From cfbe93c2805598652d85e21322b343032586b398 Mon Sep 17 00:00:00 2001
From: Mathias <mk@blackbird.online>
Date: Fri, 31 Mar 2023 10:43:30 +0200
Subject: [PATCH 01/11] Rework bufferedUart to get rid of PeripheralMutex in a
 similar fashion as nrf & rp. Also adds embedded-hal traits to bufferedUart

---
 embassy-stm32/src/usart/buffered.rs | 750 ++++++++++++++++++----------
 embassy-stm32/src/usart/mod.rs      |   9 +
 2 files changed, 490 insertions(+), 269 deletions(-)

diff --git a/embassy-stm32/src/usart/buffered.rs b/embassy-stm32/src/usart/buffered.rs
index cd7d72f9..6721c44a 100644
--- a/embassy-stm32/src/usart/buffered.rs
+++ b/embassy-stm32/src/usart/buffered.rs
@@ -1,51 +1,47 @@
-use core::cell::RefCell;
 use core::future::poll_fn;
-use core::sync::atomic::{compiler_fence, Ordering};
+use core::slice;
 use core::task::Poll;
 
-use embassy_cortex_m::peripheral::{PeripheralMutex, PeripheralState, StateStorage};
-use embassy_hal_common::ring_buffer::RingBuffer;
-use embassy_sync::waitqueue::WakerRegistration;
+use embassy_cortex_m::interrupt::Interrupt;
+use embassy_hal_common::atomic_ring_buffer::RingBuffer;
+use embassy_sync::waitqueue::AtomicWaker;
 
 use super::*;
 
-pub struct State<'d, T: BasicInstance>(StateStorage<StateInner<'d, T>>);
-impl<'d, T: BasicInstance> State<'d, T> {
+pub struct State {
+    rx_waker: AtomicWaker,
+    rx_buf: RingBuffer,
+
+    tx_waker: AtomicWaker,
+    tx_buf: RingBuffer,
+}
+
+impl State {
     pub const fn new() -> Self {
-        Self(StateStorage::new())
+        Self {
+            rx_buf: RingBuffer::new(),
+            tx_buf: RingBuffer::new(),
+            rx_waker: AtomicWaker::new(),
+            tx_waker: AtomicWaker::new(),
+        }
     }
 }
 
-struct StateInner<'d, T: BasicInstance> {
-    phantom: PhantomData<&'d mut T>,
-
-    rx_waker: WakerRegistration,
-    rx: RingBuffer<'d>,
-
-    tx_waker: WakerRegistration,
-    tx: RingBuffer<'d>,
-}
-
-unsafe impl<'d, T: BasicInstance> Send for StateInner<'d, T> {}
-unsafe impl<'d, T: BasicInstance> Sync for StateInner<'d, T> {}
-
 pub struct BufferedUart<'d, T: BasicInstance> {
-    inner: RefCell<PeripheralMutex<'d, StateInner<'d, T>>>,
+    rx: BufferedUartRx<'d, T>,
+    tx: BufferedUartTx<'d, T>,
 }
 
-pub struct BufferedUartTx<'u, 'd, T: BasicInstance> {
-    inner: &'u BufferedUart<'d, T>,
+pub struct BufferedUartTx<'d, T: BasicInstance> {
+    phantom: PhantomData<&'d mut T>,
 }
 
-pub struct BufferedUartRx<'u, 'd, T: BasicInstance> {
-    inner: &'u BufferedUart<'d, T>,
+pub struct BufferedUartRx<'d, T: BasicInstance> {
+    phantom: PhantomData<&'d mut T>,
 }
 
-impl<'d, T: BasicInstance> Unpin for BufferedUart<'d, T> {}
-
 impl<'d, T: BasicInstance> BufferedUart<'d, T> {
     pub fn new(
-        state: &'d mut State<'d, T>,
         peri: impl Peripheral<P = T> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
@@ -57,11 +53,10 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
         T::enable();
         T::reset();
 
-        Self::new_inner(state, peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
     }
 
     pub fn new_with_rtscts(
-        state: &'d mut State<'d, T>,
         peri: impl Peripheral<P = T> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
@@ -86,12 +81,11 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
             });
         }
 
-        Self::new_inner(state, peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
     }
 
     #[cfg(not(usart_v1))]
     pub fn new_with_de(
-        state: &'d mut State<'d, T>,
         peri: impl Peripheral<P = T> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
@@ -113,11 +107,10 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
             });
         }
 
-        Self::new_inner(state, peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
     }
 
     fn new_inner(
-        state: &'d mut State<'d, T>,
         _peri: impl Peripheral<P = T> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
@@ -128,8 +121,13 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
     ) -> BufferedUart<'d, T> {
         into_ref!(_peri, rx, tx, irq);
 
-        let r = T::regs();
+        let state = T::buffered_state();
+        let len = tx_buffer.len();
+        unsafe { state.tx_buf.init(tx_buffer.as_mut_ptr(), len) };
+        let len = rx_buffer.len();
+        unsafe { state.rx_buf.init(rx_buffer.as_mut_ptr(), len) };
 
+        let r = T::regs();
         unsafe {
             rx.set_as_af(rx.af_num(), AFType::Input);
             tx.set_as_af(tx.af_num(), AFType::OutputPushPull);
@@ -147,273 +145,297 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
             });
         }
 
-        Self {
-            inner: RefCell::new(PeripheralMutex::new(irq, &mut state.0, move || StateInner {
-                phantom: PhantomData,
-                tx: RingBuffer::new(tx_buffer),
-                tx_waker: WakerRegistration::new(),
+        irq.set_handler(on_interrupt::<T>);
+        irq.unpend();
+        irq.enable();
 
-                rx: RingBuffer::new(rx_buffer),
-                rx_waker: WakerRegistration::new(),
-            })),
+        Self {
+            rx: BufferedUartRx { phantom: PhantomData },
+            tx: BufferedUartTx { phantom: PhantomData },
         }
     }
 
-    pub fn split<'u>(&'u mut self) -> (BufferedUartRx<'u, 'd, T>, BufferedUartTx<'u, 'd, T>) {
-        (BufferedUartRx { inner: self }, BufferedUartTx { inner: self })
+    pub fn split(self) -> (BufferedUartRx<'d, T>, BufferedUartTx<'d, T>) {
+        (self.rx, self.tx)
     }
+}
 
-    async fn inner_read<'a>(&'a self, buf: &'a mut [u8]) -> Result<usize, Error> {
+impl<'d, T: BasicInstance> BufferedUartRx<'d, T> {
+    async fn read(&self, buf: &mut [u8]) -> Result<usize, Error> {
         poll_fn(move |cx| {
-            let mut do_pend = false;
-            let mut inner = self.inner.borrow_mut();
-            let res = inner.with(|state| {
-                compiler_fence(Ordering::SeqCst);
-
-                // We have data ready in buffer? Return it.
-                let data = state.rx.pop_buf();
-                if !data.is_empty() {
-                    let len = data.len().min(buf.len());
-                    buf[..len].copy_from_slice(&data[..len]);
-
-                    if state.rx.is_full() {
-                        do_pend = true;
-                    }
-                    state.rx.pop(len);
-
-                    return Poll::Ready(Ok(len));
-                }
-
-                state.rx_waker.register(cx.waker());
-                Poll::Pending
+            let state = T::buffered_state();
+            let mut rx_reader = unsafe { state.rx_buf.reader() };
+            let n = rx_reader.pop(|data| {
+                let n = data.len().min(buf.len());
+                buf[..n].copy_from_slice(&data[..n]);
+                n
             });
-
-            if do_pend {
-                inner.pend();
+            if n == 0 {
+                state.rx_waker.register(cx.waker());
+                return Poll::Pending;
             }
 
-            res
+            // FIXME:
+            // (Re-)Enable the interrupt to receive more data in case it was
+            // disabled because the buffer was full.
+            // let regs = T::regs();
+            // unsafe {
+            //     regs.uartimsc().write_set(|w| {
+            //         w.set_rxim(true);
+            //         w.set_rtim(true);
+            //     });
+            // }
+
+            Poll::Ready(Ok(n))
         })
         .await
+
+        // poll_fn(move |cx| {
+        //     let state = T::buffered_state();
+
+        //     let mut do_pend = false;
+        //     compiler_fence(Ordering::SeqCst);
+
+        //     // We have data ready in buffer? Return it.
+        //     let data = state.rx_buf.pop_buf();
+        //     if !data.is_empty() {
+        //         let len = data.len().min(buf.len());
+        //         buf[..len].copy_from_slice(&data[..len]);
+
+        //         if state.rx_buf.is_full() {
+        //             do_pend = true;
+        //         }
+        //         state.rx_buf.pop(len);
+
+        //         return Poll::Ready(Ok(len));
+        //     }
+
+        //     state.rx_waker.register(cx.waker());
+
+        //     if do_pend {
+        //         inner.pend();
+        //     }
+
+        //     Poll::Pending
+        // })
+        // .await
     }
 
-    fn inner_blocking_read(&self, buf: &mut [u8]) -> Result<usize, Error> {
+    fn blocking_read(&self, buf: &mut [u8]) -> Result<usize, Error> {
         loop {
-            let mut do_pend = false;
-            let mut inner = self.inner.borrow_mut();
-            let n = inner.with(|state| {
-                compiler_fence(Ordering::SeqCst);
-
-                // We have data ready in buffer? Return it.
-                let data = state.rx.pop_buf();
-                if !data.is_empty() {
-                    let len = data.len().min(buf.len());
-                    buf[..len].copy_from_slice(&data[..len]);
-
-                    if state.rx.is_full() {
-                        do_pend = true;
-                    }
-                    state.rx.pop(len);
-
-                    return len;
-                }
-
-                0
+            let state = T::buffered_state();
+            let mut rx_reader = unsafe { state.rx_buf.reader() };
+            let n = rx_reader.pop(|data| {
+                let n = data.len().min(buf.len());
+                buf[..n].copy_from_slice(&data[..n]);
+                n
             });
 
-            if do_pend {
-                inner.pend();
-            }
-
             if n > 0 {
+                // FIXME:
+                // (Re-)Enable the interrupt to receive more data in case it was
+                // disabled because the buffer was full.
+                // let regs = T::regs();
+                // unsafe {
+                //     regs.uartimsc().write_set(|w| {
+                //         w.set_rxim(true);
+                //         w.set_rtim(true);
+                //     });
+                // }
+
                 return Ok(n);
             }
         }
     }
 
-    async fn inner_write<'a>(&'a self, buf: &'a [u8]) -> Result<usize, Error> {
+    async fn fill_buf(&self) -> Result<&[u8], Error> {
         poll_fn(move |cx| {
-            let mut inner = self.inner.borrow_mut();
-            let (poll, empty) = inner.with(|state| {
-                let empty = state.tx.is_empty();
-                let tx_buf = state.tx.push_buf();
-                if tx_buf.is_empty() {
-                    state.tx_waker.register(cx.waker());
-                    return (Poll::Pending, empty);
-                }
-
-                let n = core::cmp::min(tx_buf.len(), buf.len());
-                tx_buf[..n].copy_from_slice(&buf[..n]);
-                state.tx.push(n);
-
-                (Poll::Ready(Ok(n)), empty)
-            });
-            if empty {
-                inner.pend();
+            let state = T::buffered_state();
+            let mut rx_reader = unsafe { state.rx_buf.reader() };
+            let (p, n) = rx_reader.pop_buf();
+            if n == 0 {
+                state.rx_waker.register(cx.waker());
+                return Poll::Pending;
             }
-            poll
+
+            let buf = unsafe { slice::from_raw_parts(p, n) };
+            Poll::Ready(Ok(buf))
         })
         .await
     }
 
-    async fn inner_flush<'a>(&'a self) -> Result<(), Error> {
+    fn consume(&self, amt: usize) {
+        let state = T::buffered_state();
+        let mut rx_reader = unsafe { state.rx_buf.reader() };
+        let full = state.rx_buf.is_full();
+        rx_reader.pop_done(amt);
+        if full {
+            unsafe { T::Interrupt::steal().pend() };
+        }
+    }
+}
+
+impl<'d, T: BasicInstance> BufferedUartTx<'d, T> {
+    async fn write(&self, buf: &[u8]) -> Result<usize, Error> {
         poll_fn(move |cx| {
-            self.inner.borrow_mut().with(|state| {
-                if !state.tx.is_empty() {
-                    state.tx_waker.register(cx.waker());
-                    return Poll::Pending;
-                }
+            let state = T::buffered_state();
+            let mut tx_writer = unsafe { state.tx_buf.writer() };
+            let n = tx_writer.push(|data| {
+                let n = data.len().min(buf.len());
+                data[..n].copy_from_slice(&buf[..n]);
+                n
+            });
+            if n == 0 {
+                state.tx_waker.register(cx.waker());
+                return Poll::Pending;
+            }
 
-                Poll::Ready(Ok(()))
-            })
+            // The TX interrupt only triggers when the there was data in the
+            // FIFO and the number of bytes drops below a threshold. When the
+            // FIFO was empty we have to manually pend the interrupt to shovel
+            // TX data from the buffer into the FIFO.
+            unsafe { T::Interrupt::steal() }.pend();
+            Poll::Ready(Ok(n))
         })
         .await
     }
 
-    fn inner_blocking_write(&self, buf: &[u8]) -> Result<usize, Error> {
+    async fn flush(&self) -> Result<(), Error> {
+        poll_fn(move |cx| {
+            let state = T::buffered_state();
+            if !state.tx_buf.is_empty() {
+                state.tx_waker.register(cx.waker());
+                return Poll::Pending;
+            }
+
+            Poll::Ready(Ok(()))
+        })
+        .await
+    }
+
+    fn blocking_write(&self, buf: &[u8]) -> Result<usize, Error> {
         loop {
-            let mut inner = self.inner.borrow_mut();
-            let (n, empty) = inner.with(|state| {
-                let empty = state.tx.is_empty();
-                let tx_buf = state.tx.push_buf();
-                if tx_buf.is_empty() {
-                    return (0, empty);
-                }
-
-                let n = core::cmp::min(tx_buf.len(), buf.len());
-                tx_buf[..n].copy_from_slice(&buf[..n]);
-                state.tx.push(n);
-
-                (n, empty)
+            let state = T::buffered_state();
+            let mut tx_writer = unsafe { state.tx_buf.writer() };
+            let n = tx_writer.push(|data| {
+                let n = data.len().min(buf.len());
+                data[..n].copy_from_slice(&buf[..n]);
+                n
             });
-            if empty {
-                inner.pend();
-            }
+
             if n != 0 {
+                // The TX interrupt only triggers when the there was data in the
+                // FIFO and the number of bytes drops below a threshold. When the
+                // FIFO was empty we have to manually pend the interrupt to shovel
+                // TX data from the buffer into the FIFO.
+                unsafe { T::Interrupt::steal() }.pend();
                 return Ok(n);
             }
         }
     }
 
-    fn inner_blocking_flush(&self) -> Result<(), Error> {
+    fn blocking_flush(&self) -> Result<(), Error> {
         loop {
-            if !self.inner.borrow_mut().with(|state| state.tx.is_empty()) {
+            let state = T::buffered_state();
+            if state.tx_buf.is_empty() {
                 return Ok(());
             }
         }
     }
-
-    async fn inner_fill_buf<'a>(&'a self) -> Result<&'a [u8], Error> {
-        poll_fn(move |cx| {
-            self.inner.borrow_mut().with(|state| {
-                compiler_fence(Ordering::SeqCst);
-
-                // We have data ready in buffer? Return it.
-                let buf = state.rx.pop_buf();
-                if !buf.is_empty() {
-                    let buf: &[u8] = buf;
-                    // Safety: buffer lives as long as uart
-                    let buf: &[u8] = unsafe { core::mem::transmute(buf) };
-                    return Poll::Ready(Ok(buf));
-                }
-
-                state.rx_waker.register(cx.waker());
-                Poll::<Result<&[u8], Error>>::Pending
-            })
-        })
-        .await
-    }
-
-    fn inner_consume(&self, amt: usize) {
-        let mut inner = self.inner.borrow_mut();
-        let signal = inner.with(|state| {
-            let full = state.rx.is_full();
-            state.rx.pop(amt);
-            full
-        });
-        if signal {
-            inner.pend();
-        }
-    }
 }
 
-impl<'d, T: BasicInstance> StateInner<'d, T>
-where
-    Self: 'd,
-{
-    fn on_rx(&mut self) {
-        let r = T::regs();
+impl<'d, T: BasicInstance> Drop for BufferedUartRx<'d, T> {
+    fn drop(&mut self) {
+        let state = T::buffered_state();
         unsafe {
-            let sr = sr(r).read();
-            clear_interrupt_flags(r, sr);
+            state.rx_buf.deinit();
 
-            // This read also clears the error and idle interrupt flags on v1.
-            let b = rdr(r).read_volatile();
-
-            if sr.rxne() {
-                if sr.pe() {
-                    warn!("Parity error");
-                }
-                if sr.fe() {
-                    warn!("Framing error");
-                }
-                if sr.ne() {
-                    warn!("Noise error");
-                }
-                if sr.ore() {
-                    warn!("Overrun error");
-                }
-
-                let buf = self.rx.push_buf();
-                if !buf.is_empty() {
-                    buf[0] = b;
-                    self.rx.push(1);
-                } else {
-                    warn!("RX buffer full, discard received byte");
-                }
-
-                if self.rx.is_full() {
-                    self.rx_waker.wake();
-                }
-            }
-
-            if sr.idle() {
-                self.rx_waker.wake();
-            };
-        }
-    }
-
-    fn on_tx(&mut self) {
-        let r = T::regs();
-        unsafe {
-            if sr(r).read().txe() {
-                let buf = self.tx.pop_buf();
-                if !buf.is_empty() {
-                    r.cr1().modify(|w| {
-                        w.set_txeie(true);
-                    });
-                    tdr(r).write_volatile(buf[0].into());
-                    self.tx.pop(1);
-                    self.tx_waker.wake();
-                } else {
-                    // Disable interrupt until we have something to transmit again
-                    r.cr1().modify(|w| {
-                        w.set_txeie(false);
-                    });
-                }
+            // TX is inactive if the the buffer is not available.
+            // We can now unregister the interrupt handler
+            if state.tx_buf.len() == 0 {
+                T::Interrupt::steal().disable();
             }
         }
     }
 }
 
-impl<'d, T: BasicInstance> PeripheralState for StateInner<'d, T>
-where
-    Self: 'd,
-{
-    type Interrupt = T::Interrupt;
-    fn on_interrupt(&mut self) {
-        self.on_rx();
-        self.on_tx();
+impl<'d, T: BasicInstance> Drop for BufferedUartTx<'d, T> {
+    fn drop(&mut self) {
+        let state = T::buffered_state();
+        unsafe {
+            state.tx_buf.deinit();
+
+            // RX is inactive if the the buffer is not available.
+            // We can now unregister the interrupt handler
+            if state.rx_buf.len() == 0 {
+                T::Interrupt::steal().disable();
+            }
+        }
+    }
+}
+
+unsafe fn on_interrupt<T: BasicInstance>(_: *mut ()) {
+    let r = T::regs();
+    let state = T::buffered_state();
+
+    // RX
+    unsafe {
+        let sr = sr(r).read();
+        clear_interrupt_flags(r, sr);
+
+        if sr.rxne() {
+            if sr.pe() {
+                warn!("Parity error");
+            }
+            if sr.fe() {
+                warn!("Framing error");
+            }
+            if sr.ne() {
+                warn!("Noise error");
+            }
+            if sr.ore() {
+                warn!("Overrun error");
+            }
+
+            let mut rx_writer = state.rx_buf.writer();
+            let buf = rx_writer.push_slice();
+            if !buf.is_empty() {
+                // This read also clears the error and idle interrupt flags on v1.
+                buf[0] = rdr(r).read_volatile();
+                rx_writer.push_done(1);
+            } else {
+                // FIXME: Should we disable any further RX interrupts when the buffer becomes full.
+            }
+
+            if state.rx_buf.is_full() {
+                state.rx_waker.wake();
+            }
+        }
+
+        if sr.idle() {
+            state.rx_waker.wake();
+        };
+    }
+
+    // TX
+    unsafe {
+        if sr(r).read().txe() {
+            let mut tx_reader = state.tx_buf.reader();
+            let buf = tx_reader.pop_slice();
+            if !buf.is_empty() {
+                r.cr1().modify(|w| {
+                    w.set_txeie(true);
+                });
+                tdr(r).write_volatile(buf[0].into());
+                tx_reader.pop_done(1);
+                state.tx_waker.wake();
+            } else {
+                // Disable interrupt until we have something to transmit again
+                r.cr1().modify(|w| {
+                    w.set_txeie(false);
+                });
+            }
+        }
     }
 }
 
