Merge pull request #1363 from embassy-rs/embassy-time-released

time: remove embassy-sync dep, release v0.1.1

.github/workflows/doc.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       matrix:
         crates:
-          - stm32
+          #- stm32  # runs out of disk space...
           - rest
 
     # This will ensure at most one doc build job is running at a time
@@ -46,7 +46,7 @@ jobs:
 
       - name: Install docserver
         run: |
-          wget -q -O /usr/local/bin/builder "https://github.com/embassy-rs/docserver/releases/download/v0.3/builder"
+          wget -q -O /usr/local/bin/builder "https://github.com/embassy-rs/docserver/releases/download/v0.4/builder"
           chmod +x /usr/local/bin/builder
 
       - name: build-stm32
@@ -54,7 +54,6 @@ jobs:
         run: |
           mkdir crates
           builder ./embassy-stm32 crates/embassy-stm32/git.zup
-          builder ./stm32-metapac crates/stm32-metapac/git.zup
 
       - name: build-rest
         if: ${{ matrix.crates=='rest' }}
@@ -69,12 +68,15 @@ jobs:
           builder ./embassy-futures crates/embassy-futures/git.zup
           builder ./embassy-lora crates/embassy-lora/git.zup
           builder ./embassy-net crates/embassy-net/git.zup
+          builder ./embassy-net-driver crates/embassy-net-driver/git.zup
+          builder ./embassy-net-driver-channel crates/embassy-net-driver-channel/git.zup
           builder ./embassy-nrf crates/embassy-nrf/git.zup
           builder ./embassy-rp crates/embassy-rp/git.zup
           builder ./embassy-sync crates/embassy-sync/git.zup
           builder ./embassy-time crates/embassy-time/git.zup
           builder ./embassy-usb crates/embassy-usb/git.zup
           builder ./embassy-usb-driver crates/embassy-usb-driver/git.zup
+          builder ./embassy-usb-logger crates/embassy-usb-logger/git.zup
 
       - name: upload
         run: |

.github/workflows/rust.yml

@@ -68,5 +68,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Test
-        run: cd embassy-sync && cargo test
+
+      - name: Test boot
+        working-directory: ./embassy-boot/boot
+        run: cargo test && cargo test --features "ed25519-dalek" && cargo test --features "ed25519-salty"
+
+      - name: Test sync
+        working-directory: ./embassy-sync
+        run: cargo test

.gitignore

@@ -4,8 +4,4 @@ target_ci_stable
 Cargo.lock
 third_party
 /Cargo.toml
-stm32-metapac-gen/out/
-stm32-metapac-backup
-stm32-metapac/src/chips
-stm32-metapac/src/peripherals
 out/

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "stm32-data"]
-	path = stm32-data
-	url = https://github.com/embassy-rs/stm32-data.git

.vscode/extensions.json

@@ -0,0 +1,11 @@
+{
+	// See https://go.microsoft.com/fwlink/?LinkId=827846 to learn about workspace recommendations.
+	// Extension identifier format: ${publisher}.${name}. Example: vscode.csharp
+	// List of extensions which should be recommended for users of this workspace.
+	"recommendations": [
+		"rust-lang.rust-analyzer",
+		"tamasfe.even-better-toml",
+	],
+	// List of extensions recommended by VS Code that should not be recommended for users of this workspace.
+	"unwantedRecommendations": []
+}

.vscode/settings.json

@@ -1,25 +1,22 @@
 {
   "editor.formatOnSave": true,
-  "rust-analyzer.checkOnSave.allTargets": false,
-  "rust-analyzer.checkOnSave.noDefaultFeatures": true,
+  "[toml]": {
+    "editor.formatOnSave": false
+  },
+  "rust-analyzer.check.allTargets": false,
+  "rust-analyzer.check.noDefaultFeatures": true,
   "rust-analyzer.cargo.noDefaultFeatures": true,
-  "rust-analyzer.procMacro.enable": true,
   "rust-analyzer.cargo.target": "thumbv7em-none-eabi",
+  //"rust-analyzer.cargo.target": "thumbv8m.main-none-eabihf",
   "rust-analyzer.cargo.features": [
-    // These are needed to prevent embassy-net from failing to build
-    //"embassy-net/medium-ethernet",
-    //"embassy-net/tcp",
-    //"embassy-net/pool-16",
-    //"time-tick-16mhz",
-    //"defmt-timestamp-uptime",
     "nightly",
-    //"unstable-traits",
   ],
   "rust-analyzer.linkedProjects": [
     // Declare for the target you wish to develop
-    //"embassy-executor/Cargo.toml",
-    //"embassy-sync/Cargo.toml",
-    "examples/nrf/Cargo.toml",
+    // "embassy-executor/Cargo.toml",
+    // "embassy-sync/Cargo.toml",
+    "examples/nrf52840/Cargo.toml",
+    //"examples/nrf5340/Cargo.toml",
     // "examples/nrf-rtos-trace/Cargo.toml",
     // "examples/rp/Cargo.toml",
     // "examples/std/Cargo.toml",
@@ -43,8 +40,4 @@
     // "examples/stm32wl55/Cargo.toml",
     // "examples/wasm/Cargo.toml",
   ],
-  "rust-analyzer.imports.granularity.enforce": true,
-  "rust-analyzer.imports.granularity.group": "module",
-  "rust-analyzer.cargo.buildScripts.enable": true,
-  "rust-analyzer.procMacro.attributes.enable": false,
 }

README.md

@@ -14,12 +14,16 @@ Rust's <a href="https://rust-lang.github.io/async-book/">async/await</a> allows
 - **Hardware Abstraction Layers** - HALs implement safe, idiomatic Rust APIs to use the hardware capabilities, so raw register manipulation is not needed. The Embassy project maintains HALs for select hardware, but you can still use HALs from other projects with Embassy.
   - <a href="https://docs.embassy.dev/embassy-stm32/">embassy-stm32</a>, for all STM32 microcontroller families.
   - <a href="https://docs.embassy.dev/embassy-nrf/">embassy-nrf</a>, for the Nordic Semiconductor nRF52, nRF53, nRF91 series.
+  - <a href="https://docs.embassy.dev/embassy-rp/">embassy-rp</a>, for the Raspberry Pi RP2040 microcontroller.
+  - <a href="https://github.com/esp-rs">esp-rs</a>, for the Espressif Systems ESP32 series of chips.
+    - Embassy HAL support for Espressif chips is being developed in the [esp-rs/esp-hal](https://github.com/esp-rs/esp-hal) repository.
+    - Async WiFi, Bluetooth and ESP-NOW is being developed in the [esp-rs/esp-wifi](https://github.com/esp-rs/esp-wifi) repository.
 
 - **Time that Just Works** - 
 No more messing with hardware timers. <a href="https://docs.embassy.dev/embassy-time">embassy_time</a> provides Instant, Duration and Timer types that are globally available and never overflow.
 
 - **Real-time ready** - 
-Tasks on the same async executor run cooperatively, but you can create multiple executors with different priorities, so that higher priority tasks preempt lower priority ones. See the <a href="https://github.com/embassy-rs/embassy/blob/master/examples/nrf/src/bin/multiprio.rs">example</a>.
+Tasks on the same async executor run cooperatively, but you can create multiple executors with different priorities, so that higher priority tasks preempt lower priority ones. See the <a href="https://github.com/embassy-rs/embassy/blob/master/examples/nrf52840/src/bin/multiprio.rs">example</a>.
 
 - **Low-power ready** - 
 Easily build devices with years of battery life. The async executor automatically puts the core to sleep when there's no work to do. Tasks are woken by interrupts, there is no busy-loop polling while waiting.
@@ -87,7 +91,8 @@ async fn main(spawner: Spawner) {
 
 Examples are found in the `examples/` folder seperated by the chip manufacturer they are designed to run on. For example:
 
-*   `examples/nrf` run on the `nrf52840-dk` board (PCA10056) but should be easily adaptable to other nRF52 chips and boards.
+*   `examples/nrf52840` run on the `nrf52840-dk` board (PCA10056) but should be easily adaptable to other nRF52 chips and boards.
+*   `examples/nrf5340` run on the `nrf5340-dk` board (PCA10095).
 *   `examples/stm32xx` for the various STM32 families.
 *   `examples/rp` are for the RP2040 chip.
 *   `examples/std` are designed to run locally on your PC.
@@ -110,7 +115,7 @@ cargo install probe-run
 - Change directory to the sample's base directory. For example:
 
 ```bash
-cd examples/nrf
+cd examples/nrf52840
 ```
 
 - Run the example

ci.sh

@@ -8,44 +8,30 @@ export DEFMT_LOG=trace
 
 TARGET=$(rustc -vV | sed -n 's|host: ||p')
 
+BUILD_EXTRA=""
 if [ $TARGET = "x86_64-unknown-linux-gnu" ]; then
     BUILD_EXTRA="--- build --release --manifest-path examples/std/Cargo.toml --target $TARGET --out-dir out/examples/std"
-else
-    BUILD_EXTRA=""
 fi
 
-find . -name '*.rs' -not -path '*target*' -not -path '*stm32-metapac-gen/out/*' -not -path '*stm32-metapac/src/*' | xargs rustfmt --check  --skip-children --unstable-features --edition 2018
-
-# Generate stm32-metapac
-if [ ! -d "stm32-metapac-backup" ]
-then
-    cp -r stm32-metapac stm32-metapac-backup
-fi
-
-rm -rf stm32-metapac
-cp -r stm32-metapac-backup stm32-metapac
-
-# for some reason Cargo stomps the cache if we don't specify --target.
-# This happens with vanilla Cargo, not just cargo-batch. Bug?
-(cd stm32-metapac-gen; cargo run --release --target $TARGET)
-rm -rf stm32-metapac
-mv stm32-metapac-gen/out stm32-metapac
+find . -name '*.rs' -not -path '*target*' | xargs rustfmt --check  --skip-children --unstable-features --edition 2018
 
 cargo batch  \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv7em-none-eabi --features nightly \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv7em-none-eabi --features nightly,log \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv7em-none-eabi --features nightly,defmt \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv6m-none-eabi --features nightly,defmt \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16 \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16,unstable-traits \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16,nightly \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16,unstable-traits,nightly \
+    --- build --release --manifest-path embassy-sync/Cargo.toml --target thumbv6m-none-eabi --features nightly,defmt \
+    --- build --release --manifest-path embassy-time/Cargo.toml --target thumbv6m-none-eabi --features nightly,unstable-traits,defmt,defmt-timestamp-uptime,tick-hz-32_768,generic-queue-8 \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,unstable-traits \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,nightly \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,unstable-traits,nightly \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52805,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52810,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52811,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52820,gpiote,time-driver-rtc1 \
-    --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52832,gpiote,time-driver-rtc1 \
-    --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52833,gpiote,time-driver-rtc1,unstable-traits \
+    --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52832,gpiote,time-driver-rtc1,reset-pin-as-gpio \
+    --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nightly,nrf52833,gpiote,time-driver-rtc1,unstable-traits,nfc-pins-as-gpio \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features nightly,nrf9160-s,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features nightly,nrf9160-ns,gpiote,time-driver-rtc1,unstable-traits \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features nightly,nrf5340-app-s,gpiote,time-driver-rtc1,unstable-traits \
@@ -61,7 +47,9 @@ cargo batch  \
     --- build --release --manifest-path embassy-rp/Cargo.toml --target thumbv6m-none-eabi --features nightly,intrinsics \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f410tb,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f411ce,defmt,exti,time-driver-any,unstable-traits \
-    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f429zi,log,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f413vh,defmt,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f429zi,log,exti,time-driver-any,unstable-traits,embedded-sdmmc \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32f730i8,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32h755zi-cm7,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32h7b3ai,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32l476vg,defmt,exti,time-driver-any,unstable-traits \
@@ -74,18 +62,23 @@ cargo batch  \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32f217zg,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv8m.main-none-eabihf --features nightly,stm32l552ze,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv6m-none-eabi --features nightly,stm32wl54jc-cm0p,defmt,exti,time-driver-any,unstable-traits \
-    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32wle5ub,defmt,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features nightly,stm32wle5jb,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32f107vc,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32f103re,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32f100c4,defmt,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32h503rb,defmt,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features nightly,stm32h562ag,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-boot/nrf/Cargo.toml --target thumbv7em-none-eabi --features embassy-nrf/nrf52840 \
+    --- build --release --manifest-path embassy-boot/nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features embassy-nrf/nrf9160-ns \
+    --- build --release --manifest-path embassy-boot/rp/Cargo.toml --target thumbv6m-none-eabi \
     --- build --release --manifest-path embassy-boot/stm32/Cargo.toml --target thumbv7em-none-eabi --features embassy-stm32/stm32wl55jc-cm4 \
     --- build --release --manifest-path docs/modules/ROOT/examples/basic/Cargo.toml --target thumbv7em-none-eabi \
     --- build --release --manifest-path docs/modules/ROOT/examples/layer-by-layer/blinky-pac/Cargo.toml --target thumbv7em-none-eabi \
     --- build --release --manifest-path docs/modules/ROOT/examples/layer-by-layer/blinky-hal/Cargo.toml --target thumbv7em-none-eabi \
     --- build --release --manifest-path docs/modules/ROOT/examples/layer-by-layer/blinky-irq/Cargo.toml --target thumbv7em-none-eabi \
     --- build --release --manifest-path docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml --target thumbv7em-none-eabi \
-    --- build --release --manifest-path examples/nrf/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/nrf \
+    --- build --release --manifest-path examples/nrf52840/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/nrf52840 \
+    --- build --release --manifest-path examples/nrf5340/Cargo.toml --target thumbv8m.main-none-eabihf --out-dir out/examples/nrf5340 \
     --- build --release --manifest-path examples/rp/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/rp \
     --- build --release --manifest-path examples/stm32f0/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/stm32f0 \
     --- build --release --manifest-path examples/stm32f1/Cargo.toml --target thumbv7m-none-eabi --out-dir out/examples/stm32f1 \
@@ -93,8 +86,10 @@ cargo batch  \
     --- build --release --manifest-path examples/stm32f3/Cargo.toml --target thumbv7em-none-eabihf --out-dir out/examples/stm32f3 \
     --- build --release --manifest-path examples/stm32f4/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/stm32f4 \
     --- build --release --manifest-path examples/stm32f7/Cargo.toml --target thumbv7em-none-eabihf --out-dir out/examples/stm32f7 \
+    --- build --release --manifest-path examples/stm32c0/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/stm32c0 \
     --- build --release --manifest-path examples/stm32g0/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/stm32g0 \
     --- build --release --manifest-path examples/stm32g4/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/stm32g4 \
+    --- build --release --manifest-path examples/stm32h5/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/stm32h5 \
     --- build --release --manifest-path examples/stm32h7/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/stm32h7 \
     --- build --release --manifest-path examples/stm32l0/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/stm32l0 \
     --- build --release --manifest-path examples/stm32l1/Cargo.toml --target thumbv7m-none-eabi --out-dir out/examples/stm32l1 \
@@ -103,7 +98,9 @@ cargo batch  \
     --- build --release --manifest-path examples/stm32u5/Cargo.toml --target thumbv8m.main-none-eabihf --out-dir out/examples/stm32u5 \
     --- build --release --manifest-path examples/stm32wb/Cargo.toml --target thumbv7em-none-eabihf --out-dir out/examples/stm32wb \
     --- build --release --manifest-path examples/stm32wl/Cargo.toml --target thumbv7em-none-eabihf --out-dir out/examples/stm32wl \
-    --- build --release --manifest-path examples/boot/application/nrf/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/boot/nrf --bin b \
+    --- build --release --manifest-path examples/boot/application/nrf/Cargo.toml --target thumbv7em-none-eabi --features embassy-nrf/nrf52840 --out-dir out/examples/boot/nrf --bin b \
+    --- build --release --manifest-path examples/boot/application/nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features embassy-nrf/nrf9160-ns --out-dir out/examples/boot/nrf --bin b \
+    --- build --release --manifest-path examples/boot/application/rp/Cargo.toml --target thumbv6m-none-eabi --out-dir out/examples/boot/rp --bin b \
     --- build --release --manifest-path examples/boot/application/stm32f3/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/boot/stm32f3 --bin b \
     --- build --release --manifest-path examples/boot/application/stm32f7/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/boot/stm32f7 --bin b \
     --- build --release --manifest-path examples/boot/application/stm32h7/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/boot/stm32h7 --bin b \
@@ -112,16 +109,22 @@ cargo batch  \
     --- build --release --manifest-path examples/boot/application/stm32l4/Cargo.toml --target thumbv7em-none-eabi --out-dir out/examples/boot/stm32l4 --bin b \
     --- build --release --manifest-path examples/boot/application/stm32wl/Cargo.toml --target thumbv7em-none-eabihf --out-dir out/examples/boot/stm32wl --bin b \
     --- build --release --manifest-path examples/boot/bootloader/nrf/Cargo.toml --target thumbv7em-none-eabi --features embassy-nrf/nrf52840 \
+    --- build --release --manifest-path examples/boot/bootloader/nrf/Cargo.toml --target thumbv8m.main-none-eabihf --features embassy-nrf/nrf9160-ns \
+    --- build --release --manifest-path examples/boot/bootloader/rp/Cargo.toml --target thumbv6m-none-eabi \
     --- build --release --manifest-path examples/boot/bootloader/stm32/Cargo.toml --target thumbv7em-none-eabi --features embassy-stm32/stm32wl55jc-cm4 \
     --- build --release --manifest-path examples/wasm/Cargo.toml --target wasm32-unknown-unknown --out-dir out/examples/wasm \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7m-none-eabi --features stm32f103c8 --out-dir out/tests/bluepill-stm32f103c8 \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32f429zi --out-dir out/tests/nucleo-stm32f429zi \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32g491re --out-dir out/tests/nucleo-stm32g491re \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv6m-none-eabi --features stm32g071rb --out-dir out/tests/nucleo-stm32g071rb \
+    --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv6m-none-eabi --features stm32c031c6 --out-dir out/tests/nucleo-stm32c031c6 \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32h755zi --out-dir out/tests/nucleo-stm32h755zi \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32wb55rg --out-dir out/tests/nucleo-stm32wb55rg \
+    --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32h563zi --out-dir out/tests/nucleo-stm32h563zi \
     --- build --release --manifest-path tests/stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32u585ai --out-dir out/tests/iot-stm32u585ai \
     --- build --release --manifest-path tests/rp/Cargo.toml --target thumbv6m-none-eabi --out-dir out/tests/rpi-pico \
+    --- build --release --manifest-path tests/nrf/Cargo.toml --target thumbv7em-none-eabi --out-dir out/tests/nrf52840-dk \
+    --- build --release --manifest-path tests/riscv32/Cargo.toml --target riscv32imac-unknown-none-elf \
     $BUILD_EXTRA
 
 

ci_stable.sh

@@ -13,8 +13,8 @@ cargo batch  \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv7em-none-eabi --features log \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv7em-none-eabi --features defmt \
     --- build --release --manifest-path embassy-executor/Cargo.toml --target thumbv6m-none-eabi --features defmt \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16 \
-    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,pool-16,unstable-traits \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet \
+    --- build --release --manifest-path embassy-net/Cargo.toml --target thumbv7em-none-eabi --features defmt,tcp,udp,dns,dhcpv4,medium-ethernet,unstable-traits \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nrf52805,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nrf52810,gpiote,time-driver-rtc1 \
     --- build --release --manifest-path embassy-nrf/Cargo.toml --target thumbv7em-none-eabi --features nrf52811,gpiote,time-driver-rtc1 \
@@ -36,7 +36,7 @@ cargo batch  \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32g491re,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32u585zi,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32wb55vy,defmt,exti,time-driver-any,unstable-traits \
-    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32wl55uc-cm4,defmt,exti,time-driver-any,unstable-traits \
+    --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32wl55cc-cm4,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32l4r9zi,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32f303vc,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7em-none-eabi --features stm32f411ce,defmt,time-driver-any \
@@ -65,5 +65,5 @@ cargo batch  \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features stm32l151cb-a,defmt,exti,time-driver-any,unstable-traits \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features stm32f217zg,defmt,exti,time-driver-any \
     --- build --release --manifest-path embassy-stm32/Cargo.toml --target thumbv7m-none-eabi --features stm32f217zg,defmt,exti,time-driver-any,unstable-traits \
-    --- build --release --manifest-path examples/nrf/Cargo.toml --target thumbv7em-none-eabi --no-default-features --out-dir out/examples/nrf --bin raw_spawn \
+    --- build --release --manifest-path examples/nrf52840/Cargo.toml --target thumbv7em-none-eabi --no-default-features --out-dir out/examples/nrf52840 --bin raw_spawn \
     --- build --release --manifest-path examples/stm32l0/Cargo.toml --target thumbv6m-none-eabi --no-default-features --out-dir out/examples/stm32l0 --bin raw_spawn \

docs/modules/ROOT/examples/basic/Cargo.toml

@@ -6,7 +6,7 @@ version = "0.1.0"
 license = "MIT OR Apache-2.0"
 
 [dependencies]
-embassy-executor = { version = "0.1.0", path = "../../../../../embassy-executor", features = ["defmt", "nightly", "integrated-timers"] }
+embassy-executor = { version = "0.1.0", path = "../../../../../embassy-executor", features = ["defmt", "nightly", "integrated-timers", "arch-cortex-m", "executor-thread"] }
 embassy-time = { version = "0.1.0", path = "../../../../../embassy-time", features = ["defmt", "nightly"] }
 embassy-nrf = { version = "0.1.0", path = "../../../../../embassy-nrf", features = ["defmt", "nrf52840", "time-driver-rtc1", "gpiote", "nightly"] }
 

docs/modules/ROOT/examples/layer-by-layer/Cargo.toml

@@ -10,7 +10,6 @@ members = [
 [patch.crates-io]
 embassy-executor = { path = "../../../../../embassy-executor" }
 embassy-stm32 = { path = "../../../../../embassy-stm32" }
-stm32-metapac = { path = "../../../../../stm32-metapac" }
 
 [profile.release]
 codegen-units = 1

docs/modules/ROOT/examples/layer-by-layer/blinky-async/Cargo.toml

@@ -8,7 +8,7 @@ license = "MIT OR Apache-2.0"
 cortex-m = "0.7"
 cortex-m-rt = "0.7"
 embassy-stm32 = { version = "0.1.0", features = ["stm32l475vg", "memory-x", "exti"], default-features = false  }
-embassy-executor = { version = "0.1.0", default-features = false, features = ["nightly"] }
+embassy-executor = { version = "0.1.0", default-features = false, features = ["nightly", "arch-cortex-m", "executor-thread"] }
 
 defmt = "0.3.0"
 defmt-rtt = "0.3.0"

docs/modules/ROOT/examples/layer-by-layer/blinky-pac/Cargo.toml

@@ -7,7 +7,7 @@ license = "MIT OR Apache-2.0"
 [dependencies]
 cortex-m = "0.7"
 cortex-m-rt = "0.7"
-stm32-metapac = { version = "0.1.0", features = ["stm32l475vg", "memory-x"] }
+stm32-metapac = { version = "1", features = ["stm32l475vg", "memory-x"] }
 
 defmt = "0.3.0"
 defmt-rtt = "0.3.0"

docs/modules/ROOT/pages/basic_application.adoc

@@ -21,7 +21,7 @@ Then, what follows are some declarations on how to deal with panics and faults.
 
 [source,rust]
 ----
-include::example$basic/src/main.rs[lines="11..12"]
+include::example$basic/src/main.rs[lines="10"]
 ----
 
 === Task declaration
@@ -30,7 +30,7 @@ After a bit of import declaration, the tasks run by the application should be de
 
 [source,rust]
 ----
-include::example$basic/src/main.rs[lines="13..22"]
+include::example$basic/src/main.rs[lines="12..20"]
 ----
 
 An embassy task must be declared `async`, and may NOT take generic arguments. In this case, we are handed the LED that should be blinked and the interval of the blinking.
@@ -45,23 +45,10 @@ The `Spawner` is the way the main application spawns other tasks. The `Periphera
 
 [source,rust]
 ----
-include::example$basic/src/main.rs[lines="23..-1"]
+include::example$basic/src/main.rs[lines="22..-1"]
 ----
 
-`#[embassy_executor::main]` takes an optional `config` parameter specifying a function that returns an instance of HAL's `Config` struct. For example:
-
-```rust
-fn embassy_config() -> embassy_nrf::config::Config {
-    embassy_nrf::config::Config::default()
-}
-
-#[embassy_executor::main(config = "embassy_config()")]
-async fn main(_spawner: Spawner, p: embassy_nrf::Peripherals) {
-    // ...
-}
-```
-
-What happens when the `blinker` task have been spawned and main returns? Well, the main entry point is actually just like any other task, except that you can only have one and it takes some specific type arguments. The magic lies within the `#[embassy::main]` macro. The macro does the following:
+What happens when the `blinker` task has been spawned and main returns? Well, the main entry point is actually just like any other task, except that you can only have one and it takes some specific type arguments. The magic lies within the `#[embassy::main]` macro. The macro does the following:
 
 . Creates an Embassy Executor
 . Initializes the microcontroller HAL to get the `Peripherals`
@@ -76,7 +63,7 @@ The project definition needs to contain the embassy dependencies:
 
 [source,toml]
 ----
-include::example$basic/Cargo.toml[lines="8..9"]
+include::example$basic/Cargo.toml[lines="9..11"]
 ----
 
 Depending on your microcontroller, you may need to replace `embassy-nrf` with something else (`embassy-stm32` for STM32. Remember to update feature flags as well).

docs/modules/ROOT/pages/bootloader.adoc

@@ -6,7 +6,7 @@ The bootloader can be used either as a library or be flashed directly if you are
 
 By design, the bootloader does not provide any network capabilities. Networking capabilities for fetching new firmware can be provided by the user application, using the bootloader as a library for updating the firmware, or by using the bootloader as a library and adding this capability yourself.
 
-The bootloader supports both internal and external flash by relying on the `embedded-storage` traits.
+The bootloader supports both internal and external flash by relying on the `embedded-storage` traits. The bootloader optionally supports the verification of firmware that has been digitally signed (recommended).
 
 
 == Hardware support
@@ -15,6 +15,7 @@ The bootloader supports
 
 * nRF52 with and without softdevice
 * STM32 L4, WB, WL, L1, L0, F3, F7 and H7
+* Raspberry Pi: RP2040
 
 In general, the bootloader works on any platform that implements the `embedded-storage` traits for its internal flash, but may require custom initialization code to work.
 
@@ -43,3 +44,51 @@ The partitions for ACTIVE (+BOOTLOADER), DFU and BOOTLOADER_STATE may be placed
 The BOOTLOADER_STATE partition must be big enough to store one word per page in the ACTIVE and DFU partitions combined.
 
 The bootloader has a platform-agnostic part, which implements the power fail safe swapping algorithm given the boundaries set by the partitions. The platform-specific part is a minimal shim that provides additional functionality such as watchdogs or supporting the nRF52 softdevice.
+
+=== FirmwareUpdater
+
+The `FirmwareUpdater` is an object for conveniently flashing firmware to the DFU partition and subsequently marking it as being ready for swapping with the active partition on the next reset. Its principle methods are `write_firmware`, which is called once per the size of the flash "write block" (typically 4KiB), and `mark_updated`, which is the final call.
+
+=== Verification
+
+The bootloader supports the verification of firmware that has been flashed to the DFU partition. Verification requires that firmware has been signed digitally using link:https://ed25519.cr.yp.to/[`ed25519`] signatures. With verification enabled, the `FirmwareUpdater::verify_and_mark_updated` method is called in place of `mark_updated`. A public key and signature are required, along with the actual length of the firmware that has been flashed. If verification fails then the firmware will not be marked as updated and therefore be rejected.
+
+Signatures are normally conveyed with the firmware to be updated and not written to flash. How signatures are provided is a firmware responsibility.
+
+To enable verification use either the `ed25519-dalek` or `ed25519-salty` features when depending on the `embassy-boot` crate. We recommend `ed25519-salty` at this time due to its small size.
+
+==== Tips on keys and signing with ed25519
+
+Ed25519 is a public key signature system where you are responsible for keeping the private key secure. We recommend embedding the *public* key in your program so that it can be easily passed to `verify_and_mark_updated`. An example declaration of the public key in your firmware:
+
+[source, rust]
+----
+static PUBLIC_SIGNING_KEY: &[u8] = include_bytes!("key.pub");
+----
+
+Signatures are often conveyed along with firmware by appending them.
+
+Ed25519 keys can be generated by a variety of tools. We recommend link:https://man.openbsd.org/signify[`signify`] as it is in wide use to sign and verify OpenBSD distributions, and is straightforward to use.
+
+The following set of Bash commands can be used to generate public and private keys on Unix platforms, and also generate a local `key.pub` file with the `signify` file headers removed. Declare a `SECRETS_DIR` environment variable in a secure location.
+
+[source, bash]
+----
+signify -G -n -p $SECRETS_DIR/key.pub -s $SECRETS_DIR/key.sec
+tail -n1 $SECRETS_DIR/key.pub | base64 -d -i - | dd ibs=10 skip=1 > key.pub
+chmod 700 $SECRETS_DIR/key.sec
+export SECRET_SIGNING_KEY=$(tail -n1 $SECRETS_DIR/key.sec)
+----
+
+Then, to sign your firmware given a declaration of `FIRMWARE_DIR` and a firmware filename of `myfirmware`:
+
+[source, bash]
+----
+shasum -a 512 -b $FIRMWARE_DIR/myfirmware > $SECRETS_DIR/message.txt
+cat $SECRETS_DIR/message.txt | dd ibs=128 count=1 | xxd -p -r > $SECRETS_DIR/message.txt
+signify -S -s $SECRETS_DIR/key.sec -m $SECRETS_DIR/message.txt -x $SECRETS_DIR/message.txt.sig
+cp $FIRMWARE_DIR/myfirmware $FIRMWARE_DIR/myfirmware+signed
+tail -n1 $SECRETS_DIR/message.txt.sig | base64 -d -i - | dd ibs=10 skip=1 >> $FIRMWARE_DIR/myfirmware+signed
+----
+
+Remember, guard the `$SECRETS_DIR/key.sec` key as compromising it means that another party can sign your firmware.

docs/modules/ROOT/pages/getting_started.adoc

@@ -45,7 +45,7 @@ You can run an example by opening a terminal and entering the following commands
 
 [source, bash]
 ----
-cd examples/nrf
+cd examples/nrf52840
 cargo run --bin blinky --release
 ----
 

docs/modules/ROOT/pages/layer_by_layer.adoc

@@ -8,7 +8,7 @@ The application we'll write is a simple 'push button, blink led' application, wh
 
 == PAC version
 
-The PAC is the lowest API for accessing peripherals and registers, if you don't count reading/writing directly to memory addresses. It provide distinct types
+The PAC is the lowest API for accessing peripherals and registers, if you don't count reading/writing directly to memory addresses. It provides distinct types
 to make accessing peripheral registers easier, but it does not prevent you from writing unsafe code.
 
 Writing an application using the PAC directly is therefore not recommended, but if the functionality you want to use is not exposed in the upper layers, that's what you need to use.
@@ -20,13 +20,13 @@ The blinky app using PAC is shown below:
 include::example$layer-by-layer/blinky-pac/src/main.rs[]
 ----
 
-As you can see, there are a lot of code needed to enable the peripheral clocks, configuring the input pins and the output pins of the application.
+As you can see, a lot of code is needed to enable the peripheral clocks and to configure the input pins and the output pins of the application.
 
 Another downside of this application is that it is busy-looping while polling the button state. This prevents the microcontroller from utilizing any sleep mode to save power.
 
 == HAL version
 
-To simplify our application, we can use the HAL instead. The HAL exposes higher level APIs that handle details such
+To simplify our application, we can use the HAL instead. The HAL exposes higher level APIs that handle details such as:
 
 * Automatically enabling the peripheral clock when you're using the peripheral
 * Deriving and applying register configuration from higher level types
@@ -39,7 +39,7 @@ The HAL example is shown below:
 include::example$layer-by-layer/blinky-hal/src/main.rs[]
 ----
 
-As you can see, the application becomes a lot simpler, even without using any async code. The `Input` and `Output` hides all the details accessing the GPIO registers, and allow you to use a much simpler API to query the state of the button and toggle the LED output accordingly.
+As you can see, the application becomes a lot simpler, even without using any async code. The `Input` and `Output` types hide all the details of accessing the GPIO registers and allow you to use a much simpler API for querying the state of the button and toggling the LED output.
 
 The same downside from the PAC example still applies though: the application is busy looping and consuming more power than necessary.
 

docs/modules/ROOT/pages/stm32.adoc

@@ -4,9 +4,9 @@ The link:https://github.com/embassy-rs/embassy/tree/master/embassy-stm32[Embassy
 
 == The infinite variant problem
 
-STM32 microcontrollers comes in many families and flavors, and supporting all of them is a big undertaking. Embassy has taken advantage of the fact
+STM32 microcontrollers come in many families, and flavors and supporting all of them is a big undertaking. Embassy has taken advantage of the fact
 that the STM32 peripheral versions are shared across chip families. Instead of re-implementing the SPI
-peripheral for every STM32 chip family, embassy have a single SPI implementation that depends on
+peripheral for every STM32 chip family, embassy has a single SPI implementation that depends on
 code-generated register types that are identical for STM32 families with the same version of a given peripheral.
 
 === The metapac

embassy-boot/boot/Cargo.toml

@@ -1,26 +1,52 @@
 [package]
 edition = "2021"
 name = "embassy-boot"
-version = "0.1.0"
-description = "Bootloader using Embassy"
+version = "0.1.1"
+description = "A lightweight bootloader supporting firmware updates in a power-fail-safe way, with trial boots and rollbacks."
 license = "MIT OR Apache-2.0"
+repository = "https://github.com/embassy-rs/embassy"
+categories = [
+    "embedded",
+    "no-std",
+    "asynchronous",
+]
 
 [package.metadata.embassy_docs]
 src_base = "https://github.com/embassy-rs/embassy/blob/embassy-boot-v$VERSION/embassy-boot/boot/src/"
 src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-boot/boot/src/"
 target = "thumbv7em-none-eabi"
+features = ["defmt"]
+
+[package.metadata.docs.rs]
+features = ["defmt"]
 
 [lib]
 
 [dependencies]
 defmt = { version = "0.3", optional = true }
+digest = "0.10"
 log = { version = "0.4", optional = true  }
-embassy-sync = { version = "0.1.0", path = "../../embassy-sync" }
+ed25519-dalek = { version = "1.0.1", default_features = false, features = ["u32_backend"], optional = true }
+embassy-sync = { version = "0.2.0", path = "../../embassy-sync" }
 embedded-storage = "0.3.0"
-embedded-storage-async = "0.3.0"
+embedded-storage-async = "0.4.0"
+salty = { git = "https://github.com/ycrypto/salty.git", rev = "a9f17911a5024698406b75c0fac56ab5ccf6a8c7", optional = true }
+signature = { version = "1.6.4", default-features = false }
 
 [dev-dependencies]
 log = "0.4"
 env_logger = "0.9"
-rand = "0.8"
+rand = "0.7" # ed25519-dalek v1.0.1 depends on this exact version
 futures = { version = "0.3", features = ["executor"] }
+sha1 = "0.10.5"
+
+[dev-dependencies.ed25519-dalek]
+default_features = false
+features = ["rand", "std", "u32_backend"]
+
+[features]
+ed25519-dalek = ["dep:ed25519-dalek", "_verify"]
+ed25519-salty = ["dep:salty", "_verify"]
+
+#Internal features
+_verify = []

embassy-boot/boot/src/boot_loader.rs

@@ -0,0 +1,533 @@
+use embedded_storage::nor_flash::{ErrorType, NorFlash, NorFlashError, NorFlashErrorKind, ReadNorFlash};
+
+use crate::{Partition, State, BOOT_MAGIC, SWAP_MAGIC};
+
+/// Errors returned by bootloader
+#[derive(PartialEq, Eq, Debug)]
+pub enum BootError {
+    /// Error from flash.
+    Flash(NorFlashErrorKind),
+    /// Invalid bootloader magic
+    BadMagic,
+}
+
+#[cfg(feature = "defmt")]
+impl defmt::Format for BootError {
+    fn format(&self, fmt: defmt::Formatter) {
+        match self {
+            BootError::Flash(_) => defmt::write!(fmt, "BootError::Flash(_)"),
+            BootError::BadMagic => defmt::write!(fmt, "BootError::BadMagic"),
+        }
+    }
+}
+
+impl<E> From<E> for BootError
+where
+    E: NorFlashError,
+{
+    fn from(error: E) -> Self {
+        BootError::Flash(error.kind())
+    }
+}
+
+/// Trait defining the flash handles used for active and DFU partition.
+pub trait FlashConfig {
+    /// The erase value of the state flash. Typically the default of 0xFF is used, but some flashes use a different value.
+    const STATE_ERASE_VALUE: u8 = 0xFF;
+    /// Flash type used for the state partition.
+    type STATE: NorFlash;
+    /// Flash type used for the active partition.
+    type ACTIVE: NorFlash;
+    /// Flash type used for the dfu partition.
+    type DFU: NorFlash;
+
+    /// Return flash instance used to write/read to/from active partition.
+    fn active(&mut self) -> &mut Self::ACTIVE;
+    /// Return flash instance used to write/read to/from dfu partition.
+    fn dfu(&mut self) -> &mut Self::DFU;
+    /// Return flash instance used to write/read to/from bootloader state.
+    fn state(&mut self) -> &mut Self::STATE;
+}
+
+trait FlashConfigEx {
+    fn page_size() -> u32;
+}
+
+impl<T: FlashConfig> FlashConfigEx for T {
+    /// Get the page size which is the "unit of operation" within the bootloader.
+    fn page_size() -> u32 {
+        core::cmp::max(T::ACTIVE::ERASE_SIZE, T::DFU::ERASE_SIZE) as u32
+    }
+}
+
+/// BootLoader works with any flash implementing embedded_storage.
+pub struct BootLoader {
+    // Page with current state of bootloader. The state partition has the following format:
+    // All ranges are in multiples of WRITE_SIZE bytes.
+    // | Range    | Description                                                                      |
+    // | 0..1     | Magic indicating bootloader state. BOOT_MAGIC means boot, SWAP_MAGIC means swap. |
+    // | 1..2     | Progress validity. ERASE_VALUE means valid, !ERASE_VALUE means invalid.          |
+    // | 2..2 + N | Progress index used while swapping or reverting                                  |
+    state: Partition,
+    // Location of the partition which will be booted from
+    active: Partition,
+    // Location of the partition which will be swapped in when requested
+    dfu: Partition,
+}
+
+impl BootLoader {
+    /// Create a new instance of a bootloader with the given partitions.
+    ///
+    /// - All partitions must be aligned with the PAGE_SIZE const generic parameter.
+    /// - The dfu partition must be at least PAGE_SIZE bigger than the active partition.
+    pub fn new(active: Partition, dfu: Partition, state: Partition) -> Self {
+        Self { active, dfu, state }
+    }
+
+    /// Return the offset of the active partition into the active flash.
+    pub fn boot_address(&self) -> usize {
+        self.active.from as usize
+    }
+
+    /// Perform necessary boot preparations like swapping images.
+    ///
+    /// The DFU partition is assumed to be 1 page bigger than the active partition for the swap
+    /// algorithm to work correctly.
+    ///
+    /// The provided aligned_buf argument must satisfy any alignment requirements
+    /// given by the partition flashes. All flash operations will use this buffer.
+    ///
+    /// SWAPPING
+    ///
+    /// Assume a flash size of 3 pages for the active partition, and 4 pages for the DFU partition.
+    /// The swap index contains the copy progress, as to allow continuation of the copy process on
+    /// power failure. The index counter is represented within 1 or more pages (depending on total
+    /// flash size), where a page X is considered swapped if index at location (X + WRITE_SIZE)
+    /// contains a zero value. This ensures that index updates can be performed atomically and
+    /// avoid a situation where the wrong index value is set (page write size is "atomic").
+    ///
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// | Partition | Swap Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// |    Active |          0 |      1 |      2 |      3 |      - |
+    /// |       DFU |          0 |      3 |      2 |      1 |      X |
+    /// +-----------+------------+--------+--------+--------+--------+
+    ///
+    /// The algorithm starts by copying 'backwards', and after the first step, the layout is
+    /// as follows:
+    ///
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// | Partition | Swap Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// |    Active |          1 |      1 |      2 |      1 |      - |
+    /// |       DFU |          1 |      3 |      2 |      1 |      3 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    ///
+    /// The next iteration performs the same steps
+    ///
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// | Partition | Swap Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// |    Active |          2 |      1 |      2 |      1 |      - |
+    /// |       DFU |          2 |      3 |      2 |      2 |      3 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    ///
+    /// And again until we're done
+    ///
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// | Partition | Swap Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    /// |    Active |          3 |      3 |      2 |      1 |      - |
+    /// |       DFU |          3 |      3 |      1 |      2 |      3 |
+    /// +-----------+------------+--------+--------+--------+--------+
+    ///
+    /// REVERTING
+    ///
+    /// The reverting algorithm uses the swap index to discover that images were swapped, but that
+    /// the application failed to mark the boot successful. In this case, the revert algorithm will
+    /// run.
+    ///
+    /// The revert index is located separately from the swap index, to ensure that revert can continue
+    /// on power failure.
+    ///
+    /// The revert algorithm works forwards, by starting copying into the 'unused' DFU page at the start.
+    ///
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// | Partition | Revert Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    //*/
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// |    Active |            3 |      1 |      2 |      1 |      - |
+    /// |       DFU |            3 |      3 |      1 |      2 |      3 |
+    /// +-----------+--------------+--------+--------+--------+--------+
+    ///
+    ///
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// | Partition | Revert Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// |    Active |            3 |      1 |      2 |      1 |      - |
+    /// |       DFU |            3 |      3 |      2 |      2 |      3 |
+    /// +-----------+--------------+--------+--------+--------+--------+
+    ///
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// | Partition | Revert Index | Page 0 | Page 1 | Page 3 | Page 4 |
+    /// +-----------+--------------+--------+--------+--------+--------+
+    /// |    Active |            3 |      1 |      2 |      3 |      - |
+    /// |       DFU |            3 |      3 |      2 |      1 |      3 |
+    /// +-----------+--------------+--------+--------+--------+--------+
+    ///
+    pub fn prepare_boot<P: FlashConfig>(&mut self, p: &mut P, aligned_buf: &mut [u8]) -> Result<State, BootError> {
+        // Ensure we have enough progress pages to store copy progress
+        assert_eq!(0, P::page_size() % aligned_buf.len() as u32);
+        assert_eq!(0, P::page_size() % P::ACTIVE::WRITE_SIZE as u32);
+        assert_eq!(0, P::page_size() % P::ACTIVE::ERASE_SIZE as u32);
+        assert_eq!(0, P::page_size() % P::DFU::WRITE_SIZE as u32);
+        assert_eq!(0, P::page_size() % P::DFU::ERASE_SIZE as u32);
+        assert!(aligned_buf.len() >= P::STATE::WRITE_SIZE);
+        assert_eq!(0, aligned_buf.len() % P::ACTIVE::WRITE_SIZE);
+        assert_eq!(0, aligned_buf.len() % P::DFU::WRITE_SIZE);
+        assert_partitions(self.active, self.dfu, self.state, P::page_size(), P::STATE::WRITE_SIZE);
+
+        // Copy contents from partition N to active
+        let state = self.read_state(p, aligned_buf)?;
+        if state == State::Swap {
+            //
+            // Check if we already swapped. If we're in the swap state, this means we should revert
+            // since the app has failed to mark boot as successful
+            //
+            if !self.is_swapped(p, aligned_buf)? {
+                trace!("Swapping");
+                self.swap(p, aligned_buf)?;
+                trace!("Swapping done");
+            } else {
+                trace!("Reverting");
+                self.revert(p, aligned_buf)?;
+
+                let state_flash = p.state();
+                let state_word = &mut aligned_buf[..P::STATE::WRITE_SIZE];
+
+                // Invalidate progress
+                state_word.fill(!P::STATE_ERASE_VALUE);
+                self.state
+                    .write_blocking(state_flash, P::STATE::WRITE_SIZE as u32, state_word)?;
+
+                // Clear magic and progress
+                self.state.wipe_blocking(state_flash)?;
+
+                // Set magic
+                state_word.fill(BOOT_MAGIC);
+                self.state.write_blocking(state_flash, 0, state_word)?;
+            }
+        }
+        Ok(state)
+    }
+
+    fn is_swapped<P: FlashConfig>(&mut self, p: &mut P, aligned_buf: &mut [u8]) -> Result<bool, BootError> {
+        let page_count = (self.active.size() / P::page_size()) as usize;
+        let progress = self.current_progress(p, aligned_buf)?;
+
+        Ok(progress >= page_count * 2)
+    }
+
+    fn current_progress<P: FlashConfig>(&mut self, config: &mut P, aligned_buf: &mut [u8]) -> Result<usize, BootError> {
+        let write_size = P::STATE::WRITE_SIZE as u32;
+        let max_index = (((self.state.size() - write_size) / write_size) - 2) as usize;
+        let state_flash = config.state();
+        let state_word = &mut aligned_buf[..write_size as usize];
+
+        self.state.read_blocking(state_flash, write_size, state_word)?;
+        if state_word.iter().any(|&b| b != P::STATE_ERASE_VALUE) {
+            // Progress is invalid
+            return Ok(max_index);
+        }
+
+        for index in 0..max_index {
+            self.state
+                .read_blocking(state_flash, (2 + index) as u32 * write_size, state_word)?;
+
+            if state_word.iter().any(|&b| b == P::STATE_ERASE_VALUE) {
+                return Ok(index);
+            }
+        }
+        Ok(max_index)
+    }
+
+    fn update_progress<P: FlashConfig>(
+        &mut self,
+        progress_index: usize,
+        p: &mut P,
+        aligned_buf: &mut [u8],
+    ) -> Result<(), BootError> {
+        let state_word = &mut aligned_buf[..P::STATE::WRITE_SIZE];
+        state_word.fill(!P::STATE_ERASE_VALUE);
+        self.state.write_blocking(
+            p.state(),
+            (2 + progress_index) as u32 * P::STATE::WRITE_SIZE as u32,
+            state_word,
+        )?;
+        Ok(())
+    }
+
+    fn copy_page_once_to_active<P: FlashConfig>(
+        &mut self,
+        progress_index: usize,
+        from_offset: u32,
+        to_offset: u32,
+        p: &mut P,
+        aligned_buf: &mut [u8],
+    ) -> Result<(), BootError> {
+        if self.current_progress(p, aligned_buf)? <= progress_index {
+            let page_size = P::page_size() as u32;
+
+            self.active
+                .erase_blocking(p.active(), to_offset, to_offset + page_size)?;
+
+            for offset_in_page in (0..page_size).step_by(aligned_buf.len()) {
+                self.dfu
+                    .read_blocking(p.dfu(), from_offset + offset_in_page as u32, aligned_buf)?;
+                self.active
+                    .write_blocking(p.active(), to_offset + offset_in_page as u32, aligned_buf)?;
+            }
+
+            self.update_progress(progress_index, p, aligned_buf)?;
+        }
+        Ok(())
+    }
+
+    fn copy_page_once_to_dfu<P: FlashConfig>(
+        &mut self,
+        progress_index: usize,
+        from_offset: u32,
+        to_offset: u32,
+        p: &mut P,
+        aligned_buf: &mut [u8],
+    ) -> Result<(), BootError> {
+        if self.current_progress(p, aligned_buf)? <= progress_index {
+            let page_size = P::page_size() as u32;
+
+            self.dfu
+                .erase_blocking(p.dfu(), to_offset as u32, to_offset + page_size)?;
+
+            for offset_in_page in (0..page_size).step_by(aligned_buf.len()) {
+                self.active
+                    .read_blocking(p.active(), from_offset + offset_in_page as u32, aligned_buf)?;
+                self.dfu
+                    .write_blocking(p.dfu(), to_offset + offset_in_page as u32, aligned_buf)?;
+            }
+
+            self.update_progress(progress_index, p, aligned_buf)?;
+        }
+        Ok(())
+    }
+
+    fn swap<P: FlashConfig>(&mut self, p: &mut P, aligned_buf: &mut [u8]) -> Result<(), BootError> {
+        let page_size = P::page_size();
+        let page_count = self.active.size() / page_size;
+        for page_num in 0..page_count {
+            let progress_index = (page_num * 2) as usize;
+
+            // Copy active page to the 'next' DFU page.
+            let active_from_offset = (page_count - 1 - page_num) * page_size;
+            let dfu_to_offset = (page_count - page_num) * page_size;
+            //trace!("Copy active {} to dfu {}", active_from_offset, dfu_to_offset);
+            self.copy_page_once_to_dfu(progress_index, active_from_offset, dfu_to_offset, p, aligned_buf)?;
+
+            // Copy DFU page to the active page
+            let active_to_offset = (page_count - 1 - page_num) * page_size;
+            let dfu_from_offset = (page_count - 1 - page_num) * page_size;
+            //trace!("Copy dfy {} to active {}", dfu_from_offset, active_to_offset);
+            self.copy_page_once_to_active(progress_index + 1, dfu_from_offset, active_to_offset, p, aligned_buf)?;
+        }
+
+        Ok(())
+    }
+
+    fn revert<P: FlashConfig>(&mut self, p: &mut P, aligned_buf: &mut [u8]) -> Result<(), BootError> {
+        let page_size = P::page_size();
+        let page_count = self.active.size() / page_size;
+        for page_num in 0..page_count {
+            let progress_index = (page_count * 2 + page_num * 2) as usize;
+
+            // Copy the bad active page to the DFU page
+            let active_from_offset = page_num * page_size;
+            let dfu_to_offset = page_num * page_size;
+            self.copy_page_once_to_dfu(progress_index, active_from_offset, dfu_to_offset, p, aligned_buf)?;
+
+            // Copy the DFU page back to the active page
+            let active_to_offset = page_num * page_size;
+            let dfu_from_offset = (page_num + 1) * page_size;
+            self.copy_page_once_to_active(progress_index + 1, dfu_from_offset, active_to_offset, p, aligned_buf)?;
+        }
+
+        Ok(())
+    }
+
+    fn read_state<P: FlashConfig>(&mut self, config: &mut P, aligned_buf: &mut [u8]) -> Result<State, BootError> {
+        let state_word = &mut aligned_buf[..P::STATE::WRITE_SIZE];
+        self.state.read_blocking(config.state(), 0, state_word)?;
+
+        if !state_word.iter().any(|&b| b != SWAP_MAGIC) {
+            Ok(State::Swap)
+        } else {
+            Ok(State::Boot)
+        }
+    }
+}
+
+fn assert_partitions(active: Partition, dfu: Partition, state: Partition, page_size: u32, state_write_size: usize) {
+    assert_eq!(active.size() % page_size, 0);
+    assert_eq!(dfu.size() % page_size, 0);
+    assert!(dfu.size() - active.size() >= page_size);
+    assert!(2 + 2 * (active.size() / page_size) <= state.size() / state_write_size as u32);
+}
+
+/// A flash wrapper implementing the Flash and embedded_storage traits.
+pub struct BootFlash<F>
+where
+    F: NorFlash,
+{
+    flash: F,
+}
+
+impl<F> BootFlash<F>
+where
+    F: NorFlash,
+{
+    /// Create a new instance of a bootable flash
+    pub fn new(flash: F) -> Self {
+        Self { flash }
+    }
+}
+
+impl<F> ErrorType for BootFlash<F>
+where
+    F: NorFlash,
+{
+    type Error = F::Error;
+}
+
+impl<F> NorFlash for BootFlash<F>
+where
+    F: NorFlash,
+{
+    const WRITE_SIZE: usize = F::WRITE_SIZE;
+    const ERASE_SIZE: usize = F::ERASE_SIZE;
+
+    fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        F::erase(&mut self.flash, from, to)
+    }
+
+    fn write(&mut self, offset: u32, bytes: &[u8]) -> Result<(), Self::Error> {
+        F::write(&mut self.flash, offset, bytes)
+    }
+}
+
+impl<F> ReadNorFlash for BootFlash<F>
+where
+    F: NorFlash,
+{
+    const READ_SIZE: usize = F::READ_SIZE;
+
+    fn read(&mut self, offset: u32, bytes: &mut [u8]) -> Result<(), Self::Error> {
+        F::read(&mut self.flash, offset, bytes)
+    }
+
+    fn capacity(&self) -> usize {
+        F::capacity(&self.flash)
+    }
+}
+
+/// Convenience provider that uses a single flash for all partitions.
+pub struct SingleFlashConfig<'a, F>
+where
+    F: NorFlash,
+{
+    flash: &'a mut F,
+}
+
+impl<'a, F> SingleFlashConfig<'a, F>
+where
+    F: NorFlash,
+{
+    /// Create a provider for a single flash.
+    pub fn new(flash: &'a mut F) -> Self {
+        Self { flash }
+    }
+}
+
+impl<'a, F> FlashConfig for SingleFlashConfig<'a, F>
+where
+    F: NorFlash,
+{
+    type STATE = F;
+    type ACTIVE = F;
+    type DFU = F;
+
+    fn active(&mut self) -> &mut Self::STATE {
+        self.flash
+    }
+    fn dfu(&mut self) -> &mut Self::ACTIVE {
+        self.flash
+    }
+    fn state(&mut self) -> &mut Self::DFU {
+        self.flash
+    }
+}
+
+/// Convenience flash provider that uses separate flash instances for each partition.
+pub struct MultiFlashConfig<'a, ACTIVE, STATE, DFU>
+where
+    ACTIVE: NorFlash,
+    STATE: NorFlash,
+    DFU: NorFlash,
+{
+    active: &'a mut ACTIVE,
+    state: &'a mut STATE,
+    dfu: &'a mut DFU,
+}
+
+impl<'a, ACTIVE, STATE, DFU> MultiFlashConfig<'a, ACTIVE, STATE, DFU>
+where
+    ACTIVE: NorFlash,
+    STATE: NorFlash,
+    DFU: NorFlash,
+{
+    /// Create a new flash provider with separate configuration for all three partitions.
+    pub fn new(active: &'a mut ACTIVE, state: &'a mut STATE, dfu: &'a mut DFU) -> Self {
+        Self { active, state, dfu }
+    }
+}
+
+impl<'a, ACTIVE, STATE, DFU> FlashConfig for MultiFlashConfig<'a, ACTIVE, STATE, DFU>
+where
+    ACTIVE: NorFlash,
+    STATE: NorFlash,
+    DFU: NorFlash,
+{
+    type STATE = STATE;
+    type ACTIVE = ACTIVE;
+    type DFU = DFU;
+
+    fn active(&mut self) -> &mut Self::ACTIVE {
+        self.active
+    }
+    fn dfu(&mut self) -> &mut Self::DFU {
+        self.dfu
+    }
+    fn state(&mut self) -> &mut Self::STATE {
+        self.state
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[should_panic]
+    fn test_range_asserts() {
+        const ACTIVE: Partition = Partition::new(4096, 4194304);
+        const DFU: Partition = Partition::new(4194304, 2 * 4194304);
+        const STATE: Partition = Partition::new(0, 4096);
+        assert_partitions(ACTIVE, DFU, STATE, 4096, 4);
+    }
+}

