }
 
@@ -467,7 +511,7 @@ pub(super) struct TimDynRegister {
 impl<Pin: TimPin, Tim: ValidTim> From<TimAndPinRegister<Pin, Tim>> for TimDynRegister {
     fn from(_reg: TimAndPinRegister<Pin, Tim>) -> Self {
         Self {
-            tim_id: Tim::TIM_ID,
+            tim_id: Tim::ID,
             pin_id: Pin::DYN,
         }
     }
@@ -504,10 +548,10 @@ pub fn enable_tim_clk(syscfg: &mut pac::Sysconfig, idx: u8) {
         .modify(|r, w| unsafe { w.bits(r.bits() | (1 << idx)) });
 }
 
-unsafe impl<TIM: ValidTim> TimRegInterface for CountdownTimer<TIM> {
+unsafe impl<Tim: ValidTim> TimRegInterface for CountdownTimer<Tim> {
     #[inline]
     fn tim_id(&self) -> u8 {
-        TIM::TIM_ID
+        Tim::ID
     }
 }
 
@@ -517,11 +561,11 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     /// You can use [Self::start] to start the countdown timer, and you may optionally call
     /// [Self::listen] to enable interrupts for the TIM peripheral as well.
     pub fn new(syscfg: &mut pac::Sysconfig, tim: Tim, clocks: &Clocks) -> Self {
-        enable_tim_clk(syscfg, Tim::TIM_ID);
+        enable_tim_clk(syscfg, Tim::ID);
-        assert_tim_reset(syscfg, Tim::TIM_ID);
+        assert_tim_reset(syscfg, Tim::ID);
         cortex_m::asm::nop();
         cortex_m::asm::nop();
-        deassert_tim_reset(syscfg, Tim::TIM_ID);
+        deassert_tim_reset(syscfg, Tim::ID);
 
         CountdownTimer {
             tim: unsafe { TimRegister::new(tim) },
@@ -551,7 +595,7 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     /// Return `Ok` if the timer has wrapped. Peripheral will automatically clear the
     /// flag and restart the time if configured correctly
     pub fn wait(&mut self) -> nb::Result<(), void::Void> {
-        let cnt = self.tim.reg().cnt_value().read().bits();
+        let cnt = self.tim.reg_block().cnt_value().read().bits();
         if (cnt > self.last_cnt) || cnt == 0 {
             self.last_cnt = self.rst_val;
             Ok(())
@@ -563,7 +607,10 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
 
     #[inline]
     pub fn stop(&mut self) {
-        self.tim.reg().ctrl().write(|w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .write(|w| w.enable().clear_bit());
     }
 
     #[inline]
@@ -575,26 +622,38 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
 
     #[inline(always)]
     pub fn enable_interrupt(&mut self) {
-        self.tim.reg().ctrl().modify(|_, w| w.irq_enb().set_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.irq_enb().set_bit());
     }
 
     #[inline(always)]
     pub fn disable_interrupt(&mut self) {
-        self.tim.reg().ctrl().modify(|_, w| w.irq_enb().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.irq_enb().clear_bit());
     }
 
     #[inline]
     pub fn release(self, syscfg: &mut pac::Sysconfig) -> Tim {
-        self.tim.reg().ctrl().write(|w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .write(|w| w.enable().clear_bit());
         syscfg
             .tim_clk_enable()
-            .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << Tim::TIM_ID)) });
+            .modify(|r, w| unsafe { w.bits(r.bits() & !(1 << Tim::ID)) });
         self.tim.release()
     }
 
     /// Load the count down timer with a timeout but do not start it.
     pub fn load(&mut self, timeout: impl Into<Hertz>) {
-        self.tim.reg().ctrl().modify(|_, w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.enable().clear_bit());
         self.curr_freq = timeout.into();
         self.rst_val = (self.clock.raw() / self.curr_freq.raw()) - 1;
         self.set_reload(self.rst_val);
@@ -604,27 +663,39 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
 