@@ -427,94 +449,284 @@ impl<'d, T: BasicInstance> embedded_io::Io for BufferedUart<'d, T> {
     type Error = Error;
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::Io for BufferedUartRx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::Io for BufferedUartRx<'d, T> {
     type Error = Error;
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::Io for BufferedUartTx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::Io for BufferedUartTx<'d, T> {
     type Error = Error;
 }
 
 impl<'d, T: BasicInstance> embedded_io::asynch::Read for BufferedUart<'d, T> {
     async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
-        self.inner_read(buf).await
+        self.rx.read(buf).await
     }
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::asynch::Read for BufferedUartRx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::asynch::Read for BufferedUartRx<'d, T> {
     async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
-        self.inner.inner_read(buf).await
+        Self::read(self, buf).await
     }
 }
 
 impl<'d, T: BasicInstance> embedded_io::asynch::BufRead for BufferedUart<'d, T> {
     async fn fill_buf(&mut self) -> Result<&[u8], Self::Error> {
-        self.inner_fill_buf().await
+        self.rx.fill_buf().await
     }
 
     fn consume(&mut self, amt: usize) {
-        self.inner_consume(amt)
+        self.rx.consume(amt)
     }
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::asynch::BufRead for BufferedUartRx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::asynch::BufRead for BufferedUartRx<'d, T> {
     async fn fill_buf(&mut self) -> Result<&[u8], Self::Error> {
-        self.inner.inner_fill_buf().await
+        Self::fill_buf(self).await
     }
 
     fn consume(&mut self, amt: usize) {
-        self.inner.inner_consume(amt)
+        Self::consume(self, amt)
     }
 }
 
 impl<'d, T: BasicInstance> embedded_io::asynch::Write for BufferedUart<'d, T> {
     async fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
-        self.inner_write(buf).await
+        self.tx.write(buf).await
     }
 
     async fn flush(&mut self) -> Result<(), Self::Error> {
-        self.inner_flush().await
+        self.tx.flush().await
     }
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::asynch::Write for BufferedUartTx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::asynch::Write for BufferedUartTx<'d, T> {
     async fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
-        self.inner.inner_write(buf).await
+        Self::write(self, buf).await
     }
 
     async fn flush(&mut self) -> Result<(), Self::Error> {
-        self.inner.inner_flush().await
+        Self::flush(self).await
     }
 }
 
 impl<'d, T: BasicInstance> embedded_io::blocking::Read for BufferedUart<'d, T> {
     fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
-        self.inner_blocking_read(buf)
+        self.rx.blocking_read(buf)
     }
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::blocking::Read for BufferedUartRx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::blocking::Read for BufferedUartRx<'d, T> {
     fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
-        self.inner.inner_blocking_read(buf)
+        self.blocking_read(buf)
     }
 }
 
 impl<'d, T: BasicInstance> embedded_io::blocking::Write for BufferedUart<'d, T> {
     fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
-        self.inner_blocking_write(buf)
+        self.tx.blocking_write(buf)
     }
 
     fn flush(&mut self) -> Result<(), Self::Error> {
-        self.inner_blocking_flush()
+        self.tx.blocking_flush()
     }
 }
 
-impl<'u, 'd, T: BasicInstance> embedded_io::blocking::Write for BufferedUartTx<'u, 'd, T> {
+impl<'d, T: BasicInstance> embedded_io::blocking::Write for BufferedUartTx<'d, T> {
     fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
-        self.inner.inner_blocking_write(buf)
+        Self::blocking_write(self, buf)
     }
 
     fn flush(&mut self) -> Result<(), Self::Error> {
-        self.inner.inner_blocking_flush()
+        Self::blocking_flush(self)
+    }
+}
+
+mod eh02 {
+    use super::*;
+
+    impl<'d, T: BasicInstance> embedded_hal_02::serial::Read<u8> for BufferedUartRx<'d, T> {
+        type Error = Error;
+
+        fn read(&mut self) -> Result<u8, nb::Error<Self::Error>> {
+            let r = T::regs();
+            unsafe {
+                let sr = sr(r).read();
+                if sr.pe() {
+                    rdr(r).read_volatile();
+                    Err(nb::Error::Other(Error::Parity))
+                } else if sr.fe() {
+                    rdr(r).read_volatile();
+                    Err(nb::Error::Other(Error::Framing))
+                } else if sr.ne() {
+                    rdr(r).read_volatile();
+                    Err(nb::Error::Other(Error::Noise))
+                } else if sr.ore() {
+                    rdr(r).read_volatile();
+                    Err(nb::Error::Other(Error::Overrun))
+                } else if sr.rxne() {
+                    Ok(rdr(r).read_volatile())
+                } else {
+                    Err(nb::Error::WouldBlock)
+                }
+            }
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_02::blocking::serial::Write<u8> for BufferedUartTx<'d, T> {
+        type Error = Error;
+
+        fn bwrite_all(&mut self, mut buffer: &[u8]) -> Result<(), Self::Error> {
+            while !buffer.is_empty() {
+                match self.blocking_write(buffer) {
+                    Ok(0) => panic!("zero-length write."),
+                    Ok(n) => buffer = &buffer[n..],
+                    Err(e) => return Err(e),
+                }
+            }
+            Ok(())
+        }
+
+        fn bflush(&mut self) -> Result<(), Self::Error> {
+            self.blocking_flush()
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_02::serial::Read<u8> for BufferedUart<'d, T> {
+        type Error = Error;
+
+        fn read(&mut self) -> Result<u8, nb::Error<Self::Error>> {
+            embedded_hal_02::serial::Read::read(&mut self.rx)
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_02::blocking::serial::Write<u8> for BufferedUart<'d, T> {
+        type Error = Error;
+
+        fn bwrite_all(&mut self, mut buffer: &[u8]) -> Result<(), Self::Error> {
+            while !buffer.is_empty() {
+                match self.tx.blocking_write(buffer) {
+                    Ok(0) => panic!("zero-length write."),
+                    Ok(n) => buffer = &buffer[n..],
+                    Err(e) => return Err(e),
+                }
+            }
+            Ok(())
+        }
+
+        fn bflush(&mut self) -> Result<(), Self::Error> {
+            self.tx.blocking_flush()
+        }
+    }
+}
+
+#[cfg(feature = "unstable-traits")]
+mod eh1 {
+    use super::*;
+
+    impl<'d, T: BasicInstance> embedded_hal_1::serial::ErrorType for BufferedUart<'d, T> {
+        type Error = Error;
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_1::serial::ErrorType for BufferedUartTx<'d, T> {
+        type Error = Error;
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_1::serial::ErrorType for BufferedUartRx<'d, T> {
+        type Error = Error;
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_nb::serial::Read for BufferedUartRx<'d, T> {
+        fn read(&mut self) -> nb::Result<u8, Self::Error> {
+            embedded_hal_02::serial::Read::read(self)
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_1::serial::Write for BufferedUartTx<'d, T> {
+        fn write(&mut self, buffer: &[u8]) -> Result<(), Self::Error> {
+            self.blocking_write(buffer).map(drop)
+        }
+
+        fn flush(&mut self) -> Result<(), Self::Error> {
+            self.blocking_flush()
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_nb::serial::Write for BufferedUartTx<'d, T> {
+        fn write(&mut self, char: u8) -> nb::Result<(), Self::Error> {
+            self.blocking_write(&[char]).map(drop).map_err(nb::Error::Other)
+        }
+
+        fn flush(&mut self) -> nb::Result<(), Self::Error> {
+            self.blocking_flush().map_err(nb::Error::Other)
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_nb::serial::Read for BufferedUart<'d, T> {
+        fn read(&mut self) -> Result<u8, nb::Error<Self::Error>> {
+            embedded_hal_02::serial::Read::read(&mut self.rx)
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_1::serial::Write for BufferedUart<'d, T> {
+        fn write(&mut self, buffer: &[u8]) -> Result<(), Self::Error> {
+            self.tx.blocking_write(buffer).map(drop)
+        }
+
+        fn flush(&mut self) -> Result<(), Self::Error> {
+            self.tx.blocking_flush()
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_nb::serial::Write for BufferedUart<'d, T> {
+        fn write(&mut self, char: u8) -> nb::Result<(), Self::Error> {
+            self.tx.blocking_write(&[char]).map(drop).map_err(nb::Error::Other)
+        }
+
+        fn flush(&mut self) -> nb::Result<(), Self::Error> {
+            self.tx.blocking_flush().map_err(nb::Error::Other)
+        }
+    }
+}
+
+#[cfg(all(
+    feature = "unstable-traits",
+    feature = "nightly",
+    feature = "_todo_embedded_hal_serial"
+))]
+mod eha {
+    use core::future::Future;
+
+    use super::*;
+
+    impl<'d, T: BasicInstance> embedded_hal_async::serial::Write for BufferedUartTx<'d, T> {
+        async fn write(&mut self, buf: &[u8]) -> Result<(), Self::Error> {
+            Self::write(buf)
+        }
+
+        async fn flush(&mut self) -> Result<(), Self::Error> {
+            Self::flush()
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_async::serial::Read for BufferedUartRx<'d, T> {
+        async fn read(&mut self, buf: &mut [u8]) -> Result<(), Self::Error> {
+            Self::read(buf)
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_async::serial::Write for BufferedUart<'d, T> {
+        async fn write(&mut self, buf: &[u8]) -> Result<(), Self::Error> {
+            self.tx.write(buf)
+        }
+
+        async fn flush(&mut self) -> Result<(), Self::Error> {
+            self.tx.flush()
+        }
+    }
+
+    impl<'d, T: BasicInstance> embedded_hal_async::serial::Read for BufferedUart<'d, T> {
+        async fn read(&mut self, buf: &mut [u8]) -> Result<(), Self::Error> {
+            self.rx.read(buf)
+        }
     }
 }
diff --git a/embassy-stm32/src/usart/mod.rs b/embassy-stm32/src/usart/mod.rs
index f80323e3..a42eede1 100644
--- a/embassy-stm32/src/usart/mod.rs
+++ b/embassy-stm32/src/usart/mod.rs
@@ -1112,6 +1112,9 @@ pub(crate) mod sealed {
 
         fn regs() -> Regs;
         fn state() -> &'static State;
+
+        #[cfg(feature = "nightly")]
+        fn buffered_state() -> &'static buffered::State;
     }
 
     pub trait FullInstance: BasicInstance {
@@ -1147,6 +1150,12 @@ macro_rules! impl_lpuart {
                 static STATE: crate::usart::sealed::State = crate::usart::sealed::State::new();
                 &STATE
             }
+
+            #[cfg(feature = "nightly")]
+            fn buffered_state() -> &'static buffered::State {
+                static STATE: buffered::State = buffered::State::new();
+                &STATE
+            }
         }
 
         impl BasicInstance for peripherals::$inst {}

From 472dc6b7d16ea10b9512090acb1b74aa24ed189f Mon Sep 17 00:00:00 2001
From: Mathias <mk@blackbird.online>
Date: Fri, 31 Mar 2023 15:50:37 +0200
Subject: [PATCH 02/11] Fix interrupt handling so it is similar to before the
 rework, and fix examples

---
 embassy-stm32/src/usart/buffered.rs        | 154 ++++++++-------------
 examples/stm32f4/src/bin/usart_buffered.rs |  14 +-
 examples/stm32l0/src/bin/usart_irq.rs      |  16 +--
 3 files changed, 62 insertions(+), 122 deletions(-)

diff --git a/embassy-stm32/src/usart/buffered.rs b/embassy-stm32/src/usart/buffered.rs
index 6721c44a..3e23e7ca 100644
--- a/embassy-stm32/src/usart/buffered.rs
+++ b/embassy-stm32/src/usart/buffered.rs
@@ -43,9 +43,9 @@ pub struct BufferedUartRx<'d, T: BasicInstance> {
 impl<'d, T: BasicInstance> BufferedUart<'d, T> {
     pub fn new(
         peri: impl Peripheral<P = T> + 'd,
+        irq: impl Peripheral<P = T::Interrupt> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
-        irq: impl Peripheral<P = T::Interrupt> + 'd,
         tx_buffer: &'d mut [u8],
         rx_buffer: &'d mut [u8],
         config: Config,
@@ -53,14 +53,14 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
         T::enable();
         T::reset();
 
-        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, irq, rx, tx, tx_buffer, rx_buffer, config)
     }
 
     pub fn new_with_rtscts(
         peri: impl Peripheral<P = T> + 'd,
+        irq: impl Peripheral<P = T::Interrupt> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
-        irq: impl Peripheral<P = T::Interrupt> + 'd,
         rts: impl Peripheral<P = impl RtsPin<T>> + 'd,
         cts: impl Peripheral<P = impl CtsPin<T>> + 'd,
         tx_buffer: &'d mut [u8],
@@ -81,15 +81,15 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
             });
         }
 
-        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, irq, rx, tx, tx_buffer, rx_buffer, config)
     }
 
     #[cfg(not(usart_v1))]
     pub fn new_with_de(
         peri: impl Peripheral<P = T> + 'd,
+        irq: impl Peripheral<P = T::Interrupt> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
-        irq: impl Peripheral<P = T::Interrupt> + 'd,
         de: impl Peripheral<P = impl DePin<T>> + 'd,
         tx_buffer: &'d mut [u8],
         rx_buffer: &'d mut [u8],
@@ -107,14 +107,14 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
             });
         }
 
-        Self::new_inner(peri, rx, tx, irq, tx_buffer, rx_buffer, config)
+        Self::new_inner(peri, irq, rx, tx, tx_buffer, rx_buffer, config)
     }
 
     fn new_inner(
         _peri: impl Peripheral<P = T> + 'd,
+        irq: impl Peripheral<P = T::Interrupt> + 'd,
         rx: impl Peripheral<P = impl RxPin<T>> + 'd,
         tx: impl Peripheral<P = impl TxPin<T>> + 'd,
-        irq: impl Peripheral<P = T::Interrupt> + 'd,
         tx_buffer: &'d mut [u8],
         rx_buffer: &'d mut [u8],
         config: Config,
@@ -155,8 +155,8 @@ impl<'d, T: BasicInstance> BufferedUart<'d, T> {
         }
     }
 
-    pub fn split(self) -> (BufferedUartRx<'d, T>, BufferedUartTx<'d, T>) {
-        (self.rx, self.tx)
+    pub fn split(self) -> (BufferedUartTx<'d, T>, BufferedUartRx<'d, T>) {
+        (self.tx, self.rx)
     }
 }
 
@@ -165,85 +165,46 @@ impl<'d, T: BasicInstance> BufferedUartRx<'d, T> {
         poll_fn(move |cx| {
             let state = T::buffered_state();
             let mut rx_reader = unsafe { state.rx_buf.reader() };
-            let n = rx_reader.pop(|data| {
-                let n = data.len().min(buf.len());
-                buf[..n].copy_from_slice(&data[..n]);
-                n
-            });
-            if n == 0 {
-                state.rx_waker.register(cx.waker());
-                return Poll::Pending;
+            let data = rx_reader.pop_slice();
+
+            if !data.is_empty() {
+                let len = data.len().min(buf.len());
+                buf[..len].copy_from_slice(&data[..len]);
+
+                let do_pend = state.rx_buf.is_full();
+                rx_reader.pop_done(len);
+
+                if do_pend {
+                    unsafe { T::Interrupt::steal().pend() };
+                }
+
+                return Poll::Ready(Ok(len));
             }
 
-            // FIXME:
-            // (Re-)Enable the interrupt to receive more data in case it was
-            // disabled because the buffer was full.
-            // let regs = T::regs();
-            // unsafe {
-            //     regs.uartimsc().write_set(|w| {
-            //         w.set_rxim(true);
-            //         w.set_rtim(true);
-            //     });
-            // }
-
-            Poll::Ready(Ok(n))
+            state.rx_waker.register(cx.waker());
+            Poll::Pending
         })
         .await
-
-        // poll_fn(move |cx| {
-        //     let state = T::buffered_state();
-
-        //     let mut do_pend = false;
-        //     compiler_fence(Ordering::SeqCst);
-
-        //     // We have data ready in buffer? Return it.
-        //     let data = state.rx_buf.pop_buf();
-        //     if !data.is_empty() {
-        //         let len = data.len().min(buf.len());
-        //         buf[..len].copy_from_slice(&data[..len]);
-
-        //         if state.rx_buf.is_full() {
-        //             do_pend = true;
-        //         }
-        //         state.rx_buf.pop(len);
-
-        //         return Poll::Ready(Ok(len));
-        //     }
-
-        //     state.rx_waker.register(cx.waker());
-
-        //     if do_pend {
-        //         inner.pend();
-        //     }
-
-        //     Poll::Pending
-        // })
-        // .await
     }
 
     fn blocking_read(&self, buf: &mut [u8]) -> Result<usize, Error> {
         loop {
             let state = T::buffered_state();
             let mut rx_reader = unsafe { state.rx_buf.reader() };
-            let n = rx_reader.pop(|data| {
-                let n = data.len().min(buf.len());
-                buf[..n].copy_from_slice(&data[..n]);
-                n
-            });
+            let data = rx_reader.pop_slice();
 
-            if n > 0 {
-                // FIXME:
-                // (Re-)Enable the interrupt to receive more data in case it was
-                // disabled because the buffer was full.
-                // let regs = T::regs();
-                // unsafe {
-                //     regs.uartimsc().write_set(|w| {
-                //         w.set_rxim(true);
-                //         w.set_rtim(true);
-                //     });
-                // }
+            if !data.is_empty() {
+                let len = data.len().min(buf.len());
+                buf[..len].copy_from_slice(&data[..len]);
 
-                return Ok(n);
+                let do_pend = state.rx_buf.is_full();
+                rx_reader.pop_done(len);
+
+                if do_pend {
+                    unsafe { T::Interrupt::steal().pend() };
+                }
+
+                return Ok(len);
             }
         }
     }
@@ -279,22 +240,23 @@ impl<'d, T: BasicInstance> BufferedUartTx<'d, T> {
     async fn write(&self, buf: &[u8]) -> Result<usize, Error> {
         poll_fn(move |cx| {
             let state = T::buffered_state();
+            let empty = state.tx_buf.is_empty();
+
             let mut tx_writer = unsafe { state.tx_buf.writer() };
-            let n = tx_writer.push(|data| {
-                let n = data.len().min(buf.len());
-                data[..n].copy_from_slice(&buf[..n]);
-                n
-            });
-            if n == 0 {
+            let data = tx_writer.push_slice();
+            if data.is_empty() {
                 state.tx_waker.register(cx.waker());
                 return Poll::Pending;
             }
 
-            // The TX interrupt only triggers when the there was data in the
-            // FIFO and the number of bytes drops below a threshold. When the
-            // FIFO was empty we have to manually pend the interrupt to shovel
-            // TX data from the buffer into the FIFO.
-            unsafe { T::Interrupt::steal() }.pend();
+            let n = data.len().min(buf.len());
+            data[..n].copy_from_slice(&buf[..n]);
+            tx_writer.push_done(n);
+
+            if empty {
+                unsafe { T::Interrupt::steal() }.pend();
+            }
+
             Poll::Ready(Ok(n))
         })
         .await
@@ -316,19 +278,19 @@ impl<'d, T: BasicInstance> BufferedUartTx<'d, T> {
     fn blocking_write(&self, buf: &[u8]) -> Result<usize, Error> {
         loop {
             let state = T::buffered_state();
+            let empty = state.tx_buf.is_empty();
+
             let mut tx_writer = unsafe { state.tx_buf.writer() };
-            let n = tx_writer.push(|data| {
+            let data = tx_writer.push_slice();
+            if !data.is_empty() {
                 let n = data.len().min(buf.len());
                 data[..n].copy_from_slice(&buf[..n]);
-                n
-            });
+                tx_writer.push_done(n);
+
+                if empty {
+                    unsafe { T::Interrupt::steal() }.pend();
+                }
 