embassy-boot/boot/src/digest_adapters/ed25519_dalek.rs

@@ -0,0 +1,30 @@
+use digest::typenum::U64;
+use digest::{FixedOutput, HashMarker, OutputSizeUser, Update};
+use ed25519_dalek::Digest as _;
+
+pub struct Sha512(ed25519_dalek::Sha512);
+
+impl Default for Sha512 {
+    fn default() -> Self {
+        Self(ed25519_dalek::Sha512::new())
+    }
+}
+
+impl Update for Sha512 {
+    fn update(&mut self, data: &[u8]) {
+        self.0.update(data)
+    }
+}
+
+impl FixedOutput for Sha512 {
+    fn finalize_into(self, out: &mut digest::Output<Self>) {
+        let result = self.0.finalize();
+        out.as_mut_slice().copy_from_slice(result.as_slice())
+    }
+}
+
+impl OutputSizeUser for Sha512 {
+    type OutputSize = U64;
+}
+
+impl HashMarker for Sha512 {}

embassy-boot/boot/src/digest_adapters/mod.rs

@@ -0,0 +1,5 @@
+#[cfg(feature = "ed25519-dalek")]
+pub(crate) mod ed25519_dalek;
+
+#[cfg(feature = "ed25519-salty")]
+pub(crate) mod salty;

embassy-boot/boot/src/digest_adapters/salty.rs

@@ -0,0 +1,29 @@
+use digest::typenum::U64;
+use digest::{FixedOutput, HashMarker, OutputSizeUser, Update};
+
+pub struct Sha512(salty::Sha512);
+
+impl Default for Sha512 {
+    fn default() -> Self {
+        Self(salty::Sha512::new())
+    }
+}
+
+impl Update for Sha512 {
+    fn update(&mut self, data: &[u8]) {
+        self.0.update(data)
+    }
+}
+
+impl FixedOutput for Sha512 {
+    fn finalize_into(self, out: &mut digest::Output<Self>) {
+        let result = self.0.finalize();
+        out.as_mut_slice().copy_from_slice(result.as_slice())
+    }
+}
+
+impl OutputSizeUser for Sha512 {
+    type OutputSize = U64;
+}
+
+impl HashMarker for Sha512 {}

embassy-boot/boot/src/firmware_updater.rs

@@ -0,0 +1,534 @@
+use digest::Digest;
+use embedded_storage::nor_flash::{NorFlash, NorFlashError, NorFlashErrorKind};
+use embedded_storage_async::nor_flash::NorFlash as AsyncNorFlash;
+
+use crate::{Partition, State, BOOT_MAGIC, SWAP_MAGIC};
+
+/// Errors returned by FirmwareUpdater
+#[derive(Debug)]
+pub enum FirmwareUpdaterError {
+    /// Error from flash.
+    Flash(NorFlashErrorKind),
+    /// Signature errors.
+    Signature(signature::Error),
+}
+
+#[cfg(feature = "defmt")]
+impl defmt::Format for FirmwareUpdaterError {
+    fn format(&self, fmt: defmt::Formatter) {
+        match self {
+            FirmwareUpdaterError::Flash(_) => defmt::write!(fmt, "FirmwareUpdaterError::Flash(_)"),
+            FirmwareUpdaterError::Signature(_) => defmt::write!(fmt, "FirmwareUpdaterError::Signature(_)"),
+        }
+    }
+}
+
+impl<E> From<E> for FirmwareUpdaterError
+where
+    E: NorFlashError,
+{
+    fn from(error: E) -> Self {
+        FirmwareUpdaterError::Flash(error.kind())
+    }
+}
+
+/// FirmwareUpdater is an application API for interacting with the BootLoader without the ability to
+/// 'mess up' the internal bootloader state
+pub struct FirmwareUpdater {
+    state: Partition,
+    dfu: Partition,
+}
+
+impl Default for FirmwareUpdater {
+    fn default() -> Self {
+        extern "C" {
+            static __bootloader_state_start: u32;
+            static __bootloader_state_end: u32;
+            static __bootloader_dfu_start: u32;
+            static __bootloader_dfu_end: u32;
+        }
+
+        let dfu = unsafe {
+            Partition::new(
+                &__bootloader_dfu_start as *const u32 as u32,
+                &__bootloader_dfu_end as *const u32 as u32,
+            )
+        };
+        let state = unsafe {
+            Partition::new(
+                &__bootloader_state_start as *const u32 as u32,
+                &__bootloader_state_end as *const u32 as u32,
+            )
+        };
+
+        trace!("DFU: 0x{:x} - 0x{:x}", dfu.from, dfu.to);
+        trace!("STATE: 0x{:x} - 0x{:x}", state.from, state.to);
+        FirmwareUpdater::new(dfu, state)
+    }
+}
+
+impl FirmwareUpdater {
+    /// Create a firmware updater instance with partition ranges for the update and state partitions.
+    pub const fn new(dfu: Partition, state: Partition) -> Self {
+        Self { dfu, state }
+    }
+
+    /// Obtain the current state.
+    ///
+    /// This is useful to check if the bootloader has just done a swap, in order
+    /// to do verifications and self-tests of the new image before calling
+    /// `mark_booted`.
+    pub async fn get_state<F: AsyncNorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<State, FirmwareUpdaterError> {
+        self.state.read(state_flash, 0, aligned).await?;
+
+        if !aligned.iter().any(|&b| b != SWAP_MAGIC) {
+            Ok(State::Swap)
+        } else {
+            Ok(State::Boot)
+        }
+    }
+
+    /// Verify the DFU given a public key. If there is an error then DO NOT
+    /// proceed with updating the firmware as it must be signed with a
+    /// corresponding private key (otherwise it could be malicious firmware).
+    ///
+    /// Mark to trigger firmware swap on next boot if verify suceeds.
+    ///
+    /// If the "ed25519-salty" feature is set (or another similar feature) then the signature is expected to have
+    /// been generated from a SHA-512 digest of the firmware bytes.
+    ///
+    /// If no signature feature is set then this method will always return a
+    /// signature error.
+    ///
+    /// # Safety
+    ///
+    /// The `_aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being read from
+    /// and written to.
+    #[cfg(feature = "_verify")]
+    pub async fn verify_and_mark_updated<F: AsyncNorFlash>(
+        &mut self,
+        _state_and_dfu_flash: &mut F,
+        _public_key: &[u8],
+        _signature: &[u8],
+        _update_len: u32,
+        _aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(_aligned.len(), F::WRITE_SIZE);
+        assert!(_update_len <= self.dfu.size());
+
+        #[cfg(feature = "ed25519-dalek")]
+        {
+            use ed25519_dalek::{PublicKey, Signature, SignatureError, Verifier};
+
+            use crate::digest_adapters::ed25519_dalek::Sha512;
+
+            let into_signature_error = |e: SignatureError| FirmwareUpdaterError::Signature(e.into());
+
+            let public_key = PublicKey::from_bytes(_public_key).map_err(into_signature_error)?;
+            let signature = Signature::from_bytes(_signature).map_err(into_signature_error)?;
+
+            let mut message = [0; 64];
+            self.hash::<_, Sha512>(_state_and_dfu_flash, _update_len, _aligned, &mut message)
+                .await?;
+
+            public_key.verify(&message, &signature).map_err(into_signature_error)?
+        }
+        #[cfg(feature = "ed25519-salty")]
+        {
+            use salty::constants::{PUBLICKEY_SERIALIZED_LENGTH, SIGNATURE_SERIALIZED_LENGTH};
+            use salty::{PublicKey, Signature};
+
+            use crate::digest_adapters::salty::Sha512;
+
+            fn into_signature_error<E>(_: E) -> FirmwareUpdaterError {
+                FirmwareUpdaterError::Signature(signature::Error::default())
+            }
+
+            let public_key: [u8; PUBLICKEY_SERIALIZED_LENGTH] = _public_key.try_into().map_err(into_signature_error)?;
+            let public_key = PublicKey::try_from(&public_key).map_err(into_signature_error)?;
+            let signature: [u8; SIGNATURE_SERIALIZED_LENGTH] = _signature.try_into().map_err(into_signature_error)?;
+            let signature = Signature::try_from(&signature).map_err(into_signature_error)?;
+
+            let mut message = [0; 64];
+            self.hash::<_, Sha512>(_state_and_dfu_flash, _update_len, _aligned, &mut message)
+                .await?;
+
+            let r = public_key.verify(&message, &signature);
+            trace!(
+                "Verifying with public key {}, signature {} and message {} yields ok: {}",
+                public_key.to_bytes(),
+                signature.to_bytes(),
+                message,
+                r.is_ok()
+            );
+            r.map_err(into_signature_error)?
+        }
+
+        self.set_magic(_aligned, SWAP_MAGIC, _state_and_dfu_flash).await
+    }
+
+    /// Verify the update in DFU with any digest.
+    pub async fn hash<F: AsyncNorFlash, D: Digest>(
+        &mut self,
+        dfu_flash: &mut F,
+        update_len: u32,
+        chunk_buf: &mut [u8],
+        output: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        let mut digest = D::new();
+        for offset in (0..update_len).step_by(chunk_buf.len()) {
+            self.dfu.read(dfu_flash, offset, chunk_buf).await?;
+            let len = core::cmp::min((update_len - offset) as usize, chunk_buf.len());
+            digest.update(&chunk_buf[..len]);
+        }
+        output.copy_from_slice(digest.finalize().as_slice());
+        Ok(())
+    }
+
+    /// Mark to trigger firmware swap on next boot.
+    ///
+    /// # Safety
+    ///
+    /// The `aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being written to.
+    #[cfg(not(feature = "_verify"))]
+    pub async fn mark_updated<F: AsyncNorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(aligned.len(), F::WRITE_SIZE);
+        self.set_magic(aligned, SWAP_MAGIC, state_flash).await
+    }
+
+    /// Mark firmware boot successful and stop rollback on reset.
+    ///
+    /// # Safety
+    ///
+    /// The `aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being written to.
+    pub async fn mark_booted<F: AsyncNorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(aligned.len(), F::WRITE_SIZE);
+        self.set_magic(aligned, BOOT_MAGIC, state_flash).await
+    }
+
+    async fn set_magic<F: AsyncNorFlash>(
+        &mut self,
+        aligned: &mut [u8],
+        magic: u8,
+        state_flash: &mut F,
+    ) -> Result<(), FirmwareUpdaterError> {
+        self.state.read(state_flash, 0, aligned).await?;
+
+        if aligned.iter().any(|&b| b != magic) {
+            // Read progress validity
+            self.state.read(state_flash, F::WRITE_SIZE as u32, aligned).await?;
+
+            // FIXME: Do not make this assumption.
+            const STATE_ERASE_VALUE: u8 = 0xFF;
+
+            if aligned.iter().any(|&b| b != STATE_ERASE_VALUE) {
+                // The current progress validity marker is invalid
+            } else {
+                // Invalidate progress
+                aligned.fill(!STATE_ERASE_VALUE);
+                self.state.write(state_flash, F::WRITE_SIZE as u32, aligned).await?;
+            }
+
+            // Clear magic and progress
+            self.state.wipe(state_flash).await?;
+
+            // Set magic
+            aligned.fill(magic);
+            self.state.write(state_flash, 0, aligned).await?;
+        }
+        Ok(())
+    }
+
+    /// Write data to a flash page.
+    ///
+    /// The buffer must follow alignment requirements of the target flash and a multiple of page size big.
+    ///
+    /// # Safety
+    ///
+    /// Failing to meet alignment and size requirements may result in a panic.
+    pub async fn write_firmware<F: AsyncNorFlash>(
+        &mut self,
+        offset: usize,
+        data: &[u8],
+        dfu_flash: &mut F,
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert!(data.len() >= F::ERASE_SIZE);
+
+        self.dfu
+            .erase(dfu_flash, offset as u32, (offset + data.len()) as u32)
+            .await?;
+
+        self.dfu.write(dfu_flash, offset as u32, data).await?;
+
+        Ok(())
+    }
+
+    /// Prepare for an incoming DFU update by erasing the entire DFU area and
+    /// returning its `Partition`.
+    ///
+    /// Using this instead of `write_firmware` allows for an optimized API in
+    /// exchange for added complexity.
+    pub async fn prepare_update<F: AsyncNorFlash>(
+        &mut self,
+        dfu_flash: &mut F,
+    ) -> Result<Partition, FirmwareUpdaterError> {
+        self.dfu.wipe(dfu_flash).await?;
+
+        Ok(self.dfu)
+    }
+
+    //
+    // Blocking API
+    //
+
+    /// Obtain the current state.
+    ///
+    /// This is useful to check if the bootloader has just done a swap, in order
+    /// to do verifications and self-tests of the new image before calling
+    /// `mark_booted`.
+    pub fn get_state_blocking<F: NorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<State, FirmwareUpdaterError> {
+        self.state.read_blocking(state_flash, 0, aligned)?;
+
+        if !aligned.iter().any(|&b| b != SWAP_MAGIC) {
+            Ok(State::Swap)
+        } else {
+            Ok(State::Boot)
+        }
+    }
+
+    /// Verify the DFU given a public key. If there is an error then DO NOT
+    /// proceed with updating the firmware as it must be signed with a
+    /// corresponding private key (otherwise it could be malicious firmware).
+    ///
+    /// Mark to trigger firmware swap on next boot if verify suceeds.
+    ///
+    /// If the "ed25519-salty" feature is set (or another similar feature) then the signature is expected to have
+    /// been generated from a SHA-512 digest of the firmware bytes.
+    ///
+    /// If no signature feature is set then this method will always return a
+    /// signature error.
+    ///
+    /// # Safety
+    ///
+    /// The `_aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being read from
+    /// and written to.
+    #[cfg(feature = "_verify")]
+    pub fn verify_and_mark_updated_blocking<F: NorFlash>(
+        &mut self,
+        _state_and_dfu_flash: &mut F,
+        _public_key: &[u8],
+        _signature: &[u8],
+        _update_len: u32,
+        _aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(_aligned.len(), F::WRITE_SIZE);
+        assert!(_update_len <= self.dfu.size());
+
+        #[cfg(feature = "ed25519-dalek")]
+        {
+            use ed25519_dalek::{PublicKey, Signature, SignatureError, Verifier};
+
+            use crate::digest_adapters::ed25519_dalek::Sha512;
+
+            let into_signature_error = |e: SignatureError| FirmwareUpdaterError::Signature(e.into());
+
+            let public_key = PublicKey::from_bytes(_public_key).map_err(into_signature_error)?;
+            let signature = Signature::from_bytes(_signature).map_err(into_signature_error)?;
+
+            let mut message = [0; 64];
+            self.hash_blocking::<_, Sha512>(_state_and_dfu_flash, _update_len, _aligned, &mut message)?;
+
+            public_key.verify(&message, &signature).map_err(into_signature_error)?
+        }
+        #[cfg(feature = "ed25519-salty")]
+        {
+            use salty::constants::{PUBLICKEY_SERIALIZED_LENGTH, SIGNATURE_SERIALIZED_LENGTH};
+            use salty::{PublicKey, Signature};
+
+            use crate::digest_adapters::salty::Sha512;
+
+            fn into_signature_error<E>(_: E) -> FirmwareUpdaterError {
+                FirmwareUpdaterError::Signature(signature::Error::default())
+            }
+
+            let public_key: [u8; PUBLICKEY_SERIALIZED_LENGTH] = _public_key.try_into().map_err(into_signature_error)?;
+            let public_key = PublicKey::try_from(&public_key).map_err(into_signature_error)?;
+            let signature: [u8; SIGNATURE_SERIALIZED_LENGTH] = _signature.try_into().map_err(into_signature_error)?;
+            let signature = Signature::try_from(&signature).map_err(into_signature_error)?;
+
+            let mut message = [0; 64];
+            self.hash_blocking::<_, Sha512>(_state_and_dfu_flash, _update_len, _aligned, &mut message)?;
+
+            let r = public_key.verify(&message, &signature);
+            trace!(
+                "Verifying with public key {}, signature {} and message {} yields ok: {}",
+                public_key.to_bytes(),
+                signature.to_bytes(),
+                message,
+                r.is_ok()
+            );
+            r.map_err(into_signature_error)?
+        }
+
+        self.set_magic_blocking(_aligned, SWAP_MAGIC, _state_and_dfu_flash)
+    }
+
+    /// Verify the update in DFU with any digest.
+    pub fn hash_blocking<F: NorFlash, D: Digest>(
+        &mut self,
+        dfu_flash: &mut F,
+        update_len: u32,
+        chunk_buf: &mut [u8],
+        output: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        let mut digest = D::new();
+        for offset in (0..update_len).step_by(chunk_buf.len()) {
+            self.dfu.read_blocking(dfu_flash, offset, chunk_buf)?;
+            let len = core::cmp::min((update_len - offset) as usize, chunk_buf.len());
+            digest.update(&chunk_buf[..len]);
+        }
+        output.copy_from_slice(digest.finalize().as_slice());
+        Ok(())
+    }
+
+    /// Mark to trigger firmware swap on next boot.
+    ///
+    /// # Safety
+    ///
+    /// The `aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being written to.
+    #[cfg(not(feature = "_verify"))]
+    pub fn mark_updated_blocking<F: NorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(aligned.len(), F::WRITE_SIZE);
+        self.set_magic_blocking(aligned, SWAP_MAGIC, state_flash)
+    }
+
+    /// Mark firmware boot successful and stop rollback on reset.
+    ///
+    /// # Safety
+    ///
+    /// The `aligned` buffer must have a size of F::WRITE_SIZE, and follow the alignment rules for the flash being written to.
+    pub fn mark_booted_blocking<F: NorFlash>(
+        &mut self,
+        state_flash: &mut F,
+        aligned: &mut [u8],
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert_eq!(aligned.len(), F::WRITE_SIZE);
+        self.set_magic_blocking(aligned, BOOT_MAGIC, state_flash)
+    }
+
+    fn set_magic_blocking<F: NorFlash>(
+        &mut self,
+        aligned: &mut [u8],
+        magic: u8,
+        state_flash: &mut F,
+    ) -> Result<(), FirmwareUpdaterError> {
+        self.state.read_blocking(state_flash, 0, aligned)?;
+
+        if aligned.iter().any(|&b| b != magic) {
+            // Read progress validity
+            self.state.read_blocking(state_flash, F::WRITE_SIZE as u32, aligned)?;
+
+            // FIXME: Do not make this assumption.
+            const STATE_ERASE_VALUE: u8 = 0xFF;
+
+            if aligned.iter().any(|&b| b != STATE_ERASE_VALUE) {
+                // The current progress validity marker is invalid
+            } else {
+                // Invalidate progress
+                aligned.fill(!STATE_ERASE_VALUE);
+                self.state.write_blocking(state_flash, F::WRITE_SIZE as u32, aligned)?;
+            }
+
+            // Clear magic and progress
+            self.state.wipe_blocking(state_flash)?;
+
+            // Set magic
+            aligned.fill(magic);
+            self.state.write_blocking(state_flash, 0, aligned)?;
+        }
+        Ok(())
+    }
+
+    /// Write data to a flash page.
+    ///
+    /// The buffer must follow alignment requirements of the target flash and a multiple of page size big.
+    ///
+    /// # Safety
+    ///
+    /// Failing to meet alignment and size requirements may result in a panic.
+    pub fn write_firmware_blocking<F: NorFlash>(
+        &mut self,
+        offset: usize,
+        data: &[u8],
+        dfu_flash: &mut F,
+    ) -> Result<(), FirmwareUpdaterError> {
+        assert!(data.len() >= F::ERASE_SIZE);
+
+        self.dfu
+            .erase_blocking(dfu_flash, offset as u32, (offset + data.len()) as u32)?;
+
+        self.dfu.write_blocking(dfu_flash, offset as u32, data)?;
+
+        Ok(())
+    }
+
+    /// Prepare for an incoming DFU update by erasing the entire DFU area and
+    /// returning its `Partition`.
+    ///
+    /// Using this instead of `write_firmware_blocking` allows for an optimized
+    /// API in exchange for added complexity.
+    pub fn prepare_update_blocking<F: NorFlash>(&mut self, flash: &mut F) -> Result<Partition, FirmwareUpdaterError> {
+        self.dfu.wipe_blocking(flash)?;
+
+        Ok(self.dfu)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use futures::executor::block_on;
+    use sha1::{Digest, Sha1};
+
+    use super::*;
+    use crate::mem_flash::MemFlash;
+
+    #[test]
+    fn can_verify_sha1() {
+        const STATE: Partition = Partition::new(0, 4096);
+        const DFU: Partition = Partition::new(65536, 131072);
+
+        let mut flash = MemFlash::<131072, 4096, 8>::default();
+
+        let update = [0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66];
+        let mut to_write = [0; 4096];
+        to_write[..7].copy_from_slice(update.as_slice());
+
+        let mut updater = FirmwareUpdater::new(DFU, STATE);
+        block_on(updater.write_firmware(0, to_write.as_slice(), &mut flash)).unwrap();
+        let mut chunk_buf = [0; 2];
+        let mut hash = [0; 20];
+        block_on(updater.hash::<_, Sha1>(&mut flash, update.len() as u32, &mut chunk_buf, &mut hash)).unwrap();
+
+        assert_eq!(Sha1::digest(update).as_slice(), hash);
+    }
+}

embassy-boot/boot/src/mem_flash.rs

@@ -0,0 +1,164 @@
+#![allow(unused)]
+
+use core::ops::{Bound, Range, RangeBounds};
+
+use embedded_storage::nor_flash::{ErrorType, NorFlash, NorFlashError, NorFlashErrorKind, ReadNorFlash};
+use embedded_storage_async::nor_flash::{NorFlash as AsyncNorFlash, ReadNorFlash as AsyncReadNorFlash};
+
+pub struct MemFlash<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> {
+    pub mem: [u8; SIZE],
+    pub pending_write_successes: Option<usize>,
+}
+
+#[derive(Debug)]
+pub struct MemFlashError;
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE> {
+    pub const fn new(fill: u8) -> Self {
+        Self {
+            mem: [fill; SIZE],
+            pending_write_successes: None,
+        }
+    }
+
+    #[cfg(test)]
+    pub fn random() -> Self {
+        let mut mem = [0; SIZE];
+        for byte in mem.iter_mut() {
+            *byte = rand::random::<u8>();
+        }
+        Self {
+            mem,
+            pending_write_successes: None,
+        }
+    }
+
+    pub fn program(&mut self, offset: u32, bytes: &[u8]) -> Result<(), MemFlashError> {
+        let offset = offset as usize;
+        assert!(bytes.len() % WRITE_SIZE == 0);
+        assert!(offset % WRITE_SIZE == 0);
+        assert!(offset + bytes.len() <= SIZE);
+
+        self.mem[offset..offset + bytes.len()].copy_from_slice(bytes);
+
+        Ok(())
+    }
+
+    pub fn assert_eq(&self, offset: u32, expectation: &[u8]) {
+        for i in 0..expectation.len() {
+            assert_eq!(self.mem[offset as usize + i], expectation[i], "Index {}", i);
+        }
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> Default
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    fn default() -> Self {
+        Self::new(0xFF)
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ErrorType
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    type Error = MemFlashError;
+}
+
+impl NorFlashError for MemFlashError {
+    fn kind(&self) -> NorFlashErrorKind {
+        NorFlashErrorKind::Other
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> ReadNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const READ_SIZE: usize = 1;
+
+    fn read(&mut self, offset: u32, bytes: &mut [u8]) -> Result<(), Self::Error> {
+        let len = bytes.len();
+        bytes.copy_from_slice(&self.mem[offset as usize..offset as usize + len]);
+        Ok(())
+    }
+
+    fn capacity(&self) -> usize {
+        SIZE
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> NorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const WRITE_SIZE: usize = WRITE_SIZE;
+    const ERASE_SIZE: usize = ERASE_SIZE;
+
+    fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        let from = from as usize;
+        let to = to as usize;
+        assert!(from % ERASE_SIZE == 0);
+        assert!(to % ERASE_SIZE == 0, "To: {}, erase size: {}", to, ERASE_SIZE);
+        for i in from..to {
+            self.mem[i] = 0xFF;
+        }
+        Ok(())
+    }
+
+    fn write(&mut self, offset: u32, bytes: &[u8]) -> Result<(), Self::Error> {
+        let offset = offset as usize;
+        assert!(bytes.len() % WRITE_SIZE == 0);
+        assert!(offset % WRITE_SIZE == 0);
+        assert!(offset + bytes.len() <= SIZE);
+
+        if let Some(pending_successes) = self.pending_write_successes {
+            if pending_successes > 0 {
+                self.pending_write_successes = Some(pending_successes - 1);
+            } else {
+                return Err(MemFlashError);
+            }
+        }
+
+        for ((offset, mem_byte), new_byte) in self
+            .mem
+            .iter_mut()
+            .enumerate()
+            .skip(offset)
+            .take(bytes.len())
+            .zip(bytes)
+        {
+            assert_eq!(0xFF, *mem_byte, "Offset {} is not erased", offset);
+            *mem_byte = *new_byte;
+        }
+
+        Ok(())
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncReadNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const READ_SIZE: usize = 1;
+
+    async fn read(&mut self, offset: u32, bytes: &mut [u8]) -> Result<(), Self::Error> {
+        <Self as ReadNorFlash>::read(self, offset, bytes)
+    }
+
+    fn capacity(&self) -> usize {
+        <Self as ReadNorFlash>::capacity(self)
+    }
+}
+
+impl<const SIZE: usize, const ERASE_SIZE: usize, const WRITE_SIZE: usize> AsyncNorFlash
+    for MemFlash<SIZE, ERASE_SIZE, WRITE_SIZE>
+{
+    const WRITE_SIZE: usize = WRITE_SIZE;
+    const ERASE_SIZE: usize = ERASE_SIZE;
+
+    async fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        <Self as NorFlash>::erase(self, from, to)
+    }
+
+    async fn write(&mut self, offset: u32, bytes: &[u8]) -> Result<(), Self::Error> {
+        <Self as NorFlash>::write(self, offset, bytes)
+    }
+}

embassy-boot/boot/src/partition.rs

@@ -0,0 +1,139 @@
+use embedded_storage::nor_flash::{NorFlash, ReadNorFlash};
+use embedded_storage_async::nor_flash::{NorFlash as AsyncNorFlash, ReadNorFlash as AsyncReadNorFlash};
+
+/// A region in flash used by the bootloader.
+#[derive(Copy, Clone, Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub struct Partition {
+    /// The offset into the flash where the partition starts.
+    pub from: u32,
+    /// The offset into the flash where the partition ends.
+    pub to: u32,
+}
+
+impl Partition {
+    /// Create a new partition with the provided range
+    pub const fn new(from: u32, to: u32) -> Self {
+        Self { from, to }
+    }
+
+    /// Return the size of the partition
+    pub const fn size(&self) -> u32 {
+        self.to - self.from
+    }
+
+    /// Read from the partition on the provided flash
+    pub async fn read<F: AsyncReadNorFlash>(
+        &self,
+        flash: &mut F,
+        offset: u32,
+        bytes: &mut [u8],
+    ) -> Result<(), F::Error> {
+        let offset = self.from as u32 + offset;
+        flash.read(offset, bytes).await
+    }
+
+    /// Write to the partition on the provided flash
+    pub async fn write<F: AsyncNorFlash>(&self, flash: &mut F, offset: u32, bytes: &[u8]) -> Result<(), F::Error> {
+        let offset = self.from as u32 + offset;
+        flash.write(offset, bytes).await?;
+        trace!("Wrote from 0x{:x} len {}", offset, bytes.len());
+        Ok(())
+    }
+
+    /// Erase part of the partition on the provided flash
+    pub async fn erase<F: AsyncNorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
+        let from = self.from as u32 + from;
+        let to = self.from as u32 + to;
+        flash.erase(from, to).await?;
+        trace!("Erased from 0x{:x} to 0x{:x}", from, to);
+        Ok(())
+    }
+
+    /// Erase the entire partition
+    pub(crate) async fn wipe<F: AsyncNorFlash>(&self, flash: &mut F) -> Result<(), F::Error> {
+        let from = self.from as u32;
+        let to = self.to as u32;
+        flash.erase(from, to).await?;
+        trace!("Wiped from 0x{:x} to 0x{:x}", from, to);
+        Ok(())
+    }
+
+    /// Read from the partition on the provided flash
+    pub fn read_blocking<F: ReadNorFlash>(&self, flash: &mut F, offset: u32, bytes: &mut [u8]) -> Result<(), F::Error> {
+        let offset = self.from as u32 + offset;
+        flash.read(offset, bytes)
+    }
+
+    /// Write to the partition on the provided flash
+    pub fn write_blocking<F: NorFlash>(&self, flash: &mut F, offset: u32, bytes: &[u8]) -> Result<(), F::Error> {
+        let offset = self.from as u32 + offset;
+        flash.write(offset, bytes)?;
+        trace!("Wrote from 0x{:x} len {}", offset, bytes.len());
+        Ok(())
+    }
+
+    /// Erase part of the partition on the provided flash
+    pub fn erase_blocking<F: NorFlash>(&self, flash: &mut F, from: u32, to: u32) -> Result<(), F::Error> {
+        let from = self.from as u32 + from;
+        let to = self.from as u32 + to;
+        flash.erase(from, to)?;
+        trace!("Erased from 0x{:x} to 0x{:x}", from, to);
+        Ok(())
+    }
+
+    /// Erase the entire partition
+    pub(crate) fn wipe_blocking<F: NorFlash>(&self, flash: &mut F) -> Result<(), F::Error> {
+        let from = self.from as u32;
+        let to = self.to as u32;
+        flash.erase(from, to)?;
+        trace!("Wiped from 0x{:x} to 0x{:x}", from, to);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::mem_flash::MemFlash;
+    use crate::Partition;
+
+    #[test]
+    fn can_erase() {
+        let mut flash = MemFlash::<1024, 64, 4>::new(0x00);
+        let partition = Partition::new(256, 512);
+
+        partition.erase_blocking(&mut flash, 64, 192).unwrap();
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().take(256 + 64) {
+            assert_eq!(0x00, byte, "Index {}", index);
+        }
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256 + 64).take(128) {
+            assert_eq!(0xFF, byte, "Index {}", index);
+        }
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256 + 64 + 128) {
+            assert_eq!(0x00, byte, "Index {}", index);
+        }
+    }
+
+    #[test]
+    fn can_wipe() {
+        let mut flash = MemFlash::<1024, 64, 4>::new(0x00);
+        let partition = Partition::new(256, 512);
+
+        partition.wipe_blocking(&mut flash).unwrap();
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().take(256) {
+            assert_eq!(0x00, byte, "Index {}", index);
+        }
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(256).take(256) {
+            assert_eq!(0xFF, byte, "Index {}", index);
+        }
+
+        for (index, byte) in flash.mem.iter().copied().enumerate().skip(512) {
+            assert_eq!(0x00, byte, "Index {}", index);
+        }
+    }
+}

embassy-boot/nrf/Cargo.toml

@@ -22,7 +22,7 @@ embassy-boot = { path = "../boot", default-features = false }
 cortex-m = { version = "0.7.6" }
 cortex-m-rt = { version = "0.7" }
 embedded-storage = "0.3.0"
-embedded-storage-async = "0.3.0"
+embedded-storage-async = "0.4.0"
 cfg-if = "1.0.0"
 
 nrf-softdevice-mbr = { version = "0.1.0", git = "https://github.com/embassy-rs/nrf-softdevice.git", branch = "master", optional = true }

embassy-boot/nrf/README.md

@@ -0,0 +1,26 @@
+# embassy-boot-nrf
+
+An [Embassy](https://embassy.dev) project.
+
+An adaptation of `embassy-boot` for nRF. 
+
+## Features
+
+* Load applications with our without the softdevice.
+* Configure bootloader partitions based on linker script.
+* Using watchdog timer to detect application failure.
+
+
+## Minimum supported Rust version (MSRV)
+
+`embassy-boot-nrf` requires Rust nightly to compile as it relies on async traits for interacting with the flash peripherals.
+
+## License
+
+This work is licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or
+  <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.

embassy-boot/nrf/src/lib.rs

@@ -1,7 +1,7 @@
 #![no_std]
 #![feature(type_alias_impl_trait)]
 #![warn(missing_docs)]
-#![doc = include_str!("../../README.md")]
+#![doc = include_str!("../README.md")]
 mod fmt;
 
 pub use embassy_boot::{AlignedBuffer, BootFlash, FirmwareUpdater, FlashConfig, Partition, SingleFlashConfig};
@@ -11,15 +11,14 @@ use embassy_nrf::wdt;
 use embedded_storage::nor_flash::{ErrorType, NorFlash, ReadNorFlash};
 
 /// A bootloader for nRF devices.
-pub struct BootLoader {
+pub struct BootLoader<const BUFFER_SIZE: usize = PAGE_SIZE> {
     boot: embassy_boot::BootLoader,
-    magic: AlignedBuffer<4>,
-    page: AlignedBuffer<PAGE_SIZE>,
+    aligned_buf: AlignedBuffer<BUFFER_SIZE>,
 }
 
-impl BootLoader {
+impl Default for BootLoader<PAGE_SIZE> {
     /// Create a new bootloader instance using parameters from linker script
-    pub fn default() -> Self {
+    fn default() -> Self {
         extern "C" {
             static __bootloader_state_start: u32;
             static __bootloader_state_end: u32;
@@ -31,20 +30,20 @@ impl BootLoader {
 
         let active = unsafe {
             Partition::new(
-                &__bootloader_active_start as *const u32 as usize,
-                &__bootloader_active_end as *const u32 as usize,
+                &__bootloader_active_start as *const u32 as u32,
+                &__bootloader_active_end as *const u32 as u32,
             )
         };
         let dfu = unsafe {
             Partition::new(
-                &__bootloader_dfu_start as *const u32 as usize,
-                &__bootloader_dfu_end as *const u32 as usize,
+                &__bootloader_dfu_start as *const u32 as u32,
+                &__bootloader_dfu_end as *const u32 as u32,
             )
         };
         let state = unsafe {
             Partition::new(
-                &__bootloader_state_start as *const u32 as usize,
-                &__bootloader_state_end as *const u32 as usize,
+                &__bootloader_state_start as *const u32 as u32,
+                &__bootloader_state_end as *const u32 as u32,
             )
         };
 
@@ -54,20 +53,21 @@ impl BootLoader {
 
         Self::new(active, dfu, state)
     }
+}
 
+impl<const BUFFER_SIZE: usize> BootLoader<BUFFER_SIZE> {
     /// Create a new bootloader instance using the supplied partitions for active, dfu and state.
     pub fn new(active: Partition, dfu: Partition, state: Partition) -> Self {
         Self {
             boot: embassy_boot::BootLoader::new(active, dfu, state),
-            magic: AlignedBuffer([0; 4]),
-            page: AlignedBuffer([0; PAGE_SIZE]),
+            aligned_buf: AlignedBuffer([0; BUFFER_SIZE]),
         }
     }
 