     #[inline(always)]
     pub fn set_reload(&mut self, val: u32) {
-        self.tim.reg().rst_value().write(|w| unsafe { w.bits(val) });
+        self.tim
+            .reg_block()
+            .rst_value()
+            .write(|w| unsafe { w.bits(val) });
     }
 
     #[inline(always)]
     pub fn set_count(&mut self, val: u32) {
-        self.tim.reg().cnt_value().write(|w| unsafe { w.bits(val) });
+        self.tim
+            .reg_block()
+            .cnt_value()
+            .write(|w| unsafe { w.bits(val) });
     }
 
     #[inline(always)]
     pub fn count(&self) -> u32 {
-        self.tim.reg().cnt_value().read().bits()
+        self.tim.reg_block().cnt_value().read().bits()
     }
 
     #[inline(always)]
     pub fn enable(&mut self) {
-        self.tim.reg().enable().write(|w| unsafe { w.bits(1) });
+        self.tim
+            .reg_block()
+            .enable()
+            .write(|w| unsafe { w.bits(1) });
     }
 
     #[inline(always)]
     pub fn disable(&mut self) {
-        self.tim.reg().ctrl().modify(|_, w| w.enable().clear_bit());
+        self.tim
+            .reg_block()
+            .ctrl()
+            .modify(|_, w| w.enable().clear_bit());
     }
 
     /// Disable the counter, setting both enable and active bit to 0
@@ -632,12 +703,12 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     pub fn auto_disable(self, enable: bool) -> Self {
         if enable {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_disable().set_bit());
         } else {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_disable().clear_bit());
         }
@@ -652,12 +723,12 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     pub fn auto_deactivate(self, enable: bool) -> Self {
         if enable {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_deactivate().set_bit());
         } else {
             self.tim
-                .reg()
+                .reg_block()
                 .ctrl()
                 .modify(|_, w| w.auto_deactivate().clear_bit());
         }
@@ -667,7 +738,7 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     /// Configure the cascade parameters
     #[inline]
     pub fn cascade_control(&mut self, ctrl: CascadeCtrl) {
-        self.tim.reg().csd_ctrl().write(|w| {
+        self.tim.reg_block().csd_ctrl().write(|w| {
             w.csden0().bit(ctrl.enb_start_src_csd0);
             w.csdinv0().bit(ctrl.inv_csd0);
             w.csden1().bit(ctrl.enb_start_src_csd1);
@@ -685,7 +756,7 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     pub fn cascade_0_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade0()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())
@@ -695,7 +766,7 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     pub fn cascade_1_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade1()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())
@@ -705,7 +776,7 @@ impl<Tim: ValidTim> CountdownTimer<Tim> {
     pub fn cascade_2_source(&mut self, src: CascadeSource) -> Result<(), InvalidCascadeSourceId> {
         let id = src.id()?;
         self.tim
-            .reg()
+            .reg_block()
             .cascade2()
             .write(|w| unsafe { w.cassel().bits(id) });
         Ok(())

va416xx-hal/src/uart.rs

@@ -305,17 +305,17 @@ impl IrqResultMaxSizeOrTimeout {
 
     #[inline]
     pub fn overflow_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.overflow)
+        self.errors.is_some_and(|e| e.overflow)
     }
 
     #[inline]
     pub fn framing_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.framing)
+        self.errors.is_some_and(|e| e.framing)
     }
 
     #[inline]
     pub fn parity_error(&self) -> bool {
-        self.errors.map_or(false, |e| e.parity)
+        self.errors.is_some_and(|e| e.parity)
     }
 
     #[inline]

va416xx-hal/src/wdt.rs

@@ -80,12 +80,12 @@ impl Wdt {
 
     #[inline]
     pub fn disable_reset(&mut self) {
-        self.wdt.wdogcontrol().modify(|_, w| w.resen().clear_bit())
+        self.wdt.wdogcontrol().modify(|_, w| w.resen().clear_bit());
     }
 
     #[inline]
     pub fn enable_reset(&mut self) {
-        self.wdt.wdogcontrol().modify(|_, w| w.resen().set_bit())
+        self.wdt.wdogcontrol().modify(|_, w| w.resen().set_bit());
     }
 
     #[inline]