-            if n != 0 {
-                // The TX interrupt only triggers when the there was data in the
-                // FIFO and the number of bytes drops below a threshold. When the
-                // FIFO was empty we have to manually pend the interrupt to shovel
-                // TX data from the buffer into the FIFO.
-                unsafe { T::Interrupt::steal() }.pend();
                 return Ok(n);
             }
         }
diff --git a/examples/stm32f4/src/bin/usart_buffered.rs b/examples/stm32f4/src/bin/usart_buffered.rs
index dd171fe1..a93f8bae 100644
--- a/examples/stm32f4/src/bin/usart_buffered.rs
+++ b/examples/stm32f4/src/bin/usart_buffered.rs
@@ -5,7 +5,7 @@
 use defmt::*;
 use embassy_executor::Spawner;
 use embassy_stm32::interrupt;
-use embassy_stm32::usart::{BufferedUart, Config, State};
+use embassy_stm32::usart::{BufferedUart, Config};
 use embedded_io::asynch::BufRead;
 use {defmt_rtt as _, panic_probe as _};
 
@@ -16,20 +16,10 @@ async fn main(_spawner: Spawner) {
 
     let config = Config::default();
 
-    let mut state = State::new();
     let irq = interrupt::take!(USART3);
     let mut tx_buf = [0u8; 32];
     let mut rx_buf = [0u8; 32];
-    let mut buf_usart = BufferedUart::new(
-        &mut state,
-        p.USART3,
-        p.PD9,
-        p.PD8,
-        irq,
-        &mut tx_buf,
-        &mut rx_buf,
-        config,
-    );
+    let mut buf_usart = BufferedUart::new(p.USART3, irq, p.PD9, p.PD8, &mut tx_buf, &mut rx_buf, config);
 
     loop {
         let buf = buf_usart.fill_buf().await.unwrap();
diff --git a/examples/stm32l0/src/bin/usart_irq.rs b/examples/stm32l0/src/bin/usart_irq.rs
index 8e84cd09..46534700 100644
--- a/examples/stm32l0/src/bin/usart_irq.rs
+++ b/examples/stm32l0/src/bin/usart_irq.rs
@@ -5,7 +5,7 @@
 use defmt::*;
 use embassy_executor::Spawner;
 use embassy_stm32::interrupt;
-use embassy_stm32::usart::{BufferedUart, Config, State};
+use embassy_stm32::usart::{BufferedUart, Config};
 use embedded_io::asynch::{Read, Write};
 use {defmt_rtt as _, panic_probe as _};
 
@@ -20,20 +20,8 @@ async fn main(_spawner: Spawner) {
     let mut config = Config::default();
     config.baudrate = 9600;
 
-    let mut state = State::new();
     let irq = interrupt::take!(USART2);
-    let mut usart = unsafe {
-        BufferedUart::new(
-            &mut state,
-            p.USART2,
-            p.PA3,
-            p.PA2,
-            irq,
-            &mut TX_BUFFER,
-            &mut RX_BUFFER,
-            config,
-        )
-    };
+    let mut usart = unsafe { BufferedUart::new(p.USART2, irq, p.PA3, p.PA2, &mut TX_BUFFER, &mut RX_BUFFER, config) };
 
     usart.write_all(b"Hello Embassy World!\r\n").await.unwrap();
     info!("wrote Hello, starting echo");

From b41ee47115509ba5ed302c684c0c36b6a3e3f76f Mon Sep 17 00:00:00 2001
From: Dario Nieuwenhuis <dirbaio@dirbaio.net>
Date: Mon, 3 Apr 2023 01:11:42 +0200
Subject: [PATCH 03/11] executor: unify export mod.

---
 embassy-executor/src/lib.rs                          | 12 ++++--------
 embassy-macros/src/macros/cortex_m_interrupt_take.rs |  4 ++--
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/embassy-executor/src/lib.rs b/embassy-executor/src/lib.rs
index 4c7e2f4c..8707995b 100644
--- a/embassy-executor/src/lib.rs
+++ b/embassy-executor/src/lib.rs
@@ -46,11 +46,13 @@ cfg_if::cfg_if! {
     }
 }
 
+/// Implementation details for embassy macros.
+/// Do not use. Used for macros and HALs only. Not covered by semver guarantees.
 #[doc(hidden)]
-/// Implementation details for embassy macros. DO NOT USE.
-pub mod export {
+pub mod _export {
     #[cfg(feature = "rtos-trace")]
     pub use rtos_trace::trace;
+    pub use static_cell::StaticCell;
 
     /// Expands the given block of code when `embassy-executor` is compiled with
     /// the `rtos-trace-interrupt` feature.
@@ -75,9 +77,3 @@ pub mod raw;
 
 mod spawner;
 pub use spawner::*;
-
-/// Do not use. Used for macros and HALs only. Not covered by semver guarantees.
-#[doc(hidden)]
-pub mod _export {
-    pub use static_cell::StaticCell;
-}
diff --git a/embassy-macros/src/macros/cortex_m_interrupt_take.rs b/embassy-macros/src/macros/cortex_m_interrupt_take.rs
index e2ebf98c..4806d1c1 100644
--- a/embassy-macros/src/macros/cortex_m_interrupt_take.rs
+++ b/embassy-macros/src/macros/cortex_m_interrupt_take.rs
@@ -10,12 +10,12 @@ pub fn run(name: syn::Ident) -> Result<TokenStream, TokenStream> {
     let (isr_enter, isr_exit) = (
         quote! {
             ::embassy_executor::rtos_trace_interrupt! {
-                ::embassy_executor::export::trace::isr_enter();
+                ::embassy_executor::_export::trace::isr_enter();
             }
         },
         quote! {
             ::embassy_executor::rtos_trace_interrupt! {
-                ::embassy_executor::export::trace::isr_exit();
+                ::embassy_executor::_export::trace::isr_exit();
             }
         },
     );

From d3c4e4a20a05085eae8d568c7efdbe09bada9cf5 Mon Sep 17 00:00:00 2001
From: Dario Nieuwenhuis <dirbaio@dirbaio.net>
Date: Mon, 3 Apr 2023 01:18:27 +0200
Subject: [PATCH 04/11] executor: add Pender, rework Cargo features.

This introduces a `Pender` struct with enum cases for thread-mode, interrupt-mode and
custom callback executors. This avoids calls through function pointers when using only
the thread or interrupt executors. Faster, and friendlier to `cargo-call-stack`.

`embassy-executor` now has `arch-xxx` Cargo features to select the arch and to enable
the builtin executors (thread and interrupt).
---
 docs/modules/ROOT/examples/basic/Cargo.toml   |   2 +-
 .../layer-by-layer/blinky-async/Cargo.toml    |   2 +-
 embassy-cortex-m/src/executor.rs              | 116 ---------
 embassy-cortex-m/src/lib.rs                   |   2 +-
 embassy-executor/Cargo.toml                   |  25 +-
 embassy-executor/src/arch/cortex_m.rs         | 242 ++++++++++++++----
 embassy-executor/src/arch/riscv32.rs          | 133 +++++-----
 embassy-executor/src/arch/std.rs              | 152 ++++++-----
 embassy-executor/src/arch/wasm.rs             | 136 +++++-----
 embassy-executor/src/arch/xtensa.rs           | 135 +++++-----
 embassy-executor/src/lib.rs                   |  71 +++--
 embassy-executor/src/raw/mod.rs               |  97 +++++--
 examples/boot/application/nrf/Cargo.toml      |   2 +-
 examples/boot/application/rp/Cargo.toml       |   2 +-
 examples/boot/application/stm32f3/Cargo.toml  |   2 +-
 examples/boot/application/stm32f7/Cargo.toml  |   2 +-
 examples/boot/application/stm32h7/Cargo.toml  |   2 +-
 examples/boot/application/stm32l0/Cargo.toml  |   2 +-
 examples/boot/application/stm32l1/Cargo.toml  |   2 +-
 examples/boot/application/stm32l4/Cargo.toml  |   2 +-
 examples/boot/application/stm32wl/Cargo.toml  |   2 +-
 examples/nrf-rtos-trace/Cargo.toml            |   2 +-
 examples/nrf52840/Cargo.toml                  |   2 +-
 examples/nrf5340/Cargo.toml                   |   2 +-
 examples/rp/Cargo.toml                        |   2 +-
 examples/std/Cargo.toml                       |   2 +-
 examples/stm32c0/Cargo.toml                   |   2 +-
 examples/stm32f0/Cargo.toml                   |   2 +-
 examples/stm32f0/src/bin/multiprio.rs         |   2 +-
 examples/stm32f1/Cargo.toml                   |   2 +-
 examples/stm32f2/Cargo.toml                   |   2 +-
 examples/stm32f3/Cargo.toml                   |   2 +-
 examples/stm32f3/src/bin/multiprio.rs         |   2 +-
 examples/stm32f4/Cargo.toml                   |   2 +-
 examples/stm32f4/src/bin/multiprio.rs         |   2 +-
 examples/stm32f7/Cargo.toml                   |   2 +-
 examples/stm32g0/Cargo.toml                   |   2 +-
 examples/stm32g4/Cargo.toml                   |   2 +-
 examples/stm32h7/Cargo.toml                   |   2 +-
 examples/stm32l0/Cargo.toml                   |   2 +-
 examples/stm32l1/Cargo.toml                   |   2 +-
 examples/stm32l4/Cargo.toml                   |   2 +-
 examples/stm32l5/Cargo.toml                   |   2 +-
 examples/stm32u5/Cargo.toml                   |   2 +-
 examples/stm32wb/Cargo.toml                   |   2 +-
 examples/stm32wl/Cargo.toml                   |   2 +-
 examples/wasm/Cargo.toml                      |   2 +-
 tests/nrf/Cargo.toml                          |   2 +-
 tests/rp/Cargo.toml                           |   2 +-
 tests/stm32/Cargo.toml                        |   2 +-
 50 files changed, 667 insertions(+), 522 deletions(-)
 delete mode 100644 embassy-cortex-m/src/executor.rs

diff --git a/docs/modules/ROOT/examples/basic/Cargo.toml b/docs/modules/ROOT/examples/basic/Cargo.toml
index d9f8a285..e3e446e6 100644
--- a/docs/modules/ROOT/examples/basic/Cargo.toml
+++ b/docs/modules/ROOT/examples/basic/Cargo.toml
@@ -6,7 +6,7 @@ version = "0.1.0"
 license = "MIT OR Apache-2.0"
 
 [dependencies]
-embassy-executor = { version = "0.1.0", path = "../../../../../embassy-executor", features = ["defmt", "nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../../embassy-executor", features = ["defmt", "nightly", "integrated-timers", "arch-cortex-m", "executor-thread"] }
 embassy-time = { version = "0.1.0", path = "../../../../../embassy-time", features = ["defmt", "nightly"] }
 embassy-nrf = { version = "0.1.0", path = "../../../../../embassy-nrf", features = ["defmt", "nrf52840", "time-driver-rtc1", "gpiote", "nightly"] }
 
diff --git a/docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml b/docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml
index c9a963d4..a11a7e0b 100644
--- a/docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml
+++ b/docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml
@@ -8,7 +8,7 @@ license = "MIT OR Apache-2.0"
 cortex-m = "0.7"
 cortex-m-rt = "0.7"
 embassy-stm32 = { version = "0.1.0", features = ["stm32l475vg", "memory-x", "exti"], default-features = false  }
-embassy-executor = { version = "0.1.0", default-features = false, features = ["nightly"] }
+embassy-executor = { version = "0.1.0", default-features = false, features = ["nightly", "arch-cortex-m", "executor-thread"] }
 
 defmt = "0.3.0"
 defmt-rtt = "0.3.0"
diff --git a/embassy-cortex-m/src/executor.rs b/embassy-cortex-m/src/executor.rs
deleted file mode 100644
index 558539e7..00000000
--- a/embassy-cortex-m/src/executor.rs
+++ /dev/null
@@ -1,116 +0,0 @@
-//! Executor specific to cortex-m devices.
-
-use core::cell::UnsafeCell;
-use core::mem::MaybeUninit;
-
-use atomic_polyfill::{AtomicBool, Ordering};
-use cortex_m::interrupt::InterruptNumber;
-use cortex_m::peripheral::NVIC;
-pub use embassy_executor::*;
-
-#[derive(Clone, Copy)]
-struct N(u16);
-unsafe impl cortex_m::interrupt::InterruptNumber for N {
-    fn number(self) -> u16 {
-        self.0
-    }
-}
-
-fn pend_by_number(n: u16) {
-    cortex_m::peripheral::NVIC::pend(N(n))
-}
-
-/// Interrupt mode executor.
-///
-/// This executor runs tasks in interrupt mode. The interrupt handler is set up
-/// to poll tasks, and when a task is woken the interrupt is pended from software.
-///
-/// This allows running async tasks at a priority higher than thread mode. One
-/// use case is to leave thread mode free for non-async tasks. Another use case is
-/// to run multiple executors: one in thread mode for low priority tasks and another in
-/// interrupt mode for higher priority tasks. Higher priority tasks will preempt lower
-/// priority ones.
-///
-/// It is even possible to run multiple interrupt mode executors at different priorities,
-/// by assigning different priorities to the interrupts. For an example on how to do this,
-/// See the 'multiprio' example for 'embassy-nrf'.
-///
-/// To use it, you have to pick an interrupt that won't be used by the hardware.
-/// Some chips reserve some interrupts for this purpose, sometimes named "software interrupts" (SWI).
-/// If this is not the case, you may use an interrupt from any unused peripheral.
-///
-/// It is somewhat more complex to use, it's recommended to use the thread-mode
-/// [`Executor`] instead, if it works for your use case.
-pub struct InterruptExecutor {
-    started: AtomicBool,
-    executor: UnsafeCell<MaybeUninit<raw::Executor>>,
-}
-
-unsafe impl Send for InterruptExecutor {}
-unsafe impl Sync for InterruptExecutor {}
-
-impl InterruptExecutor {
-    /// Create a new, not started `InterruptExecutor`.
-    #[inline]
-    pub const fn new() -> Self {
-        Self {
-            started: AtomicBool::new(false),
-            executor: UnsafeCell::new(MaybeUninit::uninit()),
-        }
-    }
-
-    /// Executor interrupt callback.
-    ///
-    /// # Safety
-    ///
-    /// You MUST call this from the interrupt handler, and from nowhere else.
-    pub unsafe fn on_interrupt(&'static self) {
-        let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
-        executor.poll();
-    }
-
-    /// Start the executor.
-    ///
-    /// This initializes the executor, enables the interrupt, and returns.
-    /// The executor keeps running in the background through the interrupt.
-    ///
-    /// This returns a [`SendSpawner`] you can use to spawn tasks on it. A [`SendSpawner`]
-    /// is returned instead of a [`Spawner`](embassy_executor::Spawner) because the executor effectively runs in a
-    /// different "thread" (the interrupt), so spawning tasks on it is effectively
-    /// sending them.
-    ///
-    /// To obtain a [`Spawner`](embassy_executor::Spawner) for this executor, use [`Spawner::for_current_executor()`](embassy_executor::Spawner::for_current_executor()) from
-    /// a task running in it.
-    ///
-    /// # Interrupt requirements
-    ///
-    /// You must write the interrupt handler yourself, and make it call [`on_interrupt()`](Self::on_interrupt).
-    ///
-    /// This method already enables (unmasks) the interrupt, you must NOT do it yourself.
-    ///
-    /// You must set the interrupt priority before calling this method. You MUST NOT
-    /// do it after.
-    ///
-    pub fn start(&'static self, irq: impl InterruptNumber) -> SendSpawner {
-        if self
-            .started
-            .compare_exchange(false, true, Ordering::Acquire, Ordering::Relaxed)
-            .is_err()
-        {
-            panic!("InterruptExecutor::start() called multiple times on the same executor.");
-        }
-
-        unsafe {
-            (&mut *self.executor.get()).as_mut_ptr().write(raw::Executor::new(
-                |ctx| pend_by_number(ctx as u16),
-                irq.number() as *mut (),
-            ))
-        }
-
-        let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
-
-        unsafe { NVIC::unmask(irq) }
-
-        executor.spawner().make_send()
-    }
-}
diff --git a/embassy-cortex-m/src/lib.rs b/embassy-cortex-m/src/lib.rs
index fba23367..e4b713a0 100644
--- a/embassy-cortex-m/src/lib.rs
+++ b/embassy-cortex-m/src/lib.rs
@@ -5,6 +5,6 @@
 // This mod MUST go first, so that the others see its macros.
 pub(crate) mod fmt;
 
-pub mod executor;
+pub use embassy_executor as executor;
 pub mod interrupt;
 pub mod peripheral;
diff --git a/embassy-executor/Cargo.toml b/embassy-executor/Cargo.toml
index 8ad3fd69..bb8a46c8 100644
--- a/embassy-executor/Cargo.toml
+++ b/embassy-executor/Cargo.toml
@@ -31,9 +31,22 @@ flavors = [
 features = ["std", "nightly", "defmt"]
 
 [features]
-default = []
-std = ["critical-section/std"]
-wasm = ["dep:wasm-bindgen", "dep:js-sys"]
+
+# Architecture
+_arch = [] # some arch was picked
+arch-std = ["_arch", "critical-section/std"]
+arch-cortex-m = ["_arch", "dep:cortex-m"]
+arch-xtensa = ["_arch"]
+arch-riscv32 = ["_arch"]
+arch-wasm = ["_arch", "dep:wasm-bindgen", "dep:js-sys"]
+
+# Enable creating a `Pender` from an arbitrary function pointer callback.
+pender-callback = []
+
+# Enable the thread-mode executor (using WFE/SEV in Cortex-M, WFI in other embedded archs)
+executor-thread = []
+# Enable the interrupt-mode executor (available in Cortex-M only)
+executor-interrupt = []
 
 # Enable nightly-only features
 nightly = []
@@ -55,9 +68,11 @@ embassy-macros  = { version = "0.1.0", path = "../embassy-macros" }
 embassy-time  = { version = "0.1.0", path = "../embassy-time", optional = true}
 atomic-polyfill = "1.0.1"
 critical-section = "1.1"
-cfg-if = "1.0.0"
 static_cell = "1.0"
 
-# WASM dependencies
+# arch-cortex-m dependencies
+cortex-m = { version = "0.7.6", optional = true }
+
+# arch-wasm dependencies
 wasm-bindgen = { version = "0.2.82", optional = true }
 js-sys = { version = "0.3", optional = true }
diff --git a/embassy-executor/src/arch/cortex_m.rs b/embassy-executor/src/arch/cortex_m.rs
index 4b27a264..d6a55c4c 100644
--- a/embassy-executor/src/arch/cortex_m.rs
+++ b/embassy-executor/src/arch/cortex_m.rs
@@ -1,59 +1,209 @@
-use core::arch::asm;
-use core::marker::PhantomData;
-use core::ptr;
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::arch::asm;
+    use core::marker::PhantomData;
 
-use super::{raw, Spawner};
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_cortex_m as main;
 
-/// Thread mode executor, using WFE/SEV.
-///
-/// This is the simplest and most common kind of executor. It runs on
-/// thread mode (at the lowest priority level), and uses the `WFE` ARM instruction
-/// to sleep when it has no more work to do. When a task is woken, a `SEV` instruction
-/// is executed, to make the `WFE` exit from sleep and poll the task.
-///
-/// This executor allows for ultra low power consumption for chips where `WFE`
-/// triggers low-power sleep without extra steps. If your chip requires extra steps,
-/// you may use [`raw::Executor`] directly to program custom behavior.
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            inner: raw::Executor::new(|_| unsafe { asm!("sev") }, ptr::null_mut()),
-            not_send: PhantomData,
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
+
+    impl ThreadPender {
+        pub(crate) fn pend(self) {
+            unsafe { core::arch::asm!("sev") }
         }
     }
 