     /// Inspect the bootloader state and perform actions required before booting, such as swapping
     /// firmware.
     pub fn prepare<F: FlashConfig>(&mut self, flash: &mut F) -> usize {
-        match self.boot.prepare_boot(flash, &mut self.magic.0, &mut self.page.0) {
+        match self.boot.prepare_boot(flash, &mut self.aligned_buf.0) {
             Ok(_) => self.boot.boot_address(),
             Err(_) => panic!("boot prepare error!"),
         }
@@ -147,11 +147,7 @@ pub struct WatchdogFlash<'d> {
 
 impl<'d> WatchdogFlash<'d> {
     /// Start a new watchdog with a given flash and WDT peripheral and a timeout
-    pub fn start(flash: Nvmc<'d>, wdt: WDT, timeout: u32) -> Self {
-        let mut config = wdt::Config::default();
-        config.timeout_ticks = 32768 * timeout; // timeout seconds
-        config.run_during_sleep = true;
-        config.run_during_debug_halt = false;
+    pub fn start(flash: Nvmc<'d>, wdt: WDT, config: wdt::Config) -> Self {
         let (_wdt, [wdt]) = match wdt::Watchdog::try_new(wdt, config) {
             Ok(x) => x,
             Err(_) => {

embassy-boot/rp/Cargo.toml

@@ -0,0 +1,73 @@
+[package]
+edition = "2021"
+name = "embassy-boot-rp"
+version = "0.1.0"
+description = "Bootloader lib for RP2040 chips"
+license = "MIT OR Apache-2.0"
+
+[package.metadata.embassy_docs]
+src_base = "https://github.com/embassy-rs/embassy/blob/embassy-boot-rp-v$VERSION/src/"
+src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-boot/rp/src/"
+target = "thumbv6m-none-eabi"
+
+[lib]
+
+[dependencies]
+defmt = { version = "0.3", optional = true }
+defmt-rtt = { version = "0.4", optional = true }
+log = { version = "0.4", optional = true }
+
+embassy-sync = { path = "../../embassy-sync" }
+embassy-rp = { path = "../../embassy-rp", default-features = false, features = ["nightly"] }
+embassy-boot = { path = "../boot", default-features = false }
+embassy-time = { path = "../../embassy-time", features = ["nightly"] }
+
+cortex-m = { version = "0.7.6" }
+cortex-m-rt = { version = "0.7" }
+embedded-storage = "0.3.0"
+embedded-storage-async = "0.4.0"
+cfg-if = "1.0.0"
+
+[features]
+defmt = [
+    "dep:defmt",
+    "embassy-boot/defmt",
+    "embassy-rp/defmt",
+]
+log = [
+    "dep:log",
+    "embassy-boot/log",
+    "embassy-rp/log",
+]
+debug = ["defmt-rtt"]
+
+[profile.dev]
+debug = 2
+debug-assertions = true
+incremental = false
+opt-level = 'z'
+overflow-checks = true
+
+[profile.release]
+codegen-units = 1
+debug = 2
+debug-assertions = false
+incremental = false
+lto = 'fat'
+opt-level = 'z'
+overflow-checks = false
+
+# do not optimize proc-macro crates = faster builds from scratch
+[profile.dev.build-override]
+codegen-units = 8
+debug = false
+debug-assertions = false
+opt-level = 0
+overflow-checks = false
+
+[profile.release.build-override]
+codegen-units = 8
+debug = false
+debug-assertions = false
+opt-level = 0
+overflow-checks = false

embassy-boot/rp/README.md

@@ -0,0 +1,26 @@
+# embassy-boot-rp
+
+An [Embassy](https://embassy.dev) project.
+
+An adaptation of `embassy-boot` for RP2040.
+
+NOTE: The applications using this bootloader should not link with the `link-rp.x` linker script.
+
+## Features
+
+* Configure bootloader partitions based on linker script.
+* Load applications from active partition.
+
+## Minimum supported Rust version (MSRV)
+
+`embassy-boot-rp` requires Rust nightly to compile as it relies on async traits for interacting with the flash peripherals.
+
+## License
+
+This work is licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or
+  <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.

embassy-boot/rp/build.rs

@@ -0,0 +1,8 @@
+use std::env;
+
+fn main() {
+    let target = env::var("TARGET").unwrap();
+    if target.starts_with("thumbv6m-") {
+        println!("cargo:rustc-cfg=armv6m");
+    }
+}

embassy-boot/rp/src/fmt.rs

@@ -0,0 +1,225 @@
+#![macro_use]
+#![allow(unused_macros)]
+
+#[cfg(all(feature = "defmt", feature = "log"))]
+compile_error!("You may not enable both `defmt` and `log` features.");
+
+macro_rules! assert {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert!($($x)*);
+        }
+    };
+}
+
+macro_rules! assert_eq {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert_eq!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert_eq!($($x)*);
+        }
+    };
+}
+
+macro_rules! assert_ne {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert_ne!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert_ne!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert_eq {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert_eq!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert_eq!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert_ne {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert_ne!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert_ne!($($x)*);
+        }
+    };
+}
+
+macro_rules! todo {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::todo!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::todo!($($x)*);
+        }
+    };
+}
+
+macro_rules! unreachable {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::unreachable!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::unreachable!($($x)*);
+        }
+    };
+}
+
+macro_rules! panic {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::panic!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::panic!($($x)*);
+        }
+    };
+}
+
+macro_rules! trace {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::trace!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::trace!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! debug {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::debug!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! info {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::info!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::info!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! warn {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::warn!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::warn!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! error {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::error!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::error!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+#[cfg(feature = "defmt")]
+macro_rules! unwrap {
+    ($($x:tt)*) => {
+        ::defmt::unwrap!($($x)*)
+    };
+}
+
+#[cfg(not(feature = "defmt"))]
+macro_rules! unwrap {
+    ($arg:expr) => {
+        match $crate::fmt::Try::into_result($arg) {
+            ::core::result::Result::Ok(t) => t,
+            ::core::result::Result::Err(e) => {
+                ::core::panic!("unwrap of `{}` failed: {:?}", ::core::stringify!($arg), e);
+            }
+        }
+    };
+    ($arg:expr, $($msg:expr),+ $(,)? ) => {
+        match $crate::fmt::Try::into_result($arg) {
+            ::core::result::Result::Ok(t) => t,
+            ::core::result::Result::Err(e) => {
+                ::core::panic!("unwrap of `{}` failed: {}: {:?}", ::core::stringify!($arg), ::core::format_args!($($msg,)*), e);
+            }
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone, Eq, PartialEq)]
+pub struct NoneError;
+
+pub trait Try {
+    type Ok;
+    type Error;
+    fn into_result(self) -> Result<Self::Ok, Self::Error>;
+}
+
+impl<T> Try for Option<T> {
+    type Ok = T;
+    type Error = NoneError;
+
+    #[inline]
+    fn into_result(self) -> Result<T, NoneError> {
+        self.ok_or(NoneError)
+    }
+}
+
+impl<T, E> Try for Result<T, E> {
+    type Ok = T;
+    type Error = E;
+
+    #[inline]
+    fn into_result(self) -> Self {
+        self
+    }
+}

embassy-boot/rp/src/lib.rs

@@ -0,0 +1,137 @@
+#![no_std]
+#![feature(type_alias_impl_trait)]
+#![warn(missing_docs)]
+#![doc = include_str!("../README.md")]
+mod fmt;
+
+pub use embassy_boot::{AlignedBuffer, BootFlash, FirmwareUpdater, FlashConfig, Partition, SingleFlashConfig, State};
+use embassy_rp::flash::{Flash, ERASE_SIZE};
+use embassy_rp::peripherals::{FLASH, WATCHDOG};
+use embassy_rp::watchdog::Watchdog;
+use embassy_time::Duration;
+use embedded_storage::nor_flash::{ErrorType, NorFlash, ReadNorFlash};
+
+/// A bootloader for RP2040 devices.
+pub struct BootLoader<const BUFFER_SIZE: usize = ERASE_SIZE> {
+    boot: embassy_boot::BootLoader,
+    aligned_buf: AlignedBuffer<BUFFER_SIZE>,
+}
+
+impl<const BUFFER_SIZE: usize> BootLoader<BUFFER_SIZE> {
+    /// Create a new bootloader instance using the supplied partitions for active, dfu and state.
+    pub fn new(active: Partition, dfu: Partition, state: Partition) -> Self {
+        Self {
+            boot: embassy_boot::BootLoader::new(active, dfu, state),
+            aligned_buf: AlignedBuffer([0; BUFFER_SIZE]),
+        }
+    }
+
+    /// Inspect the bootloader state and perform actions required before booting, such as swapping
+    /// firmware.
+    pub fn prepare<F: FlashConfig>(&mut self, flash: &mut F) -> usize {
+        match self.boot.prepare_boot(flash, self.aligned_buf.as_mut()) {
+            Ok(_) => embassy_rp::flash::FLASH_BASE + self.boot.boot_address(),
+            Err(_) => panic!("boot prepare error!"),
+        }
+    }
+
+    /// Boots the application.
+    ///
+    /// # Safety
+    ///
+    /// This modifies the stack pointer and reset vector and will run code placed in the active partition.
+    pub unsafe fn load(&mut self, start: usize) -> ! {
+        trace!("Loading app at 0x{:x}", start);
+        #[allow(unused_mut)]
+        let mut p = cortex_m::Peripherals::steal();
+        #[cfg(not(armv6m))]
+        p.SCB.invalidate_icache();
+        p.SCB.vtor.write(start as u32);
+
+        cortex_m::asm::bootload(start as *const u32)
+    }
+}
+
+impl Default for BootLoader<ERASE_SIZE> {
+    /// Create a new bootloader instance using parameters from linker script
+    fn default() -> Self {
+        extern "C" {
+            static __bootloader_state_start: u32;
+            static __bootloader_state_end: u32;
+            static __bootloader_active_start: u32;
+            static __bootloader_active_end: u32;
+            static __bootloader_dfu_start: u32;
+            static __bootloader_dfu_end: u32;
+        }
+
+        let active = unsafe {
+            Partition::new(
+                &__bootloader_active_start as *const u32 as u32,
+                &__bootloader_active_end as *const u32 as u32,
+            )
+        };
+        let dfu = unsafe {
+            Partition::new(
+                &__bootloader_dfu_start as *const u32 as u32,
+                &__bootloader_dfu_end as *const u32 as u32,
+            )
+        };
+        let state = unsafe {
+            Partition::new(
+                &__bootloader_state_start as *const u32 as u32,
+                &__bootloader_state_end as *const u32 as u32,
+            )
+        };
+
+        trace!("ACTIVE: 0x{:x} - 0x{:x}", active.from, active.to);
+        trace!("DFU: 0x{:x} - 0x{:x}", dfu.from, dfu.to);
+        trace!("STATE: 0x{:x} - 0x{:x}", state.from, state.to);
+
+        Self::new(active, dfu, state)
+    }
+}
+
+/// A flash implementation that will feed a watchdog when touching flash.
+pub struct WatchdogFlash<'d, const SIZE: usize> {
+    flash: Flash<'d, FLASH, SIZE>,
+    watchdog: Watchdog,
+}
+
+impl<'d, const SIZE: usize> WatchdogFlash<'d, SIZE> {
+    /// Start a new watchdog with a given flash and watchdog peripheral and a timeout
+    pub fn start(flash: FLASH, watchdog: WATCHDOG, timeout: Duration) -> Self {
+        let flash: Flash<'_, FLASH, SIZE> = Flash::new(flash);
+        let mut watchdog = Watchdog::new(watchdog);
+        watchdog.start(timeout);
+        Self { flash, watchdog }
+    }
+}
+
+impl<'d, const SIZE: usize> ErrorType for WatchdogFlash<'d, SIZE> {
+    type Error = <Flash<'d, FLASH, SIZE> as ErrorType>::Error;
+}
+
+impl<'d, const SIZE: usize> NorFlash for WatchdogFlash<'d, SIZE> {
+    const WRITE_SIZE: usize = <Flash<'d, FLASH, SIZE> as NorFlash>::WRITE_SIZE;
+    const ERASE_SIZE: usize = <Flash<'d, FLASH, SIZE> as NorFlash>::ERASE_SIZE;
+
+    fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        self.watchdog.feed();
+        self.flash.erase(from, to)
+    }
+    fn write(&mut self, offset: u32, data: &[u8]) -> Result<(), Self::Error> {
+        self.watchdog.feed();
+        self.flash.write(offset, data)
+    }
+}
+
+impl<'d, const SIZE: usize> ReadNorFlash for WatchdogFlash<'d, SIZE> {
+    const READ_SIZE: usize = <Flash<'d, FLASH, SIZE> as ReadNorFlash>::READ_SIZE;
+    fn read(&mut self, offset: u32, data: &mut [u8]) -> Result<(), Self::Error> {
+        self.watchdog.feed();
+        self.flash.read(offset, data)
+    }
+    fn capacity(&self) -> usize {
+        self.flash.capacity()
+    }
+}

embassy-boot/stm32/Cargo.toml

@@ -15,7 +15,7 @@ target = "thumbv7em-none-eabi"
 
 [dependencies]
 defmt = { version = "0.3", optional = true }
-defmt-rtt = { version = "0.3", optional = true }
+defmt-rtt = { version = "0.4", optional = true }
 log = { version = "0.4", optional = true }
 
 embassy-sync = { path = "../../embassy-sync" }
@@ -24,7 +24,7 @@ embassy-boot = { path = "../boot", default-features = false }
 cortex-m = { version = "0.7.6" }
 cortex-m-rt = { version = "0.7" }
 embedded-storage = "0.3.0"
-embedded-storage-async = "0.3.0"
+embedded-storage-async = "0.4.0"
 cfg-if = "1.0.0"
 
 [features]

embassy-boot/stm32/README.md

@@ -1,11 +1,24 @@
-# Bootloader for STM32
+# embassy-boot-stm32
 
-The bootloader uses `embassy-boot` to interact with the flash.
+An [Embassy](https://embassy.dev) project.
 
-# Usage
+An adaptation of `embassy-boot` for STM32.
 
-Flash the bootloader
+## Features
 
-```
-cargo flash --features embassy-stm32/stm32wl55jc-cm4 --release --chip STM32WLE5JCIx
-```
+* Configure bootloader partitions based on linker script.
+* Load applications from active partition.
+
+## Minimum supported Rust version (MSRV)
+
+`embassy-boot-stm32` requires Rust nightly to compile as it relies on async traits for interacting with the flash peripherals.
+
+## License
+
+This work is licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or
+  <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.

embassy-boot/stm32/src/lib.rs

@@ -1,69 +1,30 @@
 #![no_std]
 #![feature(type_alias_impl_trait)]
 #![warn(missing_docs)]
-#![doc = include_str!("../../README.md")]
+#![doc = include_str!("../README.md")]
 mod fmt;
 
 pub use embassy_boot::{AlignedBuffer, BootFlash, FirmwareUpdater, FlashConfig, Partition, SingleFlashConfig, State};
 
 /// A bootloader for STM32 devices.
-pub struct BootLoader<const PAGE_SIZE: usize, const WRITE_SIZE: usize> {
+pub struct BootLoader<const BUFFER_SIZE: usize> {
     boot: embassy_boot::BootLoader,
-    magic: AlignedBuffer<WRITE_SIZE>,
-    page: AlignedBuffer<PAGE_SIZE>,
+    aligned_buf: AlignedBuffer<BUFFER_SIZE>,
 }
 
-impl<const PAGE_SIZE: usize, const WRITE_SIZE: usize> BootLoader<PAGE_SIZE, WRITE_SIZE> {
-    /// Create a new bootloader instance using parameters from linker script
-    pub fn default() -> Self {
-        extern "C" {
-            static __bootloader_state_start: u32;
-            static __bootloader_state_end: u32;
-            static __bootloader_active_start: u32;
-            static __bootloader_active_end: u32;
-            static __bootloader_dfu_start: u32;
-            static __bootloader_dfu_end: u32;
-        }
-
-        let active = unsafe {
-            Partition::new(
-                &__bootloader_active_start as *const u32 as usize,
-                &__bootloader_active_end as *const u32 as usize,
-            )
-        };
-        let dfu = unsafe {
-            Partition::new(
-                &__bootloader_dfu_start as *const u32 as usize,
-                &__bootloader_dfu_end as *const u32 as usize,
-            )
-        };
-        let state = unsafe {
-            Partition::new(
-                &__bootloader_state_start as *const u32 as usize,
-                &__bootloader_state_end as *const u32 as usize,
-            )
-        };
-
-        trace!("ACTIVE: 0x{:x} - 0x{:x}", active.from, active.to);
-        trace!("DFU: 0x{:x} - 0x{:x}", dfu.from, dfu.to);
-        trace!("STATE: 0x{:x} - 0x{:x}", state.from, state.to);
-
-        Self::new(active, dfu, state)
-    }
-
+impl<const BUFFER_SIZE: usize> BootLoader<BUFFER_SIZE> {
     /// Create a new bootloader instance using the supplied partitions for active, dfu and state.
     pub fn new(active: Partition, dfu: Partition, state: Partition) -> Self {
         Self {
             boot: embassy_boot::BootLoader::new(active, dfu, state),
-            magic: AlignedBuffer([0; WRITE_SIZE]),
-            page: AlignedBuffer([0; PAGE_SIZE]),
+            aligned_buf: AlignedBuffer([0; BUFFER_SIZE]),
         }
     }
 
     /// Inspect the bootloader state and perform actions required before booting, such as swapping
     /// firmware.
     pub fn prepare<F: FlashConfig>(&mut self, flash: &mut F) -> usize {
-        match self.boot.prepare_boot(flash, self.magic.as_mut(), self.page.as_mut()) {
+        match self.boot.prepare_boot(flash, self.aligned_buf.as_mut()) {
             Ok(_) => embassy_stm32::flash::FLASH_BASE + self.boot.boot_address(),
             Err(_) => panic!("boot prepare error!"),
         }
@@ -85,3 +46,42 @@ impl<const PAGE_SIZE: usize, const WRITE_SIZE: usize> BootLoader<PAGE_SIZE, WRIT
         cortex_m::asm::bootload(start as *const u32)
     }
 }
+
+impl<const BUFFER_SIZE: usize> Default for BootLoader<BUFFER_SIZE> {
+    /// Create a new bootloader instance using parameters from linker script
+    fn default() -> Self {
+        extern "C" {
+            static __bootloader_state_start: u32;
+            static __bootloader_state_end: u32;
+            static __bootloader_active_start: u32;
+            static __bootloader_active_end: u32;
+            static __bootloader_dfu_start: u32;
+            static __bootloader_dfu_end: u32;
+        }
+
+        let active = unsafe {
+            Partition::new(
+                &__bootloader_active_start as *const u32 as u32,
+                &__bootloader_active_end as *const u32 as u32,
+            )
+        };
+        let dfu = unsafe {
+            Partition::new(
+                &__bootloader_dfu_start as *const u32 as u32,
+                &__bootloader_dfu_end as *const u32 as u32,
+            )
+        };
+        let state = unsafe {
+            Partition::new(
+                &__bootloader_state_start as *const u32 as u32,
+                &__bootloader_state_end as *const u32 as u32,
+            )
+        };
+
+        trace!("ACTIVE: 0x{:x} - 0x{:x}", active.from, active.to);
+        trace!("DFU: 0x{:x} - 0x{:x}", dfu.from, dfu.to);
+        trace!("STATE: 0x{:x} - 0x{:x}", state.from, state.to);
+
+        Self::new(active, dfu, state)
+    }
+}

embassy-cortex-m/Cargo.toml

@@ -36,7 +36,7 @@ prio-bits-8 = []
 defmt = { version = "0.3", optional = true }
 log = { version = "0.4.14", optional = true }
 
-embassy-sync = { version = "0.1.0", path = "../embassy-sync" }
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
 embassy-executor = { version = "0.1.0", path = "../embassy-executor"}
 embassy-macros = { version = "0.1.0", path = "../embassy-macros"}
 embassy-hal-common = { version = "0.1.0", path = "../embassy-hal-common"}

embassy-cortex-m/src/executor.rs

@@ -1,89 +0,0 @@
-//! Executor specific to cortex-m devices.
-use core::marker::PhantomData;
-
-pub use embassy_executor::*;
-
-use crate::interrupt::{Interrupt, InterruptExt};
-
-fn pend_by_number(n: u16) {
-    #[derive(Clone, Copy)]
-    struct N(u16);
-    unsafe impl cortex_m::interrupt::InterruptNumber for N {
-        fn number(self) -> u16 {
-            self.0
-        }
-    }
-    cortex_m::peripheral::NVIC::pend(N(n))
-}
-
-/// Interrupt mode executor.
-///
-/// This executor runs tasks in interrupt mode. The interrupt handler is set up
-/// to poll tasks, and when a task is woken the interrupt is pended from software.
-///
-/// This allows running async tasks at a priority higher than thread mode. One
-/// use case is to leave thread mode free for non-async tasks. Another use case is
-/// to run multiple executors: one in thread mode for low priority tasks and another in
-/// interrupt mode for higher priority tasks. Higher priority tasks will preempt lower
-/// priority ones.
-///
-/// It is even possible to run multiple interrupt mode executors at different priorities,
-/// by assigning different priorities to the interrupts. For an example on how to do this,
-/// See the 'multiprio' example for 'embassy-nrf'.
-///
-/// To use it, you have to pick an interrupt that won't be used by the hardware.
-/// Some chips reserve some interrupts for this purpose, sometimes named "software interrupts" (SWI).
-/// If this is not the case, you may use an interrupt from any unused peripheral.
-///
-/// It is somewhat more complex to use, it's recommended to use the thread-mode
-/// [`Executor`] instead, if it works for your use case.
-pub struct InterruptExecutor<I: Interrupt> {
-    irq: I,
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
-
-impl<I: Interrupt> InterruptExecutor<I> {
-    /// Create a new Executor.
-    pub fn new(irq: I) -> Self {
-        let ctx = irq.number() as *mut ();
-        Self {
-            irq,
-            inner: raw::Executor::new(|ctx| pend_by_number(ctx as u16), ctx),
-            not_send: PhantomData,
-        }
-    }
-
-    /// Start the executor.
-    ///
-    /// This initializes the executor, configures and enables the interrupt, and returns.
-    /// The executor keeps running in the background through the interrupt.
-    ///
-    /// This returns a [`SendSpawner`] you can use to spawn tasks on it. A [`SendSpawner`]
-    /// is returned instead of a [`Spawner`](embassy_executor::Spawner) because the executor effectively runs in a
-    /// different "thread" (the interrupt), so spawning tasks on it is effectively
-    /// sending them.
-    ///
-    /// To obtain a [`Spawner`](embassy_executor::Spawner) for this executor, use [`Spawner::for_current_executor()`](embassy_executor::Spawner::for_current_executor()) from
-    /// a task running in it.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    pub fn start(&'static mut self) -> SendSpawner {
-        self.irq.disable();
-
-        self.irq.set_handler(|ctx| unsafe {
-            let executor = &*(ctx as *const raw::Executor);
-            executor.poll();
-        });
-        self.irq.set_handler_context(&self.inner as *const _ as _);
-        self.irq.enable();
-
-        self.inner.spawner().make_send()
-    }
-}

embassy-cortex-m/src/interrupt.rs

@@ -13,14 +13,44 @@ pub mod _export {
     pub use embassy_macros::{cortex_m_interrupt as interrupt, cortex_m_interrupt_declare as declare};
 }
 
+/// Interrupt handler trait.
+///
+/// Drivers that need to handle interrupts implement this trait.
+/// The user must ensure `on_interrupt()` is called every time the interrupt fires.
+/// Drivers must use use [`Binding`] to assert at compile time that the user has done so.
+pub trait Handler<I: Interrupt> {
+    /// Interrupt handler function.
+    ///
+    /// Must be called every time the `I` interrupt fires, synchronously from
+    /// the interrupt handler context.
+    ///
+    /// # Safety
+    ///
+    /// This function must ONLY be called from the interrupt handler for `I`.
+    unsafe fn on_interrupt();
+}
+
+/// Compile-time assertion that an interrupt has been bound to a handler.
+///
+/// For the vast majority of cases, you should use the `bind_interrupts!`
+/// macro instead of writing `unsafe impl`s of this trait.
+///
+/// # Safety
+///
+/// By implementing this trait, you are asserting that you have arranged for `H::on_interrupt()`
+/// to be called every time the `I` interrupt fires.
+///
+/// This allows drivers to check bindings at compile-time.
+pub unsafe trait Binding<I: Interrupt, H: Handler<I>> {}
+
 /// Implementation detail, do not use outside embassy crates.
 #[doc(hidden)]
-pub struct Handler {
+pub struct DynHandler {
     pub func: AtomicPtr<()>,
     pub ctx: AtomicPtr<()>,
 }
 
-impl Handler {
+impl DynHandler {
     pub const fn new() -> Self {
         Self {
             func: AtomicPtr::new(ptr::null_mut()),
@@ -51,7 +81,7 @@ pub unsafe trait Interrupt: Peripheral<P = Self> {
 
     /// Implementation detail, do not use outside embassy crates.
     #[doc(hidden)]
-    unsafe fn __handler(&self) -> &'static Handler;
+    unsafe fn __handler(&self) -> &'static DynHandler;
 }
 
 /// Represents additional behavior for all interrupts.

embassy-cortex-m/src/lib.rs

@@ -5,6 +5,6 @@
 // This mod MUST go first, so that the others see its macros.
 pub(crate) mod fmt;
 
-pub mod executor;
+pub use embassy_executor as executor;
 pub mod interrupt;
 pub mod peripheral;

embassy-embedded-hal/Cargo.toml

@@ -17,12 +17,12 @@ std = []
 nightly = ["embedded-hal-async", "embedded-storage-async"]
 
 [dependencies]
-embassy-sync = { version = "0.1.0", path = "../embassy-sync" }
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
 embedded-hal-02 = { package = "embedded-hal", version = "0.2.6", features = ["unproven"] }
-embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.9" }
-embedded-hal-async = { version = "=0.1.0-alpha.3", optional = true }
+embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.10" }
+embedded-hal-async = { version = "=0.2.0-alpha.1", optional = true }
 embedded-storage = "0.3.0"
-embedded-storage-async = { version = "0.3.0", optional = true }
+embedded-storage-async = { version = "0.4.0", optional = true }
 nb = "1.0.0"
 
 defmt = { version = "0.3", optional = true }

embassy-embedded-hal/src/adapter.rs

@@ -1,7 +1,5 @@
 //! Adapters between embedded-hal traits.
 
-use core::future::Future;
-
 use embedded_hal_02::{blocking, serial};
 
 /// Wrapper that implements async traits using blocking implementations.
@@ -38,32 +36,26 @@ where
     E: embedded_hal_1::i2c::Error + 'static,
     T: blocking::i2c::WriteRead<Error = E> + blocking::i2c::Read<Error = E> + blocking::i2c::Write<Error = E>,
 {
-    type WriteFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-    type ReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-    type WriteReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn read<'a>(&'a mut self, address: u8, buffer: &'a mut [u8]) -> Self::ReadFuture<'a> {
-        async move { self.wrapped.read(address, buffer) }
+    async fn read(&mut self, address: u8, read: &mut [u8]) -> Result<(), Self::Error> {
+        self.wrapped.read(address, read)
     }
 
-    fn write<'a>(&'a mut self, address: u8, bytes: &'a [u8]) -> Self::WriteFuture<'a> {
-        async move { self.wrapped.write(address, bytes) }
+    async fn write(&mut self, address: u8, write: &[u8]) -> Result<(), Self::Error> {
+        self.wrapped.write(address, write)
     }
 
-    fn write_read<'a>(&'a mut self, address: u8, bytes: &'a [u8], buffer: &'a mut [u8]) -> Self::WriteReadFuture<'a> {
-        async move { self.wrapped.write_read(address, bytes, buffer) }
+    async fn write_read(&mut self, address: u8, write: &[u8], read: &mut [u8]) -> Result<(), Self::Error> {
+        self.wrapped.write_read(address, write, read)
     }
 
-    type TransactionFuture<'a, 'b> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a, 'b: 'a;
-
-    fn transaction<'a, 'b>(
-        &'a mut self,
+    async fn transaction(
+        &mut self,
         address: u8,
-        operations: &'a mut [embedded_hal_async::i2c::Operation<'b>],
-    ) -> Self::TransactionFuture<'a, 'b> {
+        operations: &mut [embedded_hal_1::i2c::Operation<'_>],
+    ) -> Result<(), Self::Error> {
         let _ = address;
         let _ = operations;
-        async move { todo!() }
+        todo!()
     }
 }
 
@@ -84,23 +76,17 @@ where
     E: embedded_hal_1::spi::Error + 'static,
     T: blocking::spi::Transfer<u8, Error = E> + blocking::spi::Write<u8, Error = E>,
 {
-    type TransferFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn transfer<'a>(&'a mut self, read: &'a mut [u8], write: &'a [u8]) -> Self::TransferFuture<'a> {
-        async move {
-            // Ensure we write the expected bytes
-            for i in 0..core::cmp::min(read.len(), write.len()) {
-                read[i] = write[i].clone();
-            }
-            self.wrapped.transfer(read)?;
-            Ok(())
+    async fn transfer<'a>(&'a mut self, read: &'a mut [u8], write: &'a [u8]) -> Result<(), Self::Error> {
+        // Ensure we write the expected bytes
+        for i in 0..core::cmp::min(read.len(), write.len()) {
+            read[i] = write[i].clone();
         }
+        self.wrapped.transfer(read)?;
+        Ok(())
     }
 
-    type TransferInPlaceFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn transfer_in_place<'a>(&'a mut self, _: &'a mut [u8]) -> Self::TransferInPlaceFuture<'a> {
-        async move { todo!() }
+    async fn transfer_in_place<'a>(&'a mut self, _: &'a mut [u8]) -> Result<(), Self::Error> {
+        todo!()
     }
 }
 
@@ -109,10 +95,8 @@ where
     E: embedded_hal_1::spi::Error + 'static,
     T: blocking::spi::Transfer<u8, Error = E> + blocking::spi::Write<u8, Error = E>,
 {
-    type FlushFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn flush<'a>(&'a mut self) -> Self::FlushFuture<'a> {
-        async move { Ok(()) }
+    async fn flush(&mut self) -> Result<(), Self::Error> {
+        Ok(())
     }
 }
 
@@ -121,13 +105,9 @@ where
     E: embedded_hal_1::spi::Error + 'static,
     T: blocking::spi::Transfer<u8, Error = E> + blocking::spi::Write<u8, Error = E>,
 {
-    type WriteFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn write<'a>(&'a mut self, data: &'a [u8]) -> Self::WriteFuture<'a> {
-        async move {
-            self.wrapped.write(data)?;
-            Ok(())
-        }
+    async fn write(&mut self, data: &[u8]) -> Result<(), Self::Error> {
+        self.wrapped.write(data)?;
+        Ok(())
     }
 }
 
@@ -136,13 +116,9 @@ where
     E: embedded_hal_1::spi::Error + 'static,
     T: blocking::spi::Transfer<u8, Error = E> + blocking::spi::Write<u8, Error = E>,
 {
-    type ReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn read<'a>(&'a mut self, data: &'a mut [u8]) -> Self::ReadFuture<'a> {
-        async move {
-            self.wrapped.transfer(data)?;
-            Ok(())
-        }
+    async fn read(&mut self, data: &mut [u8]) -> Result<(), Self::Error> {
+        self.wrapped.transfer(data)?;
+        Ok(())
     }
 }
 
@@ -192,14 +168,14 @@ where
     }
 
     type FlushFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where T: 'a;
-    fn flush<'a>(&'a mut self) -> Self::FlushFuture<'a> {
+    fn flush(&mut self) -> Result<(), Self::Error> {
         async move { self.wrapped.bflush() }
     }
 }
 
 /// NOR flash wrapper
 use embedded_storage::nor_flash::{ErrorType, NorFlash, ReadNorFlash};
-use embedded_storage_async::nor_flash::{AsyncNorFlash, AsyncReadNorFlash};
+use embedded_storage_async::nor_flash::{NorFlash as AsyncNorFlash, ReadNorFlash as AsyncReadNorFlash};
 
 impl<T> ErrorType for BlockingAsync<T>
 where
@@ -215,14 +191,12 @@ where
     const WRITE_SIZE: usize = <T as NorFlash>::WRITE_SIZE;
     const ERASE_SIZE: usize = <T as NorFlash>::ERASE_SIZE;
 
-    type WriteFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-    fn write<'a>(&'a mut self, offset: u32, data: &'a [u8]) -> Self::WriteFuture<'a> {
-        async move { self.wrapped.write(offset, data) }
+    async fn write(&mut self, offset: u32, data: &[u8]) -> Result<(), Self::Error> {
+        self.wrapped.write(offset, data)
     }
 
-    type EraseFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-    fn erase<'a>(&'a mut self, from: u32, to: u32) -> Self::EraseFuture<'a> {
-        async move { self.wrapped.erase(from, to) }
+    async fn erase(&mut self, from: u32, to: u32) -> Result<(), Self::Error> {
+        self.wrapped.erase(from, to)
     }
 }
 
@@ -231,9 +205,8 @@ where
     T: ReadNorFlash,
 {
     const READ_SIZE: usize = <T as ReadNorFlash>::READ_SIZE;
-    type ReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-    fn read<'a>(&'a mut self, address: u32, data: &'a mut [u8]) -> Self::ReadFuture<'a> {
-        async move { self.wrapped.read(address, data) }
+    async fn read(&mut self, address: u32, data: &mut [u8]) -> Result<(), Self::Error> {
+        self.wrapped.read(address, data)
     }
 
     fn capacity(&self) -> usize {

embassy-embedded-hal/src/lib.rs

@@ -1,5 +1,9 @@
 #![cfg_attr(not(feature = "std"), no_std)]
-#![cfg_attr(feature = "nightly", feature(type_alias_impl_trait))]
+#![cfg_attr(
+    feature = "nightly",
+    feature(type_alias_impl_trait, async_fn_in_trait, impl_trait_projections, try_blocks)
+)]
+#![cfg_attr(feature = "nightly", allow(incomplete_features))]
 #![warn(missing_docs)]
 
 //! Utilities to use `embedded-hal` traits with Embassy.

embassy-embedded-hal/src/shared_bus/asynch/i2c.rs

@@ -22,7 +22,6 @@
 //! let i2c_dev2 = I2cDevice::new(i2c_bus);
 //! let mpu = Mpu6050::new(i2c_dev2);
 //! ```
-use core::future::Future;
 
 use embassy_sync::blocking_mutex::raw::RawMutex;
 use embassy_sync::mutex::Mutex;
@@ -55,53 +54,39 @@ where
     M: RawMutex + 'static,
     BUS: i2c::I2c + 'static,
 {
-    type ReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn read<'a>(&'a mut self, address: u8, buffer: &'a mut [u8]) -> Self::ReadFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.read(address, buffer).await.map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+    async fn read(&mut self, address: u8, read: &mut [u8]) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.read(address, read).await.map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type WriteFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn write<'a>(&'a mut self, address: u8, bytes: &'a [u8]) -> Self::WriteFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.write(address, bytes).await.map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+    async fn write(&mut self, address: u8, write: &[u8]) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.write(address, write).await.map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type WriteReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn write_read<'a>(
-        &'a mut self,
+    async fn write_read(
+        &mut self,
         address: u8,
-        wr_buffer: &'a [u8],
-        rd_buffer: &'a mut [u8],
-    ) -> Self::WriteReadFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.write_read(address, wr_buffer, rd_buffer)
-                .await
-                .map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+        write: &[u8],
+        read: &mut [u8],
+    ) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.write_read(address, write, read)
+            .await
+            .map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type TransactionFuture<'a, 'b> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a, 'b: 'a;
-
-    fn transaction<'a, 'b>(
-        &'a mut self,
+    async fn transaction(
+        &mut self,
         address: u8,
-        operations: &'a mut [embedded_hal_async::i2c::Operation<'b>],
-    ) -> Self::TransactionFuture<'a, 'b> {
+        operations: &mut [embedded_hal_async::i2c::Operation<'_>],
+    ) -> Result<(), I2cDeviceError<BUS::Error>> {
         let _ = address;
         let _ = operations;
-        async move { todo!() }
+        todo!()
     }
 }
 
@@ -136,55 +121,37 @@ where
     M: RawMutex + 'static,
     BUS: i2c::I2c + SetConfig + 'static,
 {
-    type ReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn read<'a>(&'a mut self, address: u8, buffer: &'a mut [u8]) -> Self::ReadFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.set_config(&self.config);
-            bus.read(address, buffer).await.map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+    async fn read(&mut self, address: u8, buffer: &mut [u8]) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        bus.read(address, buffer).await.map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type WriteFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn write<'a>(&'a mut self, address: u8, bytes: &'a [u8]) -> Self::WriteFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.set_config(&self.config);
-            bus.write(address, bytes).await.map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+    async fn write(&mut self, address: u8, bytes: &[u8]) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        bus.write(address, bytes).await.map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type WriteReadFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a;
-
-    fn write_read<'a>(
-        &'a mut self,
+    async fn write_read(
+        &mut self,
         address: u8,
-        wr_buffer: &'a [u8],
-        rd_buffer: &'a mut [u8],
-    ) -> Self::WriteReadFuture<'a> {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.set_config(&self.config);
-            bus.write_read(address, wr_buffer, rd_buffer)
-                .await
-                .map_err(I2cDeviceError::I2c)?;
-            Ok(())
-        }
+        wr_buffer: &[u8],
+        rd_buffer: &mut [u8],
+    ) -> Result<(), I2cDeviceError<BUS::Error>> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        bus.write_read(address, wr_buffer, rd_buffer)
+            .await
+            .map_err(I2cDeviceError::I2c)?;
+        Ok(())
     }
 
-    type TransactionFuture<'a, 'b> = impl Future<Output = Result<(), Self::Error>> + 'a where Self: 'a, 'b: 'a;
-
-    fn transaction<'a, 'b>(
-        &'a mut self,
-        address: u8,
-        operations: &'a mut [embedded_hal_async::i2c::Operation<'b>],
-    ) -> Self::TransactionFuture<'a, 'b> {
+    async fn transaction(&mut self, address: u8, operations: &mut [i2c::Operation<'_>]) -> Result<(), Self::Error> {
         let _ = address;
         let _ = operations;
-        async move { todo!() }
+        todo!()
     }
 }

embassy-embedded-hal/src/shared_bus/asynch/spi.rs

@@ -25,12 +25,11 @@
 //! let spi_dev2 = SpiDevice::new(spi_bus, cs_pin2);
 //! let display2 = ST7735::new(spi_dev2, dc2, rst2, Default::default(), 160, 128);
 //! ```
-use core::future::Future;
 
 use embassy_sync::blocking_mutex::raw::RawMutex;
 use embassy_sync::mutex::Mutex;
 use embedded_hal_1::digital::OutputPin;
-use embedded_hal_1::spi::ErrorType;
+use embedded_hal_1::spi::Operation;
 use embedded_hal_async::spi;
 
 use crate::shared_bus::SpiDeviceError;
@@ -57,41 +56,92 @@ where
     type Error = SpiDeviceError<BUS::Error, CS::Error>;
 }
 
-unsafe impl<M, BUS, CS> spi::SpiDevice for SpiDevice<'_, M, BUS, CS>
+impl<M, BUS, CS> spi::SpiDeviceRead for SpiDevice<'_, M, BUS, CS>
 where
-    M: RawMutex + 'static,
-    BUS: spi::SpiBusFlush + 'static,
+    M: RawMutex,
+    BUS: spi::SpiBusRead,
     CS: OutputPin,
 {
-    type Bus = BUS;
+    async fn read_transaction(&mut self, operations: &mut [&mut [u8]]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
-    type TransactionFuture<'a, R, F, Fut> = impl Future<Output = Result<R, Self::Error>> + 'a
-    where
-        Self: 'a, R: 'a, F: FnOnce(*mut Self::Bus) -> Fut + 'a,
-        Fut: Future<Output =  Result<R, <Self::Bus as ErrorType>::Error>> + 'a;
+        let op_res: Result<(), BUS::Error> = try {
+            for buf in operations {
+                bus.read(buf).await?;
+            }
+        };
 
-    fn transaction<'a, R, F, Fut>(&'a mut self, f: F) -> Self::TransactionFuture<'a, R, F, Fut>
-    where
-        R: 'a,
-        F: FnOnce(*mut Self::Bus) -> Fut + 'a,
-        Fut: Future<Output = Result<R, <Self::Bus as ErrorType>::Error>> + 'a,
-    {
-        async move {
-            let mut bus = self.bus.lock().await;
-            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
 
-            let f_res = f(&mut *bus).await;
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
 
-            // On failure, it's important to still flush and deassert CS.
-            let flush_res = bus.flush().await;
-            let cs_res = self.cs.set_high();
+        Ok(op_res)
+    }
+}
 
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
-            flush_res.map_err(SpiDeviceError::Spi)?;
-            cs_res.map_err(SpiDeviceError::Cs)?;
+impl<M, BUS, CS> spi::SpiDeviceWrite for SpiDevice<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: spi::SpiBusWrite,
+    CS: OutputPin,
+{
+    async fn write_transaction(&mut self, operations: &[&[u8]]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
-            Ok(f_res)
-        }
+        let op_res: Result<(), BUS::Error> = try {
+            for buf in operations {
+                bus.write(buf).await?;
+            }
+        };
+
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
+
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
+
+        Ok(op_res)
+    }
+}
+
+impl<M, BUS, CS> spi::SpiDevice for SpiDevice<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: spi::SpiBus,
+    CS: OutputPin,
+{
+    async fn transaction(&mut self, operations: &mut [spi::Operation<'_, u8>]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+        let op_res: Result<(), BUS::Error> = try {
+            for op in operations {
+                match op {
+                    Operation::Read(buf) => bus.read(buf).await?,
+                    Operation::Write(buf) => bus.write(buf).await?,
+                    Operation::Transfer(read, write) => bus.transfer(read, write).await?,
+                    Operation::TransferInPlace(buf) => bus.transfer_in_place(buf).await?,
+                }
+            }
+        };
+
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
+
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
+
+        Ok(op_res)
     }
 }
 
@@ -122,41 +172,94 @@ where
     type Error = SpiDeviceError<BUS::Error, CS::Error>;
 }
 
-unsafe impl<M, BUS, CS> spi::SpiDevice for SpiDeviceWithConfig<'_, M, BUS, CS>
+impl<M, BUS, CS> spi::SpiDeviceWrite for SpiDeviceWithConfig<'_, M, BUS, CS>
 where
-    M: RawMutex + 'static,
-    BUS: spi::SpiBusFlush + SetConfig + 'static,
+    M: RawMutex,
+    BUS: spi::SpiBusWrite + SetConfig,
     CS: OutputPin,
 {
-    type Bus = BUS;
+    async fn write_transaction(&mut self, operations: &[&[u8]]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
-    type TransactionFuture<'a, R, F, Fut> = impl Future<Output = Result<R, Self::Error>> + 'a
-    where
-        Self: 'a, R: 'a, F: FnOnce(*mut Self::Bus) -> Fut + 'a,
-        Fut: Future<Output =  Result<R, <Self::Bus as ErrorType>::Error>> + 'a;
+        let op_res: Result<(), BUS::Error> = try {
+            for buf in operations {
+                bus.write(buf).await?;
+            }
+        };
 
-    fn transaction<'a, R, F, Fut>(&'a mut self, f: F) -> Self::TransactionFuture<'a, R, F, Fut>
-    where
-        R: 'a,
-        F: FnOnce(*mut Self::Bus) -> Fut + 'a,
-        Fut: Future<Output = Result<R, <Self::Bus as ErrorType>::Error>> + 'a,
-    {
-        async move {
-            let mut bus = self.bus.lock().await;
-            bus.set_config(&self.config);
-            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
 
-            let f_res = f(&mut *bus).await;
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
 
-            // On failure, it's important to still flush and deassert CS.
-            let flush_res = bus.flush().await;
-            let cs_res = self.cs.set_high();
-
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
-            flush_res.map_err(SpiDeviceError::Spi)?;
-            cs_res.map_err(SpiDeviceError::Cs)?;
-
-            Ok(f_res)
-        }
+        Ok(op_res)
+    }
+}
+
+impl<M, BUS, CS> spi::SpiDeviceRead for SpiDeviceWithConfig<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: spi::SpiBusRead + SetConfig,
+    CS: OutputPin,
+{
+    async fn read_transaction(&mut self, operations: &mut [&mut [u8]]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+        let op_res: Result<(), BUS::Error> = try {
+            for buf in operations {
+                bus.read(buf).await?;
+            }
+        };
+
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
+
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
+
+        Ok(op_res)
+    }
+}
+
+impl<M, BUS, CS> spi::SpiDevice for SpiDeviceWithConfig<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: spi::SpiBus + SetConfig,
+    CS: OutputPin,
+{
+    async fn transaction(&mut self, operations: &mut [spi::Operation<'_, u8>]) -> Result<(), Self::Error> {
+        let mut bus = self.bus.lock().await;
+        bus.set_config(&self.config);
+        self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+        let op_res: Result<(), BUS::Error> = try {
+            for op in operations {
+                match op {
+                    Operation::Read(buf) => bus.read(buf).await?,
+                    Operation::Write(buf) => bus.write(buf).await?,
+                    Operation::Transfer(read, write) => bus.transfer(read, write).await?,
+                    Operation::TransferInPlace(buf) => bus.transfer_in_place(buf).await?,
+                }
+            }
+        };
+
+        // On failure, it's important to still flush and deassert CS.
+        let flush_res = bus.flush().await;
+        let cs_res = self.cs.set_high();
+
+        let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+        flush_res.map_err(SpiDeviceError::Spi)?;
+        cs_res.map_err(SpiDeviceError::Cs)?;
+
+        Ok(op_res)
     }
 }

embassy-embedded-hal/src/shared_bus/blocking/i2c.rs

@@ -72,34 +72,6 @@ where
         let _ = operations;
         todo!()
     }
-
-    fn write_iter<B: IntoIterator<Item = u8>>(&mut self, addr: u8, bytes: B) -> Result<(), Self::Error> {
-        let _ = addr;
-        let _ = bytes;
-        todo!()
-    }
-
-    fn write_iter_read<B: IntoIterator<Item = u8>>(
-        &mut self,
-        addr: u8,
-        bytes: B,
-        buffer: &mut [u8],
-    ) -> Result<(), Self::Error> {
-        let _ = addr;
-        let _ = bytes;
-        let _ = buffer;
-        todo!()
-    }
-
-    fn transaction_iter<'a, O: IntoIterator<Item = Operation<'a>>>(
-        &mut self,
-        address: u8,
-        operations: O,
-    ) -> Result<(), Self::Error> {
-        let _ = address;
-        let _ = operations;
-        todo!()
-    }
 }
 
 impl<'a, M, BUS, E> embedded_hal_02::blocking::i2c::Write for I2cDevice<'_, M, BUS>
@@ -204,32 +176,4 @@ where
         let _ = operations;
         todo!()
     }
-
-    fn write_iter<B: IntoIterator<Item = u8>>(&mut self, addr: u8, bytes: B) -> Result<(), Self::Error> {
-        let _ = addr;
-        let _ = bytes;
-        todo!()
-    }
-
-    fn write_iter_read<B: IntoIterator<Item = u8>>(
-        &mut self,
-        addr: u8,
-        bytes: B,
-        buffer: &mut [u8],
-    ) -> Result<(), Self::Error> {
-        let _ = addr;
-        let _ = bytes;
-        let _ = buffer;
-        todo!()
-    }
-
-    fn transaction_iter<'a, O: IntoIterator<Item = Operation<'a>>>(
-        &mut self,
-        address: u8,
-        operations: O,
-    ) -> Result<(), Self::Error> {
-        let _ = address;
-        let _ = operations;
-        todo!()
-    }
 }

embassy-embedded-hal/src/shared_bus/blocking/spi.rs

@@ -23,8 +23,7 @@ use core::cell::RefCell;
 use embassy_sync::blocking_mutex::raw::RawMutex;
 use embassy_sync::blocking_mutex::Mutex;
 use embedded_hal_1::digital::OutputPin;
-use embedded_hal_1::spi;
-use embedded_hal_1::spi::SpiBusFlush;
+use embedded_hal_1::spi::{self, Operation, SpiBus, SpiBusRead, SpiBusWrite};
 
 use crate::shared_bus::SpiDeviceError;
 use crate::SetConfig;
@@ -50,30 +49,85 @@ where
     type Error = SpiDeviceError<BUS::Error, CS::Error>;
 }
 
-impl<BUS, M, CS> embedded_hal_1::spi::SpiDevice for SpiDevice<'_, M, BUS, CS>
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDeviceRead for SpiDevice<'_, M, BUS, CS>
 where
     M: RawMutex,
-    BUS: SpiBusFlush,
+    BUS: SpiBusRead,
     CS: OutputPin,
 {
-    type Bus = BUS;
-
-    fn transaction<R>(&mut self, f: impl FnOnce(&mut Self::Bus) -> Result<R, BUS::Error>) -> Result<R, Self::Error> {
+    fn read_transaction(&mut self, operations: &mut [&mut [u8]]) -> Result<(), Self::Error> {
         self.bus.lock(|bus| {
             let mut bus = bus.borrow_mut();
             self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
-            let f_res = f(&mut bus);
+            let op_res = operations.iter_mut().try_for_each(|buf| bus.read(buf));
 
             // On failure, it's important to still flush and deassert CS.
             let flush_res = bus.flush();
             let cs_res = self.cs.set_high();
 
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
             flush_res.map_err(SpiDeviceError::Spi)?;
             cs_res.map_err(SpiDeviceError::Cs)?;
 
-            Ok(f_res)
+            Ok(op_res)
+        })
+    }
+}
+
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDeviceWrite for SpiDevice<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: SpiBusWrite,
+    CS: OutputPin,
+{
+    fn write_transaction(&mut self, operations: &[&[u8]]) -> Result<(), Self::Error> {
+        self.bus.lock(|bus| {
+            let mut bus = bus.borrow_mut();
+            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+            let op_res = operations.iter().try_for_each(|buf| bus.write(buf));
+
+            // On failure, it's important to still flush and deassert CS.
+            let flush_res = bus.flush();
+            let cs_res = self.cs.set_high();
+
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+            flush_res.map_err(SpiDeviceError::Spi)?;
+            cs_res.map_err(SpiDeviceError::Cs)?;
+
+            Ok(op_res)
+        })
+    }
+}
+
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDevice for SpiDevice<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: SpiBus,
+    CS: OutputPin,
+{
+    fn transaction(&mut self, operations: &mut [Operation<'_, u8>]) -> Result<(), Self::Error> {
+        self.bus.lock(|bus| {
+            let mut bus = bus.borrow_mut();
+            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+            let op_res = operations.iter_mut().try_for_each(|op| match op {
+                Operation::Read(buf) => bus.read(buf),
+                Operation::Write(buf) => bus.write(buf),
+                Operation::Transfer(read, write) => bus.transfer(read, write),
+                Operation::TransferInPlace(buf) => bus.transfer_in_place(buf),
+            });
+
+            // On failure, it's important to still flush and deassert CS.
+            let flush_res = bus.flush();
+            let cs_res = self.cs.set_high();
+
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+            flush_res.map_err(SpiDeviceError::Spi)?;
+            cs_res.map_err(SpiDeviceError::Cs)?;
+
+            Ok(op_res)
         })
     }
 }
@@ -89,11 +143,11 @@ where
         self.bus.lock(|bus| {
             let mut bus = bus.borrow_mut();
             self.cs.set_low().map_err(SpiDeviceError::Cs)?;
-            let f_res = bus.transfer(words);
+            let op_res = bus.transfer(words);
             let cs_res = self.cs.set_high();
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
             cs_res.map_err(SpiDeviceError::Cs)?;
-            Ok(f_res)
+            Ok(op_res)
         })
     }
 }
@@ -110,11 +164,11 @@ where
         self.bus.lock(|bus| {
             let mut bus = bus.borrow_mut();
             self.cs.set_low().map_err(SpiDeviceError::Cs)?;
-            let f_res = bus.write(words);
+            let op_res = bus.write(words);
             let cs_res = self.cs.set_high();
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
             cs_res.map_err(SpiDeviceError::Cs)?;
-            Ok(f_res)
+            Ok(op_res)
         })
     }
 }
@@ -146,30 +200,85 @@ where
     type Error = SpiDeviceError<BUS::Error, CS::Error>;
 }
 
-impl<BUS, M, CS> embedded_hal_1::spi::SpiDevice for SpiDeviceWithConfig<'_, M, BUS, CS>
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDeviceRead for SpiDeviceWithConfig<'_, M, BUS, CS>
 where
     M: RawMutex,
-    BUS: SpiBusFlush + SetConfig,
+    BUS: SpiBusRead + SetConfig,
     CS: OutputPin,
 {
-    type Bus = BUS;
-
-    fn transaction<R>(&mut self, f: impl FnOnce(&mut Self::Bus) -> Result<R, BUS::Error>) -> Result<R, Self::Error> {
+    fn read_transaction(&mut self, operations: &mut [&mut [u8]]) -> Result<(), Self::Error> {
         self.bus.lock(|bus| {
             let mut bus = bus.borrow_mut();
             bus.set_config(&self.config);
             self.cs.set_low().map_err(SpiDeviceError::Cs)?;
 
-            let f_res = f(&mut bus);
+            let op_res = operations.iter_mut().try_for_each(|buf| bus.read(buf));
 
             // On failure, it's important to still flush and deassert CS.
             let flush_res = bus.flush();
             let cs_res = self.cs.set_high();
 
-            let f_res = f_res.map_err(SpiDeviceError::Spi)?;
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
             flush_res.map_err(SpiDeviceError::Spi)?;
             cs_res.map_err(SpiDeviceError::Cs)?;
-            Ok(f_res)
+            Ok(op_res)
+        })
+    }
+}
+
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDeviceWrite for SpiDeviceWithConfig<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: SpiBusWrite + SetConfig,
+    CS: OutputPin,
+{
+    fn write_transaction(&mut self, operations: &[&[u8]]) -> Result<(), Self::Error> {
+        self.bus.lock(|bus| {
+            let mut bus = bus.borrow_mut();
+            bus.set_config(&self.config);
+            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+            let op_res = operations.iter().try_for_each(|buf| bus.write(buf));
+
+            // On failure, it's important to still flush and deassert CS.
+            let flush_res = bus.flush();
+            let cs_res = self.cs.set_high();
+
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+            flush_res.map_err(SpiDeviceError::Spi)?;
+            cs_res.map_err(SpiDeviceError::Cs)?;
+            Ok(op_res)
+        })
+    }
+}
+
+impl<BUS, M, CS> embedded_hal_1::spi::SpiDevice for SpiDeviceWithConfig<'_, M, BUS, CS>
+where
+    M: RawMutex,
+    BUS: SpiBus + SetConfig,
+    CS: OutputPin,
+{
+    fn transaction(&mut self, operations: &mut [Operation<'_, u8>]) -> Result<(), Self::Error> {
+        self.bus.lock(|bus| {
+            let mut bus = bus.borrow_mut();
+            bus.set_config(&self.config);
+            self.cs.set_low().map_err(SpiDeviceError::Cs)?;
+
+            let op_res = operations.iter_mut().try_for_each(|op| match op {
+                Operation::Read(buf) => bus.read(buf),
+                Operation::Write(buf) => bus.write(buf),
+                Operation::Transfer(read, write) => bus.transfer(read, write),
+                Operation::TransferInPlace(buf) => bus.transfer_in_place(buf),
+            });
+
+            // On failure, it's important to still flush and deassert CS.
+            let flush_res = bus.flush();
+            let cs_res = self.cs.set_high();
+
+            let op_res = op_res.map_err(SpiDeviceError::Spi)?;
+            flush_res.map_err(SpiDeviceError::Spi)?;
+            cs_res.map_err(SpiDeviceError::Cs)?;
+            Ok(op_res)
         })
     }
 }

embassy-executor/Cargo.toml

@@ -1,34 +1,55 @@
 [package]
 name = "embassy-executor"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MIT OR Apache-2.0"
-
+description = "async/await executor designed for embedded usage"
+repository = "https://github.com/embassy-rs/embassy"
+categories = [
+    "embedded",
+    "no-std",
+    "asynchronous",
+]
 
 [package.metadata.embassy_docs]
 src_base = "https://github.com/embassy-rs/embassy/blob/embassy-executor-v$VERSION/embassy-executor/src/"
 src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-executor/src/"
-features = ["nightly", "defmt"]
+features = ["nightly", "defmt", "pender-callback"]
 flavors = [
-    { name = "std",                       target = "x86_64-unknown-linux-gnu",   features = ["std"] },
-    { name = "wasm",                      target = "wasm32-unknown-unknown",     features = ["wasm"] },
-    { name = "thumbv6m-none-eabi",        target = "thumbv6m-none-eabi",         features = [] },
-    { name = "thumbv7m-none-eabi",        target = "thumbv7m-none-eabi",         features = [] },
-    { name = "thumbv7em-none-eabi",       target = "thumbv7em-none-eabi",        features = [] },
-    { name = "thumbv7em-none-eabihf",     target = "thumbv7em-none-eabihf",      features = [] },
-    { name = "thumbv8m.base-none-eabi",   target = "thumbv8m.base-none-eabi",    features = [] },
-    { name = "thumbv8m.main-none-eabi",   target = "thumbv8m.main-none-eabi",    features = [] },
-    { name = "thumbv8m.main-none-eabihf", target = "thumbv8m.main-none-eabihf",  features = [] },
+    { name = "std",             target = "x86_64-unknown-linux-gnu",     features = ["arch-std", "executor-thread"] },
+    { name = "wasm",            target = "wasm32-unknown-unknown",       features = ["arch-wasm", "executor-thread"] },
+    { name = "cortex-m",        target = "thumbv7em-none-eabi",          features = ["arch-cortex-m", "executor-thread", "executor-interrupt"] },
+    { name = "riscv32",         target = "riscv32imac-unknown-none-elf", features = ["arch-riscv32", "executor-thread"] },
 ]
 
+[package.metadata.docs.rs]
+default-target = "thumbv7em-none-eabi"
+targets = ["thumbv7em-none-eabi"]
+features = ["nightly", "defmt", "pender-callback", "arch-cortex-m", "executor-thread", "executor-interrupt"]
+
 [features]
-default = []
-std = ["embassy-macros/std", "critical-section/std"]
-wasm = ["dep:wasm-bindgen", "dep:js-sys", "embassy-macros/wasm"]
+
+# Architecture
+_arch = [] # some arch was picked
+arch-std = ["_arch", "critical-section/std"]
+arch-cortex-m = ["_arch", "dep:cortex-m"]
+arch-xtensa = ["_arch"]
+arch-riscv32 = ["_arch"]
+arch-wasm = ["_arch", "dep:wasm-bindgen", "dep:js-sys"]
+
+# Enable creating a `Pender` from an arbitrary function pointer callback.
+pender-callback = []
+
+# Enable the thread-mode executor (using WFE/SEV in Cortex-M, WFI in other embedded archs)
+executor-thread = []
+# Enable the interrupt-mode executor (available in Cortex-M only)
+executor-interrupt = []
 
 # Enable nightly-only features
 nightly = []
 
+turbowakers = []
+
 integrated-timers = ["dep:embassy-time"]
 
 # Trace interrupt invocations with rtos-trace.
@@ -44,9 +65,11 @@ embassy-macros  = { version = "0.1.0", path = "../embassy-macros" }
 embassy-time  = { version = "0.1.0", path = "../embassy-time", optional = true}
 atomic-polyfill = "1.0.1"
 critical-section = "1.1"
-cfg-if = "1.0.0"
 static_cell = "1.0"
 
-# WASM dependencies
+# arch-cortex-m dependencies
+cortex-m = { version = "0.7.6", optional = true }
+
+# arch-wasm dependencies
 wasm-bindgen = { version = "0.2.82", optional = true }
 js-sys = { version = "0.3", optional = true }

embassy-executor/src/arch/cortex_m.rs

@@ -1,59 +1,209 @@
-use core::arch::asm;
-use core::marker::PhantomData;
-use core::ptr;
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::arch::asm;
+    use core::marker::PhantomData;
 
-use super::{raw, Spawner};
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_cortex_m as main;
 
-/// Thread mode executor, using WFE/SEV.
-///
-/// This is the simplest and most common kind of executor. It runs on
-/// thread mode (at the lowest priority level), and uses the `WFE` ARM instruction
-/// to sleep when it has no more work to do. When a task is woken, a `SEV` instruction
-/// is executed, to make the `WFE` exit from sleep and poll the task.
-///
-/// This executor allows for ultra low power consumption for chips where `WFE`
-/// triggers low-power sleep without extra steps. If your chip requires extra steps,
-/// you may use [`raw::Executor`] directly to program custom behavior.
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            inner: raw::Executor::new(|_| unsafe { asm!("sev") }, ptr::null_mut()),
-            not_send: PhantomData,
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
+
+    impl ThreadPender {
+        pub(crate) fn pend(self) {
+            unsafe { core::arch::asm!("sev") }
         }
     }
 
-    /// Run the executor.
+    /// Thread mode executor, using WFE/SEV.
     ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
+    /// This is the simplest and most common kind of executor. It runs on
+    /// thread mode (at the lowest priority level), and uses the `WFE` ARM instruction
+    /// to sleep when it has no more work to do. When a task is woken, a `SEV` instruction
+    /// is executed, to make the `WFE` exit from sleep and poll the task.
     ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// This executor allows for ultra low power consumption for chips where `WFE`
+    /// triggers low-power sleep without extra steps. If your chip requires extra steps,
+    /// you may use [`raw::Executor`] directly to program custom behavior.
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    asm!("wfe");
+                };
+            }
+        }
+    }
+}
+
+#[cfg(feature = "executor-interrupt")]
+pub use interrupt::*;
+#[cfg(feature = "executor-interrupt")]
+mod interrupt {
+    use core::cell::UnsafeCell;
+    use core::mem::MaybeUninit;
+
+    use atomic_polyfill::{AtomicBool, Ordering};
+    use cortex_m::interrupt::InterruptNumber;
+    use cortex_m::peripheral::NVIC;
+
+    use crate::raw::{self, Pender, PenderInner};
+
+    #[derive(Clone, Copy)]
+    pub(crate) struct InterruptPender(u16);
+
+    impl InterruptPender {
+        pub(crate) fn pend(self) {
+            // STIR is faster, but is only available in v7 and higher.
+            #[cfg(not(armv6m))]
+            {
+                let mut nvic: cortex_m::peripheral::NVIC = unsafe { core::mem::transmute(()) };
+                nvic.request(self);
+            }
+
+            #[cfg(armv6m)]
+            cortex_m::peripheral::NVIC::pend(self);
+        }
+    }
+
+    unsafe impl cortex_m::interrupt::InterruptNumber for InterruptPender {
+        fn number(self) -> u16 {
+            self.0
+        }
+    }
+
+    /// Interrupt mode executor.
+    ///
+    /// This executor runs tasks in interrupt mode. The interrupt handler is set up
+    /// to poll tasks, and when a task is woken the interrupt is pended from software.
+    ///
+    /// This allows running async tasks at a priority higher than thread mode. One
+    /// use case is to leave thread mode free for non-async tasks. Another use case is
+    /// to run multiple executors: one in thread mode for low priority tasks and another in
+    /// interrupt mode for higher priority tasks. Higher priority tasks will preempt lower
+    /// priority ones.
+    ///
+    /// It is even possible to run multiple interrupt mode executors at different priorities,
+    /// by assigning different priorities to the interrupts. For an example on how to do this,
+    /// See the 'multiprio' example for 'embassy-nrf'.
+    ///
+    /// To use it, you have to pick an interrupt that won't be used by the hardware.
+    /// Some chips reserve some interrupts for this purpose, sometimes named "software interrupts" (SWI).
+    /// If this is not the case, you may use an interrupt from any unused peripheral.
+    ///
+    /// It is somewhat more complex to use, it's recommended to use the thread-mode
+    /// [`Executor`] instead, if it works for your use case.
+    pub struct InterruptExecutor {
+        started: AtomicBool,
+        executor: UnsafeCell<MaybeUninit<raw::Executor>>,
+    }
+
+    unsafe impl Send for InterruptExecutor {}
+    unsafe impl Sync for InterruptExecutor {}
+
+    impl InterruptExecutor {
+        /// Create a new, not started `InterruptExecutor`.
+        #[inline]
+        pub const fn new() -> Self {
+            Self {
+                started: AtomicBool::new(false),
+                executor: UnsafeCell::new(MaybeUninit::uninit()),
+            }
+        }
+
+        /// Executor interrupt callback.
+        ///
+        /// # Safety
+        ///
+        /// You MUST call this from the interrupt handler, and from nowhere else.
+        pub unsafe fn on_interrupt(&'static self) {
+            let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
+            executor.poll();
+        }
+
+        /// Start the executor.
+        ///
+        /// This initializes the executor, enables the interrupt, and returns.
+        /// The executor keeps running in the background through the interrupt.
+        ///
+        /// This returns a [`SendSpawner`] you can use to spawn tasks on it. A [`SendSpawner`]
+        /// is returned instead of a [`Spawner`](embassy_executor::Spawner) because the executor effectively runs in a
+        /// different "thread" (the interrupt), so spawning tasks on it is effectively
+        /// sending them.
+        ///
+        /// To obtain a [`Spawner`](embassy_executor::Spawner) for this executor, use [`Spawner::for_current_executor()`](embassy_executor::Spawner::for_current_executor()) from
+        /// a task running in it.
+        ///
+        /// # Interrupt requirements
+        ///
+        /// You must write the interrupt handler yourself, and make it call [`on_interrupt()`](Self::on_interrupt).
+        ///
+        /// This method already enables (unmasks) the interrupt, you must NOT do it yourself.
+        ///
+        /// You must set the interrupt priority before calling this method. You MUST NOT
+        /// do it after.
+        ///
+        pub fn start(&'static self, irq: impl InterruptNumber) -> crate::SendSpawner {
+            if self
+                .started
+                .compare_exchange(false, true, Ordering::Acquire, Ordering::Relaxed)
+                .is_err()
+            {
+                panic!("InterruptExecutor::start() called multiple times on the same executor.");
+            }
 
-        loop {
             unsafe {
-                self.inner.poll();
-                asm!("wfe");
-            };
+                (&mut *self.executor.get())
+                    .as_mut_ptr()
+                    .write(raw::Executor::new(Pender(PenderInner::Interrupt(InterruptPender(
+                        irq.number(),
+                    )))))
+            }
+
+            let executor = unsafe { (&*self.executor.get()).assume_init_ref() };
+
+            unsafe { NVIC::unmask(irq) }
+
+            executor.spawner().make_send()
         }
     }
 }

embassy-executor/src/arch/riscv32.rs

@@ -1,73 +1,86 @@
-use core::marker::PhantomData;
-use core::ptr;
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-riscv32`.");
 
-use atomic_polyfill::{AtomicBool, Ordering};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::marker::PhantomData;
+    use core::sync::atomic::{AtomicBool, Ordering};
 
-use super::{raw, Spawner};
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_riscv as main;
 
-/// global atomic used to keep track of whether there is work to do since sev() is not available on RISCV
-///
-static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-/// RISCV32 Executor
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            // use Signal_Work_Thread_Mode as substitute for local interrupt register
-            inner: raw::Executor::new(
-                |_| {
-                    SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
-                },
-                ptr::null_mut(),
-            ),
-            not_send: PhantomData,
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            SIGNAL_WORK_THREAD_MODE.store(true, core::sync::atomic::Ordering::SeqCst);
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// global atomic used to keep track of whether there is work to do since sev() is not available on RISCV
+    static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-        loop {
-            unsafe {
-                self.inner.poll();
-                // we do not care about race conditions between the load and store operations, interrupts
-                //will only set this value to true.
-                critical_section::with(|_| {
-                    // if there is work to do, loop back to polling
-                    // TODO can we relax this?
-                    if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
-                        SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
-                    }
-                    // if not, wait for interrupt
-                    else {
-                        core::arch::asm!("wfi");
-                    }
-                });
-                // if an interrupt occurred while waiting, it will be serviced here
+    /// RISCV32 Executor
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    // we do not care about race conditions between the load and store operations, interrupts
+                    //will only set this value to true.
+                    critical_section::with(|_| {
+                        // if there is work to do, loop back to polling
+                        // TODO can we relax this?
+                        if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
+                            SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
+                        }
+                        // if not, wait for interrupt
+                        else {
+                            core::arch::asm!("wfi");
+                        }
+                    });
+                    // if an interrupt occurred while waiting, it will be serviced here
+                }
             }
         }
     }

embassy-executor/src/arch/std.rs

@@ -1,84 +1,100 @@
-use std::marker::PhantomData;
-use std::sync::{Condvar, Mutex};
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-std`.");
 
-use super::{raw, Spawner};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use std::marker::PhantomData;
+    use std::sync::{Condvar, Mutex};
 
-/// Single-threaded std-based executor.
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-    signaler: &'static Signaler,
-}
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_std as main;
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        let signaler = &*Box::leak(Box::new(Signaler::new()));
-        Self {
-            inner: raw::Executor::new(
-                |p| unsafe {
-                    let s = &*(p as *const () as *const Signaler);
-                    s.signal()
-                },
-                signaler as *const _ as _,
-            ),
-            not_send: PhantomData,
-            signaler,
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
+
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender(&'static Signaler);
+
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            self.0.signal()
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
-
-        loop {
-            unsafe { self.inner.poll() };
-            self.signaler.wait()
-        }
+    /// Single-threaded std-based executor.
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+        signaler: &'static Signaler,
     }
-}
 
-struct Signaler {
-    mutex: Mutex<bool>,
-    condvar: Condvar,
-}
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            let signaler = &*Box::leak(Box::new(Signaler::new()));
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender(signaler)))),
+                not_send: PhantomData,
+                signaler,
+            }
+        }
 
-impl Signaler {
-    fn new() -> Self {
-        Self {
-            mutex: Mutex::new(false),
-            condvar: Condvar::new(),
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe { self.inner.poll() };
+                self.signaler.wait()
+            }
         }
     }
 
-    fn wait(&self) {
-        let mut signaled = self.mutex.lock().unwrap();
-        while !*signaled {
-            signaled = self.condvar.wait(signaled).unwrap();
-        }
-        *signaled = false;
+    struct Signaler {
+        mutex: Mutex<bool>,
+        condvar: Condvar,
     }
 
-    fn signal(&self) {
-        let mut signaled = self.mutex.lock().unwrap();
-        *signaled = true;
-        self.condvar.notify_one();
+    impl Signaler {
+        fn new() -> Self {
+            Self {
+                mutex: Mutex::new(false),
+                condvar: Condvar::new(),
+            }
+        }
+
+        fn wait(&self) {
+            let mut signaled = self.mutex.lock().unwrap();
+            while !*signaled {
+                signaled = self.condvar.wait(signaled).unwrap();
+            }
+            *signaled = false;
+        }
+
+        fn signal(&self) {
+            let mut signaled = self.mutex.lock().unwrap();
+            *signaled = true;
+            self.condvar.notify_one();
+        }
     }
 }

embassy-executor/src/arch/wasm.rs

@@ -1,74 +1,88 @@
-use core::marker::PhantomData;
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-wasm`.");
 
-use js_sys::Promise;
-use wasm_bindgen::prelude::*;
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
 
-use super::raw::util::UninitCell;
-use super::raw::{self};
-use super::Spawner;
+    use core::marker::PhantomData;
 
-/// WASM executor, wasm_bindgen to schedule tasks on the JS event loop.
-pub struct Executor {
-    inner: raw::Executor,
-    ctx: &'static WasmContext,
-    not_send: PhantomData<*mut ()>,
-}
+    #[cfg(feature = "nightly")]
+    pub use embassy_macros::main_wasm as main;
+    use js_sys::Promise;
+    use wasm_bindgen::prelude::*;
 
-pub(crate) struct WasmContext {
-    promise: Promise,
-    closure: UninitCell<Closure<dyn FnMut(JsValue)>>,
-}
+    use crate::raw::util::UninitCell;
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-impl WasmContext {
-    pub fn new() -> Self {
-        Self {
-            promise: Promise::resolve(&JsValue::undefined()),
-            closure: UninitCell::uninit(),
-        }
+    /// WASM executor, wasm_bindgen to schedule tasks on the JS event loop.
+    pub struct Executor {
+        inner: raw::Executor,
+        ctx: &'static WasmContext,
+        not_send: PhantomData<*mut ()>,
     }
-}
 
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        let ctx = &*Box::leak(Box::new(WasmContext::new()));
-        let inner = raw::Executor::new(
-            |p| unsafe {
-                let ctx = &*(p as *const () as *const WasmContext);
-                let _ = ctx.promise.then(ctx.closure.as_mut());
-            },
-            ctx as *const _ as _,
-        );
-        Self {
-            inner,
-            not_send: PhantomData,
-            ctx,
+    pub(crate) struct WasmContext {
+        promise: Promise,
+        closure: UninitCell<Closure<dyn FnMut(JsValue)>>,
+    }
+
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender(&'static WasmContext);
+
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            let _ = self.0.promise.then(unsafe { self.0.closure.as_mut() });
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    pub fn start(&'static mut self, init: impl FnOnce(Spawner)) {
-        unsafe {
-            let executor = &self.inner;
-            self.ctx.closure.write(Closure::new(move |_| {
-                executor.poll();
-            }));
-            init(self.inner.spawner());
+    impl WasmContext {
+        pub fn new() -> Self {
+            Self {
+                promise: Promise::resolve(&JsValue::undefined()),
+                closure: UninitCell::uninit(),
+            }
+        }
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            let ctx = &*Box::leak(Box::new(WasmContext::new()));
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender(ctx)))),
+                not_send: PhantomData,
+                ctx,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        pub fn start(&'static mut self, init: impl FnOnce(Spawner)) {
+            unsafe {
+                let executor = &self.inner;
+                self.ctx.closure.write(Closure::new(move |_| {
+                    executor.poll();
+                }));
+                init(self.inner.spawner());
+            }
         }
     }
 }

embassy-executor/src/arch/xtensa.rs

@@ -1,74 +1,84 @@
-use core::marker::PhantomData;
-use core::ptr;
+#[cfg(feature = "executor-interrupt")]
+compile_error!("`executor-interrupt` is not supported with `arch-xtensa`.");
 
-use atomic_polyfill::{AtomicBool, Ordering};
+#[cfg(feature = "executor-thread")]
+pub use thread::*;
+#[cfg(feature = "executor-thread")]
+mod thread {
+    use core::marker::PhantomData;
+    use core::sync::atomic::{AtomicBool, Ordering};
 
-use super::{raw, Spawner};
+    use crate::raw::{Pender, PenderInner};
+    use crate::{raw, Spawner};
 
-/// global atomic used to keep track of whether there is work to do since sev() is not available on Xtensa
-///
-static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
+    #[derive(Copy, Clone)]
+    pub(crate) struct ThreadPender;
 
-/// Xtensa Executor
-pub struct Executor {
-    inner: raw::Executor,
-    not_send: PhantomData<*mut ()>,
-}
-
-impl Executor {
-    /// Create a new Executor.
-    pub fn new() -> Self {
-        Self {
-            // use Signal_Work_Thread_Mode as substitute for local interrupt register
-            inner: raw::Executor::new(
-                |_| {
-                    SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
-                },
-                ptr::null_mut(),
-            ),
-            not_send: PhantomData,
+    impl ThreadPender {
+        #[allow(unused)]
+        pub(crate) fn pend(self) {
+            SIGNAL_WORK_THREAD_MODE.store(true, core::sync::atomic::Ordering::SeqCst);
         }
     }
 
-    /// Run the executor.
-    ///
-    /// The `init` closure is called with a [`Spawner`] that spawns tasks on
-    /// this executor. Use it to spawn the initial task(s). After `init` returns,
-    /// the executor starts running the tasks.
-    ///
-    /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
-    /// for example by passing it as an argument to the initial tasks.
-    ///
-    /// This function requires `&'static mut self`. This means you have to store the
-    /// Executor instance in a place where it'll live forever and grants you mutable
-    /// access. There's a few ways to do this:
-    ///
-    /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
-    /// - a `static mut` (unsafe)
-    /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
-    ///
-    /// This function never returns.
-    pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
-        init(self.inner.spawner());
+    /// global atomic used to keep track of whether there is work to do since sev() is not available on Xtensa
+    static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-        loop {
-            unsafe {
-                self.inner.poll();
-                // we do not care about race conditions between the load and store operations, interrupts
-                // will only set this value to true.
-                // if there is work to do, loop back to polling
-                // TODO can we relax this?
-                critical_section::with(|_| {
-                    if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
-                        SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
-                    } else {
-                        // waiti sets the PS.INTLEVEL when slipping into sleep
-                        // because critical sections in Xtensa are implemented via increasing
-                        // PS.INTLEVEL the critical section ends here
-                        // take care not add code after `waiti` if it needs to be inside the CS
-                        core::arch::asm!("waiti 0"); // critical section ends here
-                    }
-                });
+    /// Xtensa Executor
+    pub struct Executor {
+        inner: raw::Executor,
+        not_send: PhantomData<*mut ()>,
+    }
+
+    impl Executor {
+        /// Create a new Executor.
+        pub fn new() -> Self {
+            Self {
+                inner: raw::Executor::new(Pender(PenderInner::Thread(ThreadPender))),
+                not_send: PhantomData,
+            }
+        }
+
+        /// Run the executor.
+        ///
+        /// The `init` closure is called with a [`Spawner`] that spawns tasks on
+        /// this executor. Use it to spawn the initial task(s). After `init` returns,
+        /// the executor starts running the tasks.
+        ///
+        /// To spawn more tasks later, you may keep copies of the [`Spawner`] (it is `Copy`),
+        /// for example by passing it as an argument to the initial tasks.
+        ///
+        /// This function requires `&'static mut self`. This means you have to store the
+        /// Executor instance in a place where it'll live forever and grants you mutable
+        /// access. There's a few ways to do this:
+        ///
+        /// - a [StaticCell](https://docs.rs/static_cell/latest/static_cell/) (safe)
+        /// - a `static mut` (unsafe)
+        /// - a local variable in a function you know never returns (like `fn main() -> !`), upgrading its lifetime with `transmute`. (unsafe)
+        ///
+        /// This function never returns.
+        pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            init(self.inner.spawner());
+
+            loop {
+                unsafe {
+                    self.inner.poll();
+                    // we do not care about race conditions between the load and store operations, interrupts
+                    // will only set this value to true.
+                    // if there is work to do, loop back to polling
+                    // TODO can we relax this?
+                    critical_section::with(|_| {
+                        if SIGNAL_WORK_THREAD_MODE.load(Ordering::SeqCst) {
+                            SIGNAL_WORK_THREAD_MODE.store(false, Ordering::SeqCst);
+                        } else {
+                            // waiti sets the PS.INTLEVEL when slipping into sleep
+                            // because critical sections in Xtensa are implemented via increasing
+                            // PS.INTLEVEL the critical section ends here
+                            // take care not add code after `waiti` if it needs to be inside the CS
+                            core::arch::asm!("waiti 0"); // critical section ends here
+                        }
+                    });
+                }
             }
         }
     }

embassy-executor/src/lib.rs

@@ -1,5 +1,5 @@
-#![cfg_attr(not(any(feature = "std", feature = "wasm")), no_std)]
-#![cfg_attr(all(feature = "nightly", target_arch = "xtensa"), feature(asm_experimental_arch))]
+#![cfg_attr(not(any(feature = "arch-std", feature = "arch-wasm")), no_std)]
+#![cfg_attr(all(feature = "nightly", feature = "arch-xtensa"), feature(asm_experimental_arch))]
 #![allow(clippy::new_without_default)]
 #![doc = include_str!("../README.md")]
 #![warn(missing_docs)]
@@ -8,41 +8,45 @@
 pub(crate) mod fmt;
 
 #[cfg(feature = "nightly")]
-pub use embassy_macros::{main, task};
+pub use embassy_macros::task;
 
-cfg_if::cfg_if! {
-    if #[cfg(cortex_m)] {
-        #[path="arch/cortex_m.rs"]
-        mod arch;
-        pub use arch::*;
-    }
-    else if #[cfg(target_arch="riscv32")] {
-        #[path="arch/riscv32.rs"]
-        mod arch;
-        pub use arch::*;
-    }
-    else if #[cfg(all(target_arch="xtensa", feature = "nightly"))] {
-        #[path="arch/xtensa.rs"]
-        mod arch;
-        pub use arch::*;
-    }
-    else if #[cfg(feature="wasm")] {
-        #[path="arch/wasm.rs"]
-        mod arch;
-        pub use arch::*;
-    }
-    else if #[cfg(feature="std")] {
-        #[path="arch/std.rs"]
-        mod arch;
-        pub use arch::*;
-    }
+macro_rules! check_at_most_one {
+    (@amo [$($feats:literal)*] [] [$($res:tt)*]) => {
+        #[cfg(any($($res)*))]
+        compile_error!(concat!("At most one of these features can be enabled at the same time:", $(" `", $feats, "`",)*));
+    };
+    (@amo $feats:tt [$curr:literal $($rest:literal)*] [$($res:tt)*]) => {
+        check_at_most_one!(@amo $feats [$($rest)*] [$($res)* $(all(feature=$curr, feature=$rest),)*]);
+    };
+    ($($f:literal),*$(,)?) => {
+        check_at_most_one!(@amo [$($f)*] [$($f)*] []);
+    };
 }
+check_at_most_one!("arch-cortex-m", "arch-riscv32", "arch-xtensa", "arch-std", "arch-wasm",);
 
+#[cfg(feature = "_arch")]
+#[cfg_attr(feature = "arch-cortex-m", path = "arch/cortex_m.rs")]
+#[cfg_attr(feature = "arch-riscv32", path = "arch/riscv32.rs")]
+#[cfg_attr(feature = "arch-xtensa", path = "arch/xtensa.rs")]
+#[cfg_attr(feature = "arch-std", path = "arch/std.rs")]
+#[cfg_attr(feature = "arch-wasm", path = "arch/wasm.rs")]
+mod arch;
+
+#[cfg(feature = "_arch")]
+pub use arch::*;
+
+pub mod raw;
+
+mod spawner;
+pub use spawner::*;
+
+/// Implementation details for embassy macros.
+/// Do not use. Used for macros and HALs only. Not covered by semver guarantees.
 #[doc(hidden)]
-/// Implementation details for embassy macros. DO NOT USE.
-pub mod export {
+pub mod _export {
     #[cfg(feature = "rtos-trace")]
     pub use rtos_trace::trace;
+    pub use static_cell::StaticCell;
 
     /// Expands the given block of code when `embassy-executor` is compiled with
     /// the `rtos-trace-interrupt` feature.
@@ -62,14 +66,3 @@ pub mod export {
         ($($tt:tt)*) => {};
     }
 }
-
-pub mod raw;
-
-mod spawner;
-pub use spawner::*;
-
-/// Do not use. Used for macros and HALs only. Not covered by semver guarantees.
-#[doc(hidden)]
-pub mod _export {
-    pub use static_cell::StaticCell;
-}

embassy-executor/src/raw/mod.rs

@@ -11,17 +11,17 @@ mod run_queue;
 #[cfg(feature = "integrated-timers")]
 mod timer_queue;
 pub(crate) mod util;
+#[cfg_attr(feature = "turbowakers", path = "waker_turbo.rs")]
 mod waker;
 
-use core::cell::Cell;
 use core::future::Future;
+use core::marker::PhantomData;
+use core::mem;
 use core::pin::Pin;
 use core::ptr::NonNull;
 use core::task::{Context, Poll};
-use core::{mem, ptr};
 
 use atomic_polyfill::{AtomicU32, Ordering};
-use critical_section::CriticalSection;
 #[cfg(feature = "integrated-timers")]
 use embassy_time::driver::{self, AlarmHandle};
 #[cfg(feature = "integrated-timers")]
@@ -30,7 +30,7 @@ use embassy_time::Instant;
 use rtos_trace::trace;
 
 use self::run_queue::{RunQueue, RunQueueItem};
-use self::util::UninitCell;
+use self::util::{SyncUnsafeCell, UninitCell};
 pub use self::waker::task_from_waker;
 use super::SpawnToken;
 
@@ -43,35 +43,49 @@ pub(crate) const STATE_RUN_QUEUED: u32 = 1 << 1;
 pub(crate) const STATE_TIMER_QUEUED: u32 = 1 << 2;
 
 /// Raw task header for use in task pointers.
-///
-/// This is an opaque struct, used for raw pointers to tasks, for use
-/// with funtions like [`wake_task`] and [`task_from_waker`].
-pub struct TaskHeader {
+pub(crate) struct TaskHeader {
     pub(crate) state: AtomicU32,
     pub(crate) run_queue_item: RunQueueItem,
-    pub(crate) executor: Cell<*const Executor>, // Valid if state != 0
-    pub(crate) poll_fn: UninitCell<unsafe fn(NonNull<TaskHeader>)>, // Valid if STATE_SPAWNED
+    pub(crate) executor: SyncUnsafeCell<Option<&'static SyncExecutor>>,
+    poll_fn: SyncUnsafeCell<Option<unsafe fn(TaskRef)>>,
 
     #[cfg(feature = "integrated-timers")]
-    pub(crate) expires_at: Cell<Instant>,
+    pub(crate) expires_at: SyncUnsafeCell<Instant>,
     #[cfg(feature = "integrated-timers")]
     pub(crate) timer_queue_item: timer_queue::TimerQueueItem,
 }
 
-impl TaskHeader {
-    pub(crate) const fn new() -> Self {
-        Self {
-            state: AtomicU32::new(0),
-            run_queue_item: RunQueueItem::new(),
-            executor: Cell::new(ptr::null()),
-            poll_fn: UninitCell::uninit(),
+/// This is essentially a `&'static TaskStorage<F>` where the type of the future has been erased.
+#[derive(Clone, Copy)]
+pub struct TaskRef {
+    ptr: NonNull<TaskHeader>,
+}
 
-            #[cfg(feature = "integrated-timers")]
-            expires_at: Cell::new(Instant::from_ticks(0)),
-            #[cfg(feature = "integrated-timers")]
-            timer_queue_item: timer_queue::TimerQueueItem::new(),
+unsafe impl Send for TaskRef where &'static TaskHeader: Send {}
+unsafe impl Sync for TaskRef where &'static TaskHeader: Sync {}
+
+impl TaskRef {
+    fn new<F: Future + 'static>(task: &'static TaskStorage<F>) -> Self {
+        Self {
+            ptr: NonNull::from(task).cast(),
         }
     }
+
+    /// Safety: The pointer must have been obtained with `Task::as_ptr`
+    pub(crate) unsafe fn from_ptr(ptr: *const TaskHeader) -> Self {
+        Self {
+            ptr: NonNull::new_unchecked(ptr as *mut TaskHeader),
+        }
+    }
+
+    pub(crate) fn header(self) -> &'static TaskHeader {
+        unsafe { self.ptr.as_ref() }
+    }
+
+    /// The returned pointer is valid for the entire TaskStorage.
+    pub(crate) fn as_ptr(self) -> *const TaskHeader {
+        self.ptr.as_ptr()
+    }
 }
 
 /// Raw storage in which a task can be spawned.
@@ -101,7 +115,18 @@ impl<F: Future + 'static> TaskStorage<F> {
     /// Create a new TaskStorage, in not-spawned state.
     pub const fn new() -> Self {
         Self {
-            raw: TaskHeader::new(),
+            raw: TaskHeader {
+                state: AtomicU32::new(0),
+                run_queue_item: RunQueueItem::new(),
+                executor: SyncUnsafeCell::new(None),
+                // Note: this is lazily initialized so that a static `TaskStorage` will go in `.bss`
+                poll_fn: SyncUnsafeCell::new(None),
+
+                #[cfg(feature = "integrated-timers")]
+                expires_at: SyncUnsafeCell::new(Instant::from_ticks(0)),
+                #[cfg(feature = "integrated-timers")]
+                timer_queue_item: timer_queue::TimerQueueItem::new(),
+            },
             future: UninitCell::uninit(),
         }
     }
@@ -120,29 +145,17 @@ impl<F: Future + 'static> TaskStorage<F> {
     /// Once the task has finished running, you may spawn it again. It is allowed to spawn it
     /// on a different executor.
     pub fn spawn(&'static self, future: impl FnOnce() -> F) -> SpawnToken<impl Sized> {
-        if self.spawn_mark_used() {
-            return unsafe { SpawnToken::<F>::new(self.spawn_initialize(future)) };
+        let task = AvailableTask::claim(self);
+        match task {
+            Some(task) => {
+                let task = task.initialize(future);
+                unsafe { SpawnToken::<F>::new(task) }
+            }
+            None => SpawnToken::new_failed(),
         }
-
-        SpawnToken::<F>::new_failed()
     }
 
-    fn spawn_mark_used(&'static self) -> bool {
-        let state = STATE_SPAWNED | STATE_RUN_QUEUED;
-        self.raw
-            .state
-            .compare_exchange(0, state, Ordering::AcqRel, Ordering::Acquire)
-            .is_ok()
-    }
-
-    unsafe fn spawn_initialize(&'static self, future: impl FnOnce() -> F) -> NonNull<TaskHeader> {
-        // Initialize the task
-        self.raw.poll_fn.write(Self::poll);
-        self.future.write(future());
-        NonNull::new_unchecked(self as *const TaskStorage<F> as *const TaskHeader as *mut TaskHeader)
-    }
-
-    unsafe fn poll(p: NonNull<TaskHeader>) {
+    unsafe fn poll(p: TaskRef) {
         let this = &*(p.as_ptr() as *const TaskStorage<F>);
 
         let future = Pin::new_unchecked(this.future.as_mut());
@@ -160,9 +173,37 @@ impl<F: Future + 'static> TaskStorage<F> {
         // it's a noop for our waker.
         mem::forget(waker);
     }
+
+    #[doc(hidden)]
+    #[allow(dead_code)]
+    fn _assert_sync(self) {
+        fn assert_sync<T: Sync>(_: T) {}
+
+        assert_sync(self)
+    }
 }
 
-unsafe impl<F: Future + 'static> Sync for TaskStorage<F> {}
+struct AvailableTask<F: Future + 'static> {
+    task: &'static TaskStorage<F>,
+}
+
+impl<F: Future + 'static> AvailableTask<F> {
+    fn claim(task: &'static TaskStorage<F>) -> Option<Self> {
+        task.raw
+            .state
+            .compare_exchange(0, STATE_SPAWNED | STATE_RUN_QUEUED, Ordering::AcqRel, Ordering::Acquire)
+            .ok()
+            .map(|_| Self { task })
+    }
+
+    fn initialize(self, future: impl FnOnce() -> F) -> TaskRef {
+        unsafe {
+            self.task.raw.poll_fn.set(Some(TaskStorage::<F>::poll));
+            self.task.future.write(future());
+        }
+        TaskRef::new(self.task)
+    }
+}
 
 /// Raw storage that can hold up to N tasks of the same type.
 ///
@@ -187,13 +228,14 @@ impl<F: Future + 'static, const N: usize> TaskPool<F, N> {
     /// is currently free. If none is free, a "poisoned" SpawnToken is returned,
     /// which will cause [`Spawner::spawn()`](super::Spawner::spawn) to return the error.
     pub fn spawn(&'static self, future: impl FnOnce() -> F) -> SpawnToken<impl Sized> {
-        for task in &self.pool {
-            if task.spawn_mark_used() {
-                return unsafe { SpawnToken::<F>::new(task.spawn_initialize(future)) };
+        let task = self.pool.iter().find_map(AvailableTask::claim);
+        match task {
+            Some(task) => {
+                let task = task.initialize(future);
+                unsafe { SpawnToken::<F>::new(task) }
             }
+            None => SpawnToken::new_failed(),
         }
-
-        SpawnToken::<F>::new_failed()
     }
 
     /// Like spawn(), but allows the task to be send-spawned if the args are Send even if
@@ -235,39 +277,71 @@ impl<F: Future + 'static, const N: usize> TaskPool<F, N> {
         // This ONLY holds for `async fn` futures. The other `spawn` methods can be called directly
         // by the user, with arbitrary hand-implemented futures. This is why these return `SpawnToken<F>`.
 