-    /// Run the executor.
+    /// Thread mode executor, using WFE/SEV.
     ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
+    /// This is the simplest and most common kind of executor. It runs on
+    /// thread mode (at the lowest priority level), and uses the `WFE` ARM instruction
+    /// to sleep when it has no more work to do. When a task is woken, a `SEV` instruction
+    /// is executed, to make the `WFE` exit from sleep and poll the task.
     ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// This executor allows for ultra low power consumption for chips where `WFE`
+    /// triggers low-power sleep without extra steps. If your chip requires extra steps,
+    /// you may use [`raw::Executor`] directly to program custom behavior.
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    asm!("wfe");
+                };
+            }
+        }
+    }
+}
+
+#[cfg(feature = "executor-interrupt")]
+pub use interrupt::*;
+#[cfg(feature = "executor-interrupt")]
+mod interrupt {
+    use core::cell::UnsafeCell;
+    use core::mem::MaybeUninit;
+
+    use atomic_polyfill::{AtomicBool, Ordering};
+    use cortex_m::interrupt::InterruptNumber;
+    use cortex_m::peripheral::NVIC;
+
+    use crate::raw::{self, Pender, PenderInner};
+
+    #[derive(Clone, Copy)]
+    pub(crate) struct InterruptPender(u16);
+
+    impl InterruptPender {
+        pub(crate) fn pend(self) {
+            // STIR is faster, but is only available in v7 and higher.
+            #[cfg(not(armv6m))]
+            {
+                let mut nvic: cortex_m::peripheral::NVIC = unsafe { core::mem::transmute(()) };
+                nvic.request(self);
+            }
+
+            #[cfg(armv6m)]
+            cortex_m::peripheral::NVIC::pend(self);
+        }
+    }
+
+    unsafe impl cortex_m::interrupt::InterruptNumber for InterruptPender {
+        fn number(self) -> u16 {
+            self.0
+        }
+    }
+
+    /// Interrupt mode executor.
+    ///
+    /// This executor runs tasks in interrupt mode. The interrupt handler is set up
+    /// to poll tasks, and when a task is woken the interrupt is pended from software.
+    ///
+    /// This allows running async tasks at a priority higher than thread mode. One
+    /// use case is to leave thread mode free for non-async tasks. Another use case is
+    /// to run multiple executors: one in thread mode for low priority tasks and another in
+    /// interrupt mode for higher priority tasks. Higher priority tasks will preempt lower
+    /// priority ones.
+    ///
+    /// It is even possible to run multiple interrupt mode executors at different priorities,
+    /// by assigning different priorities to the interrupts. For an example on how to do this,
+    /// See the 'multiprio' example for 'embassy-nrf'.
+    ///
+    /// To use it, you have to pick an interrupt that won't be used by the hardware.
+    /// Some chips reserve some interrupts for this purpose, sometimes named "software interrupts" (SWI).
+    /// If this is not the case, you may use an interrupt from any unused peripheral.
+    ///
+    /// It is somewhat more complex to use, it's recommended to use the thread-mode
+    /// [`Executor`] instead, if it works for your use case.
+    pub struct InterruptExecutor {
+        started: AtomicBool,
+        executor: UnsafeCell<MaybeUninit<raw::Executor>>,
+    }
+
+    unsafe impl Send for InterruptExecutor {}
+    unsafe impl Sync for InterruptExecutor {}
+
+    impl InterruptExecutor {
+        /// Create a new, not started `InterruptExecutor`.
+        #[inline]
+        pub const fn new() -> Self {
+            Self {
+                started: AtomicBool::new(false),
+                executor: UnsafeCell::new(MaybeUninit::uninit()),
+            }
+        }
+
+        /// Executor interrupt callback.
+        ///
+        /// # Safety
+        ///
+        /// You MUST call this from the interrupt handler, and from nowhere else.
+        pub unsafe fn on_interrupt(&'static self) {
+            let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
+            executor.poll();
+        }
+
+        /// Start the executor.
+        ///
+        /// This initializes the executor, enables the interrupt, and returns.
+        /// The executor keeps running in the background through the interrupt.
+        ///
+        /// This returns a [`SendSpawner`] you can use to spawn tasks on it. A [`SendSpawner`]
+        /// is returned instead of a [`Spawner`](embassy_executor::Spawner) because the executor effectively runs in a
+        /// different "thread" (the interrupt), so spawning tasks on it is effectively
+        /// sending them.
+        ///
+        /// To obtain a [`Spawner`](embassy_executor::Spawner) for this executor, use [`Spawner::for_current_executor()`](embassy_executor::Spawner::for_current_executor()) from
+        /// a task running in it.
+        ///
+        /// # Interrupt requirements
+        ///
+        /// You must write the interrupt handler yourself, and make it call [`on_interrupt()`](Self::on_interrupt).
+        ///
+        /// This method already enables (unmasks) the interrupt, you must NOT do it yourself.
+        ///
+        /// You must set the interrupt priority before calling this method. You MUST NOT
+        /// do it after.
+        ///
+        pub fn start(&'static self, irq: impl InterruptNumber) -> crate::SendSpawner {
+            if self
+                .started
+                .compare_exchange(false, true, Ordering::Acquire, Ordering::Relaxed)
+                .is_err()
+            {
+                panic!("InterruptExecutor::start() called multiple times on the same executor.");
+            }
 
-        loop {
             unsafe {
-                self.inner.poll();
-                asm!("wfe");
-            };
+                (&mut *self.executor.get())
+                    .as_mut_ptr()
+                    .write(raw::Executor::new(Pender(PenderInner::Interrupt(InterruptPender(
+                        irq.number(),
+                    )))))
+            }
+
+            let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
+
+            unsafe { NVIC::unmask(irq) }
+
+            executor.spawner().make_send()
         }
     }
 }
diff --git a/embassy-executor/src/arch/riscv32.rs b/embassy-executor/src/arch/riscv32.rs
index e97a56cd..f66daeae 100644
--- a/embassy-executor/src/arch/riscv32.rs
+++ b/embassy-executor/src/arch/riscv32.rs
@@ -1,72 +1,83 @@
-use core::marker::PhantomData;
-use core::ptr;
-use core::sync::atomic::{AtomicBool, Ordering};
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-riscv32`.");
 
-use super::{raw, Spawner};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::marker::PhantomData;
+    use core::sync::atomic::{AtomicBool, Ordering};
 
-/// global atomic used to keep track of whether there is work to do since sev() is not available on RISCV
-///
-static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-/// RISCV32 Executor
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            // use Signal_Work_Thread_Mode as substitute for local interrupt register
-            inner: raw::Executor::new(
-                |_| {
-                    SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
-                },
-                ptr::null_mut(),
-            ),
-            not_send: PhantomData,
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            SIGNAL_WORK_THREAD_MODE.store(true, core::sync::atomic::Ordering::SeqCst);
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// global atomic used to keep track of whether there is work to do since sev() is not available on RISCV
+    static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-        loop {
-            unsafe {
-                self.inner.poll();
-                // we do not care about race conditions between the load and store operations, interrupts
-                //will only set this value to true.
-                critical_section::with(|_| {
-                    // if there is work to do, loop back to polling
-                    // TODO can we relax this?
-                    if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
-                        SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
-                    }
-                    // if not, wait for interrupt
-                    else {
-                        core::arch::asm!("wfi");
-                    }
-                });
-                // if an interrupt occurred while waiting, it will be serviced here
+    /// RISCV32 Executor
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    // we do not care about race conditions between the load and store operations, interrupts
+                    //will only set this value to true.
+                    critical_section::with(|_| {
+                        // if there is work to do, loop back to polling
+                        // TODO can we relax this?
+                        if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
+                            SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
+                        }
+                        // if not, wait for interrupt
+                        else {
+                            core::arch::asm!("wfi");
+                        }
+                    });
+                    // if an interrupt occurred while waiting, it will be serviced here
+                }
             }
         }
     }
diff --git a/embassy-executor/src/arch/std.rs b/embassy-executor/src/arch/std.rs
index 701f0eb1..4e4a178f 100644
--- a/embassy-executor/src/arch/std.rs
+++ b/embassy-executor/src/arch/std.rs
@@ -1,84 +1,100 @@
-use std::marker::PhantomData;
-use std::sync::{Condvar, Mutex};
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-std`.");
 
-use super::{raw, Spawner};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use std::marker::PhantomData;
+    use std::sync::{Condvar, Mutex};
 
-/// Single-threaded std-based executor.
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-    signaler: &'static Signaler,
-}
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_std as main;
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        let signaler = &*Box::leak(Box::new(Signaler::new()));
-        Self {
-            inner: raw::Executor::new(
-                |p| unsafe {
-                    let s = &*(p as *const () as *const Signaler);
-                    s.signal()
-                },
-                signaler as *const _ as _,
-            ),
-            not_send: PhantomData,
-            signaler,
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
+
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender(&'static Signaler);
+
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            self.0.signal()
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
-
-        loop {
-            unsafe { self.inner.poll() };
-            self.signaler.wait()
-        }
+    /// Single-threaded std-based executor.
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+        signaler: &'static Signaler,
     }
-}
 
-struct Signaler {
-    mutex: Mutex<bool>,
-    condvar: Condvar,
-}
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            let signaler = &*Box::leak(Box::new(Signaler::new()));
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender(signaler)))),
+                not_send: PhantomData,
+                signaler,
+            }
+        }
 
-impl Signaler {
-    fn new() -> Self {
-        Self {
-            mutex: Mutex::new(false),
-            condvar: Condvar::new(),
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe { self.inner.poll() };
+                self.signaler.wait()
+            }
         }
     }
 
-    fn wait(&self) {
-        let mut signaled = self.mutex.lock().unwrap();
-        while !*signaled {
-            signaled = self.condvar.wait(signaled).unwrap();
-        }
-        *signaled = false;
+    struct Signaler {
+        mutex: Mutex<bool>,
+        condvar: Condvar,
     }
 
-    fn signal(&self) {
-        let mut signaled = self.mutex.lock().unwrap();
-        *signaled = true;
-        self.condvar.notify_one();
+    impl Signaler {
+        fn new() -> Self {
+            Self {
+                mutex: Mutex::new(false),
+                condvar: Condvar::new(),
+            }
+        }
+
+        fn wait(&self) {
+            let mut signaled = self.mutex.lock().unwrap();
+            while !*signaled {
+                signaled = self.condvar.wait(signaled).unwrap();
+            }
+            *signaled = false;
+        }
+
+        fn signal(&self) {
+            let mut signaled = self.mutex.lock().unwrap();
+            *signaled = true;
+            self.condvar.notify_one();
+        }
     }
 }
diff --git a/embassy-executor/src/arch/wasm.rs b/embassy-executor/src/arch/wasm.rs
index 98091cfb..08ab16b9 100644
--- a/embassy-executor/src/arch/wasm.rs
+++ b/embassy-executor/src/arch/wasm.rs
@@ -1,74 +1,88 @@
-use core::marker::PhantomData;
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-wasm`.");
 
-use js_sys::Promise;
-use wasm_bindgen::prelude::*;
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
 
-use super::raw::util::UninitCell;
-use super::raw::{self};
-use super::Spawner;
+    use core::marker::PhantomData;
 
-/// WASM executor, wasm_bindgen to schedule tasks on the JS event loop.
-pub struct Executor {
-    inner: raw::Executor,
-    ctx: &'static WasmContext,
-    not_send: PhantomData<*mut ()>,
-}
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_wasm as main;
+    use js_sys::Promise;
+    use wasm_bindgen::prelude::*;
 
-pub(crate) struct WasmContext {
-    promise: Promise,
-    closure: UninitCell<Closure<dyn FnMut(JsValue)>>,
-}
+    use crate::raw::util::UninitCell;
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-impl WasmContext {
-    pub fn new() -> Self {
-        Self {
-            promise: Promise::resolve(&JsValue::undefined()),
-            closure: UninitCell::uninit(),
-        }
+    /// WASM executor, wasm_bindgen to schedule tasks on the JS event loop.
+    pub struct Executor {
+        inner: raw::Executor,
+        ctx: &'static WasmContext,
+        not_send: PhantomData<*mut ()>,
     }
-}
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        let ctx = &*Box::leak(Box::new(WasmContext::new()));
-        let inner = raw::Executor::new(
-            |p| unsafe {
-                let ctx = &*(p as *const () as *const WasmContext);
-                let _ = ctx.promise.then(ctx.closure.as_mut());
-            },
-            ctx as *const _ as _,
-        );
-        Self {
-            inner,
-            not_send: PhantomData,
-            ctx,
+    pub(crate) struct WasmContext {
+        promise: Promise,
+        closure: UninitCell<Closure<dyn FnMut(JsValue)>>,
+    }
+
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender(&'static WasmContext);
+
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            let _ = self.0.promise.then(unsafe { self.0.closure.as_mut() });
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    pub fn start(&'static mut self, init: impl FnOnce(Spawner)) {
-        unsafe {
-            let executor = &self.inner;
-            self.ctx.closure.write(Closure::new(move |_| {
-                executor.poll();
-            }));
-            init(self.inner.spawner());
+    impl WasmContext {
+        pub fn new() -> Self {
+            Self {
+                promise: Promise::resolve(&JsValue::undefined()),
+                closure: UninitCell::uninit(),
+            }
+        }
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            let ctx = &*Box::leak(Box::new(WasmContext::new()));
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender(ctx)))),
+                not_send: PhantomData,
+                ctx,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        pub fn start(&'static mut self, init: impl FnOnce(Spawner)) {
+            unsafe {
+                let executor = &self.inner;
+                self.ctx.closure.write(Closure::new(move |_| {
+                    executor.poll();
+                }));
+                init(self.inner.spawner());
+            }
         }
     }
 }
diff --git a/embassy-executor/src/arch/xtensa.rs b/embassy-executor/src/arch/xtensa.rs
index 4ee0d9f7..61ea92c1 100644
--- a/embassy-executor/src/arch/xtensa.rs
+++ b/embassy-executor/src/arch/xtensa.rs
@@ -1,73 +1,84 @@
-use core::marker::PhantomData;
-use core::ptr;
-use core::sync::atomic::{AtomicBool, Ordering};
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-xtensa`.");
 
-use super::{raw, Spawner};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::marker::PhantomData;
+    use core::sync::atomic::{AtomicBool, Ordering};
 
-/// global atomic used to keep track of whether there is work to do since sev() is not available on Xtensa
-///
-static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-/// Xtensa Executor
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            // use Signal_Work_Thread_Mode as substitute for local interrupt register
-            inner: raw::Executor::new(
-                |_| {
-                    SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
-                },
-                ptr::null_mut(),
-            ),
-            not_send: PhantomData,
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            SIGNAL_WORK_THREAD_MODE.store(true, core::sync::atomic::Ordering::SeqCst);
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// global atomic used to keep track of whether there is work to do since sev() is not available on Xtensa
+    static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-        loop {
-            unsafe {
-                self.inner.poll();
-                // we do not care about race conditions between the load and store operations, interrupts
-                // will only set this value to true.
-                // if there is work to do, loop back to polling
-                // TODO can we relax this?
-                critical_section::with(|_| {
-                    if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
-                        SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
-                    } else {
-                        // waiti sets the PS.INTLEVEL when slipping into sleep
-                        // because critical sections in Xtensa are implemented via increasing
-                        // PS.INTLEVEL the critical section ends here
-                        // take care not add code after `waiti` if it needs to be inside the CS
-                        core::arch::asm!("waiti 0"); // critical section ends here
-                    }
-                });
+    /// Xtensa Executor
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    // we do not care about race conditions between the load and store operations, interrupts
+                    // will only set this value to true.
+                    // if there is work to do, loop back to polling
+                    // TODO can we relax this?
+                    critical_section::with(|_| {
+                        if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
+                            SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
+                        } else {
+                            // waiti sets the PS.INTLEVEL when slipping into sleep
+                            // because critical sections in Xtensa are implemented via increasing
+                            // PS.INTLEVEL the critical section ends here
+                            // take care not add code after `waiti` if it needs to be inside the CS
+                            core::arch::asm!("waiti 0"); // critical section ends here
+                        }
+                    });
+                }
             }
         }
     }
diff --git a/embassy-executor/src/lib.rs b/embassy-executor/src/lib.rs
index 8707995b..3ce687eb 100644
--- a/embassy-executor/src/lib.rs
+++ b/embassy-executor/src/lib.rs
@@ -1,5 +1,5 @@
-#![cfg_attr(not(any(feature = "std", feature = "wasm")), no_std)]
-#![cfg_attr(all(feature = "nightly", target_arch = "xtensa"), feature(asm_experimental_arch))]
+#![cfg_attr(not(any(feature = "arch-std", feature = "arch-wasm")), no_std)]
+#![cfg_attr(all(feature = "nightly", feature = "arch-xtensa"), feature(asm_experimental_arch))]
 #![allow(clippy::new_without_default)]
 #![doc = include_str!("../README.md")]
 #![warn(missing_docs)]
@@ -10,41 +10,35 @@ pub(crate) mod fmt;
 #[cfg(feature = "nightly")]
 pub use embassy_macros::task;
 
-cfg_if::cfg_if! {
-    if #[cfg(cortex_m)] {
-        #[path="arch/cortex_m.rs"]
-        mod arch;
-        pub use arch::*;
-        #[cfg(feature = "nightly")]
-        pub use embassy_macros::main_cortex_m as main;
-    }
-    else if #[cfg(target_arch="riscv32")] {
-        #[path="arch/riscv32.rs"]
-        mod arch;
-        pub use arch::*;
-        #[cfg(feature = "nightly")]
-        pub use embassy_macros::main_riscv as main;
-    }
-    else if #[cfg(all(target_arch="xtensa", feature = "nightly"))] {
-        #[path="arch/xtensa.rs"]
-        mod arch;
-        pub use arch::*;
-    }
-    else if #[cfg(feature="wasm")] {
-        #[path="arch/wasm.rs"]
-        mod arch;
-        pub use arch::*;
-        #[cfg(feature = "nightly")]
-        pub use embassy_macros::main_wasm as main;
-    }
-    else if #[cfg(feature="std")] {
-        #[path="arch/std.rs"]
-        mod arch;
-        pub use arch::*;
-        #[cfg(feature = "nightly")]
-        pub use embassy_macros::main_std as main;
-    }
+macro_rules! check_at_most_one {
+    (@amo [$($feats:literal)*] [] [$($res:tt)*]) => {
+        #[cfg(any($($res)*))]
+        compile_error!(concat!("At most one of these features can be enabled at the same time:", $(" `", $feats, "`",)*));
+    };
+    (@amo $feats:tt [$curr:literal $($rest:literal)*] [$($res:tt)*]) => {
+        check_at_most_one!(@amo $feats [$($rest)*] [$($res)* $(all(feature=$curr, feature=$rest),)*]);
+    };
+    ($($f:literal),*$(,)?) => {
+        check_at_most_one!(@amo [$($f)*] [$($f)*] []);
+    };
 }
+check_at_most_one!("arch-cortex-m", "arch-riscv32", "arch-xtensa", "arch-std", "arch-wasm",);
+
+#[cfg(feature = "_arch")]
+#[cfg_attr(feature = "arch-cortex-m", path = "arch/cortex_m.rs")]
+#[cfg_attr(feature = "arch-riscv32", path = "arch/riscv32.rs")]
+#[cfg_attr(feature = "arch-xtensa", path = "arch/xtensa.rs")]
+#[cfg_attr(feature = "arch-std", path = "arch/std.rs")]
+#[cfg_attr(feature = "arch-wasm", path = "arch/wasm.rs")]
+mod arch;
+
+#[cfg(feature = "_arch")]
+pub use arch::*;
+
+pub mod raw;
+
+mod spawner;
+pub use spawner::*;
 
 /// Implementation details for embassy macros.
 /// Do not use. Used for macros and HALs only. Not covered by semver guarantees.
@@ -72,8 +66,3 @@ pub mod _export {
         ($($tt:tt)*) => {};
     }
 }
-
-pub mod raw;
-
-mod spawner;
-pub use spawner::*;
diff --git a/embassy-executor/src/raw/mod.rs b/embassy-executor/src/raw/mod.rs
index 72c367c3..f6c66da5 100644
--- a/embassy-executor/src/raw/mod.rs
+++ b/embassy-executor/src/raw/mod.rs
@@ -19,7 +19,6 @@ use core::marker::PhantomData;
 use core::mem;
 use core::pin::Pin;
 use core::ptr::NonNull;
-use core::sync::atomic::AtomicPtr;
 use core::task::{Context, Poll};
 
 use atomic_polyfill::{AtomicU32, Ordering};
@@ -290,10 +289,60 @@ impl<F: Future + 'static, const N: usize> TaskPool<F, N> {
     }
 }
 