-        for task in &self.pool {
-            if task.spawn_mark_used() {
-                return SpawnToken::<FutFn>::new(task.spawn_initialize(future));
+        let task = self.pool.iter().find_map(AvailableTask::claim);
+        match task {
+            Some(task) => {
+                let task = task.initialize(future);
+                unsafe { SpawnToken::<FutFn>::new(task) }
             }
+            None => SpawnToken::new_failed(),
         }
-
-        SpawnToken::<FutFn>::new_failed()
     }
 }
 
-/// Raw executor.
+#[derive(Clone, Copy)]
+pub(crate) enum PenderInner {
+    #[cfg(feature = "executor-thread")]
+    Thread(crate::arch::ThreadPender),
+    #[cfg(feature = "executor-interrupt")]
+    Interrupt(crate::arch::InterruptPender),
+    #[cfg(feature = "pender-callback")]
+    Callback { func: fn(*mut ()), context: *mut () },
+}
+
+unsafe impl Send for PenderInner {}
+unsafe impl Sync for PenderInner {}
+
+/// Platform/architecture-specific action executed when an executor has pending work.
 ///
-/// This is the core of the Embassy executor. It is low-level, requiring manual
-/// handling of wakeups and task polling. If you can, prefer using one of the
-/// [higher level executors](crate::Executor).
+/// When a task within an executor is woken, the `Pender` is called. This does a
+/// platform/architecture-specific action to signal there is pending work in the executor.
+/// When this happens, you must arrange for [`Executor::poll`] to be called.
 ///
-/// The raw executor leaves it up to you to handle wakeups and scheduling:
-///
-/// - To get the executor to do work, call `poll()`. This will poll all queued tasks (all tasks
-///   that "want to run").
-/// - You must supply a `signal_fn`. The executor will call it to notify you it has work
-///   to do. You must arrange for `poll()` to be called as soon as possible.
-///
-/// `signal_fn` can be called from *any* context: any thread, any interrupt priority
-/// level, etc. It may be called synchronously from any `Executor` method call as well.
-/// You must deal with this correctly.
-///
-/// In particular, you must NOT call `poll` directly from `signal_fn`, as this violates
-/// the requirement for `poll` to not be called reentrantly.
-pub struct Executor {
+/// You can think of it as a waker, but for the whole executor.
+pub struct Pender(pub(crate) PenderInner);
+
+impl Pender {
+    /// Create a `Pender` that will call an arbitrary function pointer.
+    ///
+    /// # Arguments
+    ///
+    /// - `func`: The function pointer to call.
+    /// - `context`: Opaque context pointer, that will be passed to the function pointer.
+    #[cfg(feature = "pender-callback")]
+    pub fn new_from_callback(func: fn(*mut ()), context: *mut ()) -> Self {
+        Self(PenderInner::Callback {
+            func,
+            context: context.into(),
+        })
+    }
+}
+
+impl Pender {
+    pub(crate) fn pend(&self) {
+        match self.0 {
+            #[cfg(feature = "executor-thread")]
+            PenderInner::Thread(x) => x.pend(),
+            #[cfg(feature = "executor-interrupt")]
+            PenderInner::Interrupt(x) => x.pend(),
+            #[cfg(feature = "pender-callback")]
+            PenderInner::Callback { func, context } => func(context),
+        }
+    }
+}
+
+pub(crate) struct SyncExecutor {
     run_queue: RunQueue,
-    signal_fn: fn(*mut ()),
-    signal_ctx: *mut (),
+    pender: Pender,
 
     #[cfg(feature = "integrated-timers")]
     pub(crate) timer_queue: timer_queue::TimerQueue,
@@ -275,23 +349,14 @@ pub struct Executor {
     alarm: AlarmHandle,
 }
 
-impl Executor {
-    /// Create a new executor.
-    ///
-    /// When the executor has work to do, it will call `signal_fn` with
-    /// `signal_ctx` as argument.
-    ///
-    /// See [`Executor`] docs for details on `signal_fn`.
-    pub fn new(signal_fn: fn(*mut ()), signal_ctx: *mut ()) -> Self {
+impl SyncExecutor {
+    pub(crate) fn new(pender: Pender) -> Self {
         #[cfg(feature = "integrated-timers")]
         let alarm = unsafe { unwrap!(driver::allocate_alarm()) };
-        #[cfg(feature = "integrated-timers")]
-        driver::set_alarm_callback(alarm, signal_fn, signal_ctx);
 
         Self {
             run_queue: RunQueue::new(),
-            signal_fn,
-            signal_ctx,
+            pender,
 
             #[cfg(feature = "integrated-timers")]
             timer_queue: timer_queue::TimerQueue::new(),
@@ -307,59 +372,44 @@ impl Executor {
     /// - `task` must be set up to run in this executor.
     /// - `task` must NOT be already enqueued (in this executor or another one).
     #[inline(always)]
-    unsafe fn enqueue(&self, cs: CriticalSection, task: NonNull<TaskHeader>) {
+    unsafe fn enqueue(&self, task: TaskRef) {
         #[cfg(feature = "rtos-trace")]
         trace::task_ready_begin(task.as_ptr() as u32);
 
-        if self.run_queue.enqueue(cs, task) {
-            (self.signal_fn)(self.signal_ctx)
+        if self.run_queue.enqueue(task) {
+            self.pender.pend();
         }
     }
 
-    /// Spawn a task in this executor.
-    ///
-    /// # Safety
-    ///
-    /// `task` must be a valid pointer to an initialized but not-already-spawned task.
-    ///
-    /// It is OK to use `unsafe` to call this from a thread that's not the executor thread.
-    /// In this case, the task's Future must be Send. This is because this is effectively
-    /// sending the task to the executor thread.
-    pub(super) unsafe fn spawn(&'static self, task: NonNull<TaskHeader>) {
-        task.as_ref().executor.set(self);
+    #[cfg(feature = "integrated-timers")]
+    fn alarm_callback(ctx: *mut ()) {
+        let this: &Self = unsafe { &*(ctx as *const Self) };
+        this.pender.pend();
+    }
+
+    pub(super) unsafe fn spawn(&'static self, task: TaskRef) {
+        task.header().executor.set(Some(self));
 
         #[cfg(feature = "rtos-trace")]
         trace::task_new(task.as_ptr() as u32);
 
-        critical_section::with(|cs| {
-            self.enqueue(cs, task);
-        })
+        self.enqueue(task);
     }
 
-    /// Poll all queued tasks in this executor.
-    ///
-    /// This loops over all tasks that are queued to be polled (i.e. they're
-    /// freshly spawned or they've been woken). Other tasks are not polled.
-    ///
-    /// You must call `poll` after receiving a call to `signal_fn`. It is OK
-    /// to call `poll` even when not requested by `signal_fn`, but it wastes
-    /// energy.
-    ///
     /// # Safety
     ///
-    /// You must NOT call `poll` reentrantly on the same executor.
-    ///
-    /// In particular, note that `poll` may call `signal_fn` synchronously. Therefore, you
-    /// must NOT directly call `poll()` from your `signal_fn`. Instead, `signal_fn` has to
-    /// somehow schedule for `poll()` to be called later, at a time you know for sure there's
-    /// no `poll()` already running.
-    pub unsafe fn poll(&'static self) {
+    /// Same as [`Executor::poll`], plus you must only call this on the thread this executor was created.
+    pub(crate) unsafe fn poll(&'static self) {
+        #[cfg(feature = "integrated-timers")]
+        driver::set_alarm_callback(self.alarm, Self::alarm_callback, self as *const _ as *mut ());
+
+        #[allow(clippy::never_loop)]
         loop {
             #[cfg(feature = "integrated-timers")]
             self.timer_queue.dequeue_expired(Instant::now(), |task| wake_task(task));
 
             self.run_queue.dequeue_all(|p| {
-                let task = p.as_ref();
+                let task = p.header();
 
                 #[cfg(feature = "integrated-timers")]
                 task.expires_at.set(Instant::MAX);
@@ -378,7 +428,7 @@ impl Executor {
                 trace::task_exec_begin(p.as_ptr() as u32);
 
                 // Run the task
-                task.poll_fn.read()(p as _);
+                task.poll_fn.get().unwrap_unchecked()(p);
 
                 #[cfg(feature = "rtos-trace")]
                 trace::task_exec_end();
@@ -407,6 +457,84 @@ impl Executor {
         #[cfg(feature = "rtos-trace")]
         trace::system_idle();
     }
+}
+
+/// Raw executor.
+///
+/// This is the core of the Embassy executor. It is low-level, requiring manual
+/// handling of wakeups and task polling. If you can, prefer using one of the
+/// [higher level executors](crate::Executor).
+///
+/// The raw executor leaves it up to you to handle wakeups and scheduling:
+///
+/// - To get the executor to do work, call `poll()`. This will poll all queued tasks (all tasks
+///   that "want to run").
+/// - You must supply a [`Pender`]. The executor will call it to notify you it has work
+///   to do. You must arrange for `poll()` to be called as soon as possible.
+///
+/// The [`Pender`] can be called from *any* context: any thread, any interrupt priority
+/// level, etc. It may be called synchronously from any `Executor` method call as well.
+/// You must deal with this correctly.
+///
+/// In particular, you must NOT call `poll` directly from the pender callback, as this violates
+/// the requirement for `poll` to not be called reentrantly.
+#[repr(transparent)]
+pub struct Executor {
+    pub(crate) inner: SyncExecutor,
+
+    _not_sync: PhantomData<*mut ()>,
+}
+
+impl Executor {
+    pub(crate) unsafe fn wrap(inner: &SyncExecutor) -> &Self {
+        mem::transmute(inner)
+    }
+
+    /// Create a new executor.
+    ///
+    /// When the executor has work to do, it will call the [`Pender`].
+    ///
+    /// See [`Executor`] docs for details on `Pender`.
+    pub fn new(pender: Pender) -> Self {
+        Self {
+            inner: SyncExecutor::new(pender),
+            _not_sync: PhantomData,
+        }
+    }
+
+    /// Spawn a task in this executor.
+    ///
+    /// # Safety
+    ///
+    /// `task` must be a valid pointer to an initialized but not-already-spawned task.
+    ///
+    /// It is OK to use `unsafe` to call this from a thread that's not the executor thread.
+    /// In this case, the task's Future must be Send. This is because this is effectively
+    /// sending the task to the executor thread.
+    pub(super) unsafe fn spawn(&'static self, task: TaskRef) {
+        self.inner.spawn(task)
+    }
+
+    /// Poll all queued tasks in this executor.
+    ///
+    /// This loops over all tasks that are queued to be polled (i.e. they're
+    /// freshly spawned or they've been woken). Other tasks are not polled.
+    ///
+    /// You must call `poll` after receiving a call to the [`Pender`]. It is OK
+    /// to call `poll` even when not requested by the `Pender`, but it wastes
+    /// energy.
+    ///
+    /// # Safety
+    ///
+    /// You must NOT call `poll` reentrantly on the same executor.
+    ///
+    /// In particular, note that `poll` may call the `Pender` synchronously. Therefore, you
+    /// must NOT directly call `poll()` from the `Pender` callback. Instead, the callback has to
+    /// somehow schedule for `poll()` to be called later, at a time you know for sure there's
+    /// no `poll()` already running.
+    pub unsafe fn poll(&'static self) {
+        self.inner.poll()
+    }
 
     /// Get a spawner that spawns tasks in this executor.
     ///
@@ -417,30 +545,29 @@ impl Executor {
     }
 }
 
-/// Wake a task by raw pointer.
+/// Wake a task by `TaskRef`.
 ///
-/// You can obtain task pointers from `Waker`s using [`task_from_waker`].
-///
-/// # Safety
-///
-/// `task` must be a valid task pointer obtained from [`task_from_waker`].
-pub unsafe fn wake_task(task: NonNull<TaskHeader>) {
-    critical_section::with(|cs| {
-        let header = task.as_ref();
-        let state = header.state.load(Ordering::Relaxed);
+/// You can obtain a `TaskRef` from a `Waker` using [`task_from_waker`].
+pub fn wake_task(task: TaskRef) {
+    let header = task.header();
 
+    let res = header.state.fetch_update(Ordering::SeqCst, Ordering::SeqCst, |state| {
         // If already scheduled, or if not started,
         if (state & STATE_RUN_QUEUED != 0) || (state & STATE_SPAWNED == 0) {
-            return;
+            None
+        } else {
+            // Mark it as scheduled
+            Some(state | STATE_RUN_QUEUED)
         }
+    });
 
-        // Mark it as scheduled
-        header.state.store(state | STATE_RUN_QUEUED, Ordering::Relaxed);
-
+    if res.is_ok() {
         // We have just marked the task as scheduled, so enqueue it.
-        let executor = &*header.executor.get();
-        executor.enqueue(cs, task);
-    })
+        unsafe {
+            let executor = header.executor.get().unwrap_unchecked();
+            executor.enqueue(task);
+        }
+    }
 }
 
 #[cfg(feature = "integrated-timers")]
@@ -450,9 +577,11 @@ struct TimerQueue;
 impl embassy_time::queue::TimerQueue for TimerQueue {
     fn schedule_wake(&'static self, at: Instant, waker: &core::task::Waker) {
         let task = waker::task_from_waker(waker);
-        let task = unsafe { task.as_ref() };
-        let expires_at = task.expires_at.get();
-        task.expires_at.set(expires_at.min(at));
+        let task = task.header();
+        unsafe {
+            let expires_at = task.expires_at.get();
+            task.expires_at.set(expires_at.min(at));
+        }
     }
 }
 

embassy-executor/src/raw/run_queue.rs

@@ -2,9 +2,8 @@ use core::ptr;
 use core::ptr::NonNull;
 
 use atomic_polyfill::{AtomicPtr, Ordering};
-use critical_section::CriticalSection;
 
-use super::TaskHeader;
+use super::{TaskHeader, TaskRef};
 
 pub(crate) struct RunQueueItem {
     next: AtomicPtr<TaskHeader>,
@@ -46,25 +45,33 @@ impl RunQueue {
     ///
     /// `item` must NOT be already enqueued in any queue.
     #[inline(always)]
-    pub(crate) unsafe fn enqueue(&self, _cs: CriticalSection, task: NonNull<TaskHeader>) -> bool {
-        let prev = self.head.load(Ordering::Relaxed);
-        task.as_ref().run_queue_item.next.store(prev, Ordering::Relaxed);
-        self.head.store(task.as_ptr(), Ordering::Relaxed);
-        prev.is_null()
+    pub(crate) unsafe fn enqueue(&self, task: TaskRef) -> bool {
+        let mut was_empty = false;
+
+        self.head
+            .fetch_update(Ordering::SeqCst, Ordering::SeqCst, |prev| {
+                was_empty = prev.is_null();
+                task.header().run_queue_item.next.store(prev, Ordering::Relaxed);
+                Some(task.as_ptr() as *mut _)
+            })
+            .ok();
+
+        was_empty
     }
 
     /// Empty the queue, then call `on_task` for each task that was in the queue.
     /// NOTE: It is OK for `on_task` to enqueue more tasks. In this case they're left in the queue
     /// and will be processed by the *next* call to `dequeue_all`, *not* the current one.
-    pub(crate) fn dequeue_all(&self, on_task: impl Fn(NonNull<TaskHeader>)) {
+    pub(crate) fn dequeue_all(&self, on_task: impl Fn(TaskRef)) {
         // Atomically empty the queue.
         let mut ptr = self.head.swap(ptr::null_mut(), Ordering::AcqRel);
 
         // Iterate the linked list of tasks that were previously in the queue.
         while let Some(task) = NonNull::new(ptr) {
+            let task = unsafe { TaskRef::from_ptr(task.as_ptr()) };
             // If the task re-enqueues itself, the `next` pointer will get overwritten.
             // Therefore, first read the next pointer, and only then process the task.
-            let next = unsafe { task.as_ref() }.run_queue_item.next.load(Ordering::Relaxed);
+            let next = task.header().run_queue_item.next.load(Ordering::Relaxed);
 
             on_task(task);
 

embassy-executor/src/raw/timer_queue.rs

@@ -1,45 +1,43 @@
-use core::cell::Cell;
 use core::cmp::min;
-use core::ptr;
-use core::ptr::NonNull;
 
 use atomic_polyfill::Ordering;
 use embassy_time::Instant;
 
-use super::{TaskHeader, STATE_TIMER_QUEUED};
+use super::{TaskRef, STATE_TIMER_QUEUED};
+use crate::raw::util::SyncUnsafeCell;
 
 pub(crate) struct TimerQueueItem {
-    next: Cell<*mut TaskHeader>,
+    next: SyncUnsafeCell<Option<TaskRef>>,
 }
 
 impl TimerQueueItem {
     pub const fn new() -> Self {
         Self {
-            next: Cell::new(ptr::null_mut()),
+            next: SyncUnsafeCell::new(None),
         }
     }
 }
 
 pub(crate) struct TimerQueue {
-    head: Cell<*mut TaskHeader>,
+    head: SyncUnsafeCell<Option<TaskRef>>,
 }
 
 impl TimerQueue {
     pub const fn new() -> Self {
         Self {
-            head: Cell::new(ptr::null_mut()),
+            head: SyncUnsafeCell::new(None),
         }
     }
 
-    pub(crate) unsafe fn update(&self, p: NonNull<TaskHeader>) {
-        let task = p.as_ref();
+    pub(crate) unsafe fn update(&self, p: TaskRef) {
+        let task = p.header();
         if task.expires_at.get() != Instant::MAX {
             let old_state = task.state.fetch_or(STATE_TIMER_QUEUED, Ordering::AcqRel);
             let is_new = old_state & STATE_TIMER_QUEUED == 0;
 
             if is_new {
                 task.timer_queue_item.next.set(self.head.get());
-                self.head.set(p.as_ptr());
+                self.head.set(Some(p));
             }
         }
     }
@@ -47,7 +45,7 @@ impl TimerQueue {
     pub(crate) unsafe fn next_expiration(&self) -> Instant {
         let mut res = Instant::MAX;
         self.retain(|p| {
-            let task = p.as_ref();
+            let task = p.header();
             let expires = task.expires_at.get();
             res = min(res, expires);
             expires != Instant::MAX
@@ -55,9 +53,9 @@ impl TimerQueue {
         res
     }
 
-    pub(crate) unsafe fn dequeue_expired(&self, now: Instant, on_task: impl Fn(NonNull<TaskHeader>)) {
+    pub(crate) unsafe fn dequeue_expired(&self, now: Instant, on_task: impl Fn(TaskRef)) {
         self.retain(|p| {
-            let task = p.as_ref();
+            let task = p.header();
             if task.expires_at.get() <= now {
                 on_task(p);
                 false
@@ -67,11 +65,10 @@ impl TimerQueue {
         });
     }
 
-    pub(crate) unsafe fn retain(&self, mut f: impl FnMut(NonNull<TaskHeader>) -> bool) {
+    pub(crate) unsafe fn retain(&self, mut f: impl FnMut(TaskRef) -> bool) {
         let mut prev = &self.head;
-        while !prev.get().is_null() {
-            let p = NonNull::new_unchecked(prev.get());
-            let task = &*p.as_ptr();
+        while let Some(p) = prev.get() {
+            let task = p.header();
             if f(p) {
                 // Skip to next
                 prev = &task.timer_queue_item.next;

embassy-executor/src/raw/util.rs

@@ -26,8 +26,31 @@ impl<T> UninitCell<T> {
     }
 }
 
-impl<T: Copy> UninitCell<T> {
-    pub unsafe fn read(&self) -> T {
-        ptr::read(self.as_mut_ptr())
+unsafe impl<T> Sync for UninitCell<T> {}
+
+#[repr(transparent)]
+pub struct SyncUnsafeCell<T> {
+    value: UnsafeCell<T>,
+}
+
+unsafe impl<T: Sync> Sync for SyncUnsafeCell<T> {}
+
+impl<T> SyncUnsafeCell<T> {
+    #[inline]
+    pub const fn new(value: T) -> Self {
+        Self {
+            value: UnsafeCell::new(value),
+        }
+    }
+
+    pub unsafe fn set(&self, value: T) {
+        *self.value.get() = value;
+    }
+
+    pub unsafe fn get(&self) -> T
+    where
+        T: Copy,
+    {
+        *self.value.get()
     }
 }

embassy-executor/src/raw/waker.rs

@@ -1,8 +1,7 @@
 use core::mem;
-use core::ptr::NonNull;
 use core::task::{RawWaker, RawWakerVTable, Waker};
 
-use super::{wake_task, TaskHeader};
+use super::{wake_task, TaskHeader, TaskRef};
 
 const VTABLE: RawWakerVTable = RawWakerVTable::new(clone, wake, wake, drop);
 
@@ -11,14 +10,14 @@ unsafe fn clone(p: *const ()) -> RawWaker {
 }
 
 unsafe fn wake(p: *const ()) {
-    wake_task(NonNull::new_unchecked(p as *mut TaskHeader))
+    wake_task(TaskRef::from_ptr(p as *const TaskHeader))
 }
 
 unsafe fn drop(_: *const ()) {
     // nop
 }
 
-pub(crate) unsafe fn from_task(p: NonNull<TaskHeader>) -> Waker {
+pub(crate) unsafe fn from_task(p: TaskRef) -> Waker {
     Waker::from_raw(RawWaker::new(p.as_ptr() as _, &VTABLE))
 }
 
@@ -33,7 +32,7 @@ pub(crate) unsafe fn from_task(p: NonNull<TaskHeader>) -> Waker {
 /// # Panics
 ///
 /// Panics if the waker is not created by the Embassy executor.
-pub fn task_from_waker(waker: &Waker) -> NonNull<TaskHeader> {
+pub fn task_from_waker(waker: &Waker) -> TaskRef {
     // safety: OK because WakerHack has the same layout as Waker.
     // This is not really guaranteed because the structs are `repr(Rust)`, it is
     // indeed the case in the current implementation.
@@ -43,8 +42,8 @@ pub fn task_from_waker(waker: &Waker) -> NonNull<TaskHeader> {
         panic!("Found waker not created by the Embassy executor. `embassy_time::Timer` only works with the Embassy executor.")
     }
 
-    // safety: we never create a waker with a null data pointer.
-    unsafe { NonNull::new_unchecked(hack.data as *mut TaskHeader) }
+    // safety: our wakers are always created with `TaskRef::as_ptr`
+    unsafe { TaskRef::from_ptr(hack.data as *const TaskHeader) }
 }
 
 struct WakerHack {

embassy-executor/src/raw/waker_turbo.rs

@@ -0,0 +1,34 @@
+use core::ptr::NonNull;
+use core::task::Waker;
+
+use super::{wake_task, TaskHeader, TaskRef};
+
+pub(crate) unsafe fn from_task(p: TaskRef) -> Waker {
+    Waker::from_turbo_ptr(NonNull::new_unchecked(p.as_ptr() as _))
+}
+
+/// Get a task pointer from a waker.
+///
+/// This can be used as an optimization in wait queues to store task pointers
+/// (1 word) instead of full Wakers (2 words). This saves a bit of RAM and helps
+/// avoid dynamic dispatch.
+///
+/// You can use the returned task pointer to wake the task with [`wake_task`](super::wake_task).
+///
+/// # Panics
+///
+/// Panics if the waker is not created by the Embassy executor.
+pub fn task_from_waker(waker: &Waker) -> TaskRef {
+    let ptr = waker.as_turbo_ptr().as_ptr();
+
+    // safety: our wakers are always created with `TaskRef::as_ptr`
+    unsafe { TaskRef::from_ptr(ptr as *const TaskHeader) }
+}
+
+#[inline(never)]
+#[no_mangle]
+fn _turbo_wake(ptr: NonNull<()>) {
+    // safety: our wakers are always created with `TaskRef::as_ptr`
+    let task = unsafe { TaskRef::from_ptr(ptr.as_ptr() as *const TaskHeader) };
+    wake_task(task)
+}

embassy-executor/src/spawner.rs

@@ -1,7 +1,6 @@
 use core::future::poll_fn;
 use core::marker::PhantomData;
 use core::mem;
-use core::ptr::NonNull;
 use core::task::Poll;
 
 use super::raw;
@@ -22,12 +21,12 @@ use super::raw;
 /// Once you've invoked a task function and obtained a SpawnToken, you *must* spawn it.
 #[must_use = "Calling a task function does nothing on its own. You must spawn the returned SpawnToken, typically with Spawner::spawn()"]
 pub struct SpawnToken<S> {
-    raw_task: Option<NonNull<raw::TaskHeader>>,
+    raw_task: Option<raw::TaskRef>,
     phantom: PhantomData<*mut S>,
 }
 
 impl<S> SpawnToken<S> {
-    pub(crate) unsafe fn new(raw_task: NonNull<raw::TaskHeader>) -> Self {
+    pub(crate) unsafe fn new(raw_task: raw::TaskRef) -> Self {
         Self {
             raw_task: Some(raw_task),
             phantom: PhantomData,
@@ -90,10 +89,11 @@ impl Spawner {
     ///
     /// Panics if the current executor is not an Embassy executor.
     pub async fn for_current_executor() -> Self {
-        poll_fn(|cx| unsafe {
+        poll_fn(|cx| {
             let task = raw::task_from_waker(cx.waker());
-            let executor = (*task.as_ptr()).executor.get();
-            Poll::Ready(Self::new(&*executor))
+            let executor = unsafe { task.header().executor.get().unwrap_unchecked() };
+            let executor = unsafe { raw::Executor::wrap(executor) };
+            Poll::Ready(Self::new(executor))
         })
         .await
     }
@@ -131,9 +131,7 @@ impl Spawner {
     /// spawner to other threads, but the spawner loses the ability to spawn
     /// non-Send tasks.
     pub fn make_send(&self) -> SendSpawner {
-        SendSpawner {
-            executor: self.executor,
-        }
+        SendSpawner::new(&self.executor.inner)
     }
 }
 
@@ -146,14 +144,11 @@ impl Spawner {
 /// If you want to spawn non-Send tasks, use [Spawner].
 #[derive(Copy, Clone)]
 pub struct SendSpawner {
-    executor: &'static raw::Executor,
+    executor: &'static raw::SyncExecutor,
 }
 
-unsafe impl Send for SendSpawner {}
-unsafe impl Sync for SendSpawner {}
-
 impl SendSpawner {
-    pub(crate) fn new(executor: &'static raw::Executor) -> Self {
+    pub(crate) fn new(executor: &'static raw::SyncExecutor) -> Self {
         Self { executor }
     }
 
@@ -166,10 +161,10 @@ impl SendSpawner {
     ///
     /// Panics if the current executor is not an Embassy executor.
     pub async fn for_current_executor() -> Self {
-        poll_fn(|cx| unsafe {
+        poll_fn(|cx| {
             let task = raw::task_from_waker(cx.waker());
-            let executor = (*task.as_ptr()).executor.get();
-            Poll::Ready(Self::new(&*executor))
+            let executor = unsafe { task.header().executor.get().unwrap_unchecked() };
+            Poll::Ready(Self::new(executor))
         })
         .await
     }

embassy-futures/src/yield_now.rs

@@ -24,6 +24,7 @@ pub fn yield_now() -> impl Future<Output = ()> {
     YieldNowFuture { yielded: false }
 }
 
+#[must_use = "futures do nothing unless you `.await` or poll them"]
 struct YieldNowFuture {
     yielded: bool,
 }

embassy-hal-common/src/atomic_ring_buffer.rs

@@ -0,0 +1,558 @@
+use core::slice;
+use core::sync::atomic::{AtomicPtr, AtomicUsize, Ordering};
+
+/// Atomic reusable ringbuffer
+///
+/// This ringbuffer implementation is designed to be stored in a `static`,
+/// therefore all methods take `&self` and not `&mut self`.
+///
+/// It is "reusable": when created it has no backing buffer, you can give it
+/// one with `init` and take it back with `deinit`, and init it again in the
+/// future if needed. This is very non-idiomatic, but helps a lot when storing
+/// it in a `static`.
+///
+/// One concurrent writer and one concurrent reader are supported, even at
+/// different execution priorities (like main and irq).
+pub struct RingBuffer {
+    pub buf: AtomicPtr<u8>,
+    pub len: AtomicUsize,
+
+    // start and end wrap at len*2, not at len.
+    // This allows distinguishing "full" and "empty".
+    // full is when start+len == end (modulo len*2)
+    // empty is when start == end
+    //
+    // This avoids having to consider the ringbuffer "full" at len-1 instead of len.
+    // The usual solution is adding a "full" flag, but that can't be made atomic
+    pub start: AtomicUsize,
+    pub end: AtomicUsize,
+}
+
+pub struct Reader<'a>(&'a RingBuffer);
+pub struct Writer<'a>(&'a RingBuffer);
+
+impl RingBuffer {
+    /// Create a new empty ringbuffer.
+    pub const fn new() -> Self {
+        Self {
+            buf: AtomicPtr::new(core::ptr::null_mut()),
+            len: AtomicUsize::new(0),
+            start: AtomicUsize::new(0),
+            end: AtomicUsize::new(0),
+        }
+    }
+
+    /// Initialize the ring buffer with a buffer.
+    ///
+    /// # Safety
+    /// - The buffer (`buf .. buf+len`) must be valid memory until `deinit` is called.
+    /// - Must not be called concurrently with any other methods.
+    pub unsafe fn init(&self, buf: *mut u8, len: usize) {
+        // Ordering: it's OK to use `Relaxed` because this is not called
+        // concurrently with other methods.
+        self.buf.store(buf, Ordering::Relaxed);
+        self.len.store(len, Ordering::Relaxed);
+        self.start.store(0, Ordering::Relaxed);
+        self.end.store(0, Ordering::Relaxed);
+    }
+
+    /// Deinitialize the ringbuffer.
+    ///
+    /// After calling this, the ringbuffer becomes empty, as if it was
+    /// just created with `new()`.
+    ///
+    /// # Safety
+    /// - Must not be called concurrently with any other methods.
+    pub unsafe fn deinit(&self) {
+        // Ordering: it's OK to use `Relaxed` because this is not called
+        // concurrently with other methods.
+        self.len.store(0, Ordering::Relaxed);
+        self.start.store(0, Ordering::Relaxed);
+        self.end.store(0, Ordering::Relaxed);
+    }
+
+    /// Create a reader.
+    ///
+    /// # Safety
+    ///
+    /// Only one reader can exist at a time.
+    pub unsafe fn reader(&self) -> Reader<'_> {
+        Reader(self)
+    }
+
+    /// Create a writer.
+    ///
+    /// # Safety
+    ///
+    /// Only one writer can exist at a time.
+    pub unsafe fn writer(&self) -> Writer<'_> {
+        Writer(self)
+    }
+
+    pub fn len(&self) -> usize {
+        self.len.load(Ordering::Relaxed)
+    }
+
+    pub fn is_full(&self) -> bool {
+        let len = self.len.load(Ordering::Relaxed);
+        let start = self.start.load(Ordering::Relaxed);
+        let end = self.end.load(Ordering::Relaxed);
+
+        self.wrap(start + len) == end
+    }
+
+    pub fn is_empty(&self) -> bool {
+        let start = self.start.load(Ordering::Relaxed);
+        let end = self.end.load(Ordering::Relaxed);
+
+        start == end
+    }
+
+    fn wrap(&self, mut n: usize) -> usize {
+        let len = self.len.load(Ordering::Relaxed);
+
+        if n >= len * 2 {
+            n -= len * 2
+        }
+        n
+    }
+}
+
+impl<'a> Writer<'a> {
+    /// Push data into the buffer in-place.
+    ///
+    /// The closure `f` is called with a free part of the buffer, it must write
+    /// some data to it and return the amount of bytes written.
+    pub fn push(&mut self, f: impl FnOnce(&mut [u8]) -> usize) -> usize {
+        let (p, n) = self.push_buf();
+        let buf = unsafe { slice::from_raw_parts_mut(p, n) };
+        let n = f(buf);
+        self.push_done(n);
+        n
+    }
+
+    /// Push one data byte.
+    ///
+    /// Returns true if pushed succesfully.
+    pub fn push_one(&mut self, val: u8) -> bool {
+        let n = self.push(|f| match f {
+            [] => 0,
+            [x, ..] => {
+                *x = val;
+                1
+            }
+        });
+        n != 0
+    }
+
+    /// Get a buffer where data can be pushed to.
+    ///
+    /// Equivalent to [`Self::push_buf`] but returns a slice.
+    pub fn push_slice(&mut self) -> &mut [u8] {
+        let (data, len) = self.push_buf();
+        unsafe { slice::from_raw_parts_mut(data, len) }
+    }
+
+    /// Get up to two buffers where data can be pushed to.
+    ///
+    /// Equivalent to [`Self::push_bufs`] but returns slices.
+    pub fn push_slices(&mut self) -> [&mut [u8]; 2] {
+        let [(d0, l0), (d1, l1)] = self.push_bufs();
+        unsafe { [slice::from_raw_parts_mut(d0, l0), slice::from_raw_parts_mut(d1, l1)] }
+    }
+
+    /// Get a buffer where data can be pushed to.
+    ///
+    /// Write data to the start of the buffer, then call `push_done` with
+    /// however many bytes you've pushed.
+    ///
+    /// The buffer is suitable to DMA to.
+    ///
+    /// If the ringbuf is full, size=0 will be returned.
+    ///
+    /// The buffer stays valid as long as no other `Writer` method is called
+    /// and `init`/`deinit` aren't called on the ringbuf.
+    pub fn push_buf(&mut self) -> (*mut u8, usize) {
+        // Ordering: popping writes `start` last, so we read `start` first.
+        // Read it with Acquire ordering, so that the next accesses can't be reordered up past it.
+        let mut start = self.0.start.load(Ordering::Acquire);
+        let buf = self.0.buf.load(Ordering::Relaxed);
+        let len = self.0.len.load(Ordering::Relaxed);
+        let mut end = self.0.end.load(Ordering::Relaxed);
+
+        let empty = start == end;
+
+        if start >= len {
+            start -= len
+        }
+        if end >= len {
+            end -= len
+        }
+
+        if start == end && !empty {
+            // full
+            return (buf, 0);
+        }
+        let n = if start > end { start - end } else { len - end };
+
+        trace!("  ringbuf: push_buf {:?}..{:?}", end, end + n);
+        (unsafe { buf.add(end) }, n)
+    }
+
+    /// Get up to two buffers where data can be pushed to.
+    ///
+    /// Write data starting at the beginning of the first buffer, then call
+    /// `push_done` with however many bytes you've pushed.
+    ///
+    /// The buffers are suitable to DMA to.
+    ///
+    /// If the ringbuf is full, both buffers will be zero length.
+    /// If there is only area available, the second buffer will be zero length.
+    ///
+    /// The buffer stays valid as long as no other `Writer` method is called
+    /// and `init`/`deinit` aren't called on the ringbuf.
+    pub fn push_bufs(&mut self) -> [(*mut u8, usize); 2] {
+        // Ordering: as per push_buf()
+        let mut start = self.0.start.load(Ordering::Acquire);
+        let buf = self.0.buf.load(Ordering::Relaxed);
+        let len = self.0.len.load(Ordering::Relaxed);
+        let mut end = self.0.end.load(Ordering::Relaxed);
+
+        let empty = start == end;
+
+        if start >= len {
+            start -= len
+        }
+        if end >= len {
+            end -= len
+        }
+
+        if start == end && !empty {
+            // full
+            return [(buf, 0), (buf, 0)];
+        }
+        let n0 = if start > end { start - end } else { len - end };
+        let n1 = if start <= end { start } else { 0 };
+
+        trace!("  ringbuf: push_bufs [{:?}..{:?}, {:?}..{:?}]", end, end + n0, 0, n1);
+        [(unsafe { buf.add(end) }, n0), (buf, n1)]
+    }
+
+    pub fn push_done(&mut self, n: usize) {
+        trace!("  ringbuf: push {:?}", n);
+        let end = self.0.end.load(Ordering::Relaxed);
+
+        // Ordering: write `end` last, with Release ordering.
+        // The ordering ensures no preceding memory accesses (such as writing
+        // the actual data in the buffer) can be reordered down past it, which
+        // will guarantee the reader sees them after reading from `end`.
+        self.0.end.store(self.0.wrap(end + n), Ordering::Release);
+    }
+}
+
+impl<'a> Reader<'a> {
+    /// Pop data from the buffer in-place.
+    ///
+    /// The closure `f` is called with the next data, it must process
+    /// some data from it and return the amount of bytes processed.
+    pub fn pop(&mut self, f: impl FnOnce(&[u8]) -> usize) -> usize {
+        let (p, n) = self.pop_buf();
+        let buf = unsafe { slice::from_raw_parts(p, n) };
+        let n = f(buf);
+        self.pop_done(n);
+        n
+    }
+
+    /// Pop one data byte.
+    ///
+    /// Returns true if popped succesfully.
+    pub fn pop_one(&mut self) -> Option<u8> {
+        let mut res = None;
+        self.pop(|f| match f {
+            &[] => 0,
+            &[x, ..] => {
+                res = Some(x);
+                1
+            }
+        });
+        res
+    }
+
+    /// Get a buffer where data can be popped from.
+    ///
+    /// Equivalent to [`Self::pop_buf`] but returns a slice.
+    pub fn pop_slice(&mut self) -> &mut [u8] {
+        let (data, len) = self.pop_buf();
+        unsafe { slice::from_raw_parts_mut(data, len) }
+    }
+
+    /// Get a buffer where data can be popped from.
+    ///
+    /// Read data from the start of the buffer, then call `pop_done` with
+    /// however many bytes you've processed.
+    ///
+    /// The buffer is suitable to DMA from.
+    ///
+    /// If the ringbuf is empty, size=0 will be returned.
+    ///
+    /// The buffer stays valid as long as no other `Reader` method is called
+    /// and `init`/`deinit` aren't called on the ringbuf.
+    pub fn pop_buf(&mut self) -> (*mut u8, usize) {
+        // Ordering: pushing writes `end` last, so we read `end` first.
+        // Read it with Acquire ordering, so that the next accesses can't be reordered up past it.
+        // This is needed to guarantee we "see" the data written by the writer.
+        let mut end = self.0.end.load(Ordering::Acquire);
+        let buf = self.0.buf.load(Ordering::Relaxed);
+        let len = self.0.len.load(Ordering::Relaxed);
+        let mut start = self.0.start.load(Ordering::Relaxed);
+
+        if start == end {
+            return (buf, 0);
+        }
+
+        if start >= len {
+            start -= len
+        }
+        if end >= len {
+            end -= len
+        }
+
+        let n = if end > start { end - start } else { len - start };
+
+        trace!("  ringbuf: pop_buf {:?}..{:?}", start, start + n);
+        (unsafe { buf.add(start) }, n)
+    }
+
+    pub fn pop_done(&mut self, n: usize) {
+        trace!("  ringbuf: pop {:?}", n);
+
+        let start = self.0.start.load(Ordering::Relaxed);
+
+        // Ordering: write `start` last, with Release ordering.
+        // The ordering ensures no preceding memory accesses (such as reading
+        // the actual data) can be reordered down past it. This is necessary
+        // because writing to `start` is effectively freeing the read part of the
+        // buffer, which "gives permission" to the writer to write to it again.
+        // Therefore, all buffer accesses must be completed before this.
+        self.0.start.store(self.0.wrap(start + n), Ordering::Release);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn push_pop() {
+        let mut b = [0; 4];
+        let rb = RingBuffer::new();
+        unsafe {
+            rb.init(b.as_mut_ptr(), 4);
+
+            assert_eq!(rb.is_empty(), true);
+            assert_eq!(rb.is_full(), false);
+
+            rb.writer().push(|buf| {
+                assert_eq!(4, buf.len());
+                buf[0] = 1;
+                buf[1] = 2;
+                buf[2] = 3;
+                buf[3] = 4;
+                4
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), true);
+
+            rb.writer().push(|buf| {
+                // If it's full, we can push 0 bytes.
+                assert_eq!(0, buf.len());
+                0
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), true);
+
+            rb.reader().pop(|buf| {
+                assert_eq!(4, buf.len());
+                assert_eq!(1, buf[0]);
+                1
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), false);
+
+            rb.reader().pop(|buf| {
+                assert_eq!(3, buf.len());
+                0
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), false);
+
+            rb.reader().pop(|buf| {
+                assert_eq!(3, buf.len());
+                assert_eq!(2, buf[0]);
+                assert_eq!(3, buf[1]);
+                2
+            });
+            rb.reader().pop(|buf| {
+                assert_eq!(1, buf.len());
+                assert_eq!(4, buf[0]);
+                1
+            });
+
+            assert_eq!(rb.is_empty(), true);
+            assert_eq!(rb.is_full(), false);
+
+            rb.reader().pop(|buf| {
+                assert_eq!(0, buf.len());
+                0
+            });
+
+            rb.writer().push(|buf| {
+                assert_eq!(4, buf.len());
+                buf[0] = 10;
+                1
+            });
+
+            rb.writer().push(|buf| {
+                assert_eq!(3, buf.len());
+                buf[0] = 11;
+                buf[1] = 12;
+                2
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), false);
+
+            rb.writer().push(|buf| {
+                assert_eq!(1, buf.len());
+                buf[0] = 13;
+                1
+            });
+
+            assert_eq!(rb.is_empty(), false);
+            assert_eq!(rb.is_full(), true);
+        }
+    }
+
+    #[test]
+    fn zero_len() {
+        let rb = RingBuffer::new();
+        unsafe {
+            assert_eq!(rb.is_empty(), true);
+            assert_eq!(rb.is_full(), true);
+
+            rb.writer().push(|buf| {
+                assert_eq!(0, buf.len());
+                0
+            });
+
+            rb.reader().pop(|buf| {
+                assert_eq!(0, buf.len());
+                0
+            });
+        }
+    }
+
+    #[test]
+    fn push_slices() {
+        init();
+
+        let mut b = [0; 4];
+        let rb = RingBuffer::new();
+        unsafe {
+            rb.init(b.as_mut_ptr(), 4);
+
+            /* push 3 -> [1 2 3 x] */
+            let mut w = rb.writer();
+            let ps = w.push_slices();
+            assert_eq!(4, ps[0].len());
+            assert_eq!(0, ps[1].len());
+            ps[0][0] = 1;
+            ps[0][1] = 2;
+            ps[0][2] = 3;
+            w.push_done(3);
+            drop(w);
+
+            /* pop 2 -> [x x 3 x] */
+            rb.reader().pop(|buf| {
+                assert_eq!(3, buf.len());
+                assert_eq!(1, buf[0]);
+                assert_eq!(2, buf[1]);
+                assert_eq!(3, buf[2]);
+                2
+            });
+
+            /* push 3 -> [5 6 3 4] */
+            let mut w = rb.writer();
+            let ps = w.push_slices();
+            assert_eq!(1, ps[0].len());
+            assert_eq!(2, ps[1].len());
+            ps[0][0] = 4;
+            ps[1][0] = 5;
+            ps[1][1] = 6;
+            w.push_done(3);
+            drop(w);
+
+            /* buf is now full */
+            let mut w = rb.writer();
+            let ps = w.push_slices();
+            assert_eq!(0, ps[0].len());
+            assert_eq!(0, ps[1].len());
+
+            /* pop 2 -> [5 6 x x] */
+            rb.reader().pop(|buf| {
+                assert_eq!(2, buf.len());
+                assert_eq!(3, buf[0]);
+                assert_eq!(4, buf[1]);
+                2
+            });
+
+            /* should now have one push slice again */
+            let mut w = rb.writer();
+            let ps = w.push_slices();
+            assert_eq!(2, ps[0].len());
+            assert_eq!(0, ps[1].len());
+            drop(w);
+
+            /* pop 2 -> [x x x x] */
+            rb.reader().pop(|buf| {
+                assert_eq!(2, buf.len());
+                assert_eq!(5, buf[0]);
+                assert_eq!(6, buf[1]);
+                2
+            });
+
+            /* should now have two push slices */
+            let mut w = rb.writer();
+            let ps = w.push_slices();
+            assert_eq!(2, ps[0].len());
+            assert_eq!(2, ps[1].len());
+            drop(w);
+
+            /* make sure we exercise all wrap around cases properly */
+            for _ in 0..10 {
+                /* should be empty, push 1 */
+                let mut w = rb.writer();
+                let ps = w.push_slices();
+                assert_eq!(4, ps[0].len() + ps[1].len());
+                w.push_done(1);
+                drop(w);
+
+                /* should have 1 element */
+                let mut w = rb.writer();
+                let ps = w.push_slices();
+                assert_eq!(3, ps[0].len() + ps[1].len());
+                drop(w);
+
+                /* pop 1 */
+                rb.reader().pop(|buf| {
+                    assert_eq!(1, buf.len());
+                    1
+                });
+            }
+        }
+    }
+}

embassy-hal-common/src/drop.rs

@@ -1,6 +1,7 @@
 use core::mem;
 use core::mem::MaybeUninit;
 
+#[must_use = "to delay the drop handler invokation to the end of the scope"]
 pub struct OnDrop<F: FnOnce()> {
     f: MaybeUninit<F>,
 }
@@ -27,6 +28,7 @@ impl<F: FnOnce()> Drop for OnDrop<F> {
 ///
 /// To correctly dispose of this device, call the [defuse](struct.DropBomb.html#method.defuse)
 /// method before this object is dropped.
+#[must_use = "to delay the drop bomb invokation to the end of the scope"]
 pub struct DropBomb {
     _private: (),
 }

embassy-hal-common/src/lib.rs

@@ -4,6 +4,7 @@
 // This mod MUST go first, so that the others see its macros.
 pub(crate) mod fmt;
 
+pub mod atomic_ring_buffer;
 pub mod drop;
 mod macros;
 mod peripheral;

embassy-hal-common/src/macros.rs

@@ -1,10 +1,12 @@
 #[macro_export]
 macro_rules! peripherals {
     ($($(#[$cfg:meta])? $name:ident),*$(,)?) => {
+        /// Types for the peripheral singletons.
         pub mod peripherals {
             $(
                 $(#[$cfg])?
                 #[allow(non_camel_case_types)]
+                #[doc = concat!(stringify!($name), " peripheral")]
                 pub struct $name { _private: () }
 
                 $(#[$cfg])?
@@ -25,9 +27,13 @@ macro_rules! peripherals {
             )*
         }
 
+        /// Struct containing all the peripheral singletons.
+        ///
+        /// To obtain the peripherals, you must initialize the HAL, by calling [`crate::init`].
         #[allow(non_snake_case)]
         pub struct Peripherals {
             $(
+                #[doc = concat!(stringify!($name), " peripheral")]
                 $(#[$cfg])?
                 pub $name: peripherals::$name,
             )*
@@ -86,7 +92,7 @@ macro_rules! impl_peripheral {
             type P = $type;
 
             #[inline]
-            unsafe fn clone_unchecked(&mut self) -> Self::P {
+            unsafe fn clone_unchecked(&self) -> Self::P {
                 $type { ..*self }
             }
         }

embassy-hal-common/src/peripheral.rs

@@ -3,16 +3,17 @@ use core::ops::{Deref, DerefMut};
 