+#[derive(Clone, Copy)]
+pub(crate) enum PenderInner {
+    #[cfg(feature = "executor-thread")]
+    Thread(crate::arch::ThreadPender),
+    #[cfg(feature = "executor-interrupt")]
+    Interrupt(crate::arch::InterruptPender),
+    #[cfg(feature = "pender-callback")]
+    Callback { func: fn(*mut ()), context: *mut () },
+}
+
+unsafe impl Send for PenderInner {}
+unsafe impl Sync for PenderInner {}
+
+/// Platform/architecture-specific action executed when an executor has pending work.
+///
+/// When a task within an executor is woken, the `Pender` is called. This does a
+/// platform/architecture-specific action to signal there is pending work in the executor.
+/// When this happens, you must arrange for [`Executor::poll`] to be called.
+///
+/// You can think of it as a waker, but for the whole executor.
+pub struct Pender(pub(crate) PenderInner);
+
+impl Pender {
+    /// Create a `Pender` that will call an arbitrary function pointer.
+    ///
+    /// # Arguments
+    ///
+    /// - `func`: The function pointer to call.
+    /// - `context`: Opaque context pointer, that will be passed to the function pointer.
+    #[cfg(feature = "pender-callback")]
+    pub fn new_from_callback(func: fn(*mut ()), context: *mut ()) -> Self {
+        Self(PenderInner::Callback {
+            func,
+            context: context.into(),
+        })
+    }
+}
+
+impl Pender {
+    pub(crate) fn pend(&self) {
+        match self.0 {
+            #[cfg(feature = "executor-thread")]
+            PenderInner::Thread(x) => x.pend(),
+            #[cfg(feature = "executor-interrupt")]
+            PenderInner::Interrupt(x) => x.pend(),
+            #[cfg(feature = "pender-callback")]
+            PenderInner::Callback { func, context } => func(context),
+        }
+    }
+}
+
 pub(crate) struct SyncExecutor {
     run_queue: RunQueue,
-    signal_fn: fn(*mut ()),
-    signal_ctx: AtomicPtr<()>,
+    pender: Pender,
 
     #[cfg(feature = "integrated-timers")]
     pub(crate) timer_queue: timer_queue::TimerQueue,
@@ -302,16 +351,13 @@ pub(crate) struct SyncExecutor {
 }
 
 impl SyncExecutor {
-    pub(crate) fn new(signal_fn: fn(*mut ()), signal_ctx: *mut ()) -> Self {
+    pub(crate) fn new(pender: Pender) -> Self {
         #[cfg(feature = "integrated-timers")]
         let alarm = unsafe { unwrap!(driver::allocate_alarm()) };
-        #[cfg(feature = "integrated-timers")]
-        driver::set_alarm_callback(alarm, signal_fn, signal_ctx);
 
         Self {
             run_queue: RunQueue::new(),
-            signal_fn,
-            signal_ctx: AtomicPtr::new(signal_ctx),
+            pender,
 
             #[cfg(feature = "integrated-timers")]
             timer_queue: timer_queue::TimerQueue::new(),
@@ -332,10 +378,16 @@ impl SyncExecutor {
         trace::task_ready_begin(task.as_ptr() as u32);
 
         if self.run_queue.enqueue(cs, task) {
-            (self.signal_fn)(self.signal_ctx.load(Ordering::Relaxed))
+            self.pender.pend();
         }
     }
 
+    #[cfg(feature = "integrated-timers")]
+    fn alarm_callback(ctx: *mut ()) {
+        let this: &Self = unsafe { &*(ctx as *const Self) };
+        this.pender.pend();
+    }
+
     pub(super) unsafe fn spawn(&'static self, task: TaskRef) {
         task.header().executor.set(Some(self));
 
@@ -351,6 +403,9 @@ impl SyncExecutor {
     ///
     /// Same as [`Executor::poll`], plus you must only call this on the thread this executor was created.
     pub(crate) unsafe fn poll(&'static self) {
+        #[cfg(feature = "integrated-timers")]
+        driver::set_alarm_callback(self.alarm, Self::alarm_callback, self as *const _ as *mut ());
+
         #[allow(clippy::never_loop)]
         loop {
             #[cfg(feature = "integrated-timers")]
@@ -417,14 +472,14 @@ impl SyncExecutor {
 ///
 /// - To get the executor to do work, call `poll()`. This will poll all queued tasks (all tasks
 ///   that "want to run").
-/// - You must supply a `signal_fn`. The executor will call it to notify you it has work
+/// - You must supply a [`Pender`]. The executor will call it to notify you it has work
 ///   to do. You must arrange for `poll()` to be called as soon as possible.
 ///
-/// `signal_fn` can be called from *any* context: any thread, any interrupt priority
+/// The [`Pender`] can be called from *any* context: any thread, any interrupt priority
 /// level, etc. It may be called synchronously from any `Executor` method call as well.
 /// You must deal with this correctly.
 ///
-/// In particular, you must NOT call `poll` directly from `signal_fn`, as this violates
+/// In particular, you must NOT call `poll` directly from the pender callback, as this violates
 /// the requirement for `poll` to not be called reentrantly.
 #[repr(transparent)]
 pub struct Executor {
@@ -437,15 +492,15 @@ impl Executor {
     pub(crate) unsafe fn wrap(inner: &SyncExecutor) -> &Self {
         mem::transmute(inner)
     }
+
     /// Create a new executor.
     ///
-    /// When the executor has work to do, it will call `signal_fn` with
-    /// `signal_ctx` as argument.
+    /// When the executor has work to do, it will call the [`Pender`].
     ///
-    /// See [`Executor`] docs for details on `signal_fn`.
-    pub fn new(signal_fn: fn(*mut ()), signal_ctx: *mut ()) -> Self {
+    /// See [`Executor`] docs for details on `Pender`.
+    pub fn new(pender: Pender) -> Self {
         Self {
-            inner: SyncExecutor::new(signal_fn, signal_ctx),
+            inner: SyncExecutor::new(pender),
             _not_sync: PhantomData,
         }
     }
@@ -468,16 +523,16 @@ impl Executor {
     /// This loops over all tasks that are queued to be polled (i.e. they're
     /// freshly spawned or they've been woken). Other tasks are not polled.
     ///
-    /// You must call `poll` after receiving a call to `signal_fn`. It is OK
-    /// to call `poll` even when not requested by `signal_fn`, but it wastes
+    /// You must call `poll` after receiving a call to the [`Pender`]. It is OK
+    /// to call `poll` even when not requested by the `Pender`, but it wastes
     /// energy.
     ///
     /// # Safety
     ///
     /// You must NOT call `poll` reentrantly on the same executor.
     ///
-    /// In particular, note that `poll` may call `signal_fn` synchronously. Therefore, you
-    /// must NOT directly call `poll()` from your `signal_fn`. Instead, `signal_fn` has to
+    /// In particular, note that `poll` may call the `Pender` synchronously. Therefore, you
+    /// must NOT directly call `poll()` from the `Pender` callback. Instead, the callback has to
     /// somehow schedule for `poll()` to be called later, at a time you know for sure there's
     /// no `poll()` already running.
     pub unsafe fn poll(&'static self) {
diff --git a/examples/boot/application/nrf/Cargo.toml b/examples/boot/application/nrf/Cargo.toml
index 88899325..e75c73cb 100644
--- a/examples/boot/application/nrf/Cargo.toml
+++ b/examples/boot/application/nrf/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync" }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers", "arch-cortex-m", "executor-thread"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly"] }
 embassy-nrf = { version = "0.1.0", path = "../../../../embassy-nrf", features = ["time-driver-rtc1", "gpiote", "nightly"] }
 embassy-boot = { version = "0.1.0", path = "../../../../embassy-boot/boot" }
diff --git a/examples/boot/application/rp/Cargo.toml b/examples/boot/application/rp/Cargo.toml
index 8d826790..8de2d2eb 100644
--- a/examples/boot/application/rp/Cargo.toml
+++ b/examples/boot/application/rp/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync" }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers", "arch-cortex-m", "executor-thread"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly"] }
 embassy-rp = { version = "0.1.0", path = "../../../../embassy-rp", features = ["time-driver", "unstable-traits", "nightly"] }
 embassy-boot-rp = { version = "0.1.0", path = "../../../../embassy-boot/rp" }
diff --git a/examples/boot/application/stm32f3/Cargo.toml b/examples/boot/application/stm32f3/Cargo.toml
index aa279fb7..083607de 100644
--- a/examples/boot/application/stm32f3/Cargo.toml
+++ b/examples/boot/application/stm32f3/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32f303re", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32f7/Cargo.toml b/examples/boot/application/stm32f7/Cargo.toml
index 1ec0643a..74f50851 100644
--- a/examples/boot/application/stm32f7/Cargo.toml
+++ b/examples/boot/application/stm32f7/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32f767zi", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32h7/Cargo.toml b/examples/boot/application/stm32h7/Cargo.toml
index a4eefe2a..898b9a47 100644
--- a/examples/boot/application/stm32h7/Cargo.toml
+++ b/examples/boot/application/stm32h7/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync" }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32h743zi", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32l0/Cargo.toml b/examples/boot/application/stm32l0/Cargo.toml
index 36eada29..e142c848 100644
--- a/examples/boot/application/stm32l0/Cargo.toml
+++ b/examples/boot/application/stm32l0/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32l072cz", "time-driver-any", "exti", "memory-x"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32l1/Cargo.toml b/examples/boot/application/stm32l1/Cargo.toml
index 67efda74..f0e92e1a 100644
--- a/examples/boot/application/stm32l1/Cargo.toml
+++ b/examples/boot/application/stm32l1/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32l151cb-a", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32l4/Cargo.toml b/examples/boot/application/stm32l4/Cargo.toml
index 4b2e02dd..87689e9a 100644
--- a/examples/boot/application/stm32l4/Cargo.toml
+++ b/examples/boot/application/stm32l4/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32l475vg", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/boot/application/stm32wl/Cargo.toml b/examples/boot/application/stm32wl/Cargo.toml
index fecbfc51..a6708bf5 100644
--- a/examples/boot/application/stm32wl/Cargo.toml
+++ b/examples/boot/application/stm32wl/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../../../embassy-time", features = ["nightly", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../../../embassy-stm32", features = ["unstable-traits", "nightly", "stm32wl55jc-cm4", "time-driver-any", "exti"]  }
 embassy-boot-stm32 = { version = "0.1.0", path = "../../../../embassy-boot/stm32" }
diff --git a/examples/nrf-rtos-trace/Cargo.toml b/examples/nrf-rtos-trace/Cargo.toml
index d8c24dfa..7910b372 100644
--- a/examples/nrf-rtos-trace/Cargo.toml
+++ b/examples/nrf-rtos-trace/Cargo.toml
@@ -17,7 +17,7 @@ log = [
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync" }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features=["rtos-trace", "rtos-trace-interrupt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "rtos-trace", "rtos-trace-interrupt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time" }
 embassy-nrf = { version = "0.1.0", path = "../../embassy-nrf", features = ["nrf52840", "time-driver-rtc1", "gpiote", "unstable-pac"] }
 
diff --git a/examples/nrf52840/Cargo.toml b/examples/nrf52840/Cargo.toml
index cc88d92c..3ece2406 100644
--- a/examples/nrf52840/Cargo.toml
+++ b/examples/nrf52840/Cargo.toml
@@ -12,7 +12,7 @@ nightly = ["embassy-executor/nightly", "embassy-nrf/nightly", "embassy-net/night
 [dependencies]
 embassy-futures = { version = "0.1.0", path = "../../embassy-futures" }
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "executor-interrupt", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime"] }
 embassy-nrf = { version = "0.1.0", path = "../../embassy-nrf", features = ["defmt", "nrf52840", "time-driver-rtc1", "gpiote", "unstable-pac", "time"] }
 embassy-net = { version = "0.1.0", path = "../../embassy-net", features = ["defmt", "tcp", "dhcpv4", "medium-ethernet"], optional = true }
diff --git a/examples/nrf5340/Cargo.toml b/examples/nrf5340/Cargo.toml
index e88ddf2f..4134db46 100644
--- a/examples/nrf5340/Cargo.toml
+++ b/examples/nrf5340/Cargo.toml
@@ -9,7 +9,7 @@ embassy-futures = { version = "0.1.0", path = "../../embassy-futures" }
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = [
     "defmt",
 ] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = [
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", 
     "nightly",
     "defmt",
     "integrated-timers",
diff --git a/examples/rp/Cargo.toml b/examples/rp/Cargo.toml
index 1e8870ed..aea61eec 100644
--- a/examples/rp/Cargo.toml
+++ b/examples/rp/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime"] }
 embassy-rp = { version = "0.1.0", path = "../../embassy-rp", features = ["defmt", "unstable-traits", "nightly", "unstable-pac", "time-driver", "pio", "critical-section-impl"] }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/std/Cargo.toml b/examples/std/Cargo.toml
index 8087df09..ff08e378 100644
--- a/examples/std/Cargo.toml
+++ b/examples/std/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["log"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["log", "std", "nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-std", "executor-thread", "log", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["log", "std", "nightly"] }
 embassy-net = { version = "0.1.0", path = "../../embassy-net", features=[ "std", "nightly", "log", "medium-ethernet", "tcp", "udp", "dns", "dhcpv4", "unstable-traits", "proto-ipv6"] }
 embassy-net-driver = { version = "0.1.0", path = "../../embassy-net-driver" }
diff --git a/examples/stm32c0/Cargo.toml b/examples/stm32c0/Cargo.toml
index 0095a680..3b1d888f 100644
--- a/examples/stm32c0/Cargo.toml
+++ b/examples/stm32c0/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "time-driver-any", "stm32c031c6", "memory-x", "unstable-pac", "exti"]  }
 
diff --git a/examples/stm32f0/Cargo.toml b/examples/stm32f0/Cargo.toml
index 89d99b6d..5c82c557 100644
--- a/examples/stm32f0/Cargo.toml
+++ b/examples/stm32f0/Cargo.toml
@@ -13,7 +13,7 @@ defmt = "0.3"
 defmt-rtt = "0.4"
 panic-probe = "0.3"
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "executor-interrupt", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "memory-x", "stm32f091rc", "time-driver-any", "exti", "unstable-pac"] }
 static_cell = "1.0"
diff --git a/examples/stm32f0/src/bin/multiprio.rs b/examples/stm32f0/src/bin/multiprio.rs
index e0dc8c98..430a805f 100644
--- a/examples/stm32f0/src/bin/multiprio.rs
+++ b/examples/stm32f0/src/bin/multiprio.rs
@@ -62,7 +62,7 @@ use core::mem;
 use cortex_m::peripheral::NVIC;
 use cortex_m_rt::entry;
 use defmt::*;
-use embassy_stm32::executor::{Executor, InterruptExecutor};
+use embassy_executor::{Executor, InterruptExecutor};
 use embassy_stm32::interrupt;
 use embassy_stm32::pac::Interrupt;
 use embassy_time::{Duration, Instant, Timer};
diff --git a/examples/stm32f1/Cargo.toml b/examples/stm32f1/Cargo.toml
index 53f369b3..387af783 100644
--- a/examples/stm32f1/Cargo.toml
+++ b/examples/stm32f1/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32f103c8", "unstable-pac", "memory-x", "time-driver-any"]  }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/stm32f2/Cargo.toml b/examples/stm32f2/Cargo.toml
index afaf9a0c..ffb23231 100644
--- a/examples/stm32f2/Cargo.toml
+++ b/examples/stm32f2/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32f207zg", "unstable-pac", "memory-x", "time-driver-any", "exti"]  }
 
diff --git a/examples/stm32f3/Cargo.toml b/examples/stm32f3/Cargo.toml
index 69ebef78..38f11201 100644
--- a/examples/stm32f3/Cargo.toml
+++ b/examples/stm32f3/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "executor-interrupt", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32f303ze", "unstable-pac", "memory-x", "time-driver-any", "exti"]  }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/stm32f3/src/bin/multiprio.rs b/examples/stm32f3/src/bin/multiprio.rs
index 77df51ac..5d010f79 100644
--- a/examples/stm32f3/src/bin/multiprio.rs
+++ b/examples/stm32f3/src/bin/multiprio.rs
@@ -62,7 +62,7 @@ use core::mem;
 use cortex_m::peripheral::NVIC;
 use cortex_m_rt::entry;
 use defmt::*;
-use embassy_stm32::executor::{Executor, InterruptExecutor};
+use embassy_executor::{Executor, InterruptExecutor};
 use embassy_stm32::interrupt;
 use embassy_stm32::pac::Interrupt;
 use embassy_time::{Duration, Instant, Timer};
diff --git a/examples/stm32f4/Cargo.toml b/examples/stm32f4/Cargo.toml
index 7a7bab5b..d967d850 100644
--- a/examples/stm32f4/Cargo.toml
+++ b/examples/stm32f4/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "executor-interrupt", "defmt", "integrated-timers", "arch-cortex-m", "executor-thread", "executor-interrupt"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "unstable-traits", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "unstable-traits", "defmt", "stm32f429zi", "unstable-pac", "memory-x", "time-driver-any", "exti"]  }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/stm32f4/src/bin/multiprio.rs b/examples/stm32f4/src/bin/multiprio.rs
index 77df51ac..5d010f79 100644
--- a/examples/stm32f4/src/bin/multiprio.rs
+++ b/examples/stm32f4/src/bin/multiprio.rs
@@ -62,7 +62,7 @@ use core::mem;
 use cortex_m::peripheral::NVIC;
 use cortex_m_rt::entry;
 use defmt::*;
-use embassy_stm32::executor::{Executor, InterruptExecutor};
+use embassy_executor::{Executor, InterruptExecutor};
 use embassy_stm32::interrupt;
 use embassy_stm32::pac::Interrupt;
 use embassy_time::{Duration, Instant, Timer};
diff --git a/examples/stm32f7/Cargo.toml b/examples/stm32f7/Cargo.toml
index ea4cbd80..74e7bf53 100644
--- a/examples/stm32f7/Cargo.toml
+++ b/examples/stm32f7/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32f767zi", "unstable-pac", "time-driver-any", "exti"]  }
 embassy-net = { path = "../../embassy-net", features = ["defmt", "nightly", "tcp", "dhcpv4", "medium-ethernet"] }
diff --git a/examples/stm32g0/Cargo.toml b/examples/stm32g0/Cargo.toml
index e7273c9f..03bdbcea 100644
--- a/examples/stm32g0/Cargo.toml
+++ b/examples/stm32g0/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "time-driver-any", "stm32g071rb", "memory-x", "unstable-pac", "exti"]  }
 
diff --git a/examples/stm32g4/Cargo.toml b/examples/stm32g4/Cargo.toml
index 8a57a8ef..4e415035 100644
--- a/examples/stm32g4/Cargo.toml
+++ b/examples/stm32g4/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "time-driver-any", "stm32g491re", "memory-x", "unstable-pac", "exti"]  }
 embassy-hal-common = {version = "0.1.0", path = "../../embassy-hal-common" }
diff --git a/examples/stm32h7/Cargo.toml b/examples/stm32h7/Cargo.toml
index a0413478..d0d6a949 100644
--- a/examples/stm32h7/Cargo.toml
+++ b/examples/stm32h7/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "unstable-traits", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32h743bi", "time-driver-any", "exti", "unstable-pac", "unstable-traits"] }
 embassy-net = { path = "../../embassy-net", features = ["defmt", "nightly", "tcp", "dhcpv4", "medium-ethernet", "unstable-traits", "proto-ipv6"] }
diff --git a/examples/stm32l0/Cargo.toml b/examples/stm32l0/Cargo.toml
index 86933a62..413d5c18 100644
--- a/examples/stm32l0/Cargo.toml
+++ b/examples/stm32l0/Cargo.toml
@@ -10,7 +10,7 @@ nightly = ["embassy-stm32/nightly", "embassy-lora", "lorawan-device", "lorawan",
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["defmt", "stm32l072cz", "time-driver-any", "exti", "unstable-traits", "memory-x"]  }
 embassy-lora = { version = "0.1.0", path = "../../embassy-lora", features = ["sx127x", "time", "defmt"], optional = true}
diff --git a/examples/stm32l1/Cargo.toml b/examples/stm32l1/Cargo.toml
index 6e3b2103..cd9508d5 100644
--- a/examples/stm32l1/Cargo.toml
+++ b/examples/stm32l1/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32l151cb-a", "time-driver-any", "memory-x"]  }
 