 /// An exclusive reference to a peripheral.
 ///
-/// This is functionally the same as a `&'a mut T`. The reason for having a
-/// dedicated struct is memory efficiency:
+/// This is functionally the same as a `&'a mut T`. There's a few advantages in having
+/// a dedicated struct instead:
 ///
-/// Peripheral singletons are typically either zero-sized (for concrete peripherals
-/// like `PA9` or `Spi4`) or very small (for example `AnyPin` which is 1 byte).
-/// However `&mut T` is always 4 bytes for 32-bit targets, even if T is zero-sized.
-/// PeripheralRef stores a copy of `T` instead, so it's the same size.
-///
-/// but it is the size of `T` not the size
-/// of a pointer. This is useful if T is a zero sized type.
+/// - Memory efficiency: Peripheral singletons are typically either zero-sized (for concrete
+///   peripherals like `PA9` or `SPI4`) or very small (for example `AnyPin`, which is 1 byte).
+///   However `&mut T` is always 4 bytes for 32-bit targets, even if T is zero-sized.
+///   PeripheralRef stores a copy of `T` instead, so it's the same size.
+/// - Code size efficiency. If the user uses the same driver with both `SPI4` and `&mut SPI4`,
+///   the driver code would be monomorphized two times. With PeripheralRef, the driver is generic
+///   over a lifetime only. `SPI4` becomes `PeripheralRef<'static, SPI4>`, and `&mut SPI4` becomes
+///   `PeripheralRef<'a, SPI4>`. Lifetimes don't cause monomorphization.
 pub struct PeripheralRef<'a, T> {
     inner: T,
     _lifetime: PhantomData<&'a mut T>,
@@ -38,7 +39,7 @@ impl<'a, T> PeripheralRef<'a, T> {
     /// You should strongly prefer using `reborrow()` instead. It returns a
     /// `PeripheralRef` that borrows `self`, which allows the borrow checker
     /// to enforce this at compile time.
-    pub unsafe fn clone_unchecked(&mut self) -> PeripheralRef<'a, T>
+    pub unsafe fn clone_unchecked(&self) -> PeripheralRef<'a, T>
     where
         T: Peripheral<P = T>,
     {
@@ -145,14 +146,14 @@ pub trait Peripheral: Sized {
     ///
     /// You should strongly prefer using `into_ref()` instead. It returns a
     /// `PeripheralRef`, which allows the borrow checker to enforce this at compile time.
-    unsafe fn clone_unchecked(&mut self) -> Self::P;
+    unsafe fn clone_unchecked(&self) -> Self::P;
 
     /// Convert a value into a `PeripheralRef`.
     ///
     /// When called on an owned `T`, yields a `PeripheralRef<'static, T>`.
     /// When called on an `&'a mut T`, yields a `PeripheralRef<'a, T>`.
     #[inline]
-    fn into_ref<'a>(mut self) -> PeripheralRef<'a, Self::P>
+    fn into_ref<'a>(self) -> PeripheralRef<'a, Self::P>
     where
         Self: 'a,
     {
@@ -160,14 +161,14 @@ pub trait Peripheral: Sized {
     }
 }
 
-impl<'b, T: DerefMut> Peripheral for T
+impl<'b, T: Deref> Peripheral for T
 where
     T::Target: Peripheral,
 {
     type P = <T::Target as Peripheral>::P;
 
     #[inline]
-    unsafe fn clone_unchecked(&mut self) -> Self::P {
-        self.deref_mut().clone_unchecked()
+    unsafe fn clone_unchecked(&self) -> Self::P {
+        self.deref().clone_unchecked()
     }
 }

embassy-lora/Cargo.toml

@@ -9,9 +9,9 @@ src_base = "https://github.com/embassy-rs/embassy/blob/embassy-lora-v$VERSION/em
 src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-lora/src/"
 features = ["time", "defmt"]
 flavors = [
-    { name = "sx126x", target = "thumbv7em-none-eabihf",   features = ["sx126x"] },
-    { name = "sx127x",  target = "thumbv7em-none-eabihf", features = ["sx127x", "embassy-stm32/stm32wl55jc-cm4", "embassy-stm32/time-driver-any"] },
-    { name = "stm32wl", target = "thumbv7em-none-eabihf", features = ["stm32wl", "embassy-stm32/stm32wl55jc-cm4", "embassy-stm32/time-driver-any"] },
+    { name = "sx126x",  target = "thumbv7em-none-eabihf", features = ["sx126x"] },
+    { name = "sx127x",  target = "thumbv7em-none-eabihf", features = ["sx127x"] },
+    { name = "stm32wl", target = "thumbv7em-none-eabihf", features = ["stm32wl", "embassy-stm32?/stm32wl55jc-cm4", "embassy-stm32?/time-driver-any"] },
 ]
 
 [lib]
@@ -19,7 +19,7 @@ flavors = [
 [features]
 sx126x = []
 sx127x = []
-stm32wl = ["embassy-stm32", "embassy-stm32/subghz"]
+stm32wl = ["dep:embassy-stm32"]
 time = []
 defmt = ["dep:defmt", "lorawan/defmt", "lorawan-device/defmt"]
 
@@ -29,10 +29,10 @@ defmt = { version = "0.3", optional = true }
 log = { version = "0.4.14", optional = true }
 
 embassy-time = { version = "0.1.0", path = "../embassy-time" }
-embassy-sync = { version = "0.1.0", path = "../embassy-sync" }
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
 embassy-stm32 = { version = "0.1.0", path = "../embassy-stm32", default-features = false, optional = true }
-embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.9" }
-embedded-hal-async = { version = "=0.1.0-alpha.3" }
+embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.10" }
+embedded-hal-async = { version = "=0.2.0-alpha.1" }
 embassy-hal-common = { version = "0.1.0", path = "../embassy-hal-common", default-features = false }
 futures = { version = "0.3.17", default-features = false, features = [ "async-await" ] }
 embedded-hal = { version = "0.2", features = ["unproven"] }

embassy-lora/src/stm32wl/mod.rs

@@ -70,7 +70,7 @@ impl<'d, RS: RadioSwitch> SubGhzRadio<'d, RS> {
     /// Perform a transmission with the given parameters and payload. Returns any time adjustements needed form
     /// the upcoming RX window start.
     async fn do_tx(&mut self, config: TxConfig, buf: &[u8]) -> Result<u32, RadioError> {
-        trace!("TX request: {}", config);
+        trace!("TX request: {:?}", config);
         self.switch.set_tx();
 
         self.radio
@@ -130,7 +130,7 @@ impl<'d, RS: RadioSwitch> SubGhzRadio<'d, RS> {
     /// be able to hold a single LoRaWAN packet.
     async fn do_rx(&mut self, config: RfConfig, buf: &mut [u8]) -> Result<(usize, RxQuality), RadioError> {
         assert!(buf.len() >= 255);
-        trace!("RX request: {}", config);
+        trace!("RX request: {:?}", config);
         self.switch.set_rx();
 
         self.radio.set_rf_frequency(&RfFreq::from_frequency(config.frequency))?;
@@ -172,7 +172,11 @@ impl<'d, RS: RadioSwitch> SubGhzRadio<'d, RS> {
                 self.radio.read_buffer(ptr, &mut buf[..len as usize])?;
                 self.radio.set_standby(StandbyClk::Rc)?;
 
+                #[cfg(feature = "defmt")]
                 trace!("RX done: {=[u8]:#02X}", &mut buf[..len as usize]);
+
+                #[cfg(feature = "log")]
+                trace!("RX done: {:02x?}", &mut buf[..len as usize]);
                 return Ok((len as usize, RxQuality::new(rssi, snr as i8)));
             }
 
@@ -193,7 +197,7 @@ impl<'d, RS: RadioSwitch> SubGhzRadio<'d, RS> {
                 .clear_irq_status(irq_status)
                 .expect("error clearing irq status");
 
-            trace!("SUGHZ IRQ 0b{=u16:b}, {:?}", irq_status, status);
+            trace!("SUGHZ IRQ 0b{:016b}, {:?}", irq_status, status);
 
             if irq_status == 0 {
                 Poll::Pending
@@ -256,10 +260,10 @@ impl From<embassy_stm32::spi::Error> for RadioError {
 
 impl<'d, RS> Timings for SubGhzRadio<'d, RS> {
     fn get_rx_window_offset_ms(&self) -> i32 {
-        -500
+        -3
     }
     fn get_rx_window_duration_ms(&self) -> u32 {
-        3000
+        1003
     }
 }
 

embassy-lora/src/sx126x/mod.rs

@@ -55,10 +55,10 @@ where
     BUS: Error + Format + 'static,
 {
     fn get_rx_window_offset_ms(&self) -> i32 {
-        -500
+        -50
     }
     fn get_rx_window_duration_ms(&self) -> u32 {
-        800
+        1050
     }
 }
 
@@ -87,7 +87,7 @@ where
                     config.rf.spreading_factor.into(),
                     config.rf.bandwidth.into(),
                     config.rf.coding_rate.into(),
-                    4,
+                    8,
                     false,
                     true,
                     false,
@@ -119,14 +119,14 @@ where
                     config.spreading_factor.into(),
                     config.bandwidth.into(),
                     config.coding_rate.into(),
-                    4,
+                    8,
                     4,
                     false,
                     0u8,
                     true,
                     false,
                     0,
-                    false,
+                    true,
                     true,
                 )
                 .await?;

embassy-lora/src/sx127x/mod.rs

@@ -70,10 +70,10 @@ where
     RFS: RadioSwitch + 'static,
 {
     fn get_rx_window_offset_ms(&self) -> i32 {
-        -500
+        -3
     }
     fn get_rx_window_duration_ms(&self) -> u32 {
-        800
+        1003
     }
 }
 

embassy-macros/Cargo.toml

@@ -3,6 +3,13 @@ name = "embassy-macros"
 version = "0.1.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
+description = "macros for creating the entry point and tasks for embassy-executor"
+repository = "https://github.com/embassy-rs/embassy"
+categories = [
+    "embedded",
+    "no-std",
+    "asynchronous",
+]
 
 [dependencies]
 syn = { version = "1.0.76", features = ["full", "extra-traits"] }
@@ -14,8 +21,5 @@ proc-macro2 = "1.0.29"
 proc-macro = true
 
 [features]
-std = []
-wasm = []
-
 # Enabling this cause interrupt::take! to require embassy-executor
 rtos-trace-interrupt = []

embassy-macros/README.md

@@ -0,0 +1,21 @@
+# embassy-macros
+
+An [Embassy](https://embassy.dev) project.
+
+Macros for creating the main entry point and tasks that can be spawned by `embassy-executor`. 
+
+NOTE: The macros are re-exported by the `embassy-executor` crate which should be used instead of adding a direct dependency on the `embassy-macros` crate.
+
+## Minimum supported Rust version (MSRV)
+
+The `task` and `main` macros require the type alias impl trait (TAIT) nightly feature in order to compile.
+
+## License
+
+This work is licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or
+  <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.

embassy-macros/src/lib.rs

@@ -1,3 +1,4 @@
+#![doc = include_str!("../README.md")]
 extern crate proc_macro;
 
 use proc_macro::TokenStream;
@@ -6,6 +7,36 @@ mod macros;
 mod util;
 use macros::*;
 
+/// Declares an async task that can be run by `embassy-executor`. The optional `pool_size` parameter can be used to specify how
+/// many concurrent tasks can be spawned (default is 1) for the function.
+///
+///
+/// The following restrictions apply:
+///
+/// * The function must be declared `async`.
+/// * The function must not use generics.
+/// * The optional `pool_size` attribute must be 1 or greater.
+///
+///
+/// ## Examples
+///
+/// Declaring a task taking no arguments:
+///
+/// ``` rust
+/// #[embassy_executor::task]
+/// async fn mytask() {
+///     // Function body
+/// }
+/// ```
+///
+/// Declaring a task with a given pool size:
+///
+/// ``` rust
+/// #[embassy_executor::task(pool_size = 4)]
+/// async fn mytask() {
+///     // Function body
+/// }
+/// ```
 #[proc_macro_attribute]
 pub fn task(args: TokenStream, item: TokenStream) -> TokenStream {
     let args = syn::parse_macro_input!(args as syn::AttributeArgs);
@@ -14,11 +45,104 @@ pub fn task(args: TokenStream, item: TokenStream) -> TokenStream {
     task::run(args, f).unwrap_or_else(|x| x).into()
 }
 
+/// Creates a new `executor` instance and declares an application entry point for Cortex-M spawning the corresponding function body as an async task.
+///
+/// The following restrictions apply:
+///
+/// * The function must accept exactly 1 parameter, an `embassy_executor::Spawner` handle that it can use to spawn additional tasks.
+/// * The function must be declared `async`.
+/// * The function must not use generics.
+/// * Only a single `main` task may be declared.
+///
+/// ## Examples
+/// Spawning a task:
+///
+/// ``` rust
+/// #[embassy_executor::main]
+/// async fn main(_s: embassy_executor::Spawner) {
+///     // Function body
+/// }
+/// ```
 #[proc_macro_attribute]
-pub fn main(args: TokenStream, item: TokenStream) -> TokenStream {
+pub fn main_cortex_m(args: TokenStream, item: TokenStream) -> TokenStream {
     let args = syn::parse_macro_input!(args as syn::AttributeArgs);
     let f = syn::parse_macro_input!(item as syn::ItemFn);
-    main::run(args, f).unwrap_or_else(|x| x).into()
+    main::run(args, f, main::cortex_m()).unwrap_or_else(|x| x).into()
+}
+
+/// Creates a new `executor` instance and declares an application entry point for RISC-V spawning the corresponding function body as an async task.
+///
+/// The following restrictions apply:
+///
+/// * The function must accept exactly 1 parameter, an `embassy_executor::Spawner` handle that it can use to spawn additional tasks.
+/// * The function must be declared `async`.
+/// * The function must not use generics.
+/// * Only a single `main` task may be declared.
+///
+/// ## Examples
+/// Spawning a task:
+///
+/// ``` rust
+/// #[embassy_executor::main]
+/// async fn main(_s: embassy_executor::Spawner) {
+///     // Function body
+/// }
+/// ```
+#[proc_macro_attribute]
+pub fn main_riscv(args: TokenStream, item: TokenStream) -> TokenStream {
+    let args = syn::parse_macro_input!(args as syn::AttributeArgs);
+    let f = syn::parse_macro_input!(item as syn::ItemFn);
+    main::run(args, f, main::riscv()).unwrap_or_else(|x| x).into()
+}
+
+/// Creates a new `executor` instance and declares an application entry point for STD spawning the corresponding function body as an async task.
+///
+/// The following restrictions apply:
+///
+/// * The function must accept exactly 1 parameter, an `embassy_executor::Spawner` handle that it can use to spawn additional tasks.
+/// * The function must be declared `async`.
+/// * The function must not use generics.
+/// * Only a single `main` task may be declared.
+///
+/// ## Examples
+/// Spawning a task:
+///
+/// ``` rust
+/// #[embassy_executor::main]
+/// async fn main(_s: embassy_executor::Spawner) {
+///     // Function body
+/// }
+/// ```
+#[proc_macro_attribute]
+pub fn main_std(args: TokenStream, item: TokenStream) -> TokenStream {
+    let args = syn::parse_macro_input!(args as syn::AttributeArgs);
+    let f = syn::parse_macro_input!(item as syn::ItemFn);
+    main::run(args, f, main::std()).unwrap_or_else(|x| x).into()
+}
+
+/// Creates a new `executor` instance and declares an application entry point for WASM spawning the corresponding function body as an async task.
+///
+/// The following restrictions apply:
+///
+/// * The function must accept exactly 1 parameter, an `embassy_executor::Spawner` handle that it can use to spawn additional tasks.
+/// * The function must be declared `async`.
+/// * The function must not use generics.
+/// * Only a single `main` task may be declared.
+///
+/// ## Examples
+/// Spawning a task:
+///
+/// ``` rust
+/// #[embassy_executor::main]
+/// async fn main(_s: embassy_executor::Spawner) {
+///     // Function body
+/// }
+/// ```
+#[proc_macro_attribute]
+pub fn main_wasm(args: TokenStream, item: TokenStream) -> TokenStream {
+    let args = syn::parse_macro_input!(args as syn::AttributeArgs);
+    let f = syn::parse_macro_input!(item as syn::ItemFn);
+    main::run(args, f, main::wasm()).unwrap_or_else(|x| x).into()
 }
 
 #[proc_macro_attribute]

embassy-macros/src/macros/cortex_m_interrupt_declare.rs

@@ -6,7 +6,10 @@ pub fn run(name: syn::Ident) -> Result<TokenStream, TokenStream> {
     let name_interrupt = format_ident!("{}", name);
     let name_handler = format!("__EMBASSY_{}_HANDLER", name);
 
+    let doc = format!("{} interrupt singleton.", name);
+
     let result = quote! {
+        #[doc = #doc]
         #[allow(non_camel_case_types)]
         pub struct #name_interrupt(());
         unsafe impl ::embassy_cortex_m::interrupt::Interrupt for #name_interrupt {
@@ -18,9 +21,9 @@ pub fn run(name: syn::Ident) -> Result<TokenStream, TokenStream> {
             unsafe fn steal() -> Self {
                 Self(())
             }
-            unsafe fn __handler(&self) -> &'static ::embassy_cortex_m::interrupt::Handler {
+            unsafe fn __handler(&self) -> &'static ::embassy_cortex_m::interrupt::DynHandler {
                 #[export_name = #name_handler]
-                static HANDLER: ::embassy_cortex_m::interrupt::Handler = ::embassy_cortex_m::interrupt::Handler::new();
+                static HANDLER: ::embassy_cortex_m::interrupt::DynHandler = ::embassy_cortex_m::interrupt::DynHandler::new();
                 &HANDLER
             }
         }

embassy-macros/src/macros/cortex_m_interrupt_take.rs

@@ -10,12 +10,12 @@ pub fn run(name: syn::Ident) -> Result<TokenStream, TokenStream> {
     let (isr_enter, isr_exit) = (
         quote! {
             ::embassy_executor::rtos_trace_interrupt! {
-                ::embassy_executor::export::trace::isr_enter();
+                ::embassy_executor::_export::trace::isr_enter();
             }
         },
         quote! {
             ::embassy_executor::rtos_trace_interrupt! {
-                ::embassy_executor::export::trace::isr_exit();
+                ::embassy_executor::_export::trace::isr_exit();
             }
         },
     );
@@ -30,7 +30,7 @@ pub fn run(name: syn::Ident) -> Result<TokenStream, TokenStream> {
             pub unsafe extern "C" fn trampoline() {
                 extern "C" {
                     #[link_name = #name_handler]
-                    static HANDLER: interrupt::Handler;
+                    static HANDLER: interrupt::DynHandler;
                 }
 
                 let func = HANDLER.func.load(interrupt::_export::atomic::Ordering::Relaxed);

embassy-macros/src/macros/main.rs

@@ -1,13 +1,69 @@
 use darling::FromMeta;
 use proc_macro2::TokenStream;
 use quote::quote;
+use syn::{ReturnType, Type};
 
 use crate::util::ctxt::Ctxt;
 
 #[derive(Debug, FromMeta)]
 struct Args {}
 
-pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, TokenStream> {
+pub fn riscv() -> TokenStream {
+    quote! {
+        #[riscv_rt::entry]
+        fn main() -> ! {
+            let mut executor = ::embassy_executor::Executor::new();
+            let executor = unsafe { __make_static(&mut executor) };
+            executor.run(|spawner| {
+                spawner.must_spawn(__embassy_main(spawner));
+            })
+        }
+    }
+}
+
+pub fn cortex_m() -> TokenStream {
+    quote! {
+        #[cortex_m_rt::entry]
+        fn main() -> ! {
+            let mut executor = ::embassy_executor::Executor::new();
+            let executor = unsafe { __make_static(&mut executor) };
+            executor.run(|spawner| {
+                spawner.must_spawn(__embassy_main(spawner));
+            })
+        }
+    }
+}
+
+pub fn wasm() -> TokenStream {
+    quote! {
+        #[wasm_bindgen::prelude::wasm_bindgen(start)]
+        pub fn main() -> Result<(), wasm_bindgen::JsValue> {
+            static EXECUTOR: ::embassy_executor::_export::StaticCell<::embassy_executor::Executor> = ::embassy_executor::_export::StaticCell::new();
+            let executor = EXECUTOR.init(::embassy_executor::Executor::new());
+
+            executor.start(|spawner| {
+                spawner.spawn(__embassy_main(spawner)).unwrap();
+            });
+
+            Ok(())
+        }
+    }
+}
+
+pub fn std() -> TokenStream {
+    quote! {
+        fn main() -> ! {
+            let mut executor = ::embassy_executor::Executor::new();
+            let executor = unsafe { __make_static(&mut executor) };
+
+            executor.run(|spawner| {
+                spawner.must_spawn(__embassy_main(spawner));
+            })
+        }
+    }
+}
+
+pub fn run(args: syn::AttributeArgs, f: syn::ItemFn, main: TokenStream) -> Result<TokenStream, TokenStream> {
     #[allow(unused_variables)]
     let args = Args::from_list(&args).map_err(|e| e.write_errors())?;
 
@@ -21,6 +77,26 @@ pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, Toke
     if !f.sig.generics.params.is_empty() {
         ctxt.error_spanned_by(&f.sig, "main function must not be generic");
     }
+    if !f.sig.generics.where_clause.is_none() {
+        ctxt.error_spanned_by(&f.sig, "main function must not have `where` clauses");
+    }
+    if !f.sig.abi.is_none() {
+        ctxt.error_spanned_by(&f.sig, "main function must not have an ABI qualifier");
+    }
+    if !f.sig.variadic.is_none() {
+        ctxt.error_spanned_by(&f.sig, "main function must not be variadic");
+    }
+    match &f.sig.output {
+        ReturnType::Default => {}
+        ReturnType::Type(_, ty) => match &**ty {
+            Type::Tuple(tuple) if tuple.elems.is_empty() => {}
+            Type::Never(_) => {}
+            _ => ctxt.error_spanned_by(
+                &f.sig,
+                "main function must either not return a value, return `()` or return `!`",
+            ),
+        },
+    }
 
     if fargs.len() != 1 {
         ctxt.error_spanned_by(&f.sig, "main function must have 1 argument: the spawner.");
@@ -29,50 +105,11 @@ pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, Toke
     ctxt.check()?;
 
     let f_body = f.block;
-
-    #[cfg(feature = "wasm")]
-    let main = quote! {
-        #[wasm_bindgen::prelude::wasm_bindgen(start)]
-        pub fn main() -> Result<(), wasm_bindgen::JsValue> {
-            static EXECUTOR: ::embassy_executor::_export::StaticCell<::embassy_executor::Executor> = ::embassy_executor::_export::StaticCell::new();
-            let executor = EXECUTOR.init(::embassy_executor::Executor::new());
-
-            executor.start(|spawner| {
-                spawner.spawn(__embassy_main(spawner)).unwrap();
-            });
-
-            Ok(())
-        }
-    };
-
-    #[cfg(all(feature = "std", not(feature = "wasm")))]
-    let main = quote! {
-        fn main() -> ! {
-            let mut executor = ::embassy_executor::Executor::new();
-            let executor = unsafe { __make_static(&mut executor) };
-
-            executor.run(|spawner| {
-                spawner.must_spawn(__embassy_main(spawner));
-            })
-        }
-    };
-
-    #[cfg(all(not(feature = "std"), not(feature = "wasm")))]
-    let main = quote! {
-        #[cortex_m_rt::entry]
-        fn main() -> ! {
-            let mut executor = ::embassy_executor::Executor::new();
-            let executor = unsafe { __make_static(&mut executor) };
-
-            executor.run(|spawner| {
-                spawner.must_spawn(__embassy_main(spawner));
-            })
-        }
-    };
+    let out = &f.sig.output;
 
     let result = quote! {
         #[::embassy_executor::task()]
-        async fn __embassy_main(#fargs) {
+        async fn __embassy_main(#fargs) #out {
             #f_body
         }
 

embassy-macros/src/macros/task.rs

@@ -1,6 +1,7 @@
 use darling::FromMeta;
 use proc_macro2::TokenStream;
 use quote::{format_ident, quote};
+use syn::{parse_quote, ItemFn, ReturnType, Type};
 
 use crate::util::ctxt::Ctxt;
 
@@ -23,6 +24,27 @@ pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, Toke
     if !f.sig.generics.params.is_empty() {
         ctxt.error_spanned_by(&f.sig, "task functions must not be generic");
     }
+    if !f.sig.generics.where_clause.is_none() {
+        ctxt.error_spanned_by(&f.sig, "task functions must not have `where` clauses");
+    }
+    if !f.sig.abi.is_none() {
+        ctxt.error_spanned_by(&f.sig, "task functions must not have an ABI qualifier");
+    }
+    if !f.sig.variadic.is_none() {
+        ctxt.error_spanned_by(&f.sig, "task functions must not be variadic");
+    }
+    match &f.sig.output {
+        ReturnType::Default => {}
+        ReturnType::Type(_, ty) => match &**ty {
+            Type::Tuple(tuple) if tuple.elems.is_empty() => {}
+            Type::Never(_) => {}
+            _ => ctxt.error_spanned_by(
+                &f.sig,
+                "task functions must either not return a value, return `()` or return `!`",
+            ),
+        },
+    }
+
     if pool_size < 1 {
         ctxt.error_spanned_by(&f.sig, "pool_size must be 1 or greater");
     }
@@ -57,13 +79,7 @@ pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, Toke
     task_inner.vis = syn::Visibility::Inherited;
     task_inner.sig.ident = task_inner_ident.clone();
 
-    let result = quote! {
-        // This is the user's task function, renamed.
-        // We put it outside the #task_ident fn below, because otherwise
-        // the items defined there (such as POOL) would be in scope
-        // in the user's code.
-        #task_inner
-
+    let mut task_outer: ItemFn = parse_quote! {
         #visibility fn #task_ident(#fargs) -> ::embassy_executor::SpawnToken<impl Sized> {
             type Fut = impl ::core::future::Future + 'static;
             static POOL: ::embassy_executor::raw::TaskPool<Fut, #pool_size> = ::embassy_executor::raw::TaskPool::new();
@@ -71,5 +87,18 @@ pub fn run(args: syn::AttributeArgs, f: syn::ItemFn) -> Result<TokenStream, Toke
         }
     };
 
+    task_outer.attrs.append(&mut task_inner.attrs.clone());
+
+    let result = quote! {
+        // This is the user's task function, renamed.
+        // We put it outside the #task_ident fn below, because otherwise
+        // the items defined there (such as POOL) would be in scope
+        // in the user's code.
+        #[doc(hidden)]
+        #task_inner
+
+        #task_outer
+    };
+
     Ok(result)
 }

embassy-net-driver-channel/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "embassy-net-driver-channel"
+version = "0.1.0"
+edition = "2021"
+
+[package.metadata.embassy_docs]
+src_base = "https://github.com/embassy-rs/embassy/blob/embassy-net-driver-channel-v$VERSION/embassy-net-driver-channel/src/"
+src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-net-driver-channel/src/"
+features = ["defmt"]
+target = "thumbv7em-none-eabi"
+
+[dependencies]
+defmt = { version = "0.3", optional = true }
+log = { version = "0.4.14", optional = true }
+
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
+embassy-futures = { version = "0.1.0", path = "../embassy-futures" }
+embassy-net-driver = { version = "0.1.0", path = "../embassy-net-driver" }

embassy-net-driver-channel/src/fmt.rs

@@ -0,0 +1,225 @@
+#![macro_use]
+#![allow(unused_macros)]
+
+#[cfg(all(feature = "defmt", feature = "log"))]
+compile_error!("You may not enable both `defmt` and `log` features.");
+
+macro_rules! assert {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert!($($x)*);
+        }
+    };
+}
+
+macro_rules! assert_eq {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert_eq!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert_eq!($($x)*);
+        }
+    };
+}
+
+macro_rules! assert_ne {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::assert_ne!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::assert_ne!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert_eq {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert_eq!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert_eq!($($x)*);
+        }
+    };
+}
+
+macro_rules! debug_assert_ne {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::debug_assert_ne!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug_assert_ne!($($x)*);
+        }
+    };
+}
+
+macro_rules! todo {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::todo!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::todo!($($x)*);
+        }
+    };
+}
+
+macro_rules! unreachable {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::unreachable!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::unreachable!($($x)*);
+        }
+    };
+}
+
+macro_rules! panic {
+    ($($x:tt)*) => {
+        {
+            #[cfg(not(feature = "defmt"))]
+            ::core::panic!($($x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::panic!($($x)*);
+        }
+    };
+}
+
+macro_rules! trace {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::trace!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::trace!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! debug {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::debug!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::debug!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! info {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::info!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::info!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! warn {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::warn!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::warn!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+macro_rules! error {
+    ($s:literal $(, $x:expr)* $(,)?) => {
+        {
+            #[cfg(feature = "log")]
+            ::log::error!($s $(, $x)*);
+            #[cfg(feature = "defmt")]
+            ::defmt::error!($s $(, $x)*);
+            #[cfg(not(any(feature = "log", feature="defmt")))]
+            let _ = ($( & $x ),*);
+        }
+    };
+}
+
+#[cfg(feature = "defmt")]
+macro_rules! unwrap {
+    ($($x:tt)*) => {
+        ::defmt::unwrap!($($x)*)
+    };
+}
+
+#[cfg(not(feature = "defmt"))]
+macro_rules! unwrap {
+    ($arg:expr) => {
+        match $crate::fmt::Try::into_result($arg) {
+            ::core::result::Result::Ok(t) => t,
+            ::core::result::Result::Err(e) => {
+                ::core::panic!("unwrap of `{}` failed: {:?}", ::core::stringify!($arg), e);
+            }
+        }
+    };
+    ($arg:expr, $($msg:expr),+ $(,)? ) => {
+        match $crate::fmt::Try::into_result($arg) {
+            ::core::result::Result::Ok(t) => t,
+            ::core::result::Result::Err(e) => {
+                ::core::panic!("unwrap of `{}` failed: {}: {:?}", ::core::stringify!($arg), ::core::format_args!($($msg,)*), e);
+            }
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone, Eq, PartialEq)]
+pub struct NoneError;
+
+pub trait Try {
+    type Ok;
+    type Error;
+    fn into_result(self) -> Result<Self::Ok, Self::Error>;
+}
+
+impl<T> Try for Option<T> {
+    type Ok = T;
+    type Error = NoneError;
+
+    #[inline]
+    fn into_result(self) -> Result<T, NoneError> {
+        self.ok_or(NoneError)
+    }
+}
+
+impl<T, E> Try for Result<T, E> {
+    type Ok = T;
+    type Error = E;
+
+    #[inline]
+    fn into_result(self) -> Self {
+        self
+    }
+}

embassy-net-driver-channel/src/lib.rs

@@ -0,0 +1,549 @@
+#![no_std]
+
+// must go first!
+mod fmt;
+
+use core::cell::RefCell;
+use core::mem::MaybeUninit;
+use core::task::{Context, Poll};
+
+pub use embassy_net_driver as driver;
+use embassy_net_driver::{Capabilities, LinkState, Medium};
+use embassy_sync::blocking_mutex::raw::NoopRawMutex;
+use embassy_sync::blocking_mutex::Mutex;
+use embassy_sync::waitqueue::WakerRegistration;
+
+pub struct State<const MTU: usize, const N_RX: usize, const N_TX: usize> {
+    rx: [PacketBuf<MTU>; N_RX],
+    tx: [PacketBuf<MTU>; N_TX],
+    inner: MaybeUninit<StateInner<'static, MTU>>,
+}
+
+impl<const MTU: usize, const N_RX: usize, const N_TX: usize> State<MTU, N_RX, N_TX> {
+    const NEW_PACKET: PacketBuf<MTU> = PacketBuf::new();
+
+    pub const fn new() -> Self {
+        Self {
+            rx: [Self::NEW_PACKET; N_RX],
+            tx: [Self::NEW_PACKET; N_TX],
+            inner: MaybeUninit::uninit(),
+        }
+    }
+}
+
+struct StateInner<'d, const MTU: usize> {
+    rx: zerocopy_channel::Channel<'d, NoopRawMutex, PacketBuf<MTU>>,
+    tx: zerocopy_channel::Channel<'d, NoopRawMutex, PacketBuf<MTU>>,
+    shared: Mutex<NoopRawMutex, RefCell<Shared>>,
+}
+
+/// State of the LinkState
+struct Shared {
+    link_state: LinkState,
+    waker: WakerRegistration,
+    ethernet_address: [u8; 6],
+}
+
+pub struct Runner<'d, const MTU: usize> {
+    tx_chan: zerocopy_channel::Receiver<'d, NoopRawMutex, PacketBuf<MTU>>,
+    rx_chan: zerocopy_channel::Sender<'d, NoopRawMutex, PacketBuf<MTU>>,
+    shared: &'d Mutex<NoopRawMutex, RefCell<Shared>>,
+}
+
+#[derive(Clone, Copy)]
+pub struct StateRunner<'d> {
+    shared: &'d Mutex<NoopRawMutex, RefCell<Shared>>,
+}
+
+pub struct RxRunner<'d, const MTU: usize> {
+    rx_chan: zerocopy_channel::Sender<'d, NoopRawMutex, PacketBuf<MTU>>,
+}
+
+pub struct TxRunner<'d, const MTU: usize> {
+    tx_chan: zerocopy_channel::Receiver<'d, NoopRawMutex, PacketBuf<MTU>>,
+}
+
+impl<'d, const MTU: usize> Runner<'d, MTU> {
+    pub fn split(self) -> (StateRunner<'d>, RxRunner<'d, MTU>, TxRunner<'d, MTU>) {
+        (
+            StateRunner { shared: self.shared },
+            RxRunner { rx_chan: self.rx_chan },
+            TxRunner { tx_chan: self.tx_chan },
+        )
+    }
+
+    pub fn state_runner(&self) -> StateRunner<'d> {
+        StateRunner { shared: self.shared }
+    }
+
+    pub fn set_link_state(&mut self, state: LinkState) {
+        self.shared.lock(|s| {
+            let s = &mut *s.borrow_mut();
+            s.link_state = state;
+            s.waker.wake();
+        });
+    }
+
+    pub fn set_ethernet_address(&mut self, address: [u8; 6]) {
+        self.shared.lock(|s| {
+            let s = &mut *s.borrow_mut();
+            s.ethernet_address = address;
+            s.waker.wake();
+        });
+    }
+
+    pub async fn rx_buf(&mut self) -> &mut [u8] {
+        let p = self.rx_chan.send().await;
+        &mut p.buf
+    }
+
+    pub fn try_rx_buf(&mut self) -> Option<&mut [u8]> {
+        let p = self.rx_chan.try_send()?;
+        Some(&mut p.buf)
+    }
+
+    pub fn poll_rx_buf(&mut self, cx: &mut Context) -> Poll<&mut [u8]> {
+        match self.rx_chan.poll_send(cx) {
+            Poll::Ready(p) => Poll::Ready(&mut p.buf),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+
+    pub fn rx_done(&mut self, len: usize) {
+        let p = self.rx_chan.try_send().unwrap();
+        p.len = len;
+        self.rx_chan.send_done();
+    }
+
+    pub async fn tx_buf(&mut self) -> &mut [u8] {
+        let p = self.tx_chan.recv().await;
+        &mut p.buf[..p.len]
+    }
+
+    pub fn try_tx_buf(&mut self) -> Option<&mut [u8]> {
+        let p = self.tx_chan.try_recv()?;
+        Some(&mut p.buf[..p.len])
+    }
+
+    pub fn poll_tx_buf(&mut self, cx: &mut Context) -> Poll<&mut [u8]> {
+        match self.tx_chan.poll_recv(cx) {
+            Poll::Ready(p) => Poll::Ready(&mut p.buf[..p.len]),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+
+    pub fn tx_done(&mut self) {
+        self.tx_chan.recv_done();
+    }
+}
+
+impl<'d> StateRunner<'d> {
+    pub fn set_link_state(&self, state: LinkState) {
+        self.shared.lock(|s| {
+            let s = &mut *s.borrow_mut();
+            s.link_state = state;
+            s.waker.wake();
+        });
+    }
+
+    pub fn set_ethernet_address(&self, address: [u8; 6]) {
+        self.shared.lock(|s| {
+            let s = &mut *s.borrow_mut();
+            s.ethernet_address = address;
+            s.waker.wake();
+        });
+    }
+}
+
+impl<'d, const MTU: usize> RxRunner<'d, MTU> {
+    pub async fn rx_buf(&mut self) -> &mut [u8] {
+        let p = self.rx_chan.send().await;
+        &mut p.buf
+    }
+
+    pub fn try_rx_buf(&mut self) -> Option<&mut [u8]> {
+        let p = self.rx_chan.try_send()?;
+        Some(&mut p.buf)
+    }
+
+    pub fn poll_rx_buf(&mut self, cx: &mut Context) -> Poll<&mut [u8]> {
+        match self.rx_chan.poll_send(cx) {
+            Poll::Ready(p) => Poll::Ready(&mut p.buf),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+
+    pub fn rx_done(&mut self, len: usize) {
+        let p = self.rx_chan.try_send().unwrap();
+        p.len = len;
+        self.rx_chan.send_done();
+    }
+}
+
+impl<'d, const MTU: usize> TxRunner<'d, MTU> {
+    pub async fn tx_buf(&mut self) -> &mut [u8] {
+        let p = self.tx_chan.recv().await;
+        &mut p.buf[..p.len]
+    }
+
+    pub fn try_tx_buf(&mut self) -> Option<&mut [u8]> {
+        let p = self.tx_chan.try_recv()?;
+        Some(&mut p.buf[..p.len])
+    }
+
+    pub fn poll_tx_buf(&mut self, cx: &mut Context) -> Poll<&mut [u8]> {
+        match self.tx_chan.poll_recv(cx) {
+            Poll::Ready(p) => Poll::Ready(&mut p.buf[..p.len]),
+            Poll::Pending => Poll::Pending,
+        }
+    }
+
+    pub fn tx_done(&mut self) {
+        self.tx_chan.recv_done();
+    }
+}
+
+pub fn new<'d, const MTU: usize, const N_RX: usize, const N_TX: usize>(
+    state: &'d mut State<MTU, N_RX, N_TX>,
+    ethernet_address: [u8; 6],
+) -> (Runner<'d, MTU>, Device<'d, MTU>) {
+    let mut caps = Capabilities::default();
+    caps.max_transmission_unit = MTU;
+    caps.medium = Medium::Ethernet;
+
+    // safety: this is a self-referential struct, however:
+    // - it can't move while the `'d` borrow is active.
+    // - when the borrow ends, the dangling references inside the MaybeUninit will never be used again.
+    let state_uninit: *mut MaybeUninit<StateInner<'d, MTU>> =
+        (&mut state.inner as *mut MaybeUninit<StateInner<'static, MTU>>).cast();
+    let state = unsafe { &mut *state_uninit }.write(StateInner {
+        rx: zerocopy_channel::Channel::new(&mut state.rx[..]),
+        tx: zerocopy_channel::Channel::new(&mut state.tx[..]),
+        shared: Mutex::new(RefCell::new(Shared {
+            link_state: LinkState::Down,
+            ethernet_address,
+            waker: WakerRegistration::new(),
+        })),
+    });
+
+    let (rx_sender, rx_receiver) = state.rx.split();
+    let (tx_sender, tx_receiver) = state.tx.split();
+
+    (
+        Runner {
+            tx_chan: tx_receiver,
+            rx_chan: rx_sender,
+            shared: &state.shared,
+        },
+        Device {
+            caps,
+            shared: &state.shared,
+            rx: rx_receiver,
+            tx: tx_sender,
+        },
+    )
+}
+
+pub struct PacketBuf<const MTU: usize> {
+    len: usize,
+    buf: [u8; MTU],
+}
+
+impl<const MTU: usize> PacketBuf<MTU> {
+    pub const fn new() -> Self {
+        Self { len: 0, buf: [0; MTU] }
+    }
+}
+
+pub struct Device<'d, const MTU: usize> {
+    rx: zerocopy_channel::Receiver<'d, NoopRawMutex, PacketBuf<MTU>>,
+    tx: zerocopy_channel::Sender<'d, NoopRawMutex, PacketBuf<MTU>>,
+    shared: &'d Mutex<NoopRawMutex, RefCell<Shared>>,
+    caps: Capabilities,
+}
+
+impl<'d, const MTU: usize> embassy_net_driver::Driver for Device<'d, MTU> {
+    type RxToken<'a> = RxToken<'a, MTU> where Self: 'a ;
+    type TxToken<'a> = TxToken<'a, MTU> where Self: 'a ;
+
+    fn receive(&mut self, cx: &mut Context) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)> {
+        if self.rx.poll_recv(cx).is_ready() && self.tx.poll_send(cx).is_ready() {
+            Some((RxToken { rx: self.rx.borrow() }, TxToken { tx: self.tx.borrow() }))
+        } else {
+            None
+        }
+    }
+
+    /// Construct a transmit token.
+    fn transmit(&mut self, cx: &mut Context) -> Option<Self::TxToken<'_>> {
+        if self.tx.poll_send(cx).is_ready() {
+            Some(TxToken { tx: self.tx.borrow() })
+        } else {
+            None
+        }
+    }
+
+    /// Get a description of device capabilities.
+    fn capabilities(&self) -> Capabilities {
+        self.caps.clone()
+    }
+
+    fn ethernet_address(&self) -> [u8; 6] {
+        self.shared.lock(|s| s.borrow().ethernet_address)
+    }
+
+    fn link_state(&mut self, cx: &mut Context) -> LinkState {
+        self.shared.lock(|s| {
+            let s = &mut *s.borrow_mut();
+            s.waker.register(cx.waker());
+            s.link_state
+        })
+    }
+}
+
+pub struct RxToken<'a, const MTU: usize> {
+    rx: zerocopy_channel::Receiver<'a, NoopRawMutex, PacketBuf<MTU>>,
+}
+
+impl<'a, const MTU: usize> embassy_net_driver::RxToken for RxToken<'a, MTU> {
+    fn consume<R, F>(mut self, f: F) -> R
+    where
+        F: FnOnce(&mut [u8]) -> R,
+    {
+        // NOTE(unwrap): we checked the queue wasn't full when creating the token.
+        let pkt = unwrap!(self.rx.try_recv());
+        let r = f(&mut pkt.buf[..pkt.len]);
+        self.rx.recv_done();
+        r
+    }
+}
+
+pub struct TxToken<'a, const MTU: usize> {
+    tx: zerocopy_channel::Sender<'a, NoopRawMutex, PacketBuf<MTU>>,
+}
+
+impl<'a, const MTU: usize> embassy_net_driver::TxToken for TxToken<'a, MTU> {
+    fn consume<R, F>(mut self, len: usize, f: F) -> R
+    where
+        F: FnOnce(&mut [u8]) -> R,
+    {
+        // NOTE(unwrap): we checked the queue wasn't full when creating the token.
+        let pkt = unwrap!(self.tx.try_send());
+        let r = f(&mut pkt.buf[..len]);
+        pkt.len = len;
+        self.tx.send_done();
+        r
+    }
+}
+
+mod zerocopy_channel {
+    use core::cell::RefCell;
+    use core::future::poll_fn;
+    use core::marker::PhantomData;
+    use core::task::{Context, Poll};
+
+    use embassy_sync::blocking_mutex::raw::RawMutex;
+    use embassy_sync::blocking_mutex::Mutex;
+    use embassy_sync::waitqueue::WakerRegistration;
+
+    pub struct Channel<'a, M: RawMutex, T> {
+        buf: *mut T,
+        phantom: PhantomData<&'a mut T>,
+        state: Mutex<M, RefCell<State>>,
+    }
+
+    impl<'a, M: RawMutex, T> Channel<'a, M, T> {
+        pub fn new(buf: &'a mut [T]) -> Self {
+            let len = buf.len();
+            assert!(len != 0);
+
+            Self {
+                buf: buf.as_mut_ptr(),
+                phantom: PhantomData,
+                state: Mutex::new(RefCell::new(State {
+                    len,
+                    front: 0,
+                    back: 0,
+                    full: false,
+                    send_waker: WakerRegistration::new(),
+                    recv_waker: WakerRegistration::new(),
+                })),
+            }
+        }
+
+        pub fn split(&mut self) -> (Sender<'_, M, T>, Receiver<'_, M, T>) {
+            (Sender { channel: self }, Receiver { channel: self })
+        }
+    }
+
+    pub struct Sender<'a, M: RawMutex, T> {
+        channel: &'a Channel<'a, M, T>,
+    }
+
+    impl<'a, M: RawMutex, T> Sender<'a, M, T> {
+        pub fn borrow(&mut self) -> Sender<'_, M, T> {
+            Sender { channel: self.channel }
+        }
+
+        pub fn try_send(&mut self) -> Option<&mut T> {
+            self.channel.state.lock(|s| {
+                let s = &mut *s.borrow_mut();
+                match s.push_index() {
+                    Some(i) => Some(unsafe { &mut *self.channel.buf.add(i) }),
+                    None => None,
+                }
+            })
+        }
+
+        pub fn poll_send(&mut self, cx: &mut Context) -> Poll<&mut T> {
+            self.channel.state.lock(|s| {
+                let s = &mut *s.borrow_mut();
+                match s.push_index() {
+                    Some(i) => Poll::Ready(unsafe { &mut *self.channel.buf.add(i) }),
+                    None => {
+                        s.recv_waker.register(cx.waker());
+                        Poll::Pending
+                    }
+                }
+            })
+        }
+
+        pub async fn send(&mut self) -> &mut T {
+            let i = poll_fn(|cx| {
+                self.channel.state.lock(|s| {
+                    let s = &mut *s.borrow_mut();
+                    match s.push_index() {
+                        Some(i) => Poll::Ready(i),
+                        None => {
+                            s.recv_waker.register(cx.waker());
+                            Poll::Pending
+                        }
+                    }
+                })
+            })
+            .await;
+            unsafe { &mut *self.channel.buf.add(i) }
+        }
+
+        pub fn send_done(&mut self) {
+            self.channel.state.lock(|s| s.borrow_mut().push_done())
+        }
+    }
+    pub struct Receiver<'a, M: RawMutex, T> {
+        channel: &'a Channel<'a, M, T>,
+    }
+
+    impl<'a, M: RawMutex, T> Receiver<'a, M, T> {
+        pub fn borrow(&mut self) -> Receiver<'_, M, T> {
+            Receiver { channel: self.channel }
+        }
+
+        pub fn try_recv(&mut self) -> Option<&mut T> {
+            self.channel.state.lock(|s| {
+                let s = &mut *s.borrow_mut();
+                match s.pop_index() {
+                    Some(i) => Some(unsafe { &mut *self.channel.buf.add(i) }),
+                    None => None,
+                }
+            })
+        }
+
+        pub fn poll_recv(&mut self, cx: &mut Context) -> Poll<&mut T> {
+            self.channel.state.lock(|s| {
+                let s = &mut *s.borrow_mut();
+                match s.pop_index() {
+                    Some(i) => Poll::Ready(unsafe { &mut *self.channel.buf.add(i) }),
+                    None => {
+                        s.send_waker.register(cx.waker());
+                        Poll::Pending
+                    }
+                }
+            })
+        }
+
+        pub async fn recv(&mut self) -> &mut T {
+            let i = poll_fn(|cx| {
+                self.channel.state.lock(|s| {
+                    let s = &mut *s.borrow_mut();
+                    match s.pop_index() {
+                        Some(i) => Poll::Ready(i),
+                        None => {
+                            s.send_waker.register(cx.waker());
+                            Poll::Pending
+                        }
+                    }
+                })
+            })
+            .await;
+            unsafe { &mut *self.channel.buf.add(i) }
+        }
+
+        pub fn recv_done(&mut self) {
+            self.channel.state.lock(|s| s.borrow_mut().pop_done())
+        }
+    }
+
+    struct State {
+        len: usize,
+
+        /// Front index. Always 0..=(N-1)
+        front: usize,
+        /// Back index. Always 0..=(N-1).
+        back: usize,
+
+        /// Used to distinguish "empty" and "full" cases when `front == back`.
+        /// May only be `true` if `front == back`, always `false` otherwise.
+        full: bool,
+
+        send_waker: WakerRegistration,
+        recv_waker: WakerRegistration,
+    }
+
+    impl State {
+        fn increment(&self, i: usize) -> usize {
+            if i + 1 == self.len {
+                0
+            } else {
+                i + 1
+            }
+        }
+
+        fn is_full(&self) -> bool {
+            self.full
+        }
+
+        fn is_empty(&self) -> bool {
+            self.front == self.back && !self.full
+        }
+
+        fn push_index(&mut self) -> Option<usize> {
+            match self.is_full() {
+                true => None,
+                false => Some(self.back),
+            }
+        }
+
+        fn push_done(&mut self) {
+            assert!(!self.is_full());
+            self.back = self.increment(self.back);
+            if self.back == self.front {
+                self.full = true;
+            }
+            self.send_waker.wake();
+        }
+
+        fn pop_index(&mut self) -> Option<usize> {
+            match self.is_empty() {
+                true => None,
+                false => Some(self.front),
+            }
+        }
+
+        fn pop_done(&mut self) {
+            assert!(!self.is_empty());
+            self.front = self.increment(self.front);
+            self.full = false;
+            self.recv_waker.wake();
+        }
+    }
+}

embassy-net-driver/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "embassy-net-driver"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+
+
+[package.metadata.embassy_docs]
+src_base = "https://github.com/embassy-rs/embassy/blob/embassy-net-driver-v$VERSION/embassy-net-driver/src/"
+src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-net-driver/src/"
+features = ["defmt"]
+target = "thumbv7em-none-eabi"
+
+[dependencies]
+defmt = { version = "0.3", optional = true }

embassy-net-driver/src/lib.rs

@@ -0,0 +1,175 @@
+#![no_std]
+
+use core::task::Context;
+
+pub trait Driver {
+    type RxToken<'a>: RxToken
+    where
+        Self: 'a;
+    type TxToken<'a>: TxToken
+    where
+        Self: 'a;
+
+    fn receive(&mut self, cx: &mut Context) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)>;
+    fn transmit(&mut self, cx: &mut Context) -> Option<Self::TxToken<'_>>;
+    fn link_state(&mut self, cx: &mut Context) -> LinkState;
+
+    fn capabilities(&self) -> Capabilities;
+    fn ethernet_address(&self) -> [u8; 6];
+}
+
+impl<T: ?Sized + Driver> Driver for &mut T {
+    type RxToken<'a> = T::RxToken<'a>
+    where
+        Self: 'a;
+    type TxToken<'a> = T::TxToken<'a>
+    where
+        Self: 'a;
+
+    fn transmit(&mut self, cx: &mut Context) -> Option<Self::TxToken<'_>> {
+        T::transmit(self, cx)
+    }
+    fn receive(&mut self, cx: &mut Context) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)> {
+        T::receive(self, cx)
+    }
+    fn capabilities(&self) -> Capabilities {
+        T::capabilities(self)
+    }
+    fn link_state(&mut self, cx: &mut Context) -> LinkState {
+        T::link_state(self, cx)
+    }
+    fn ethernet_address(&self) -> [u8; 6] {
+        T::ethernet_address(self)
+    }
+}
+
+/// A token to receive a single network packet.
+pub trait RxToken {
+    /// Consumes the token to receive a single network packet.
+    ///
+    /// This method receives a packet and then calls the given closure `f` with the raw
+    /// packet bytes as argument.
+    fn consume<R, F>(self, f: F) -> R
+    where
+        F: FnOnce(&mut [u8]) -> R;
+}
+
+/// A token to transmit a single network packet.
+pub trait TxToken {
+    /// Consumes the token to send a single network packet.
+    ///
+    /// This method constructs a transmit buffer of size `len` and calls the passed
+    /// closure `f` with a mutable reference to that buffer. The closure should construct
+    /// a valid network packet (e.g. an ethernet packet) in the buffer. When the closure
+    /// returns, the transmit buffer is sent out.
+    fn consume<R, F>(self, len: usize, f: F) -> R
+    where
+        F: FnOnce(&mut [u8]) -> R;
+}
+
+/// A description of device capabilities.
+///
+/// Higher-level protocols may achieve higher throughput or lower latency if they consider
+/// the bandwidth or packet size limitations.
+#[derive(Debug, Clone, Default)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[non_exhaustive]
+pub struct Capabilities {
+    /// Medium of the device.
+    ///
+    /// This indicates what kind of packet the sent/received bytes are, and determines
+    /// some behaviors of Interface. For example, ARP/NDISC address resolution is only done
+    /// for Ethernet mediums.
+    pub medium: Medium,
+
+    /// Maximum transmission unit.
+    ///
+    /// The network device is unable to send or receive frames larger than the value returned
+    /// by this function.
+    ///
+    /// For Ethernet devices, this is the maximum Ethernet frame size, including the Ethernet header (14 octets), but
+    /// *not* including the Ethernet FCS (4 octets). Therefore, Ethernet MTU = IP MTU + 14.
+    ///
+    /// Note that in Linux and other OSes, "MTU" is the IP MTU, not the Ethernet MTU, even for Ethernet
+    /// devices. This is a common source of confusion.
+    ///
+    /// Most common IP MTU is 1500. Minimum is 576 (for IPv4) or 1280 (for IPv6). Maximum is 9216 octets.
+    pub max_transmission_unit: usize,
+
+    /// Maximum burst size, in terms of MTU.
+    ///
+    /// The network device is unable to send or receive bursts large than the value returned
+    /// by this function.
+    ///
+    /// If `None`, there is no fixed limit on burst size, e.g. if network buffers are
+    /// dynamically allocated.
+    pub max_burst_size: Option<usize>,
+
+    /// Checksum behavior.
+    ///
+    /// If the network device is capable of verifying or computing checksums for some protocols,
+    /// it can request that the stack not do so in software to improve performance.
+    pub checksum: ChecksumCapabilities,
+}
+
+/// Type of medium of a device.
+#[derive(Debug, Eq, PartialEq, Copy, Clone)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum Medium {
+    /// Ethernet medium. Devices of this type send and receive Ethernet frames,
+    /// and interfaces using it must do neighbor discovery via ARP or NDISC.
+    ///
+    /// Examples of devices of this type are Ethernet, WiFi (802.11), Linux `tap`, and VPNs in tap (layer 2) mode.
+    Ethernet,
+
+    /// IP medium. Devices of this type send and receive IP frames, without an
+    /// Ethernet header. MAC addresses are not used, and no neighbor discovery (ARP, NDISC) is done.
+    ///
+    /// Examples of devices of this type are the Linux `tun`, PPP interfaces, VPNs in tun (layer 3) mode.
+    Ip,
+}
+
+impl Default for Medium {
+    fn default() -> Medium {
+        Medium::Ethernet
+    }
+}
+
+/// A description of checksum behavior for every supported protocol.
+#[derive(Debug, Clone, Default)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[non_exhaustive]
+pub struct ChecksumCapabilities {
+    pub ipv4: Checksum,
+    pub udp: Checksum,
+    pub tcp: Checksum,
+    pub icmpv4: Checksum,
+    pub icmpv6: Checksum,
+}
+
+/// A description of checksum behavior for a particular protocol.
+#[derive(Debug, Clone, Copy)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum Checksum {
+    /// Verify checksum when receiving and compute checksum when sending.
+    Both,
+    /// Verify checksum when receiving.
+    Rx,
+    /// Compute checksum before sending.
+    Tx,
+    /// Ignore checksum completely.
+    None,
+}
+
+impl Default for Checksum {
+    fn default() -> Checksum {
+        Checksum::Both
+    }
+}
+
+#[derive(PartialEq, Eq, Clone, Copy)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum LinkState {
+    Down,
+    Up,
+}

embassy-net/Cargo.toml

@@ -8,41 +8,43 @@ license = "MIT OR Apache-2.0"
 [package.metadata.embassy_docs]
 src_base = "https://github.com/embassy-rs/embassy/blob/embassy-net-v$VERSION/embassy-net/src/"
 src_base_git = "https://github.com/embassy-rs/embassy/blob/$COMMIT/embassy-net/src/"
-features = ["pool-4", "defmt", "tcp", "dns", "dhcpv4", "proto-ipv6", "medium-ethernet", "medium-ip"]
+features = ["nightly", "unstable-traits", "defmt", "tcp", "udp", "dns", "dhcpv4", "proto-ipv6", "medium-ethernet", "medium-ip", "igmp"]
 target = "thumbv7em-none-eabi"
 
 [features]
 default = []
 std = []
 
-defmt = ["dep:defmt", "smoltcp/defmt"]
+defmt = ["dep:defmt", "smoltcp/defmt", "embassy-net-driver/defmt"]
 
 nightly = ["dep:embedded-io", "embedded-io?/async", "dep:embedded-nal-async"]
 unstable-traits = []
 
 udp = ["smoltcp/socket-udp"]
 tcp = ["smoltcp/socket-tcp"]
-dns = ["smoltcp/socket-dns"]
+dns = ["smoltcp/socket-dns", "smoltcp/proto-dns"]
 dhcpv4 = ["medium-ethernet", "smoltcp/socket-dhcpv4"]
 proto-ipv6 = ["smoltcp/proto-ipv6"]
 medium-ethernet = ["smoltcp/medium-ethernet"]
 medium-ip = ["smoltcp/medium-ip"]
-
-pool-4 = []
-pool-8 = []
-pool-16 = []
-pool-32 = []
-pool-64 = []
-pool-128 = []
+igmp = ["smoltcp/proto-igmp"]
 
 [dependencies]
 
 defmt = { version = "0.3", optional = true }
 log = { version = "0.4.14", optional = true }
 
+smoltcp = { version = "0.9.0", default-features = false, features = [
+  "proto-ipv4",
+  "socket",
+  "async",
+]}
+
+embassy-net-driver = { version = "0.1.0", path = "../embassy-net-driver" }
+embassy-hal-common = { version = "0.1.0", path = "../embassy-hal-common" }
 embassy-time = { version = "0.1.0", path = "../embassy-time" }
-embassy-sync = { version = "0.1.0", path = "../embassy-sync" }
-embedded-io = { version = "0.3.1", optional = true }
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
+embedded-io = { version = "0.4.0", optional = true }
 
 managed = { version = "0.8.0", default-features = false, features = [ "map" ] }
 heapless = { version = "0.7.5", default-features = false }
@@ -51,16 +53,5 @@ generic-array = { version = "0.14.4", default-features = false }
 stable_deref_trait = { version = "1.2.0", default-features = false }
 futures = { version = "0.3.17", default-features = false, features = [ "async-await" ] }
 atomic-pool = "1.0"
-atomic-polyfill = "1.0.1"
-embedded-nal-async = { version = "0.2.0", optional = true }
-
-[dependencies.smoltcp]
-version = "0.8.0"
-git = "https://github.com/smoltcp-rs/smoltcp"
-rev = "ed0cf16750a42f30e31fcaf5347915592924b1e3"
-default-features = false
-features = [
-  "proto-ipv4",
-  "socket",
-  "async",
-]
+embedded-nal-async = { version = "0.4.0", optional = true }
+atomic-polyfill = { version = "1.0" }

embassy-net/README.md

@@ -17,11 +17,13 @@ sudo ip -6 route add fe80::/64 dev tap0
 sudo ip -6 route add fdaa::/64 dev tap0
 ```
 
+Second, have something listening there. For example `nc -l 8000`
+
 Then run the example located in the `examples` folder:
 