diff --git a/examples/stm32l4/Cargo.toml b/examples/stm32l4/Cargo.toml
index 644c90b1..7c254eba 100644
--- a/examples/stm32l4/Cargo.toml
+++ b/examples/stm32l4/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-embedded-hal = { version = "0.1.0", path = "../../embassy-embedded-hal" }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "unstable-pac", "stm32l4s5vi", "time-driver-any", "exti", "unstable-traits"]  }
diff --git a/examples/stm32l5/Cargo.toml b/examples/stm32l5/Cargo.toml
index f880328d..1c662b9d 100644
--- a/examples/stm32l5/Cargo.toml
+++ b/examples/stm32l5/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "unstable-pac", "stm32l552ze", "time-driver-any", "exti", "unstable-traits", "memory-x"]  }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/stm32u5/Cargo.toml b/examples/stm32u5/Cargo.toml
index 2b02eda9..ebef0a4f 100644
--- a/examples/stm32u5/Cargo.toml
+++ b/examples/stm32u5/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "unstable-pac", "stm32u585ai", "time-driver-any", "memory-x" ]  }
 embassy-usb = { version = "0.1.0", path = "../../embassy-usb", features = ["defmt"] }
diff --git a/examples/stm32wb/Cargo.toml b/examples/stm32wb/Cargo.toml
index e27b4527..ddf9729e 100644
--- a/examples/stm32wb/Cargo.toml
+++ b/examples/stm32wb/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32wb55cc", "time-driver-any", "exti"]  }
 
diff --git a/examples/stm32wl/Cargo.toml b/examples/stm32wl/Cargo.toml
index 690481bb..9fc7e0f4 100644
--- a/examples/stm32wl/Cargo.toml
+++ b/examples/stm32wl/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "stm32wl55jc-cm4", "time-driver-any", "memory-x", "subghz", "unstable-pac", "exti"]  }
 embassy-lora = { version = "0.1.0", path = "../../embassy-lora", features = ["stm32wl", "time", "defmt"] }
diff --git a/examples/wasm/Cargo.toml b/examples/wasm/Cargo.toml
index e0e799a3..430d0b4c 100644
--- a/examples/wasm/Cargo.toml
+++ b/examples/wasm/Cargo.toml
@@ -9,7 +9,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["log"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["log", "wasm", "nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-wasm", "executor-thread", "log", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["log", "wasm", "nightly"] }
 
 wasm-logger = "0.2.0"
diff --git a/tests/nrf/Cargo.toml b/tests/nrf/Cargo.toml
index 2a4e8cf4..912749e5 100644
--- a/tests/nrf/Cargo.toml
+++ b/tests/nrf/Cargo.toml
@@ -7,7 +7,7 @@ license = "MIT OR Apache-2.0"
 [dependencies]
 embassy-futures = { version = "0.1.0", path = "../../embassy-futures" }
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt", "nightly"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "nightly", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "nightly", "defmt-timestamp-uptime"] }
 embassy-nrf = { version = "0.1.0", path = "../../embassy-nrf", features = ["defmt", "nightly", "unstable-traits", "nrf52840", "time-driver-rtc1", "gpiote", "unstable-pac"] }
 embedded-io = { version = "0.4.0", features = ["async"] }
diff --git a/tests/rp/Cargo.toml b/tests/rp/Cargo.toml
index 572a9ce8..eb447be3 100644
--- a/tests/rp/Cargo.toml
+++ b/tests/rp/Cargo.toml
@@ -6,7 +6,7 @@ license = "MIT OR Apache-2.0"
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt"] }
 embassy-rp = { version = "0.1.0", path = "../../embassy-rp", features = ["nightly", "defmt", "unstable-pac", "unstable-traits", "time-driver", "critical-section-impl"]  }
 embassy-futures = { version = "0.1.0", path = "../../embassy-futures" }
diff --git a/tests/stm32/Cargo.toml b/tests/stm32/Cargo.toml
index 08a775ea..17b64079 100644
--- a/tests/stm32/Cargo.toml
+++ b/tests/stm32/Cargo.toml
@@ -15,7 +15,7 @@ stm32u585ai = ["embassy-stm32/stm32u585ai"]     # IoT board
 
 [dependencies]
 embassy-sync = { version = "0.1.0", path = "../../embassy-sync", features = ["defmt"] }
-embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["defmt", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../embassy-executor", features = ["arch-cortex-m", "executor-thread", "defmt", "integrated-timers"] }
 embassy-time = { version = "0.1.0", path = "../../embassy-time", features = ["defmt", "tick-hz-32_768"] }
 embassy-stm32 = { version = "0.1.0", path = "../../embassy-stm32", features = ["nightly", "defmt", "unstable-pac", "memory-x", "time-driver-tim2"]  }
 

From 7c11d85e1ea0d01e5e1b4d6564d258663d66509b Mon Sep 17 00:00:00 2001
From: Rasmus Melchior Jacobsen <rmja@laesoe.org>
Date: Mon, 3 Apr 2023 15:33:20 +0200
Subject: [PATCH 05/11] Move MemFlash to separate module and add
 verify_erased_before_write verification

---
 embassy-boot/boot/src/lib.rs       | 155 +++------------------
 embassy-boot/boot/src/mem_flash.rs | 213 +++++++++++++++++++++++++++++
 embassy-boot/boot/src/partition.rs |  18 +--
 3 files changed, 244 insertions(+), 142 deletions(-)
 create mode 100644 embassy-boot/boot/src/mem_flash.rs

diff --git a/embassy-boot/boot/src/lib.rs b/embassy-boot/boot/src/lib.rs
index 4c28d7aa..a5795781 100644
--- a/embassy-boot/boot/src/lib.rs
+++ b/embassy-boot/boot/src/lib.rs
@@ -8,6 +8,7 @@ mod fmt;
 mod boot_loader;
 mod firmware_updater;
 mod firmware_writer;
+mod mem_flash;
 mod partition;
 
 pub use boot_loader::{BootError, BootFlash, BootLoader, Flash, FlashConfig, MultiFlashConfig, SingleFlashConfig};
@@ -46,13 +47,10 @@ impl<const N: usize> AsMut<[u8]> for AlignedBuffer<N> {
 
 #[cfg(test)]
 mod tests {
-    use core::convert::Infallible;
-
-    use embedded_storage::nor_flash::{ErrorType, NorFlash, ReadNorFlash};
-    use embedded_storage_async::nor_flash::{NorFlash as AsyncNorFlash, ReadNorFlash as AsyncReadNorFlash};
     use futures::executor::block_on;
 
     use super::*;
+    use crate::mem_flash::MemFlash;
 
     /*
     #[test]
@@ -75,8 +73,8 @@ mod tests {
         const ACTIVE: Partition = Partition::new(4096, 61440);
         const DFU: Partition = Partition::new(61440, 122880);
 
-        let mut flash = MemFlash::<131072, 4096, 4>([0xff; 131072]);
-        flash.0[0..4].copy_from_slice(&[BOOT_MAGIC; 4]);
+        let mut flash = MemFlash::<131072, 4096, 4>::default();
+        flash.mem[0..4].copy_from_slice(&[BOOT_MAGIC; 4]);
         let mut flash = SingleFlashConfig::new(&mut flash);
 
         let mut bootloader: BootLoader = BootLoader::new(ACTIVE, DFU, STATE);
@@ -95,14 +93,14 @@ mod tests {
         const STATE: Partition = Partition::new(0, 4096);
         const ACTIVE: Partition = Partition::new(4096, 61440);
         const DFU: Partition = Partition::new(61440, 122880);
-        let mut flash = MemFlash::<131072, 4096, 4>([0xff; 131072]);
+        let mut flash = MemFlash::<131072, 4096, 4>::random().with_limited_erase_before_write_verification(4..);
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
         let update: [u8; DFU.len()] = [rand::random::<u8>(); DFU.len()];
         let mut aligned = [0; 4];
 
         for i in ACTIVE.from..ACTIVE.to {
-            flash.0[i] = original[i - ACTIVE.from];
+            flash.mem[i] = original[i - ACTIVE.from];
         }
 
         let mut bootloader: BootLoader = BootLoader::new(ACTIVE, DFU, STATE);
@@ -124,12 +122,12 @@ mod tests {
         );
 
         for i in ACTIVE.from..ACTIVE.to {
-            assert_eq!(flash.0[i], update[i - ACTIVE.from], "Index {}", i);
+            assert_eq!(flash.mem[i], update[i - ACTIVE.from], "Index {}", i);
         }
 
         // First DFU page is untouched
         for i in DFU.from + 4096..DFU.to {
-            assert_eq!(flash.0[i], original[i - DFU.from - 4096], "Index {}", i);
+            assert_eq!(flash.mem[i], original[i - DFU.from - 4096], "Index {}", i);
         }
 
         // Running again should cause a revert
@@ -141,12 +139,12 @@ mod tests {
         );
 
         for i in ACTIVE.from..ACTIVE.to {
-            assert_eq!(flash.0[i], original[i - ACTIVE.from], "Index {}", i);
+            assert_eq!(flash.mem[i], original[i - ACTIVE.from], "Index {}", i);
         }
 
         // Last page is untouched
         for i in DFU.from..DFU.to - 4096 {
-            assert_eq!(flash.0[i], update[i - DFU.from], "Index {}", i);
+            assert_eq!(flash.mem[i], update[i - DFU.from], "Index {}", i);
         }
 
         // Mark as booted
@@ -166,16 +164,16 @@ mod tests {
         const ACTIVE: Partition = Partition::new(4096, 16384);
         const DFU: Partition = Partition::new(0, 16384);
 
-        let mut active = MemFlash::<16384, 4096, 8>([0xff; 16384]);
-        let mut dfu = MemFlash::<16384, 2048, 8>([0xff; 16384]);
-        let mut state = MemFlash::<4096, 128, 4>([0xff; 4096]);
+        let mut active = MemFlash::<16384, 4096, 8>::random();
+        let mut dfu = MemFlash::<16384, 2048, 8>::random();
+        let mut state = MemFlash::<4096, 128, 4>::random().with_limited_erase_before_write_verification(2048 + 4..);
         let mut aligned = [0; 4];
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
         let update: [u8; DFU.len()] = [rand::random::<u8>(); DFU.len()];
 
         for i in ACTIVE.from..ACTIVE.to {
-            active.0[i] = original[i - ACTIVE.from];
+            active.mem[i] = original[i - ACTIVE.from];
         }
 
         let mut updater = FirmwareUpdater::new(DFU, STATE);
@@ -203,12 +201,12 @@ mod tests {
         );
 
         for i in ACTIVE.from..ACTIVE.to {
-            assert_eq!(active.0[i], update[i - ACTIVE.from], "Index {}", i);
+            assert_eq!(active.mem[i], update[i - ACTIVE.from], "Index {}", i);
         }
 
         // First DFU page is untouched
         for i in DFU.from + 4096..DFU.to {
-            assert_eq!(dfu.0[i], original[i - DFU.from - 4096], "Index {}", i);
+            assert_eq!(dfu.mem[i], original[i - DFU.from - 4096], "Index {}", i);
         }
     }
 
@@ -220,15 +218,15 @@ mod tests {
         const DFU: Partition = Partition::new(0, 16384);
 
         let mut aligned = [0; 4];
-        let mut active = MemFlash::<16384, 2048, 4>([0xff; 16384]);
-        let mut dfu = MemFlash::<16384, 4096, 8>([0xff; 16384]);
-        let mut state = MemFlash::<4096, 128, 4>([0xff; 4096]);
+        let mut active = MemFlash::<16384, 2048, 4>::random();
+        let mut dfu = MemFlash::<16384, 4096, 8>::random();
+        let mut state = MemFlash::<4096, 128, 4>::random().with_limited_erase_before_write_verification(2048 + 4..);
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
         let update: [u8; DFU.len()] = [rand::random::<u8>(); DFU.len()];
 
         for i in ACTIVE.from..ACTIVE.to {
-            active.0[i] = original[i - ACTIVE.from];
+            active.mem[i] = original[i - ACTIVE.from];
         }
 
         let mut updater = FirmwareUpdater::new(DFU, STATE);
@@ -255,12 +253,12 @@ mod tests {
         );
 
         for i in ACTIVE.from..ACTIVE.to {
-            assert_eq!(active.0[i], update[i - ACTIVE.from], "Index {}", i);
+            assert_eq!(active.mem[i], update[i - ACTIVE.from], "Index {}", i);
         }
 
         // First DFU page is untouched
         for i in DFU.from + 4096..DFU.to {
-            assert_eq!(dfu.0[i], original[i - DFU.from - 4096], "Index {}", i);
+            assert_eq!(dfu.mem[i], original[i - DFU.from - 4096], "Index {}", i);
         }
     }
 
@@ -313,113 +311,4 @@ mod tests {
         ))
         .is_ok());
     }
-
-    pub struct MemFlash<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize>(pub [u8; SIZE]);
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> NorFlash
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        const WRITE_SIZE: usize = WRITE_SIZE;
-        const ERASE_SIZE: usize = ERASE_SIZE;
-        fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
-            let from = from as usize;
-            let to = to as usize;
-            assert!(from % ERASE_SIZE == 0);
-            assert!(to % ERASE_SIZE == 0, "To: {}, erase size: {}", to, ERASE_SIZE);
-            for i in from..to {
-                self.0[i] = 0xFF;
-            }
-            Ok(())
-        }
-
-        fn write(&mut self, offset: u32, data: &[u8]) -> Result<(), Self::Error> {
-            assert!(data.len() % WRITE_SIZE == 0);
-            assert!(offset as usize % WRITE_SIZE == 0);
-            assert!(offset as usize + data.len() <= SIZE);
-
-            self.0[offset as usize..offset as usize + data.len()].copy_from_slice(data);
-
-            Ok(())
-        }
-    }
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ErrorType
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        type Error = Infallible;
-    }
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ReadNorFlash
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        const READ_SIZE: usize = 1;
-
-        fn read(&mut self, offset: u32, buf: &mut [u8]) -> Result<(), Self::Error> {
-            let len = buf.len();
-            buf[..].copy_from_slice(&self.0[offset as usize..offset as usize + len]);
-            Ok(())
-        }
-
-        fn capacity(&self) -> usize {
-            SIZE
-        }
-    }
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> super::Flash
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        const BLOCK_SIZE: usize = ERASE_SIZE;
-        const ERASE_VALUE: u8 = 0xFF;
-    }
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncReadNorFlash
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        const READ_SIZE: usize = 1;
-
-        async fn read(&mut self, offset: u32, buf: &mut [u8]) -> Result<(), Self::Error> {
-            let len = buf.len();
-            buf[..].copy_from_slice(&self.0[offset as usize..offset as usize + len]);
-            Ok(())
-        }
-
-        fn capacity(&self) -> usize {
-            SIZE
-        }
-    }
-
-    impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncNorFlash
-        for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
-    {
-        const WRITE_SIZE: usize = WRITE_SIZE;
-        const ERASE_SIZE: usize = ERASE_SIZE;
-
-        async fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
-            let from = from as usize;
-            let to = to as usize;
-            assert!(from % ERASE_SIZE == 0);
-            assert!(to % ERASE_SIZE == 0);
-            for i in from..to {
-                self.0[i] = 0xFF;
-            }
-            Ok(())
-        }
-
-        async fn write(&mut self, offset: u32, data: &[u8]) -> Result<(), Self::Error> {
-            info!("Writing {} bytes to 0x{:x}", data.len(), offset);
-            assert!(data.len() % WRITE_SIZE == 0);
-            assert!(offset as usize % WRITE_SIZE == 0);
-            assert!(
-                offset as usize + data.len() <= SIZE,
-                "OFFSET: {}, LEN: {}, FLASH SIZE: {}",
-                offset,
-                data.len(),
-                SIZE
-            );
-
-            self.0[offset as usize..offset as usize + data.len()].copy_from_slice(data);
-
-            Ok(())
-        }
-    }
 }
diff --git a/embassy-boot/boot/src/mem_flash.rs b/embassy-boot/boot/src/mem_flash.rs
new file mode 100644
index 00000000..e87ccd37
--- /dev/null
+++ b/embassy-boot/boot/src/mem_flash.rs
@@ -0,0 +1,213 @@
+#![allow(unused)]
+
+use core::ops::{Bound, Range, RangeBounds};
+
+use embedded_storage::nor_flash::{ErrorType, NorFlash, NorFlashError, NorFlashErrorKind, ReadNorFlash};
+use embedded_storage_async::nor_flash::{NorFlash as AsyncNorFlash, ReadNorFlash as AsyncReadNorFlash};
+
+use crate::Flash;
+
+pub struct MemFlash<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> {
+    pub mem: [u8; SIZE],
+    pub allow_same_write: bool,
+    pub verify_erased_before_write: Range<usize>,
+    pub pending_write_successes: Option<usize>,
+}
+
+#[derive(Debug)]
+pub struct MemFlashError;
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE> {
+    pub const fn new(fill: u8) -> Self {
+        Self {
+            mem: [fill; SIZE],
+            allow_same_write: false,
+            verify_erased_before_write: 0..SIZE,
+            pending_write_successes: None,
+        }
+    }
+
+    #[cfg(test)]
+    pub fn random() -> Self {
+        let mut mem = [0; SIZE];
+        for byte in mem.iter_mut() {
+            *byte = rand::random::<u8>();
+        }
+        Self {
+            mem,
+            allow_same_write: false,
+            verify_erased_before_write: 0..SIZE,
+            pending_write_successes: None,
+        }
+    }
+
+    #[must_use]
+    pub fn allow_same_write(self, allow: bool) -> Self {
+        Self {
+            allow_same_write: allow,
+            ..self
+        }
+    }
+
+    #[must_use]
+    pub fn with_limited_erase_before_write_verification<R: RangeBounds<usize>>(self, verified_range: R) -> Self {
+        let start = match verified_range.start_bound() {
+            Bound::Included(start) => *start,
+            Bound::Excluded(start) => *start + 1,
+            Bound::Unbounded => 0,
+        };
+        let end = match verified_range.end_bound() {
+            Bound::Included(end) => *end - 1,
+            Bound::Excluded(end) => *end,
+            Bound::Unbounded => self.mem.len(),
+        };
+        Self {
+            verify_erased_before_write: start..end,
+            ..self
+        }
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> Default
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    fn default() -> Self {
+        Self::new(0xFF)
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> Flash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const BLOCK_SIZE: usize = ERASE_SIZE;
+    const ERASE_VALUE: u8 = 0xFF;
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ErrorType
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    type Error = MemFlashError;
+}
+
+impl NorFlashError for MemFlashError {
+    fn kind(&self) -> NorFlashErrorKind {
+        NorFlashErrorKind::Other
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ReadNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const READ_SIZE: usize = 1;
+
+    fn read(&mut self, offset: u32, bytes: &mut [u8]) -> Result<(), Self::Error> {
+        let len = bytes.len();
+        bytes.copy_from_slice(&self.mem[offset as usize..offset as usize + len]);
+        Ok(())
+    }
+
+    fn capacity(&self) -> usize {
+        SIZE
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> NorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const WRITE_SIZE: usize = WRITE_SIZE;
+    const ERASE_SIZE: usize = ERASE_SIZE;
+
+    fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        let from = from as usize;
+        let to = to as usize;
+        assert!(from % ERASE_SIZE == 0);
+        assert!(to % ERASE_SIZE == 0, "To: {}, erase size: {}", to, ERASE_SIZE);
+        for i in from..to {
+            self.mem[i] = 0xFF;
+        }
+        Ok(())
+    }
+
+    fn write(&mut self, offset: u32, bytes: &[u8]) -> Result<(), Self::Error> {
+        let offset = offset as usize;
+        assert!(bytes.len() % WRITE_SIZE == 0);
+        assert!(offset % WRITE_SIZE == 0);
+        assert!(offset + bytes.len() <= SIZE);
+
+        if let Some(pending_successes) = self.pending_write_successes {
+            if pending_successes > 0 {
+                self.pending_write_successes = Some(pending_successes - 1);
+            } else {
+                return Err(MemFlashError);
+            }
+        }
+
+        for ((offset, mem_byte), new_byte) in self
+            .mem
+            .iter_mut()
+            .enumerate()
+            .skip(offset)
+            .take(bytes.len())
+            .zip(bytes)
+        {
+            if self.allow_same_write && mem_byte == new_byte {
+                // Write does not change the flash memory which is allowed
+            } else {
+                if self.verify_erased_before_write.contains(&offset) {
+                    assert_eq!(0xFF, *mem_byte, "Offset {} is not erased", offset);
+                }
+                *mem_byte &= *new_byte;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncReadNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const READ_SIZE: usize = 1;
+
+    async fn read(&mut self, offset: u32, bytes: &mut [u8]) -> Result<(), Self::Error> {
+        <Self as ReadNorFlash>::read(self, offset, bytes)
+    }
+
+    fn capacity(&self) -> usize {
+        <Self as ReadNorFlash>::capacity(self)
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const WRITE_SIZE: usize = WRITE_SIZE;
+    const ERASE_SIZE: usize = ERASE_SIZE;
+
+    async fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        <Self as NorFlash>::erase(self, from, to)
+    }
+
+    async fn write(&mut self, offset: u32, bytes: &[u8]) -> Result<(), Self::Error> {
+        <Self as NorFlash>::write(self, offset, bytes)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use core::ops::Range;
+
+    use embedded_storage::nor_flash::NorFlash;
+
+    use super::MemFlash;
+
+    #[test]
+    fn writes_only_flip_bits_from_1_to_0() {
+        let mut flash = MemFlash::<16, 16, 1>::default().with_limited_erase_before_write_verification(0..0);
+
+        flash.write(0, &[0x55]).unwrap();
+        flash.write(0, &[0xAA]).unwrap();
+
+        assert_eq!(0x00, flash.mem[0]);
+    }
+}
diff --git a/embassy-boot/boot/src/partition.rs b/embassy-boot/boot/src/partition.rs
index 3ccd4dd7..1157e8cd 100644
--- a/embassy-boot/boot/src/partition.rs
+++ b/embassy-boot/boot/src/partition.rs
@@ -105,45 +105,45 @@ impl Partition {
 
 #[cfg(test)]
 mod tests {
-    use crate::tests::MemFlash;
+    use crate::mem_flash::MemFlash;
     use crate::Partition;
 
     #[test]
     fn can_erase() {
-        let mut flash = MemFlash::<1024, 64, 4>([0x00; 1024]);
+        let mut flash = MemFlash::<1024, 64, 4>::new(0x00);
         let partition = Partition::new(256, 512);
 
         partition.erase_blocking(&mut flash, 64, 192).unwrap();
 
-        for (index, byte) in flash.0.iter().copied().enumerate().take(256 + 64) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().take(256 + 64) {
             assert_eq!(0x00, byte, "Index {}", index);
         }
 
-        for (index, byte) in flash.0.iter().copied().enumerate().skip(256 + 64).take(128) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256 + 64).take(128) {
             assert_eq!(0xFF, byte, "Index {}", index);
         }
 
-        for (index, byte) in flash.0.iter().copied().enumerate().skip(256 + 64 + 128) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256 + 64 + 128) {
             assert_eq!(0x00, byte, "Index {}", index);
         }
     }
 
     #[test]
     fn can_wipe() {
-        let mut flash = MemFlash::<1024, 64, 4>([0x00; 1024]);
+        let mut flash = MemFlash::<1024, 64, 4>::new(0x00);
         let partition = Partition::new(256, 512);
 
         partition.wipe_blocking(&mut flash).unwrap();
 
-        for (index, byte) in flash.0.iter().copied().enumerate().take(256) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().take(256) {
             assert_eq!(0x00, byte, "Index {}", index);
         }
 
-        for (index, byte) in flash.0.iter().copied().enumerate().skip(256).take(256) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256).take(256) {
             assert_eq!(0xFF, byte, "Index {}", index);
         }
 
-        for (index, byte) in flash.0.iter().copied().enumerate().skip(512) {
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(512) {
             assert_eq!(0x00, byte, "Index {}", index);
         }
     }

From 4ce1c5f27dbb06641abddd2b10aebae1511a894b Mon Sep 17 00:00:00 2001
From: Mathieu Dupont <mdupont@cppm.in2p3.fr>
Date: Mon, 3 Apr 2023 16:41:25 +0200
Subject: [PATCH 06/11] Add MCO support for L4 and F4 families

---
 embassy-stm32/build.rs          |  17 +++-
 embassy-stm32/src/rcc/f4.rs     | 165 ++++++++++++++++++++++++++++++++
 embassy-stm32/src/rcc/l4.rs     | 133 +++++++++++++++++++++++++
 examples/stm32f4/src/bin/mco.rs |  31 ++++++
 examples/stm32l4/src/bin/mco.rs |  27 ++++++
 5 files changed, 371 insertions(+), 2 deletions(-)
 create mode 100644 examples/stm32f4/src/bin/mco.rs
 create mode 100644 examples/stm32l4/src/bin/mco.rs

diff --git a/embassy-stm32/build.rs b/embassy-stm32/build.rs
index 3780c5a4..481fec67 100644
--- a/embassy-stm32/build.rs
+++ b/embassy-stm32/build.rs
@@ -50,10 +50,13 @@ fn main() {
                 // We *shouldn't* have singletons for these, but the HAL currently requires
                 // singletons, for using with RccPeripheral to enable/disable clocks to them.
                 "rcc" => {
-                    if r.version.starts_with("h7") {
+                    if r.version.starts_with("h7") || r.version.starts_with("f4") {
                         singletons.push("MCO1".to_string());
                         singletons.push("MCO2".to_string());
                     }
+                    if r.version.starts_with("l4") {
+                        singletons.push("MCO".to_string());
+                    }
                     singletons.push(p.name.to_string());
                 }
                 //"dbgmcu" => {}
@@ -258,6 +261,7 @@ fn main() {
         (("i2c", "SCL"), quote!(crate::i2c::SclPin)),
         (("rcc", "MCO_1"), quote!(crate::rcc::McoPin)),
         (("rcc", "MCO_2"), quote!(crate::rcc::McoPin)),
+        (("rcc", "MCO"), quote!(crate::rcc::McoPin)),
         (("dcmi", "D0"), quote!(crate::dcmi::D0Pin)),
         (("dcmi", "D1"), quote!(crate::dcmi::D1Pin)),
         (("dcmi", "D2"), quote!(crate::dcmi::D2Pin)),
@@ -447,13 +451,22 @@ fn main() {
                     // MCO is special
                     if pin.signal.starts_with("MCO_") {
                         // Supported in H7 only for now
-                        if regs.version.starts_with("h7") {
+                        if regs.version.starts_with("h7") || regs.version.starts_with("f4") {
                             peri = format_ident!("{}", pin.signal.replace("_", ""));
                         } else {
                             continue;
                         }
                     }
 
+                    if pin.signal == "MCO" {
+                        // Supported in H7 only for now
+                        if regs.version.starts_with("l4") {
+                            peri = format_ident!("MCO");
+                        } else {
+                            continue;
+                        }
+                    }
+
                     g.extend(quote! {
                         pin_trait_impl!(#tr, #peri, #pin_name, #af);
                     })
diff --git a/embassy-stm32/src/rcc/f4.rs b/embassy-stm32/src/rcc/f4.rs
index 200bcce9..d0e0d585 100644
--- a/embassy-stm32/src/rcc/f4.rs
+++ b/embassy-stm32/src/rcc/f4.rs
@@ -1,8 +1,16 @@
+use core::marker::PhantomData;
+
+use embassy_hal_common::into_ref;
+use stm32_metapac::rcc::vals::{Mco1, Mco2, Mcopre};
+
 use super::sealed::RccPeripheral;
+use crate::gpio::sealed::AFType;
+use crate::gpio::Speed;
 use crate::pac::rcc::vals::{Hpre, Ppre, Sw};
 use crate::pac::{FLASH, PWR, RCC};
 use crate::rcc::{set_freqs, Clocks};
 use crate::time::Hertz;
+use crate::{peripherals, Peripheral};
 
 /// HSI speed
 pub const HSI_FREQ: Hertz = Hertz(16_000_000);
@@ -96,6 +104,163 @@ unsafe fn setup_pll(pllsrcclk: u32, use_hse: bool, pllsysclk: Option<u32>, pll48
     }
 }
 
+pub enum McoClock {
+    DIV1,
+    DIV2,
+    DIV3,
+    DIV4,
+    DIV5,
+}
+
+impl McoClock {
+    fn into_raw(&self) -> Mcopre {
+        match self {
+            McoClock::DIV1 => Mcopre::DIV1,
+            McoClock::DIV2 => Mcopre::DIV2,
+            McoClock::DIV3 => Mcopre::DIV3,
+            McoClock::DIV4 => Mcopre::DIV4,
+            McoClock::DIV5 => Mcopre::DIV5,
+        }
+    }
+}
+
+#[derive(Copy, Clone)]
+pub enum Mco1Source {
+    Hsi,
+    Lse,
+    Hse,
+    Pll,
+}
+
+impl Default for Mco1Source {
+    fn default() -> Self {
+        Self::Hsi
+    }
+}
+
+pub trait McoSource {
+    type Raw;
+
+    fn into_raw(&self) -> Self::Raw;
+}
+
+impl McoSource for Mco1Source {
+    type Raw = Mco1;
+    fn into_raw(&self) -> Self::Raw {
+        match self {
+            Mco1Source::Hsi => Mco1::HSI,
+            Mco1Source::Lse => Mco1::LSE,
+            Mco1Source::Hse => Mco1::HSE,
+            Mco1Source::Pll => Mco1::PLL,
+        }
+    }
+}
+
+#[derive(Copy, Clone)]
+pub enum Mco2Source {
+    SysClk,
+    Plli2s,
+    Hse,
+    Pll,
+}
+
+impl Default for Mco2Source {
+    fn default() -> Self {
+        Self::SysClk
+    }
+}
+
+impl McoSource for Mco2Source {
+    type Raw = Mco2;
+    fn into_raw(&self) -> Self::Raw {
+        match self {
+            Mco2Source::SysClk => Mco2::SYSCLK,
+            Mco2Source::Plli2s => Mco2::PLLI2S,
+            Mco2Source::Hse => Mco2::HSE,
+            Mco2Source::Pll => Mco2::PLL,
+        }
+    }
+}
+
+pub(crate) mod sealed {
+    use stm32_metapac::rcc::vals::Mcopre;
+    pub trait McoInstance {
+        type Source;
+        unsafe fn apply_clock_settings(source: Self::Source, prescaler: Mcopre);
+    }
+}
+
+pub trait McoInstance: sealed::McoInstance + 'static {}
+
+pin_trait!(McoPin, McoInstance);
+
+impl sealed::McoInstance for peripherals::MCO1 {
+    type Source = Mco1;
+    unsafe fn apply_clock_settings(source: Self::Source, prescaler: Mcopre) {
+        RCC.cfgr().modify(|w| {
+            w.set_mco1(source);
+            w.set_mco1pre(prescaler);
+        });
+        match source {
+            Mco1::PLL => {
+                RCC.cr().modify(|w| w.set_pllon(true));
+                while !RCC.cr().read().pllrdy() {}
+            }
+            Mco1::HSI => {
+                RCC.cr().modify(|w| w.set_hsion(true));
+                while !RCC.cr().read().hsirdy() {}
+            }
+            _ => {}
+        }
+    }
+}
+impl McoInstance for peripherals::MCO1 {}
+
+impl sealed::McoInstance for peripherals::MCO2 {
+    type Source = Mco2;
+    unsafe fn apply_clock_settings(source: Self::Source, prescaler: Mcopre) {
+        RCC.cfgr().modify(|w| {
+            w.set_mco2(source);
+            w.set_mco2pre(prescaler);
+        });
+        match source {
+            Mco2::PLL => {
+                RCC.cr().modify(|w| w.set_pllon(true));
+                while !RCC.cr().read().pllrdy() {}
+            }
+            Mco2::PLLI2S => {
+                RCC.cr().modify(|w| w.set_plli2son(true));
+                while !RCC.cr().read().plli2srdy() {}
+            }
+            _ => {}
+        }
+    }
+}
+impl McoInstance for peripherals::MCO2 {}
+
+pub struct Mco<'d, T: McoInstance> {
+    phantom: PhantomData<&'d mut T>,
+}
+
+impl<'d, T: McoInstance> Mco<'d, T> {
+    pub fn new(
+        _peri: impl Peripheral<P = T> + 'd,
+        pin: impl Peripheral<P = impl McoPin<T>> + 'd,
+        source: impl McoSource<Raw = T::Source>,
+        prescaler: McoClock,
+    ) -> Self {
+        into_ref!(pin);
+
+        critical_section::with(|_| unsafe {
+            T::apply_clock_settings(source.into_raw(), prescaler.into_raw());
+            pin.set_as_af(pin.af_num(), AFType::OutputPushPull);
+            pin.set_speed(Speed::VeryHigh);
+        });
+
+        Self { phantom: PhantomData }
+    }
+}
+
 unsafe fn flash_setup(sysclk: u32) {
     use crate::pac::flash::vals::Latency;
 
diff --git a/embassy-stm32/src/rcc/l4.rs b/embassy-stm32/src/rcc/l4.rs
index e650490f..c1bf7d0c 100644
--- a/embassy-stm32/src/rcc/l4.rs
+++ b/embassy-stm32/src/rcc/l4.rs
@@ -1,7 +1,15 @@
+use core::marker::PhantomData;
+
+use embassy_hal_common::into_ref;
+use stm32_metapac::rcc::vals::{Mcopre, Mcosel};
+
+use crate::gpio::sealed::AFType;
+use crate::gpio::Speed;
 use crate::pac::rcc::vals::{Hpre, Msirange, Pllsrc, Ppre, Sw};
 use crate::pac::{FLASH, RCC};
 use crate::rcc::{set_freqs, Clocks};
 use crate::time::Hertz;
+use crate::{peripherals, Peripheral};
 
 /// HSI speed
 pub const HSI_FREQ: Hertz = Hertz(16_000_000);
@@ -298,6 +306,131 @@ impl Default for Config {
     }
 }
 
+pub enum McoClock {
+    DIV1,
+    DIV2,
+    DIV4,
+    DIV8,
+    DIV16,
+}
+
+impl McoClock {
+    fn into_raw(&self) -> Mcopre {
+        match self {
+            McoClock::DIV1 => Mcopre::DIV1,
+            McoClock::DIV2 => Mcopre::DIV2,
+            McoClock::DIV4 => Mcopre::DIV4,
+            McoClock::DIV8 => Mcopre::DIV8,
+            McoClock::DIV16 => Mcopre::DIV16,
+        }
+    }
+}
+
+#[derive(Copy, Clone)]
+pub enum Mco1Source {
+    Disabled,
+    Lse,
+    Lsi,
+    Hse,
+    Hsi16,
+    PllClk,
+    SysClk,
+    Msi,
+    #[cfg(not(any(stm32l471, stm32l475, stm32l476, stm32l486)))]
+    Hsi48,
+}
+
+impl Default for Mco1Source {
+    fn default() -> Self {
+        Self::Hsi16
+    }
+}
+
+pub trait McoSource {
+    type Raw;
+
+    fn into_raw(&self) -> Self::Raw;
+}
+
+impl McoSource for Mco1Source {
+    type Raw = Mcosel;
+    fn into_raw(&self) -> Self::Raw {
+        match self {
+            Mco1Source::Disabled => Mcosel::NOCLOCK,
+            Mco1Source::Lse => Mcosel::LSE,
+            Mco1Source::Lsi => Mcosel::LSI,
+            Mco1Source::Hse => Mcosel::HSE,
+            Mco1Source::Hsi16 => Mcosel::HSI16,
+            Mco1Source::PllClk => Mcosel::PLL,
+            Mco1Source::SysClk => Mcosel::SYSCLK,
+            Mco1Source::Msi => Mcosel::MSI,
+            #[cfg(not(any(stm32l471, stm32l475, stm32l476, stm32l486)))]
+            Mco1Source::Hsi48 => Mcosel::HSI48,
+        }
+    }
+}
+
+pub(crate) mod sealed {
+    use stm32_metapac::rcc::vals::Mcopre;
+    pub trait McoInstance {
+        type Source;
+        unsafe fn apply_clock_settings(source: Self::Source, prescaler: Mcopre);
+    }
+}
+
+pub trait McoInstance: sealed::McoInstance + 'static {}
+
+pin_trait!(McoPin, McoInstance);
+
+impl sealed::McoInstance for peripherals::MCO {
+    type Source = Mcosel;
+
+    unsafe fn apply_clock_settings(source: Self::Source, prescaler: Mcopre) {
+        RCC.cfgr().modify(|w| {
+            w.set_mcosel(source);
+            w.set_mcopre(prescaler);
+        });
+
+        match source {
+            Mcosel::HSI16 => {
+                RCC.cr().modify(|w| w.set_hsion(true));
+                while !RCC.cr().read().hsirdy() {}
+            }
+            #[cfg(not(any(stm32l471, stm32l475, stm32l476, stm32l486)))]
+            Mcosel::HSI48 => {
+                RCC.crrcr().modify(|w| w.set_hsi48on(true));
+                while !RCC.crrcr().read().hsi48rdy() {}
+            }
+            _ => {}
+        }
+    }
+}
+
+impl McoInstance for peripherals::MCO {}
+
+pub struct Mco<'d, T: McoInstance> {
+    phantom: PhantomData<&'d mut T>,
+}
+
+impl<'d, T: McoInstance> Mco<'d, T> {
+    pub fn new(
+        _peri: impl Peripheral<P = T> + 'd,
+        pin: impl Peripheral<P = impl McoPin<T>> + 'd,
+        source: impl McoSource<Raw = T::Source>,
+        prescaler: McoClock,
+    ) -> Self {
+        into_ref!(pin);
+
+        critical_section::with(|_| unsafe {
+            T::apply_clock_settings(source.into_raw(), prescaler.into_raw());
+            pin.set_as_af(pin.af_num(), AFType::OutputPushPull);
+            pin.set_speed(Speed::VeryHigh);
+        });
+
+        Self { phantom: PhantomData }
+    }
+}
+
 pub(crate) unsafe fn init(config: Config) {
     let (sys_clk, sw) = match config.mux {
         ClockSrc::MSI(range) => {
diff --git a/examples/stm32f4/src/bin/mco.rs b/examples/stm32f4/src/bin/mco.rs
new file mode 100644
index 00000000..5d780f94
--- /dev/null
+++ b/examples/stm32f4/src/bin/mco.rs
@@ -0,0 +1,31 @@
+#![no_std]
+#![no_main]
+#![feature(type_alias_impl_trait)]
+
+use defmt::*;
+use embassy_executor::Spawner;
+use embassy_stm32::gpio::{Level, Output, Speed};
+use embassy_stm32::rcc::{Mco, Mco1Source, Mco2Source, McoClock};
+use embassy_time::{Duration, Timer};
+use {defmt_rtt as _, panic_probe as _};
+
+#[embassy_executor::main]
+async fn main(_spawner: Spawner) {
+    let p = embassy_stm32::init(Default::default());
+    info!("Hello World!");
+
+
+    let _mco1 = Mco::new(p.MCO1, p.PA8, Mco1Source::Hsi, McoClock::DIV1);
+    let _mco2 = Mco::new(p.MCO2, p.PC9, Mco2Source::Pll, McoClock::DIV4);
+    let mut led = Output::new(p.PB7, Level::High, Speed::Low);
+
+    loop {
+        info!("high");
+        led.set_high();
+        Timer::after(Duration::from_millis(300)).await;
+
+        info!("low");
+        led.set_low();
+        Timer::after(Duration::from_millis(300)).await;
+    }
+}
diff --git a/examples/stm32l4/src/bin/mco.rs b/examples/stm32l4/src/bin/mco.rs
new file mode 100644
index 00000000..dea0c66e
--- /dev/null
+++ b/examples/stm32l4/src/bin/mco.rs
@@ -0,0 +1,27 @@
+#![no_std]
+#![no_main]
+#![feature(type_alias_impl_trait)]
+
+use defmt::*;
+use embassy_executor::Spawner;
+use embassy_stm32::gpio::{Level, Output, Speed};
+use embassy_stm32::rcc::{Mco, Mco1Source, McoClock};
+use embassy_time::{Duration, Timer};
+use {defmt_rtt as _, panic_probe as _};
+
+#[embassy_executor::main]
+async fn main(_spawner: Spawner) {
+    let p = embassy_stm32::init(Default::default());
+    info!("Hello World!");
+
+    let _mco = Mco::new(p.MCO, p.PA8, Mco1Source::Hsi16, McoClock::DIV1);
+
+    let mut led = Output::new(p.PB14, Level::High, Speed::Low);
+
+    loop {
+        led.set_high();
+        Timer::after(Duration::from_millis(300)).await;
+        led.set_low();
+        Timer::after(Duration::from_millis(300)).await;
+    }
+}

From 932b80ca8a5d49bcd05d523fe7f7320e2b960e85 Mon Sep 17 00:00:00 2001
From: Mathieu Dupont <mdupont@cppm.in2p3.fr>
Date: Mon, 3 Apr 2023 16:52:57 +0200
Subject: [PATCH 07/11] run fmt

---
 examples/stm32f4/src/bin/mco.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/examples/stm32f4/src/bin/mco.rs b/examples/stm32f4/src/bin/mco.rs
index 5d780f94..2b9ceebc 100644
--- a/examples/stm32f4/src/bin/mco.rs
+++ b/examples/stm32f4/src/bin/mco.rs
@@ -14,7 +14,6 @@ async fn main(_spawner: Spawner) {
     let p = embassy_stm32::init(Default::default());
     info!("Hello World!");
 
-
     let _mco1 = Mco::new(p.MCO1, p.PA8, Mco1Source::Hsi, McoClock::DIV1);
     let _mco2 = Mco::new(p.MCO2, p.PC9, Mco2Source::Pll, McoClock::DIV4);
     let mut led = Output::new(p.PB7, Level::High, Speed::Low);

From 1349dabe1aae491d83b83d27a80da7216333bb52 Mon Sep 17 00:00:00 2001
From: Mathieu Dupont <mdupont@cppm.in2p3.fr>
Date: Mon, 3 Apr 2023 17:55:05 +0200
Subject: [PATCH 08/11] add compilation time exclusion for stm32f410

---
 embassy-stm32/src/rcc/f4.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/embassy-stm32/src/rcc/f4.rs b/embassy-stm32/src/rcc/f4.rs
index d0e0d585..2a17eb9b 100644
--- a/embassy-stm32/src/rcc/f4.rs
+++ b/embassy-stm32/src/rcc/f4.rs
@@ -228,6 +228,7 @@ impl sealed::McoInstance for peripherals::MCO2 {
                 RCC.cr().modify(|w| w.set_pllon(true));
                 while !RCC.cr().read().pllrdy() {}
             }
+            #[cfg(not(stm32f410))]
             Mco2::PLLI2S => {
                 RCC.cr().modify(|w| w.set_plli2son(true));
                 while !RCC.cr().read().plli2srdy() {}

From df3a1e1b9d337c17e08faf41c6e3c50c35eb9a6c Mon Sep 17 00:00:00 2001
From: Rasmus Melchior Jacobsen <rmja@laesoe.org>
Date: Tue, 4 Apr 2023 07:18:29 +0200
Subject: [PATCH 09/11] Avoid write to not-erased magic

This introduces an additional marker to the state partition right after the magic which indicates whether the current progress is valid or not. Validation in tests that we never write without an erase is added.

There is currently a FIXME in the FirmwareUpdater. Let me know if we should take the erase value as a parameter. I opened a feature request in embedded-storage to get this value in the trait. Before this, the assumption about ERASE_VALUE=0xFF was the same.
---
 embassy-boot/boot/src/boot_loader.rs      | 43 ++++++++++------
 embassy-boot/boot/src/firmware_updater.rs | 34 +++++++++++--
 embassy-boot/boot/src/lib.rs              |  6 +--
 embassy-boot/boot/src/mem_flash.rs        | 61 +----------------------
 4 files changed, 63 insertions(+), 81 deletions(-)

diff --git a/embassy-boot/boot/src/boot_loader.rs b/embassy-boot/boot/src/boot_loader.rs
index e2e361e3..9d047f77 100644
--- a/embassy-boot/boot/src/boot_loader.rs
+++ b/embassy-boot/boot/src/boot_loader.rs
@@ -31,7 +31,7 @@ where
 }
 
 /// Extension of the embedded-storage flash type information with block size and erase value.
-pub trait Flash: NorFlash + ReadNorFlash {
+pub trait Flash: NorFlash {
     /// The block size that should be used when writing to flash. For most builtin flashes, this is the same as the erase
     /// size of the flash, but for external QSPI flash modules, this can be lower.
     const BLOCK_SIZE: usize;
@@ -60,9 +60,11 @@ pub trait FlashConfig {
 /// different page sizes and flash write sizes.
 pub struct BootLoader {
     // Page with current state of bootloader. The state partition has the following format:
-    // | Range          | Description                                                                      |
-    // | 0 - WRITE_SIZE | Magic indicating bootloader state. BOOT_MAGIC means boot, SWAP_MAGIC means swap. |
-    // | WRITE_SIZE - N | Progress index used while swapping or reverting                                  |
+    // All ranges are in multiples of WRITE_SIZE bytes.
+    // | Range    | Description                                                                      |
+    // | 0..1     | Magic indicating bootloader state. BOOT_MAGIC means boot, SWAP_MAGIC means swap. |
+    // | 1..2     | Progress validity. ERASE_VALUE means valid, !ERASE_VALUE means invalid.          |
+    // | 2..2 + N | Progress index used while swapping or reverting                                  |
     state: Partition,
     // Location of the partition which will be booted from
     active: Partition,
@@ -192,12 +194,17 @@ impl BootLoader {
                 trace!("Reverting");
                 self.revert(p, magic, page)?;
 
-                // Overwrite magic and reset progress
                 let state_flash = p.state();
+
+                // Invalidate progress
                 magic.fill(!P::STATE::ERASE_VALUE);
-                self.state.write_blocking(state_flash, 0, magic)?;
+                self.state
+                    .write_blocking(state_flash, P::STATE::WRITE_SIZE as u32, magic)?;
+
+                // Clear magic and progress
                 self.state.wipe_blocking(state_flash)?;
 
+                // Set magic
                 magic.fill(BOOT_MAGIC);
                 self.state.write_blocking(state_flash, 0, magic)?;
             }
@@ -215,28 +222,34 @@ impl BootLoader {
 
     fn current_progress<P: FlashConfig>(&mut self, config: &mut P, aligned: &mut [u8]) -> Result<usize, BootError> {
         let write_size = aligned.len();
-        let max_index = ((self.state.len() - write_size) / write_size) - 1;
+        let max_index = ((self.state.len() - write_size) / write_size) - 2;
         aligned.fill(!P::STATE::ERASE_VALUE);
 
         let state_flash = config.state();
-        for i in 0..max_index {
+
+        self.state
+            .read_blocking(state_flash, P::STATE::WRITE_SIZE as u32, aligned)?;
+        if aligned.iter().any(|&b| b != P::STATE::ERASE_VALUE) {
+            // Progress is invalid
+            return Ok(max_index);
+        }
+
+        for index in 0..max_index {
             self.state
-                .read_blocking(state_flash, (write_size + i * write_size) as u32, aligned)?;
+                .read_blocking(state_flash, (2 + index) as u32 * P::STATE::WRITE_SIZE as u32, aligned)?;
 
             if aligned.iter().any(|&b| b == P::STATE::ERASE_VALUE) {
-                return Ok(i);
+                return Ok(index);
             }
         }
         Ok(max_index)
     }
 
-    fn update_progress<P: FlashConfig>(&mut self, idx: usize, p: &mut P, magic: &mut [u8]) -> Result<(), BootError> {
-        let write_size = magic.len();
-
+    fn update_progress<P: FlashConfig>(&mut self, index: usize, p: &mut P, magic: &mut [u8]) -> Result<(), BootError> {
         let aligned = magic;
         aligned.fill(!P::STATE::ERASE_VALUE);
         self.state
-            .write_blocking(p.state(), (write_size + idx * write_size) as u32, aligned)?;
+            .write_blocking(p.state(), (2 + index) as u32 * P::STATE::WRITE_SIZE as u32, aligned)?;
         Ok(())
     }
 
@@ -360,7 +373,7 @@ fn assert_partitions(active: Partition, dfu: Partition, state: Partition, page_s
     assert_eq!(active.len() % page_size, 0);
     assert_eq!(dfu.len() % page_size, 0);
     assert!(dfu.len() - active.len() >= page_size);
-    assert!(2 * (active.len() / page_size) <= (state.len() - write_size) / write_size);
+    assert!(2 + 2 * (active.len() / page_size) <= state.len() / write_size);
 }
 
 /// A flash wrapper implementing the Flash and embedded_storage traits.
diff --git a/embassy-boot/boot/src/firmware_updater.rs b/embassy-boot/boot/src/firmware_updater.rs
index af1ba114..fe3c0452 100644
--- a/embassy-boot/boot/src/firmware_updater.rs
+++ b/embassy-boot/boot/src/firmware_updater.rs
@@ -220,11 +220,24 @@ impl FirmwareUpdater {
         self.state.read(state_flash, 0, aligned).await?;
 
         if aligned.iter().any(|&b| b != magic) {
-            aligned.fill(0);
+            // Read progress validity
+            self.state.read(state_flash, F::WRITE_SIZE as u32, aligned).await?;
 
-            self.state.write(state_flash, 0, aligned).await?;
+            // FIXME: Do not make this assumption.
+            const STATE_ERASE_VALUE: u8 = 0xFF;
+
+            if aligned.iter().any(|&b| b != STATE_ERASE_VALUE) {
+                // The current progress validity marker is invalid
+            } else {
+                // Invalidate progress
+                aligned.fill(!STATE_ERASE_VALUE);
+                self.state.write(state_flash, F::WRITE_SIZE as u32, aligned).await?;
+            }
+
+            // Clear magic and progress
             self.state.wipe(state_flash).await?;
 
+            // Set magic
             aligned.fill(magic);
             self.state.write(state_flash, 0, aligned).await?;
         }
@@ -420,11 +433,24 @@ impl FirmwareUpdater {
         self.state.read_blocking(state_flash, 0, aligned)?;
 
         if aligned.iter().any(|&b| b != magic) {
-            aligned.fill(0);
+            // Read progress validity
+            self.state.read_blocking(state_flash, F::WRITE_SIZE as u32, aligned)?;
 
-            self.state.write_blocking(state_flash, 0, aligned)?;
+            // FIXME: Do not make this assumption.
+            const STATE_ERASE_VALUE: u8 = 0xFF;
+
+            if aligned.iter().any(|&b| b != STATE_ERASE_VALUE) {
+                // The current progress validity marker is invalid
+            } else {
+                // Invalidate progress
+                aligned.fill(!STATE_ERASE_VALUE);
+                self.state.write_blocking(state_flash, F::WRITE_SIZE as u32, aligned)?;
+            }
+
+            // Clear magic and progress
             self.state.wipe_blocking(state_flash)?;
 
+            // Set magic
             aligned.fill(magic);
             self.state.write_blocking(state_flash, 0, aligned)?;
         }
diff --git a/embassy-boot/boot/src/lib.rs b/embassy-boot/boot/src/lib.rs
index a5795781..597ce3fa 100644
--- a/embassy-boot/boot/src/lib.rs
+++ b/embassy-boot/boot/src/lib.rs
@@ -93,7 +93,7 @@ mod tests {
         const STATE: Partition = Partition::new(0, 4096);
         const ACTIVE: Partition = Partition::new(4096, 61440);
         const DFU: Partition = Partition::new(61440, 122880);
-        let mut flash = MemFlash::<131072, 4096, 4>::random().with_limited_erase_before_write_verification(4..);
+        let mut flash = MemFlash::<131072, 4096, 4>::random();
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
         let update: [u8; DFU.len()] = [rand::random::<u8>(); DFU.len()];
@@ -166,7 +166,7 @@ mod tests {
 
         let mut active = MemFlash::<16384, 4096, 8>::random();
         let mut dfu = MemFlash::<16384, 2048, 8>::random();
-        let mut state = MemFlash::<4096, 128, 4>::random().with_limited_erase_before_write_verification(2048 + 4..);
+        let mut state = MemFlash::<4096, 128, 4>::random();
         let mut aligned = [0; 4];
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
@@ -220,7 +220,7 @@ mod tests {
         let mut aligned = [0; 4];
         let mut active = MemFlash::<16384, 2048, 4>::random();
         let mut dfu = MemFlash::<16384, 4096, 8>::random();
-        let mut state = MemFlash::<4096, 128, 4>::random().with_limited_erase_before_write_verification(2048 + 4..);
+        let mut state = MemFlash::<4096, 128, 4>::random();
 
         let original: [u8; ACTIVE.len()] = [rand::random::<u8>(); ACTIVE.len()];
         let update: [u8; DFU.len()] = [rand::random::<u8>(); DFU.len()];
diff --git a/embassy-boot/boot/src/mem_flash.rs b/embassy-boot/boot/src/mem_flash.rs
index e87ccd37..828aad9d 100644
--- a/embassy-boot/boot/src/mem_flash.rs
+++ b/embassy-boot/boot/src/mem_flash.rs
@@ -9,8 +9,6 @@ use crate::Flash;
 
 pub struct MemFlash<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> {
     pub mem: [u8; SIZE],
-    pub allow_same_write: bool,
-    pub verify_erased_before_write: Range<usize>,
     pub pending_write_successes: Option<usize>,
 }
 
@@ -21,8 +19,6 @@ impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> MemFla
     pub const fn new(fill: u8) -> Self {
         Self {
             mem: [fill; SIZE],
-            allow_same_write: false,
-            verify_erased_before_write: 0..SIZE,
             pending_write_successes: None,
         }
     }
@@ -35,37 +31,9 @@ impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> MemFla
         }
         Self {
             mem,
-            allow_same_write: false,
-            verify_erased_before_write: 0..SIZE,
             pending_write_successes: None,
         }
     }
-
-    #[must_use]
-    pub fn allow_same_write(self, allow: bool) -> Self {
-        Self {
-            allow_same_write: allow,
-            ..self
-        }
-    }
-
-    #[must_use]
-    pub fn with_limited_erase_before_write_verification<R: RangeBounds<usize>>(self, verified_range: R) -> Self {
-        let start = match verified_range.start_bound() {
-            Bound::Included(start) => *start,
-            Bound::Excluded(start) => *start + 1,
-            Bound::Unbounded => 0,
-        };
-        let end = match verified_range.end_bound() {
-            Bound::Included(end) => *end - 1,
-            Bound::Excluded(end) => *end,
-            Bound::Unbounded => self.mem.len(),
-        };
-        Self {
-            verify_erased_before_write: start..end,
-            ..self
-        }
-    }
 }
 
 impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> Default
@@ -150,14 +118,8 @@ impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> NorFla
             .take(bytes.len())
             .zip(bytes)
         {
-            if self.allow_same_write && mem_byte == new_byte {
-                // Write does not change the flash memory which is allowed
-            } else {
-                if self.verify_erased_before_write.contains(&offset) {
-                    assert_eq!(0xFF, *mem_byte, "Offset {} is not erased", offset);
-                }
-                *mem_byte &= *new_byte;
-            }
+            assert_eq!(0xFF, *mem_byte, "Offset {} is not erased", offset);
+            *mem_byte = *new_byte;
         }
 
         Ok(())
@@ -192,22 +154,3 @@ impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncN
         <Self as NorFlash>::write(self, offset, bytes)
     }
 }
-
-#[cfg(test)]
-mod tests {
-    use core::ops::Range;
-
-    use embedded_storage::nor_flash::NorFlash;
-
-    use super::MemFlash;
-
-    #[test]
-    fn writes_only_flip_bits_from_1_to_0() {
-        let mut flash = MemFlash::<16, 16, 1>::default().with_limited_erase_before_write_verification(0..0);
-
-        flash.write(0, &[0x55]).unwrap();
-        flash.write(0, &[0xAA]).unwrap();
-
-        assert_eq!(0x00, flash.mem[0]);
-    }
-}

From 5e19fb6fb976db869696eaa5e8a2cdba751055b1 Mon Sep 17 00:00:00 2001
From: Rasmus Melchior Jacobsen <rmja@laesoe.org>
Date: Tue, 4 Apr 2023 12:36:50 +0200
Subject: [PATCH 10/11] Fix compile error when verification is enabled

---
 embassy-boot/boot/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/embassy-boot/boot/src/lib.rs b/embassy-boot/boot/src/lib.rs
index cb12f9dc..d53c613a 100644
--- a/embassy-boot/boot/src/lib.rs
+++ b/embassy-boot/boot/src/lib.rs
@@ -286,13 +286,13 @@ mod tests {
 
         const STATE: Partition = Partition::new(0, 4096);
         const DFU: Partition = Partition::new(4096, 8192);
-        let mut flash = MemFlash::<8192, 4096, 4>([0xff; 8192]);
+        let mut flash = MemFlash::<8192, 4096, 4>::default();
 
         let firmware_len = firmware.len();
 
         let mut write_buf = [0; 4096];
         write_buf[0..firmware_len].copy_from_slice(firmware);
-        NorFlash::write(&mut flash, DFU.from as u32, &write_buf).unwrap();
+        DFU.write_blocking(&mut flash, 0, &write_buf).unwrap();
 
         // On with the test
 

From 803c09c300a9aeb412e08c37723cd9de3caf89e9 Mon Sep 17 00:00:00 2001
From: Rasmus Melchior Jacobsen <rmja@laesoe.org>
Date: Tue, 4 Apr 2023 12:50:53 +0200
Subject: [PATCH 11/11] Expose read/write/erase on partition

---
 embassy-boot/boot/src/partition.rs | 22 ++++++----------------
 1 file changed, 6 insertions(+), 16 deletions(-)

diff --git a/embassy-boot/boot/src/partition.rs b/embassy-boot/boot/src/partition.rs
index 3ccd4dd7..217c457f 100644
--- a/embassy-boot/boot/src/partition.rs
+++ b/embassy-boot/boot/src/partition.rs
@@ -24,7 +24,7 @@ impl Partition {
     }
 
     /// Read from the partition on the provided flash
-    pub(crate) async fn read<F: AsyncReadNorFlash>(
+    pub async fn read<F: AsyncReadNorFlash>(
         &self,
         flash: &mut F,
         offset: u32,
@@ -35,12 +35,7 @@ impl Partition {
     }
 
     /// Write to the partition on the provided flash
-    pub(crate) async fn write<F: AsyncNorFlash>(
-        &self,
-        flash: &mut F,
-        offset: u32,
-        bytes: &[u8],
-    ) -> Result<(), F::Error> {
+    pub async fn write<F: AsyncNorFlash>(&self, flash: &mut F, offset: u32, bytes: &[u8]) -> Result<(), F::Error> {
         let offset = self.from as u32 + offset;
         flash.write(offset, bytes).await?;
         trace!("Wrote from 0x{:x} len {}", offset, bytes.len());
@@ -48,7 +43,7 @@ impl Partition {
     }
 
     /// Erase part of the partition on the provided flash
-    pub(crate) async fn erase<F: AsyncNorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
+    pub async fn erase<F: AsyncNorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
         let from = self.from as u32 + from;
         let to = self.from as u32 + to;
         flash.erase(from, to).await?;
@@ -66,18 +61,13 @@ impl Partition {
     }
 
     /// Read from the partition on the provided flash
-    pub(crate) fn read_blocking<F: ReadNorFlash>(
-        &self,
-        flash: &mut F,
-        offset: u32,
-        bytes: &mut [u8],
-    ) -> Result<(), F::Error> {
+    pub fn read_blocking<F: ReadNorFlash>(&self, flash: &mut F, offset: u32, bytes: &mut [u8]) -> Result<(), F::Error> {
         let offset = self.from as u32 + offset;
         flash.read(offset, bytes)
     }
 
     /// Write to the partition on the provided flash
-    pub(crate) fn write_blocking<F: NorFlash>(&self, flash: &mut F, offset: u32, bytes: &[u8]) -> Result<(), F::Error> {
+    pub fn write_blocking<F: NorFlash>(&self, flash: &mut F, offset: u32, bytes: &[u8]) -> Result<(), F::Error> {
         let offset = self.from as u32 + offset;
         flash.write(offset, bytes)?;
         trace!("Wrote from 0x{:x} len {}", offset, bytes.len());
@@ -85,7 +75,7 @@ impl Partition {
     }
 
     /// Erase part of the partition on the provided flash
-    pub(crate) fn erase_blocking<F: NorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
+    pub fn erase_blocking<F: NorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
         let from = self.from as u32 + from;
         let to = self.from as u32 + to;
         flash.erase(from, to)?;