 ```sh
 cd $EMBASSY_ROOT/examples/std/
-cargo run --bin net
+cargo run --bin net -- --static-ip
 ```
 
 ## License

embassy-net/src/device.rs

@@ -1,129 +1,102 @@
-use core::task::Waker;
+use core::task::Context;
 
-use smoltcp::phy::{Device as SmolDevice, DeviceCapabilities};
-use smoltcp::time::Instant as SmolInstant;
+use embassy_net_driver::{Capabilities, Checksum, Driver, Medium, RxToken, TxToken};
+use smoltcp::phy;
+use smoltcp::time::Instant;
 
-use crate::packet_pool::PacketBoxExt;
-use crate::{Packet, PacketBox, PacketBuf};
-
-#[derive(PartialEq, Eq, Clone, Copy)]
-pub enum LinkState {
-    Down,
-    Up,
+pub(crate) struct DriverAdapter<'d, 'c, T>
+where
+    T: Driver,
+{
+    // must be Some when actually using this to rx/tx
+    pub cx: Option<&'d mut Context<'c>>,
+    pub inner: &'d mut T,
 }
 
-// 'static required due to the "fake GAT" in smoltcp::phy::Device.
-// https://github.com/smoltcp-rs/smoltcp/pull/572
-pub trait Device {
-    fn is_transmit_ready(&mut self) -> bool;
-    fn transmit(&mut self, pkt: PacketBuf);
-    fn receive(&mut self) -> Option<PacketBuf>;
+impl<'d, 'c, T> phy::Device for DriverAdapter<'d, 'c, T>
+where
+    T: Driver,
+{
+    type RxToken<'a> = RxTokenAdapter<T::RxToken<'a>> where Self: 'a;
+    type TxToken<'a> = TxTokenAdapter<T::TxToken<'a>> where Self: 'a;
 
-    fn register_waker(&mut self, waker: &Waker);
-    fn capabilities(&self) -> DeviceCapabilities;
-    fn link_state(&mut self) -> LinkState;
-    fn ethernet_address(&self) -> [u8; 6];
-}
-
-impl<T: ?Sized + Device> Device for &'static mut T {
-    fn is_transmit_ready(&mut self) -> bool {
-        T::is_transmit_ready(self)
-    }
-    fn transmit(&mut self, pkt: PacketBuf) {
-        T::transmit(self, pkt)
-    }
-    fn receive(&mut self) -> Option<PacketBuf> {
-        T::receive(self)
-    }
-    fn register_waker(&mut self, waker: &Waker) {
-        T::register_waker(self, waker)
-    }
-    fn capabilities(&self) -> DeviceCapabilities {
-        T::capabilities(self)
-    }
-    fn link_state(&mut self) -> LinkState {
-        T::link_state(self)
-    }
-    fn ethernet_address(&self) -> [u8; 6] {
-        T::ethernet_address(self)
-    }
-}
-
-pub struct DeviceAdapter<D: Device> {
-    pub device: D,
-    caps: DeviceCapabilities,
-}
-
-impl<D: Device> DeviceAdapter<D> {
-    pub(crate) fn new(device: D) -> Self {
-        Self {
-            caps: device.capabilities(),
-            device,
-        }
-    }
-}
-
-impl<'a, D: Device + 'static> SmolDevice<'a> for DeviceAdapter<D> {
-    type RxToken = RxToken;
-    type TxToken = TxToken<'a, D>;
-
-    fn receive(&'a mut self) -> Option<(Self::RxToken, Self::TxToken)> {
-        let tx_pkt = PacketBox::new(Packet::new())?;
-        let rx_pkt = self.device.receive()?;
-        let rx_token = RxToken { pkt: rx_pkt };
-        let tx_token = TxToken {
-            device: &mut self.device,
-            pkt: tx_pkt,
-        };
-
-        Some((rx_token, tx_token))
+    fn receive(&mut self, _timestamp: Instant) -> Option<(Self::RxToken<'_>, Self::TxToken<'_>)> {
+        self.inner
+            .receive(self.cx.as_deref_mut().unwrap())
+            .map(|(rx, tx)| (RxTokenAdapter(rx), TxTokenAdapter(tx)))
     }
 
     /// Construct a transmit token.
-    fn transmit(&'a mut self) -> Option<Self::TxToken> {
-        if !self.device.is_transmit_ready() {
-            return None;
-        }
-
-        let tx_pkt = PacketBox::new(Packet::new())?;
-        Some(TxToken {
-            device: &mut self.device,
-            pkt: tx_pkt,
-        })
+    fn transmit(&mut self, _timestamp: Instant) -> Option<Self::TxToken<'_>> {
+        self.inner.transmit(self.cx.as_deref_mut().unwrap()).map(TxTokenAdapter)
     }
 
     /// Get a description of device capabilities.
-    fn capabilities(&self) -> DeviceCapabilities {
-        self.caps.clone()
+    fn capabilities(&self) -> phy::DeviceCapabilities {
+        fn convert(c: Checksum) -> phy::Checksum {
+            match c {
+                Checksum::Both => phy::Checksum::Both,
+                Checksum::Tx => phy::Checksum::Tx,
+                Checksum::Rx => phy::Checksum::Rx,
+                Checksum::None => phy::Checksum::None,
+            }
+        }
+        let caps: Capabilities = self.inner.capabilities();
+        let mut smolcaps = phy::DeviceCapabilities::default();
+
+        smolcaps.max_transmission_unit = caps.max_transmission_unit;
+        smolcaps.max_burst_size = caps.max_burst_size;
+        smolcaps.medium = match caps.medium {
+            #[cfg(feature = "medium-ethernet")]
+            Medium::Ethernet => phy::Medium::Ethernet,
+            #[cfg(feature = "medium-ip")]
+            Medium::Ip => phy::Medium::Ip,
+            _ => panic!(
+                "Unsupported medium {:?}. MAke sure to enable it in embassy-net's Cargo features.",
+                caps.medium
+            ),
+        };
+        smolcaps.checksum.ipv4 = convert(caps.checksum.ipv4);
+        smolcaps.checksum.tcp = convert(caps.checksum.tcp);
+        smolcaps.checksum.udp = convert(caps.checksum.udp);
+        smolcaps.checksum.icmpv4 = convert(caps.checksum.icmpv4);
+        #[cfg(feature = "proto-ipv6")]
+        {
+            smolcaps.checksum.icmpv6 = convert(caps.checksum.icmpv6);
+        }
+
+        smolcaps
     }
 }
 
-pub struct RxToken {
-    pkt: PacketBuf,
-}
+pub(crate) struct RxTokenAdapter<T>(T)
+where
+    T: RxToken;
 
-impl smoltcp::phy::RxToken for RxToken {
-    fn consume<R, F>(mut self, _timestamp: SmolInstant, f: F) -> smoltcp::Result<R>
+impl<T> phy::RxToken for RxTokenAdapter<T>
+where
+    T: RxToken,
+{
+    fn consume<R, F>(self, f: F) -> R
     where
-        F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
+        F: FnOnce(&mut [u8]) -> R,
     {
-        f(&mut self.pkt)
+        self.0.consume(|buf| f(buf))
     }
 }
 
-pub struct TxToken<'a, D: Device> {
-    device: &'a mut D,
-    pkt: PacketBox,
-}
+pub(crate) struct TxTokenAdapter<T>(T)
+where
+    T: TxToken;
 
-impl<'a, D: Device> smoltcp::phy::TxToken for TxToken<'a, D> {
-    fn consume<R, F>(self, _timestamp: SmolInstant, len: usize, f: F) -> smoltcp::Result<R>
+impl<T> phy::TxToken for TxTokenAdapter<T>
+where
+    T: TxToken,
+{
+    fn consume<R, F>(self, len: usize, f: F) -> R
     where
-        F: FnOnce(&mut [u8]) -> smoltcp::Result<R>,
+        F: FnOnce(&mut [u8]) -> R,
     {
-        let mut buf = self.pkt.slice(0..len);
-        let r = f(&mut buf)?;
-        self.device.transmit(buf);
-        Ok(r)
+        self.0.consume(len, |buf| f(buf))
     }
 }

embassy-net/src/dns.rs

@@ -0,0 +1,97 @@
+//! DNS socket with async support.
+use heapless::Vec;
+pub use smoltcp::socket::dns::{DnsQuery, Socket};
+pub(crate) use smoltcp::socket::dns::{GetQueryResultError, StartQueryError};
+pub use smoltcp::wire::{DnsQueryType, IpAddress};
+
+use crate::{Driver, Stack};
+
+/// Errors returned by DnsSocket.
+#[derive(Debug, PartialEq, Eq, Clone, Copy)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum Error {
+    /// Invalid name
+    InvalidName,
+    /// Name too long
+    NameTooLong,
+    /// Name lookup failed
+    Failed,
+}
+
+impl From<GetQueryResultError> for Error {
+    fn from(_: GetQueryResultError) -> Self {
+        Self::Failed
+    }
+}
+
+impl From<StartQueryError> for Error {
+    fn from(e: StartQueryError) -> Self {
+        match e {
+            StartQueryError::NoFreeSlot => Self::Failed,
+            StartQueryError::InvalidName => Self::InvalidName,
+            StartQueryError::NameTooLong => Self::NameTooLong,
+        }
+    }
+}
+
+/// Async socket for making DNS queries.
+pub struct DnsSocket<'a, D>
+where
+    D: Driver + 'static,
+{
+    stack: &'a Stack<D>,
+}
+
+impl<'a, D> DnsSocket<'a, D>
+where
+    D: Driver + 'static,
+{
+    /// Create a new DNS socket using the provided stack.
+    ///
+    /// NOTE: If using DHCP, make sure it has reconfigured the stack to ensure the DNS servers are updated.
+    pub fn new(stack: &'a Stack<D>) -> Self {
+        Self { stack }
+    }
+
+    /// Make a query for a given name and return the corresponding IP addresses.
+    pub async fn query(&self, name: &str, qtype: DnsQueryType) -> Result<Vec<IpAddress, 1>, Error> {
+        self.stack.dns_query(name, qtype).await
+    }
+}
+
+#[cfg(all(feature = "unstable-traits", feature = "nightly"))]
+impl<'a, D> embedded_nal_async::Dns for DnsSocket<'a, D>
+where
+    D: Driver + 'static,
+{
+    type Error = Error;
+
+    async fn get_host_by_name(
+        &self,
+        host: &str,
+        addr_type: embedded_nal_async::AddrType,
+    ) -> Result<embedded_nal_async::IpAddr, Self::Error> {
+        use embedded_nal_async::{AddrType, IpAddr};
+        let qtype = match addr_type {
+            AddrType::IPv6 => DnsQueryType::Aaaa,
+            _ => DnsQueryType::A,
+        };
+        let addrs = self.query(host, qtype).await?;
+        if let Some(first) = addrs.get(0) {
+            Ok(match first {
+                IpAddress::Ipv4(addr) => IpAddr::V4(addr.0.into()),
+                #[cfg(feature = "proto-ipv6")]
+                IpAddress::Ipv6(addr) => IpAddr::V6(addr.0.into()),
+            })
+        } else {
+            Err(Error::Failed)
+        }
+    }
+
+    async fn get_host_by_address(
+        &self,
+        _addr: embedded_nal_async::IpAddr,
+    ) -> Result<heapless::String<256>, Self::Error> {
+        todo!()
+    }
+}

embassy-net/src/lib.rs

@@ -1,25 +1,40 @@
 #![cfg_attr(not(feature = "std"), no_std)]
-#![cfg_attr(feature = "nightly", feature(type_alias_impl_trait))]
+#![cfg_attr(
+    feature = "nightly",
+    feature(type_alias_impl_trait, async_fn_in_trait, impl_trait_projections)
+)]
+#![cfg_attr(feature = "nightly", allow(incomplete_features))]
 
 // This mod MUST go first, so that the others see its macros.
 pub(crate) mod fmt;
 
+pub use embassy_net_driver as driver;
+
 mod device;
-mod packet_pool;
-mod stack;
-
-pub use device::{Device, LinkState};
-pub use packet_pool::{Packet, PacketBox, PacketBoxExt, PacketBuf, MTU};
-pub use stack::{Config, ConfigStrategy, Stack, StackResources};
-
+#[cfg(feature = "dns")]
+pub mod dns;
 #[cfg(feature = "tcp")]
 pub mod tcp;
-
 #[cfg(feature = "udp")]
 pub mod udp;
 
+use core::cell::RefCell;
+use core::future::{poll_fn, Future};
+use core::task::{Context, Poll};
+
+use embassy_net_driver::{Driver, LinkState, Medium};
+use embassy_sync::waitqueue::WakerRegistration;
+use embassy_time::{Instant, Timer};
+use futures::pin_mut;
+use heapless::Vec;
+#[cfg(feature = "dhcpv4")]
+use smoltcp::iface::SocketHandle;
+use smoltcp::iface::{Interface, SocketSet, SocketStorage};
+#[cfg(feature = "dhcpv4")]
+use smoltcp::socket::dhcpv4;
+use smoltcp::socket::dhcpv4::RetryConfig;
+use smoltcp::time::Duration;
 // smoltcp reexports
-pub use smoltcp::phy::{DeviceCapabilities, Medium};
 pub use smoltcp::time::{Duration as SmolDuration, Instant as SmolInstant};
 #[cfg(feature = "medium-ethernet")]
 pub use smoltcp::wire::{EthernetAddress, HardwareAddress};
@@ -28,3 +43,435 @@ pub use smoltcp::wire::{IpAddress, IpCidr, Ipv4Address, Ipv4Cidr};
 pub use smoltcp::wire::{Ipv6Address, Ipv6Cidr};
 #[cfg(feature = "udp")]
 pub use smoltcp::{socket::udp::PacketMetadata, wire::IpListenEndpoint};
+
+use crate::device::DriverAdapter;
+
+const LOCAL_PORT_MIN: u16 = 1025;
+const LOCAL_PORT_MAX: u16 = 65535;
+#[cfg(feature = "dns")]
+const MAX_QUERIES: usize = 4;
+
+pub struct StackResources<const SOCK: usize> {
+    sockets: [SocketStorage<'static>; SOCK],
+    #[cfg(feature = "dns")]
+    queries: [Option<dns::DnsQuery>; MAX_QUERIES],
+}
+
+impl<const SOCK: usize> StackResources<SOCK> {
+    pub fn new() -> Self {
+        #[cfg(feature = "dns")]
+        const INIT: Option<dns::DnsQuery> = None;
+        Self {
+            sockets: [SocketStorage::EMPTY; SOCK],
+            #[cfg(feature = "dns")]
+            queries: [INIT; MAX_QUERIES],
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct StaticConfig {
+    pub address: Ipv4Cidr,
+    pub gateway: Option<Ipv4Address>,
+    pub dns_servers: Vec<Ipv4Address, 3>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DhcpConfig {
+    pub max_lease_duration: Option<Duration>,
+    pub retry_config: RetryConfig,
+    /// Ignore NAKs.
+    pub ignore_naks: bool,
+    /// Server port config
+    pub server_port: u16,
+    /// Client port config
+    pub client_port: u16,
+}
+
+impl Default for DhcpConfig {
+    fn default() -> Self {
+        Self {
+            max_lease_duration: Default::default(),
+            retry_config: Default::default(),
+            ignore_naks: Default::default(),
+            server_port: smoltcp::wire::DHCP_SERVER_PORT,
+            client_port: smoltcp::wire::DHCP_CLIENT_PORT,
+        }
+    }
+}
+
+pub enum Config {
+    Static(StaticConfig),
+    #[cfg(feature = "dhcpv4")]
+    Dhcp(DhcpConfig),
+}
+
+pub struct Stack<D: Driver> {
+    pub(crate) socket: RefCell<SocketStack>,
+    inner: RefCell<Inner<D>>,
+}
+
+struct Inner<D: Driver> {
+    device: D,
+    link_up: bool,
+    config: Option<StaticConfig>,
+    #[cfg(feature = "dhcpv4")]
+    dhcp_socket: Option<SocketHandle>,
+    #[cfg(feature = "dns")]
+    dns_socket: SocketHandle,
+    #[cfg(feature = "dns")]
+    dns_waker: WakerRegistration,
+}
+
+pub(crate) struct SocketStack {
+    pub(crate) sockets: SocketSet<'static>,
+    pub(crate) iface: Interface,
+    pub(crate) waker: WakerRegistration,
+    next_local_port: u16,
+}
+
+impl<D: Driver + 'static> Stack<D> {
+    pub fn new<const SOCK: usize>(
+        mut device: D,
+        config: Config,
+        resources: &'static mut StackResources<SOCK>,
+        random_seed: u64,
+    ) -> Self {
+        #[cfg(feature = "medium-ethernet")]
+        let medium = device.capabilities().medium;
+
+        let mut iface_cfg = smoltcp::iface::Config::new();
+        iface_cfg.random_seed = random_seed;
+        #[cfg(feature = "medium-ethernet")]
+        if medium == Medium::Ethernet {
+            iface_cfg.hardware_addr = Some(HardwareAddress::Ethernet(EthernetAddress(device.ethernet_address())));
+        }
+
+        let iface = Interface::new(
+            iface_cfg,
+            &mut DriverAdapter {
+                inner: &mut device,
+                cx: None,
+            },
+        );
+
+        let sockets = SocketSet::new(&mut resources.sockets[..]);
+
+        let next_local_port = (random_seed % (LOCAL_PORT_MAX - LOCAL_PORT_MIN) as u64) as u16 + LOCAL_PORT_MIN;
+
+        let mut socket = SocketStack {
+            sockets,
+            iface,
+            waker: WakerRegistration::new(),
+            next_local_port,
+        };
+
+        let mut inner = Inner {
+            device,
+            link_up: false,
+            config: None,
+            #[cfg(feature = "dhcpv4")]
+            dhcp_socket: None,
+            #[cfg(feature = "dns")]
+            dns_socket: socket.sockets.add(dns::Socket::new(
+                &[],
+                managed::ManagedSlice::Borrowed(&mut resources.queries),
+            )),
+            #[cfg(feature = "dns")]
+            dns_waker: WakerRegistration::new(),
+        };
+
+        match config {
+            Config::Static(config) => {
+                inner.apply_config(&mut socket, config);
+            }
+            #[cfg(feature = "dhcpv4")]
+            Config::Dhcp(config) => {
+                let mut dhcp_socket = smoltcp::socket::dhcpv4::Socket::new();
+                inner.apply_dhcp_config(&mut dhcp_socket, config);
+                let handle = socket.sockets.add(dhcp_socket);
+                inner.dhcp_socket = Some(handle);
+            }
+        }
+
+        Self {
+            socket: RefCell::new(socket),
+            inner: RefCell::new(inner),
+        }
+    }
+
+    fn with<R>(&self, f: impl FnOnce(&SocketStack, &Inner<D>) -> R) -> R {
+        f(&*self.socket.borrow(), &*self.inner.borrow())
+    }
+
+    fn with_mut<R>(&self, f: impl FnOnce(&mut SocketStack, &mut Inner<D>) -> R) -> R {
+        f(&mut *self.socket.borrow_mut(), &mut *self.inner.borrow_mut())
+    }
+
+    pub fn ethernet_address(&self) -> [u8; 6] {
+        self.with(|_s, i| i.device.ethernet_address())
+    }
+
+    pub fn is_link_up(&self) -> bool {
+        self.with(|_s, i| i.link_up)
+    }
+
+    pub fn is_config_up(&self) -> bool {
+        self.with(|_s, i| i.config.is_some())
+    }
+
+    pub fn config(&self) -> Option<StaticConfig> {
+        self.with(|_s, i| i.config.clone())
+    }
+
+    pub async fn run(&self) -> ! {
+        poll_fn(|cx| {
+            self.with_mut(|s, i| i.poll(cx, s));
+            Poll::<()>::Pending
+        })
+        .await;
+        unreachable!()
+    }
+
+    /// Make a query for a given name and return the corresponding IP addresses.
+    #[cfg(feature = "dns")]
+    pub async fn dns_query(&self, name: &str, qtype: dns::DnsQueryType) -> Result<Vec<IpAddress, 1>, dns::Error> {
+        // For A and AAAA queries we try detect whether `name` is just an IP address
+        match qtype {
+            dns::DnsQueryType::A => {
+                if let Ok(ip) = name.parse().map(IpAddress::Ipv4) {
+                    return Ok([ip].into_iter().collect());
+                }
+            }
+            #[cfg(feature = "proto-ipv6")]
+            dns::DnsQueryType::Aaaa => {
+                if let Ok(ip) = name.parse().map(IpAddress::Ipv6) {
+                    return Ok([ip].into_iter().collect());
+                }
+            }
+            _ => {}
+        }
+
+        let query = poll_fn(|cx| {
+            self.with_mut(|s, i| {
+                let socket = s.sockets.get_mut::<dns::Socket>(i.dns_socket);
+                match socket.start_query(s.iface.context(), name, qtype) {
+                    Ok(handle) => Poll::Ready(Ok(handle)),
+                    Err(dns::StartQueryError::NoFreeSlot) => {
+                        i.dns_waker.register(cx.waker());
+                        Poll::Pending
+                    }
+                    Err(e) => Poll::Ready(Err(e)),
+                }
+            })
+        })
+        .await?;
+
+        use embassy_hal_common::drop::OnDrop;
+        let drop = OnDrop::new(|| {
+            self.with_mut(|s, i| {
+                let socket = s.sockets.get_mut::<dns::Socket>(i.dns_socket);
+                socket.cancel_query(query);
+                s.waker.wake();
+                i.dns_waker.wake();
+            })
+        });
+
+        let res = poll_fn(|cx| {
+            self.with_mut(|s, i| {
+                let socket = s.sockets.get_mut::<dns::Socket>(i.dns_socket);
+                match socket.get_query_result(query) {
+                    Ok(addrs) => {
+                        i.dns_waker.wake();
+                        Poll::Ready(Ok(addrs))
+                    }
+                    Err(dns::GetQueryResultError::Pending) => {
+                        socket.register_query_waker(query, cx.waker());
+                        Poll::Pending
+                    }
+                    Err(e) => {
+                        i.dns_waker.wake();
+                        Poll::Ready(Err(e.into()))
+                    }
+                }
+            })
+        })
+        .await;
+
+        drop.defuse();
+
+        res
+    }
+}
+
+#[cfg(feature = "igmp")]
+impl<D: Driver + smoltcp::phy::Device + 'static> Stack<D> {
+    pub fn join_multicast_group<T>(&self, addr: T) -> Result<bool, smoltcp::iface::MulticastError>
+    where
+        T: Into<IpAddress>,
+    {
+        let addr = addr.into();
+
+        self.with_mut(|s, i| {
+            s.iface
+                .join_multicast_group(&mut i.device, addr, instant_to_smoltcp(Instant::now()))
+        })
+    }
+
+    pub fn leave_multicast_group<T>(&self, addr: T) -> Result<bool, smoltcp::iface::MulticastError>
+    where
+        T: Into<IpAddress>,
+    {
+        let addr = addr.into();
+
+        self.with_mut(|s, i| {
+            s.iface
+                .leave_multicast_group(&mut i.device, addr, instant_to_smoltcp(Instant::now()))
+        })
+    }
+
+    pub fn has_multicast_group<T: Into<IpAddress>>(&self, addr: T) -> bool {
+        self.socket.borrow().iface.has_multicast_group(addr)
+    }
+}
+
+impl SocketStack {
+    #[allow(clippy::absurd_extreme_comparisons, dead_code)]
+    pub fn get_local_port(&mut self) -> u16 {
+        let res = self.next_local_port;
+        self.next_local_port = if res >= LOCAL_PORT_MAX { LOCAL_PORT_MIN } else { res + 1 };
+        res
+    }
+}
+
+impl<D: Driver + 'static> Inner<D> {
+    fn apply_config(&mut self, s: &mut SocketStack, config: StaticConfig) {
+        #[cfg(feature = "medium-ethernet")]
+        let medium = self.device.capabilities().medium;
+
+        debug!("Acquired IP configuration:");
+
+        debug!("   IP address:      {}", config.address);
+        s.iface.update_ip_addrs(|addrs| {
+            if addrs.is_empty() {
+                addrs.push(IpCidr::Ipv4(config.address)).unwrap();
+            } else {
+                addrs[0] = IpCidr::Ipv4(config.address);
+            }
+        });
+
+        #[cfg(feature = "medium-ethernet")]
+        if medium == Medium::Ethernet {
+            if let Some(gateway) = config.gateway {
+                debug!("   Default gateway: {}", gateway);
+                s.iface.routes_mut().add_default_ipv4_route(gateway).unwrap();
+            } else {
+                debug!("   Default gateway: None");
+                s.iface.routes_mut().remove_default_ipv4_route();
+            }
+        }
+        for (i, s) in config.dns_servers.iter().enumerate() {
+            debug!("   DNS server {}:    {}", i, s);
+        }
+
+        #[cfg(feature = "dns")]
+        {
+            let socket = s.sockets.get_mut::<smoltcp::socket::dns::Socket>(self.dns_socket);
+            let servers: Vec<IpAddress, 3> = config.dns_servers.iter().map(|c| IpAddress::Ipv4(*c)).collect();
+            socket.update_servers(&servers[..]);
+        }
+
+        self.config = Some(config)
+    }
+
+    fn apply_dhcp_config(&self, socket: &mut smoltcp::socket::dhcpv4::Socket, config: DhcpConfig) {
+        socket.set_ignore_naks(config.ignore_naks);
+        socket.set_max_lease_duration(config.max_lease_duration);
+        socket.set_ports(config.server_port, config.client_port);
+        socket.set_retry_config(config.retry_config);
+    }
+
+    #[allow(unused)] // used only with dhcp
+    fn unapply_config(&mut self, s: &mut SocketStack) {
+        #[cfg(feature = "medium-ethernet")]
+        let medium = self.device.capabilities().medium;
+
+        debug!("Lost IP configuration");
+        s.iface.update_ip_addrs(|ip_addrs| ip_addrs.clear());
+        #[cfg(feature = "medium-ethernet")]
+        if medium == Medium::Ethernet {
+            s.iface.routes_mut().remove_default_ipv4_route();
+        }
+        self.config = None
+    }
+
+    fn poll(&mut self, cx: &mut Context<'_>, s: &mut SocketStack) {
+        s.waker.register(cx.waker());
+
+        #[cfg(feature = "medium-ethernet")]
+        if self.device.capabilities().medium == Medium::Ethernet {
+            s.iface.set_hardware_addr(HardwareAddress::Ethernet(EthernetAddress(
+                self.device.ethernet_address(),
+            )));
+        }
+
+        let timestamp = instant_to_smoltcp(Instant::now());
+        let mut smoldev = DriverAdapter {
+            cx: Some(cx),
+            inner: &mut self.device,
+        };
+        s.iface.poll(timestamp, &mut smoldev, &mut s.sockets);
+
+        // Update link up
+        let old_link_up = self.link_up;
+        self.link_up = self.device.link_state(cx) == LinkState::Up;
+
+        // Print when changed
+        if old_link_up != self.link_up {
+            info!("link_up = {:?}", self.link_up);
+        }
+
+        #[cfg(feature = "dhcpv4")]
+        if let Some(dhcp_handle) = self.dhcp_socket {
+            let socket = s.sockets.get_mut::<dhcpv4::Socket>(dhcp_handle);
+
+            if self.link_up {
+                match socket.poll() {
+                    None => {}
+                    Some(dhcpv4::Event::Deconfigured) => self.unapply_config(s),
+                    Some(dhcpv4::Event::Configured(config)) => {
+                        let config = StaticConfig {
+                            address: config.address,
+                            gateway: config.router,
+                            dns_servers: config.dns_servers,
+                        };
+                        self.apply_config(s, config)
+                    }
+                }
+            } else if old_link_up {
+                socket.reset();
+                self.unapply_config(s);
+            }
+        }
+        //if old_link_up || self.link_up {
+        //    self.poll_configurator(timestamp)
+        //}
+        //
+
+        if let Some(poll_at) = s.iface.poll_at(timestamp, &mut s.sockets) {
+            let t = Timer::at(instant_from_smoltcp(poll_at));
+            pin_mut!(t);
+            if t.poll(cx).is_ready() {
+                cx.waker().wake_by_ref();
+            }
+        }
+    }
+}
+
+fn instant_to_smoltcp(instant: Instant) -> SmolInstant {
+    SmolInstant::from_millis(instant.as_millis() as i64)
+}
+
+fn instant_from_smoltcp(instant: SmolInstant) -> Instant {
+    Instant::from_millis(instant.total_millis() as u64)
+}

embassy-net/src/packet_pool.rs

@@ -1,107 +0,0 @@
-use core::ops::{Deref, DerefMut, Range};
-
-use as_slice::{AsMutSlice, AsSlice};
-use atomic_pool::{pool, Box};
-
-pub const MTU: usize = 1516;
-
-#[cfg(feature = "pool-4")]
-pub const PACKET_POOL_SIZE: usize = 4;
-
-#[cfg(feature = "pool-8")]
-pub const PACKET_POOL_SIZE: usize = 8;
-
-#[cfg(feature = "pool-16")]
-pub const PACKET_POOL_SIZE: usize = 16;
-
-#[cfg(feature = "pool-32")]
-pub const PACKET_POOL_SIZE: usize = 32;
-
-#[cfg(feature = "pool-64")]
-pub const PACKET_POOL_SIZE: usize = 64;
-
-#[cfg(feature = "pool-128")]
-pub const PACKET_POOL_SIZE: usize = 128;
-
-pool!(pub PacketPool: [Packet; PACKET_POOL_SIZE]);
-pub type PacketBox = Box<PacketPool>;
-
-#[repr(align(4))]
-pub struct Packet(pub [u8; MTU]);
-
-impl Packet {
-    pub const fn new() -> Self {
-        Self([0; MTU])
-    }
-}
-
-pub trait PacketBoxExt {
-    fn slice(self, range: Range<usize>) -> PacketBuf;
-}
-
-impl PacketBoxExt for PacketBox {
-    fn slice(self, range: Range<usize>) -> PacketBuf {
-        PacketBuf { packet: self, range }
-    }
-}
-
-impl AsSlice for Packet {
-    type Element = u8;
-
-    fn as_slice(&self) -> &[Self::Element] {
-        &self.deref()[..]
-    }
-}
-
-impl AsMutSlice for Packet {
-    fn as_mut_slice(&mut self) -> &mut [Self::Element] {
-        &mut self.deref_mut()[..]
-    }
-}
-
-impl Deref for Packet {
-    type Target = [u8; MTU];
-
-    fn deref(&self) -> &[u8; MTU] {
-        &self.0
-    }
-}
-
-impl DerefMut for Packet {
-    fn deref_mut(&mut self) -> &mut [u8; MTU] {
-        &mut self.0
-    }
-}
-
-pub struct PacketBuf {
-    packet: PacketBox,
-    range: Range<usize>,
-}
-
-impl AsSlice for PacketBuf {
-    type Element = u8;
-
-    fn as_slice(&self) -> &[Self::Element] {
-        &self.packet[self.range.clone()]
-    }
-}
-
-impl AsMutSlice for PacketBuf {
-    fn as_mut_slice(&mut self) -> &mut [Self::Element] {
-        &mut self.packet[self.range.clone()]
-    }
-}
-
-impl Deref for PacketBuf {
-    type Target = [u8];
-
-    fn deref(&self) -> &[u8] {
-        &self.packet[self.range.clone()]
-    }
-}
-
-impl DerefMut for PacketBuf {
-    fn deref_mut(&mut self) -> &mut [u8] {
-        &mut self.packet[self.range.clone()]
-    }
-}

embassy-net/src/stack.rs

@@ -1,315 +0,0 @@
-use core::cell::UnsafeCell;
-use core::future::{poll_fn, Future};
-use core::task::{Context, Poll};
-
-use embassy_sync::waitqueue::WakerRegistration;
-use embassy_time::{Instant, Timer};
-use futures::pin_mut;
-use heapless::Vec;
-#[cfg(feature = "dhcpv4")]
-use smoltcp::iface::SocketHandle;
-use smoltcp::iface::{Interface, InterfaceBuilder, SocketSet, SocketStorage};
-#[cfg(feature = "medium-ethernet")]
-use smoltcp::iface::{Neighbor, NeighborCache, Route, Routes};
-#[cfg(feature = "medium-ethernet")]
-use smoltcp::phy::{Device as _, Medium};
-#[cfg(feature = "dhcpv4")]
-use smoltcp::socket::dhcpv4;
-use smoltcp::time::Instant as SmolInstant;
-#[cfg(feature = "medium-ethernet")]
-use smoltcp::wire::{EthernetAddress, HardwareAddress, IpAddress};
-use smoltcp::wire::{IpCidr, Ipv4Address, Ipv4Cidr};
-
-use crate::device::{Device, DeviceAdapter, LinkState};
-
-const LOCAL_PORT_MIN: u16 = 1025;
-const LOCAL_PORT_MAX: u16 = 65535;
-
-pub struct StackResources<const ADDR: usize, const SOCK: usize, const NEIGHBOR: usize> {
-    addresses: [IpCidr; ADDR],
-    sockets: [SocketStorage<'static>; SOCK],
-
-    #[cfg(feature = "medium-ethernet")]
-    routes: [Option<(IpCidr, Route)>; 1],
-    #[cfg(feature = "medium-ethernet")]
-    neighbor_cache: [Option<(IpAddress, Neighbor)>; NEIGHBOR],
-}
-
-impl<const ADDR: usize, const SOCK: usize, const NEIGHBOR: usize> StackResources<ADDR, SOCK, NEIGHBOR> {
-    pub fn new() -> Self {
-        Self {
-            addresses: [IpCidr::new(Ipv4Address::UNSPECIFIED.into(), 32); ADDR],
-            sockets: [SocketStorage::EMPTY; SOCK],
-            #[cfg(feature = "medium-ethernet")]
-            routes: [None; 1],
-            #[cfg(feature = "medium-ethernet")]
-            neighbor_cache: [None; NEIGHBOR],
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct Config {
-    pub address: Ipv4Cidr,
-    pub gateway: Option<Ipv4Address>,
-    pub dns_servers: Vec<Ipv4Address, 3>,
-}
-
-pub enum ConfigStrategy {
-    Static(Config),
-    #[cfg(feature = "dhcpv4")]
-    Dhcp,
-}
-
-pub struct Stack<D: Device> {
-    pub(crate) socket: UnsafeCell<SocketStack>,
-    inner: UnsafeCell<Inner<D>>,
-}
-
-struct Inner<D: Device> {
-    device: DeviceAdapter<D>,
-    link_up: bool,
-    config: Option<Config>,
-    #[cfg(feature = "dhcpv4")]
-    dhcp_socket: Option<SocketHandle>,
-}
-
-pub(crate) struct SocketStack {
-    pub(crate) sockets: SocketSet<'static>,
-    pub(crate) iface: Interface<'static>,
-    pub(crate) waker: WakerRegistration,
-    next_local_port: u16,
-}
-
-unsafe impl<D: Device> Send for Stack<D> {}
-
-impl<D: Device + 'static> Stack<D> {
-    pub fn new<const ADDR: usize, const SOCK: usize, const NEIGH: usize>(
-        device: D,
-        config: ConfigStrategy,
-        resources: &'static mut StackResources<ADDR, SOCK, NEIGH>,
-        random_seed: u64,
-    ) -> Self {
-        #[cfg(feature = "medium-ethernet")]
-        let medium = device.capabilities().medium;
-
-        #[cfg(feature = "medium-ethernet")]
-        let ethernet_addr = if medium == Medium::Ethernet {
-            device.ethernet_address()
-        } else {
-            [0, 0, 0, 0, 0, 0]
-        };
-
-        let mut device = DeviceAdapter::new(device);
-
-        let mut b = InterfaceBuilder::new();
-        b = b.ip_addrs(&mut resources.addresses[..]);
-        b = b.random_seed(random_seed);
-
-        #[cfg(feature = "medium-ethernet")]
-        if medium == Medium::Ethernet {
-            b = b.hardware_addr(HardwareAddress::Ethernet(EthernetAddress(ethernet_addr)));
-            b = b.neighbor_cache(NeighborCache::new(&mut resources.neighbor_cache[..]));
-            b = b.routes(Routes::new(&mut resources.routes[..]));
-        }
-
-        let iface = b.finalize(&mut device);
-
-        let sockets = SocketSet::new(&mut resources.sockets[..]);
-
-        let next_local_port = (random_seed % (LOCAL_PORT_MAX - LOCAL_PORT_MIN) as u64) as u16 + LOCAL_PORT_MIN;
-
-        let mut inner = Inner {
-            device,
-            link_up: false,
-            config: None,
-            #[cfg(feature = "dhcpv4")]
-            dhcp_socket: None,
-        };
-        let mut socket = SocketStack {
-            sockets,
-            iface,
-            waker: WakerRegistration::new(),
-            next_local_port,
-        };
-
-        match config {
-            ConfigStrategy::Static(config) => inner.apply_config(&mut socket, config),
-            #[cfg(feature = "dhcpv4")]
-            ConfigStrategy::Dhcp => {
-                let handle = socket.sockets.add(smoltcp::socket::dhcpv4::Socket::new());
-                inner.dhcp_socket = Some(handle);
-            }
-        }
-
-        Self {
-            socket: UnsafeCell::new(socket),
-            inner: UnsafeCell::new(inner),
-        }
-    }
-
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with<R>(&self, f: impl FnOnce(&SocketStack, &Inner<D>) -> R) -> R {
-        f(&*self.socket.get(), &*self.inner.get())
-    }
-
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with_mut<R>(&self, f: impl FnOnce(&mut SocketStack, &mut Inner<D>) -> R) -> R {
-        f(&mut *self.socket.get(), &mut *self.inner.get())
-    }
-
-    pub fn ethernet_address(&self) -> [u8; 6] {
-        unsafe { self.with(|_s, i| i.device.device.ethernet_address()) }
-    }
-
-    pub fn is_link_up(&self) -> bool {
-        unsafe { self.with(|_s, i| i.link_up) }
-    }
-
-    pub fn is_config_up(&self) -> bool {
-        unsafe { self.with(|_s, i| i.config.is_some()) }
-    }
-
-    pub fn config(&self) -> Option<Config> {
-        unsafe { self.with(|_s, i| i.config.clone()) }
-    }
-
-    pub async fn run(&self) -> ! {
-        poll_fn(|cx| {
-            unsafe { self.with_mut(|s, i| i.poll(cx, s)) }
-            Poll::<()>::Pending
-        })
-        .await;
-        unreachable!()
-    }
-}
-
-impl SocketStack {
-    #[allow(clippy::absurd_extreme_comparisons)]
-    pub fn get_local_port(&mut self) -> u16 {
-        let res = self.next_local_port;
-        self.next_local_port = if res >= LOCAL_PORT_MAX { LOCAL_PORT_MIN } else { res + 1 };
-        res
-    }
-}
-
-impl<D: Device + 'static> Inner<D> {
-    fn apply_config(&mut self, s: &mut SocketStack, config: Config) {
-        #[cfg(feature = "medium-ethernet")]
-        let medium = self.device.capabilities().medium;
-
-        debug!("Acquired IP configuration:");
-
-        debug!("   IP address:      {}", config.address);
-        self.set_ipv4_addr(s, config.address);
-
-        #[cfg(feature = "medium-ethernet")]
-        if medium == Medium::Ethernet {
-            if let Some(gateway) = config.gateway {
-                debug!("   Default gateway: {}", gateway);
-                s.iface.routes_mut().add_default_ipv4_route(gateway).unwrap();
-            } else {
-                debug!("   Default gateway: None");
-                s.iface.routes_mut().remove_default_ipv4_route();
-            }
-        }
-        for (i, s) in config.dns_servers.iter().enumerate() {
-            debug!("   DNS server {}:    {}", i, s);
-        }
-
-        self.config = Some(config)
-    }
-
-    #[allow(unused)] // used only with dhcp
-    fn unapply_config(&mut self, s: &mut SocketStack) {
-        #[cfg(feature = "medium-ethernet")]
-        let medium = self.device.capabilities().medium;
-
-        debug!("Lost IP configuration");
-        self.set_ipv4_addr(s, Ipv4Cidr::new(Ipv4Address::UNSPECIFIED, 0));
-        #[cfg(feature = "medium-ethernet")]
-        if medium == Medium::Ethernet {
-            s.iface.routes_mut().remove_default_ipv4_route();
-        }
-        self.config = None
-    }
-
-    fn set_ipv4_addr(&mut self, s: &mut SocketStack, cidr: Ipv4Cidr) {
-        s.iface.update_ip_addrs(|addrs| {
-            let dest = addrs.iter_mut().next().unwrap();
-            *dest = IpCidr::Ipv4(cidr);
-        });
-    }
-
-    fn poll(&mut self, cx: &mut Context<'_>, s: &mut SocketStack) {
-        self.device.device.register_waker(cx.waker());
-        s.waker.register(cx.waker());
-
-        let timestamp = instant_to_smoltcp(Instant::now());
-        if s.iface.poll(timestamp, &mut self.device, &mut s.sockets).is_err() {
-            // If poll() returns error, it may not be done yet, so poll again later.
-            cx.waker().wake_by_ref();
-            return;
-        }
-
-        // Update link up
-        let old_link_up = self.link_up;
-        self.link_up = self.device.device.link_state() == LinkState::Up;
-
-        // Print when changed
-        if old_link_up != self.link_up {
-            info!("link_up = {:?}", self.link_up);
-        }
-
-        #[cfg(feature = "dhcpv4")]
-        if let Some(dhcp_handle) = self.dhcp_socket {
-            let socket = s.sockets.get_mut::<dhcpv4::Socket>(dhcp_handle);
-
-            if self.link_up {
-                match socket.poll() {
-                    None => {}
-                    Some(dhcpv4::Event::Deconfigured) => self.unapply_config(s),
-                    Some(dhcpv4::Event::Configured(config)) => {
-                        let mut dns_servers = Vec::new();
-                        for s in &config.dns_servers {
-                            if let Some(addr) = s {
-                                dns_servers.push(addr.clone()).unwrap();
-                            }
-                        }
-
-                        self.apply_config(
-                            s,
-                            Config {
-                                address: config.address,
-                                gateway: config.router,
-                                dns_servers,
-                            },
-                        )
-                    }
-                }
-            } else if old_link_up {
-                socket.reset();
-                self.unapply_config(s);
-            }
-        }
-        //if old_link_up || self.link_up {
-        //    self.poll_configurator(timestamp)
-        //}
-
-        if let Some(poll_at) = s.iface.poll_at(timestamp, &mut s.sockets) {
-            let t = Timer::at(instant_from_smoltcp(poll_at));
-            pin_mut!(t);
-            if t.poll(cx).is_ready() {
-                cx.waker().wake_by_ref();
-            }
-        }
-    }
-}
-
-fn instant_to_smoltcp(instant: Instant) -> SmolInstant {
-    SmolInstant::from_millis(instant.as_millis() as i64)
-}
-
-fn instant_from_smoltcp(instant: SmolInstant) -> Instant {
-    Instant::from_millis(instant.total_millis() as u64)
-}

embassy-net/src/tcp.rs

@@ -1,16 +1,15 @@
-use core::cell::UnsafeCell;
+use core::cell::RefCell;
 use core::future::poll_fn;
 use core::mem;
 use core::task::Poll;
 
+use embassy_net_driver::Driver;
 use smoltcp::iface::{Interface, SocketHandle};
 use smoltcp::socket::tcp;
 use smoltcp::time::Duration;
 use smoltcp::wire::{IpEndpoint, IpListenEndpoint};
 
-use super::stack::Stack;
-use crate::stack::SocketStack;
-use crate::Device;
+use crate::{SocketStack, Stack};
 
 #[derive(PartialEq, Eq, Clone, Copy, Debug)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
@@ -64,12 +63,15 @@ impl<'a> TcpWriter<'a> {
     pub async fn write(&mut self, buf: &[u8]) -> Result<usize, Error> {
         self.io.write(buf).await
     }
+
+    pub async fn flush(&mut self) -> Result<(), Error> {
+        self.io.flush().await
+    }
 }
 
 impl<'a> TcpSocket<'a> {
-    pub fn new<D: Device>(stack: &'a Stack<D>, rx_buffer: &'a mut [u8], tx_buffer: &'a mut [u8]) -> Self {
-        // safety: not accessed reentrantly.
-        let s = unsafe { &mut *stack.socket.get() };
+    pub fn new<D: Driver>(stack: &'a Stack<D>, rx_buffer: &'a mut [u8], tx_buffer: &'a mut [u8]) -> Self {
+        let s = &mut *stack.socket.borrow_mut();
         let rx_buffer: &'static mut [u8] = unsafe { mem::transmute(rx_buffer) };
         let tx_buffer: &'static mut [u8] = unsafe { mem::transmute(tx_buffer) };
         let handle = s.sockets.add(tcp::Socket::new(
@@ -93,17 +95,18 @@ impl<'a> TcpSocket<'a> {
     where
         T: Into<IpEndpoint>,
     {
-        // safety: not accessed reentrantly.
-        let local_port = unsafe { &mut *self.io.stack.get() }.get_local_port();
+        let local_port = self.io.stack.borrow_mut().get_local_port();
 
-        // safety: not accessed reentrantly.
-        match unsafe { self.io.with_mut(|s, i| s.connect(i, remote_endpoint, local_port)) } {
+        match {
+            self.io
+                .with_mut(|s, i| s.connect(i.context(), remote_endpoint, local_port))
+        } {
             Ok(()) => {}
             Err(tcp::ConnectError::InvalidState) => return Err(ConnectError::InvalidState),
             Err(tcp::ConnectError::Unaddressable) => return Err(ConnectError::NoRoute),
         }
 
-        poll_fn(|cx| unsafe {
+        poll_fn(|cx| {
             self.io.with_mut(|s, _| match s.state() {
                 tcp::State::Closed | tcp::State::TimeWait => Poll::Ready(Err(ConnectError::ConnectionReset)),
                 tcp::State::Listen => unreachable!(),
@@ -121,14 +124,13 @@ impl<'a> TcpSocket<'a> {
     where
         T: Into<IpListenEndpoint>,
     {
-        // safety: not accessed reentrantly.
-        match unsafe { self.io.with_mut(|s, _| s.listen(local_endpoint)) } {
+        match self.io.with_mut(|s, _| s.listen(local_endpoint)) {
             Ok(()) => {}
             Err(tcp::ListenError::InvalidState) => return Err(AcceptError::InvalidState),
             Err(tcp::ListenError::Unaddressable) => return Err(AcceptError::InvalidPort),
         }
 
-        poll_fn(|cx| unsafe {
+        poll_fn(|cx| {
             self.io.with_mut(|s, _| match s.state() {
                 tcp::State::Listen | tcp::State::SynSent | tcp::State::SynReceived => {
                     s.register_send_waker(cx.waker());
@@ -148,52 +150,54 @@ impl<'a> TcpSocket<'a> {
         self.io.write(buf).await
     }
 
+    pub async fn flush(&mut self) -> Result<(), Error> {
+        self.io.flush().await
+    }
+
     pub fn set_timeout(&mut self, duration: Option<Duration>) {
-        unsafe { self.io.with_mut(|s, _| s.set_timeout(duration)) }
+        self.io.with_mut(|s, _| s.set_timeout(duration))
     }
 
     pub fn set_keep_alive(&mut self, interval: Option<Duration>) {
-        unsafe { self.io.with_mut(|s, _| s.set_keep_alive(interval)) }
+        self.io.with_mut(|s, _| s.set_keep_alive(interval))
     }
 
     pub fn set_hop_limit(&mut self, hop_limit: Option<u8>) {
-        unsafe { self.io.with_mut(|s, _| s.set_hop_limit(hop_limit)) }
+        self.io.with_mut(|s, _| s.set_hop_limit(hop_limit))
     }
 
     pub fn local_endpoint(&self) -> Option<IpEndpoint> {
-        unsafe { self.io.with(|s, _| s.local_endpoint()) }
+        self.io.with(|s, _| s.local_endpoint())
     }
 
     pub fn remote_endpoint(&self) -> Option<IpEndpoint> {
-        unsafe { self.io.with(|s, _| s.remote_endpoint()) }
+        self.io.with(|s, _| s.remote_endpoint())
     }
 
     pub fn state(&self) -> tcp::State {
-        unsafe { self.io.with(|s, _| s.state()) }
+        self.io.with(|s, _| s.state())
     }
 
     pub fn close(&mut self) {
-        unsafe { self.io.with_mut(|s, _| s.close()) }
+        self.io.with_mut(|s, _| s.close())
     }
 
     pub fn abort(&mut self) {
-        unsafe { self.io.with_mut(|s, _| s.abort()) }
+        self.io.with_mut(|s, _| s.abort())
     }
 
     pub fn may_send(&self) -> bool {
-        unsafe { self.io.with(|s, _| s.may_send()) }
+        self.io.with(|s, _| s.may_send())
     }
 
     pub fn may_recv(&self) -> bool {
-        unsafe { self.io.with(|s, _| s.may_recv()) }
+        self.io.with(|s, _| s.may_recv())
     }
 }
 
 impl<'a> Drop for TcpSocket<'a> {
     fn drop(&mut self) {
-        // safety: not accessed reentrantly.
-        let s = unsafe { &mut *self.io.stack.get() };
-        s.sockets.remove(self.io.handle);
+        self.io.stack.borrow_mut().sockets.remove(self.io.handle);
     }
 }
 
@@ -201,21 +205,19 @@ impl<'a> Drop for TcpSocket<'a> {
 
 #[derive(Copy, Clone)]
 struct TcpIo<'a> {
-    stack: &'a UnsafeCell<SocketStack>,
+    stack: &'a RefCell<SocketStack>,
     handle: SocketHandle,
 }
 
 impl<'d> TcpIo<'d> {
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with<R>(&self, f: impl FnOnce(&tcp::Socket, &Interface) -> R) -> R {
-        let s = &*self.stack.get();
+    fn with<R>(&self, f: impl FnOnce(&tcp::Socket, &Interface) -> R) -> R {
+        let s = &*self.stack.borrow();
         let socket = s.sockets.get::<tcp::Socket>(self.handle);
         f(socket, &s.iface)
     }
 
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with_mut<R>(&mut self, f: impl FnOnce(&mut tcp::Socket, &mut Interface) -> R) -> R {
-        let s = &mut *self.stack.get();
+    fn with_mut<R>(&mut self, f: impl FnOnce(&mut tcp::Socket, &mut Interface) -> R) -> R {
+        let s = &mut *self.stack.borrow_mut();
         let socket = s.sockets.get_mut::<tcp::Socket>(self.handle);
         let res = f(socket, &mut s.iface);
         s.waker.wake();
@@ -223,7 +225,7 @@ impl<'d> TcpIo<'d> {
     }
 
     async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Error> {
-        poll_fn(move |cx| unsafe {
+        poll_fn(move |cx| {
             // CAUTION: smoltcp semantics around EOF are different to what you'd expect
             // from posix-like IO, so we have to tweak things here.
             self.with_mut(|s, _| match s.recv_slice(buf) {
@@ -244,7 +246,7 @@ impl<'d> TcpIo<'d> {
     }
 
     async fn write(&mut self, buf: &[u8]) -> Result<usize, Error> {
-        poll_fn(move |cx| unsafe {
+        poll_fn(move |cx| {
             self.with_mut(|s, _| match s.send_slice(buf) {
                 // Not ready to send (no space in the tx buffer)
                 Ok(0) => {
@@ -260,10 +262,19 @@ impl<'d> TcpIo<'d> {
         .await
     }
 
-    #[allow(unused)]
     async fn flush(&mut self) -> Result<(), Error> {
-        poll_fn(move |_| {
-            Poll::Ready(Ok(())) // TODO: Is there a better implementation for this?
+        poll_fn(move |cx| {
+            self.with_mut(|s, _| {
+                // If there are outstanding send operations, register for wake up and wait
+                // smoltcp issues wake-ups when octets are dequeued from the send buffer
+                if s.send_queue() > 0 {
+                    s.register_send_waker(cx.waker());
+                    Poll::Pending
+                // No outstanding sends, socket is flushed
+                } else {
+                    Poll::Ready(Ok(()))
+                }
+            })
         })
         .await
     }
@@ -271,8 +282,6 @@ impl<'d> TcpIo<'d> {
 
 #[cfg(feature = "nightly")]
 mod embedded_io_impls {
-    use core::future::Future;
-
     use super::*;
 
     impl embedded_io::Error for ConnectError {
@@ -292,30 +301,18 @@ mod embedded_io_impls {
     }
 
     impl<'d> embedded_io::asynch::Read for TcpSocket<'d> {
-        type ReadFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn read<'a>(&'a mut self, buf: &'a mut [u8]) -> Self::ReadFuture<'a> {
-            self.io.read(buf)
+        async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
+            self.io.read(buf).await
         }
     }
 
     impl<'d> embedded_io::asynch::Write for TcpSocket<'d> {
-        type WriteFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn write<'a>(&'a mut self, buf: &'a [u8]) -> Self::WriteFuture<'a> {
-            self.io.write(buf)
+        async fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
+            self.io.write(buf).await
         }
 
-        type FlushFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn flush<'a>(&'a mut self) -> Self::FlushFuture<'a> {
-            self.io.flush()
+        async fn flush(&mut self) -> Result<(), Self::Error> {
+            self.io.flush().await
         }
     }
 
@@ -324,12 +321,8 @@ mod embedded_io_impls {
     }
 
     impl<'d> embedded_io::asynch::Read for TcpReader<'d> {
-        type ReadFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn read<'a>(&'a mut self, buf: &'a mut [u8]) -> Self::ReadFuture<'a> {
-            self.io.read(buf)
+        async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
+            self.io.read(buf).await
         }
     }
 
@@ -338,27 +331,19 @@ mod embedded_io_impls {
     }
 
     impl<'d> embedded_io::asynch::Write for TcpWriter<'d> {
-        type WriteFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn write<'a>(&'a mut self, buf: &'a [u8]) -> Self::WriteFuture<'a> {
-            self.io.write(buf)
+        async fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
+            self.io.write(buf).await
         }
 
-        type FlushFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn flush<'a>(&'a mut self) -> Self::FlushFuture<'a> {
-            self.io.flush()
+        async fn flush(&mut self) -> Result<(), Self::Error> {
+            self.io.flush().await
         }
     }
 }
 
 #[cfg(all(feature = "unstable-traits", feature = "nightly"))]
 pub mod client {
-    use core::future::Future;
+    use core::cell::UnsafeCell;
     use core::mem::MaybeUninit;
     use core::ptr::NonNull;
 
@@ -368,45 +353,46 @@ pub mod client {
     use super::*;
 
     /// TCP client capable of creating up to N multiple connections with tx and rx buffers according to TX_SZ and RX_SZ.
-    pub struct TcpClient<'d, D: Device, const N: usize, const TX_SZ: usize = 1024, const RX_SZ: usize = 1024> {
+    pub struct TcpClient<'d, D: Driver, const N: usize, const TX_SZ: usize = 1024, const RX_SZ: usize = 1024> {
         stack: &'d Stack<D>,
         state: &'d TcpClientState<N, TX_SZ, RX_SZ>,
     }
 
-    impl<'d, D: Device, const N: usize, const TX_SZ: usize, const RX_SZ: usize> TcpClient<'d, D, N, TX_SZ, RX_SZ> {
+    impl<'d, D: Driver, const N: usize, const TX_SZ: usize, const RX_SZ: usize> TcpClient<'d, D, N, TX_SZ, RX_SZ> {
         /// Create a new TcpClient
         pub fn new(stack: &'d Stack<D>, state: &'d TcpClientState<N, TX_SZ, RX_SZ>) -> Self {
             Self { stack, state }
         }
     }
 
-    impl<'d, D: Device, const N: usize, const TX_SZ: usize, const RX_SZ: usize> embedded_nal_async::TcpConnect
+    impl<'d, D: Driver, const N: usize, const TX_SZ: usize, const RX_SZ: usize> embedded_nal_async::TcpConnect
         for TcpClient<'d, D, N, TX_SZ, RX_SZ>
     {
         type Error = Error;
         type Connection<'m> = TcpConnection<'m, N, TX_SZ, RX_SZ> where Self: 'm;
-        type ConnectFuture<'m> = impl Future<Output = Result<Self::Connection<'m>, Self::Error>> + 'm
-    where
-        Self: 'm;
 
-        fn connect<'m>(&'m self, remote: embedded_nal_async::SocketAddr) -> Self::ConnectFuture<'m> {
-            async move {
-                let addr: crate::IpAddress = match remote.ip() {
-                    IpAddr::V4(addr) => crate::IpAddress::Ipv4(crate::Ipv4Address::from_bytes(&addr.octets())),
-                    #[cfg(feature = "proto-ipv6")]
-                    IpAddr::V6(addr) => crate::IpAddress::Ipv6(crate::Ipv6Address::from_bytes(&addr.octets())),
-                    #[cfg(not(feature = "proto-ipv6"))]
-                    IpAddr::V6(_) => panic!("ipv6 support not enabled"),
-                };
-                let remote_endpoint = (addr, remote.port());
-                let mut socket = TcpConnection::new(&self.stack, self.state)?;
-                socket
-                    .socket
-                    .connect(remote_endpoint)
-                    .await
-                    .map_err(|_| Error::ConnectionReset)?;
-                Ok(socket)
-            }
+        async fn connect<'a>(
+            &'a self,
+            remote: embedded_nal_async::SocketAddr,
+        ) -> Result<Self::Connection<'a>, Self::Error>
+        where
+            Self: 'a,
+        {
+            let addr: crate::IpAddress = match remote.ip() {
+                IpAddr::V4(addr) => crate::IpAddress::Ipv4(crate::Ipv4Address::from_bytes(&addr.octets())),
+                #[cfg(feature = "proto-ipv6")]
+                IpAddr::V6(addr) => crate::IpAddress::Ipv6(crate::Ipv6Address::from_bytes(&addr.octets())),
+                #[cfg(not(feature = "proto-ipv6"))]
+                IpAddr::V6(_) => panic!("ipv6 support not enabled"),
+            };
+            let remote_endpoint = (addr, remote.port());
+            let mut socket = TcpConnection::new(&self.stack, self.state)?;
+            socket
+                .socket
+                .connect(remote_endpoint)
+                .await
+                .map_err(|_| Error::ConnectionReset)?;
+            Ok(socket)
         }
     }
 
@@ -417,10 +403,10 @@ pub mod client {
     }
 
     impl<'d, const N: usize, const TX_SZ: usize, const RX_SZ: usize> TcpConnection<'d, N, TX_SZ, RX_SZ> {
-        fn new<D: Device>(stack: &'d Stack<D>, state: &'d TcpClientState<N, TX_SZ, RX_SZ>) -> Result<Self, Error> {
+        fn new<D: Driver>(stack: &'d Stack<D>, state: &'d TcpClientState<N, TX_SZ, RX_SZ>) -> Result<Self, Error> {
             let mut bufs = state.pool.alloc().ok_or(Error::ConnectionReset)?;
             Ok(Self {
-                socket: unsafe { TcpSocket::new(stack, &mut bufs.as_mut().0, &mut bufs.as_mut().1) },
+                socket: unsafe { TcpSocket::new(stack, &mut bufs.as_mut().1, &mut bufs.as_mut().0) },
                 state,
                 bufs,
             })
@@ -445,32 +431,20 @@ pub mod client {
     impl<'d, const N: usize, const TX_SZ: usize, const RX_SZ: usize> embedded_io::asynch::Read
         for TcpConnection<'d, N, TX_SZ, RX_SZ>
     {
-        type ReadFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn read<'a>(&'a mut self, buf: &'a mut [u8]) -> Self::ReadFuture<'a> {
-            self.socket.read(buf)
+        async fn read(&mut self, buf: &mut [u8]) -> Result<usize, Self::Error> {
+            self.socket.read(buf).await
         }
     }
 
     impl<'d, const N: usize, const TX_SZ: usize, const RX_SZ: usize> embedded_io::asynch::Write
         for TcpConnection<'d, N, TX_SZ, RX_SZ>
     {
-        type WriteFuture<'a> = impl Future<Output = Result<usize, Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn write<'a>(&'a mut self, buf: &'a [u8]) -> Self::WriteFuture<'a> {
-            self.socket.write(buf)
+        async fn write(&mut self, buf: &[u8]) -> Result<usize, Self::Error> {
+            self.socket.write(buf).await
         }
 
-        type FlushFuture<'a> = impl Future<Output = Result<(), Self::Error>> + 'a
-    where
-        Self: 'a;
-
-        fn flush<'a>(&'a mut self) -> Self::FlushFuture<'a> {
-            self.socket.flush()
+        async fn flush(&mut self) -> Result<(), Self::Error> {
+            self.socket.flush().await
         }
     }
 

embassy-net/src/udp.rs

@@ -1,14 +1,14 @@
-use core::cell::UnsafeCell;
+use core::cell::RefCell;
 use core::future::poll_fn;
 use core::mem;
 use core::task::Poll;
 
+use embassy_net_driver::Driver;
 use smoltcp::iface::{Interface, SocketHandle};
 use smoltcp::socket::udp::{self, PacketMetadata};
 use smoltcp::wire::{IpEndpoint, IpListenEndpoint};
 
-use super::stack::SocketStack;
-use crate::{Device, Stack};
+use crate::{SocketStack, Stack};
 
 #[derive(PartialEq, Eq, Clone, Copy, Debug)]
 #[cfg_attr(feature = "defmt", derive(defmt::Format))]
@@ -27,20 +27,19 @@ pub enum Error {
 }
 
 pub struct UdpSocket<'a> {
-    stack: &'a UnsafeCell<SocketStack>,
+    stack: &'a RefCell<SocketStack>,
     handle: SocketHandle,
 }
 
 impl<'a> UdpSocket<'a> {
-    pub fn new<D: Device>(
+    pub fn new<D: Driver>(
         stack: &'a Stack<D>,
         rx_meta: &'a mut [PacketMetadata],
         rx_buffer: &'a mut [u8],
         tx_meta: &'a mut [PacketMetadata],
         tx_buffer: &'a mut [u8],
     ) -> Self {
-        // safety: not accessed reentrantly.
-        let s = unsafe { &mut *stack.socket.get() };
+        let s = &mut *stack.socket.borrow_mut();
 
         let rx_meta: &'static mut [PacketMetadata] = unsafe { mem::transmute(rx_meta) };
         let rx_buffer: &'static mut [u8] = unsafe { mem::transmute(rx_buffer) };
@@ -63,30 +62,26 @@ impl<'a> UdpSocket<'a> {
     {
         let mut endpoint = endpoint.into();
 
-        // safety: not accessed reentrantly.
         if endpoint.port == 0 {
             // If user didn't specify port allocate a dynamic port.
-            endpoint.port = unsafe { &mut *self.stack.get() }.get_local_port();
+            endpoint.port = self.stack.borrow_mut().get_local_port();
         }
 
-        // safety: not accessed reentrantly.
-        match unsafe { self.with_mut(|s, _| s.bind(endpoint)) } {
+        match self.with_mut(|s, _| s.bind(endpoint)) {
             Ok(()) => Ok(()),
             Err(udp::BindError::InvalidState) => Err(BindError::InvalidState),
             Err(udp::BindError::Unaddressable) => Err(BindError::NoRoute),
         }
     }
 
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with<R>(&self, f: impl FnOnce(&udp::Socket, &Interface) -> R) -> R {
-        let s = &*self.stack.get();
+    fn with<R>(&self, f: impl FnOnce(&udp::Socket, &Interface) -> R) -> R {
+        let s = &*self.stack.borrow();
         let socket = s.sockets.get::<udp::Socket>(self.handle);
         f(socket, &s.iface)
     }
 
-    /// SAFETY: must not call reentrantly.
-    unsafe fn with_mut<R>(&self, f: impl FnOnce(&mut udp::Socket, &mut Interface) -> R) -> R {
-        let s = &mut *self.stack.get();
+    fn with_mut<R>(&self, f: impl FnOnce(&mut udp::Socket, &mut Interface) -> R) -> R {
+        let s = &mut *self.stack.borrow_mut();
         let socket = s.sockets.get_mut::<udp::Socket>(self.handle);
         let res = f(socket, &mut s.iface);
         s.waker.wake();
@@ -94,13 +89,12 @@ impl<'a> UdpSocket<'a> {
     }
 
     pub async fn recv_from(&self, buf: &mut [u8]) -> Result<(usize, IpEndpoint), Error> {
-        poll_fn(move |cx| unsafe {
+        poll_fn(move |cx| {
             self.with_mut(|s, _| match s.recv_slice(buf) {
                 Ok(x) => Poll::Ready(Ok(x)),
                 // No data ready
                 Err(udp::RecvError::Exhausted) => {
-                    //s.register_recv_waker(cx.waker());
-                    cx.waker().wake_by_ref();
+                    s.register_recv_waker(cx.waker());
                     Poll::Pending
                 }
             })
@@ -113,7 +107,7 @@ impl<'a> UdpSocket<'a> {
         T: Into<IpEndpoint>,
     {
         let remote_endpoint = remote_endpoint.into();
-        poll_fn(move |cx| unsafe {
+        poll_fn(move |cx| {
             self.with_mut(|s, _| match s.send_slice(buf, remote_endpoint) {
                 // Entire datagram has been sent
                 Ok(()) => Poll::Ready(Ok(())),
@@ -128,30 +122,28 @@ impl<'a> UdpSocket<'a> {
     }
 
     pub fn endpoint(&self) -> IpListenEndpoint {
-        unsafe { self.with(|s, _| s.endpoint()) }
+        self.with(|s, _| s.endpoint())
     }
 
     pub fn is_open(&self) -> bool {
-        unsafe { self.with(|s, _| s.is_open()) }
+        self.with(|s, _| s.is_open())
     }
 
     pub fn close(&mut self) {
-        unsafe { self.with_mut(|s, _| s.close()) }
+        self.with_mut(|s, _| s.close())
     }
 
     pub fn may_send(&self) -> bool {
-        unsafe { self.with(|s, _| s.can_send()) }
+        self.with(|s, _| s.can_send())
     }
 
     pub fn may_recv(&self) -> bool {
-        unsafe { self.with(|s, _| s.can_recv()) }
+        self.with(|s, _| s.can_recv())
     }
 }
 
 impl Drop for UdpSocket<'_> {
     fn drop(&mut self) {
-        // safety: not accessed reentrantly.
-        let s = unsafe { &mut *self.stack.get() };
-        s.sockets.remove(self.handle);
+        self.stack.borrow_mut().sockets.remove(self.handle);
     }
 }

embassy-nrf/Cargo.toml

@@ -34,22 +34,30 @@ unstable-pac = []
 # Implement embedded-hal-async traits if `nightly` is set as well.
 unstable-traits = ["embedded-hal-1"]
 
-nrf52805 = ["nrf52805-pac", "_ppi"]
-nrf52810 = ["nrf52810-pac", "_ppi"]
-nrf52811 = ["nrf52811-pac", "_ppi"]
-nrf52820 = ["nrf52820-pac", "_ppi"]
-nrf52832 = ["nrf52832-pac", "_ppi"]
-nrf52833 = ["nrf52833-pac", "_ppi", "_gpio-p1"]
-nrf52840 = ["nrf52840-pac", "_ppi", "_gpio-p1"]
-nrf5340-app-s = ["_nrf5340-app"]
-nrf5340-app-ns = ["_nrf5340-app"]
+nrf52805 = ["nrf52805-pac", "_nrf52"]
+nrf52810 = ["nrf52810-pac", "_nrf52"]
+nrf52811 = ["nrf52811-pac", "_nrf52"]
+nrf52820 = ["nrf52820-pac", "_nrf52"]
+nrf52832 = ["nrf52832-pac", "_nrf52"]
+nrf52833 = ["nrf52833-pac", "_nrf52", "_gpio-p1"]
+nrf52840 = ["nrf52840-pac", "_nrf52", "_gpio-p1"]
+nrf5340-app-s = ["_nrf5340-app", "_s"]
+nrf5340-app-ns = ["_nrf5340-app", "_ns"]
 nrf5340-net = ["_nrf5340-net"]
-nrf9160-s = ["_nrf9160"]
-nrf9160-ns = ["_nrf9160"]
+nrf9160-s = ["_nrf9160", "_s"]
+nrf9160-ns = ["_nrf9160", "_ns"]
 
 gpiote = []
 time-driver-rtc1 = ["_time-driver"]
 
+# Allow using the NFC pins as regular GPIO pins (P0_09/P0_10 on nRF52, P0_02/P0_03 on nRF53)
+nfc-pins-as-gpio = []
+
+# Allow using the RST pin as a regular GPIO pin.
+# nrf52805, nrf52810, nrf52811, nrf52832: P0_21
+# nrf52820, nrf52833, nrf52840: P0_18
+reset-pin-as-gpio = []
+
 # Features starting with `_` are for internal use only. They're not intended
 # to be enabled by other crates, and are not covered by semver guarantees.
 
@@ -57,9 +65,14 @@ _nrf5340-app = ["_nrf5340", "nrf5340-app-pac"]
 _nrf5340-net = ["_nrf5340", "nrf5340-net-pac"]
 _nrf5340 = ["_gpio-p1", "_dppi"]
 _nrf9160 = ["nrf9160-pac", "_dppi"]
+_nrf52 = ["_ppi"]
 
 _time-driver = ["dep:embassy-time", "embassy-time?/tick-hz-32_768"]
 
+# trustzone state.
+_s = []
+_ns = []
+
 _ppi = []
 _dppi = []
 _gpio-p1 = []
@@ -67,16 +80,16 @@ _gpio-p1 = []
 [dependencies]
 embassy-executor = { version = "0.1.0", path = "../embassy-executor", optional = true }
 embassy-time = { version = "0.1.0", path = "../embassy-time", optional = true }
-embassy-sync = { version = "0.1.0", path = "../embassy-sync" }
+embassy-sync = { version = "0.2.0", path = "../embassy-sync" }
 embassy-cortex-m = { version = "0.1.0", path = "../embassy-cortex-m", features = ["prio-bits-3"]}
 embassy-hal-common = {version = "0.1.0", path = "../embassy-hal-common" }
 embassy-embedded-hal = {version = "0.1.0", path = "../embassy-embedded-hal" }
 embassy-usb-driver = {version = "0.1.0", path = "../embassy-usb-driver", optional=true }
 
 embedded-hal-02 = { package = "embedded-hal", version = "0.2.6", features = ["unproven"] }
-embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.9", optional = true}
-embedded-hal-async = { version = "=0.1.0-alpha.3", optional = true}
-embedded-io = { version = "0.3.1", features = ["async"], optional = true }
+embedded-hal-1 = { package = "embedded-hal", version = "=1.0.0-alpha.10", optional = true}
+embedded-hal-async = { version = "=0.2.0-alpha.1", optional = true}
+embedded-io = { version = "0.4.0", features = ["async"], optional = true }
 
 defmt = { version = "0.3", optional = true }
 log = { version = "0.4.14", optional = true }
@@ -87,7 +100,7 @@ critical-section = "1.1"
 rand_core = "0.6.3"
 fixed = "1.10.0"
 embedded-storage = "0.3.0"
-embedded-storage-async = { version = "0.3.0", optional = true }
+embedded-storage-async = { version = "0.4.0", optional = true }
 cfg-if = "1.0.0"
 
 nrf52805-pac  = { version = "0.12.0", optional = true, features = [ "rt" ] }

embassy-nrf/README.md

@@ -0,0 +1,58 @@
+# Embassy nRF HAL
+
+HALs implement safe, idiomatic Rust APIs to use the hardware capabilities, so raw register manipulation is not needed.
+
+The Embassy nRF HAL targets the Nordic Semiconductor nRF family of hardware. The HAL implements both blocking and async APIs
+for many peripherals. The benefit of using the async APIs is that the HAL takes care of waiting for peripherals to
+complete operations in low power mod and handling interrupts, so that applications can focus on more important matters.
+
+## EasyDMA considerations
+
+On nRF chips, peripherals can use the so called EasyDMA feature to offload the task of interacting
+with peripherals. It takes care of sending/receiving data over a variety of bus protocols (TWI/I2C, UART, SPI).
+However, EasyDMA requires the buffers used to transmit and receive data to reside in RAM. Unfortunately, Rust
+slices will not always do so. The following example using the SPI peripheral shows a common situation where this might happen:
+
+```no_run
+// As we pass a slice to the function whose contents will not ever change,
+// the compiler writes it into the flash and thus the pointer to it will
+// reference static memory. Since EasyDMA requires slices to reside in RAM,
+// this function call will fail.
+let result = spim.write_from_ram(&[1, 2, 3]);
+assert_eq!(result, Err(Error::BufferNotInRAM));
+
+// The data is still static and located in flash. However, since we are assigning
+// it to a variable, the compiler will load it into memory. Passing a reference to the
+// variable will yield a pointer that references dynamic memory, thus making EasyDMA happy.
+// This function call succeeds.
+let data = [1, 2, 3];
+let result = spim.write_from_ram(&data);
+assert!(result.is_ok());
+```
+
+Each peripheral struct which uses EasyDMA ([`Spim`](spim::Spim), [`Uarte`](uarte::Uarte), [`Twim`](twim::Twim)) has two variants of their mutating functions:
+- Functions with the suffix (e.g. [`write_from_ram`](spim::Spim::write_from_ram), [`transfer_from_ram`](spim::Spim::transfer_from_ram)) will return an error if the passed slice does not reside in RAM.
+- Functions without the suffix (e.g. [`write`](spim::Spim::write), [`transfer`](spim::Spim::transfer)) will check whether the data is in RAM and copy it into memory prior to transmission.
+
+Since copying incurs a overhead, you are given the option to choose from `_from_ram` variants which will
+fail and notify you, or the more convenient versions without the suffix which are potentially a little bit
+more inefficient. Be aware that this overhead is not only in terms of instruction count but also in terms of memory usage
+as the methods without the suffix will be allocating a statically sized buffer (up to 512 bytes for the nRF52840).
+
+Note that the methods that read data like [`read`](spim::Spim::read) and [`transfer_in_place`](spim::Spim::transfer_in_place) do not have the corresponding `_from_ram` variants as
+mutable slices always reside in RAM.
+
+## Minimum supported Rust version (MSRV)
+
+Embassy is guaranteed to compile on the latest stable Rust version at the time of release. It might compile with older versions but that may change in any new patch release.
+
+## License
+
+This work is licensed under either of
+
+- Apache License, Version 2.0 ([LICENSE-APACHE](LICENSE-APACHE) or
+  <http://www.apache.org/licenses/LICENSE-2.0>)
+- MIT license ([LICENSE-MIT](LICENSE-MIT) or <http://opensource.org/licenses/MIT>)
+
+at your option.
+

embassy-nrf/src/chips/nrf52805.rs

@@ -6,6 +6,8 @@ pub const FORCE_COPY_BUFFER_SIZE: usize = 256;
 
 pub const FLASH_SIZE: usize = 192 * 1024;
 
+pub const RESET_PIN: u32 = 21;
+
 embassy_hal_common::peripherals! {
     // RTC
     RTC0,
@@ -108,6 +110,7 @@ embassy_hal_common::peripherals! {
     P0_18,
     P0_19,
     P0_20,
+    #[cfg(feature="reset-pin-as-gpio")]
     P0_21,
     P0_22,
     P0_23,
@@ -131,8 +134,16 @@ impl_uarte!(UARTE0, UARTE0, UARTE0_UART0);
 
 impl_spim!(SPI0, SPIM0, SPIM0_SPIS0_SPI0);
 
+impl_spis!(SPI0, SPIS0, SPIM0_SPIS0_SPI0);
+
 impl_twim!(TWI0, TWIM0, TWIM0_TWIS0_TWI0);
 
+impl_twis!(TWI0, TWIS0, TWIM0_TWIS0_TWI0);
+
+impl_qdec!(QDEC, QDEC, QDEC);
+
+impl_rng!(RNG, RNG, RNG);
+
 impl_timer!(TIMER0, TIMER0, TIMER0);
 impl_timer!(TIMER1, TIMER1, TIMER1);
 impl_timer!(TIMER2, TIMER2, TIMER2);
@@ -158,6 +169,7 @@ impl_pin!(P0_17, 0, 17);
 impl_pin!(P0_18, 0, 18);
 impl_pin!(P0_19, 0, 19);
 impl_pin!(P0_20, 0, 20);
+#[cfg(feature = "reset-pin-as-gpio")]
 impl_pin!(P0_21, 0, 21);
 impl_pin!(P0_22, 0, 22);
 impl_pin!(P0_23, 0, 23);

embassy-nrf/src/chips/nrf52810.rs

@@ -6,6 +6,8 @@ pub const FORCE_COPY_BUFFER_SIZE: usize = 256;
 
 pub const FLASH_SIZE: usize = 192 * 1024;
 
+pub const RESET_PIN: u32 = 21;
+
 embassy_hal_common::peripherals! {
     // RTC
     RTC0,
@@ -111,6 +113,7 @@ embassy_hal_common::peripherals! {
     P0_18,
     P0_19,
     P0_20,
+    #[cfg(feature="reset-pin-as-gpio")]
     P0_21,
     P0_22,
     P0_23,
@@ -137,10 +140,20 @@ impl_uarte!(UARTE0, UARTE0, UARTE0_UART0);
 
 impl_spim!(SPI0, SPIM0, SPIM0_SPIS0_SPI0);
 
+impl_spis!(SPI0, SPIS0, SPIM0_SPIS0_SPI0);
+
 impl_twim!(TWI0, TWIM0, TWIM0_TWIS0_TWI0);
 
+impl_twis!(TWI0, TWIS0, TWIM0_TWIS0_TWI0);
+
 impl_pwm!(PWM0, PWM0, PWM0);
 
+impl_pdm!(PDM, PDM, PDM);
+
+impl_qdec!(QDEC, QDEC, QDEC);
+
+impl_rng!(RNG, RNG, RNG);
+
 impl_timer!(TIMER0, TIMER0, TIMER0);
 impl_timer!(TIMER1, TIMER1, TIMER1);
 impl_timer!(TIMER2, TIMER2, TIMER2);
@@ -166,6 +179,7 @@ impl_pin!(P0_17, 0, 17);
 impl_pin!(P0_18, 0, 18);
 impl_pin!(P0_19, 0, 19);
 impl_pin!(P0_20, 0, 20);
+#[cfg(feature = "reset-pin-as-gpio")]
 impl_pin!(P0_21, 0, 21);
 impl_pin!(P0_22, 0, 22);
 impl_pin!(P0_23, 0, 23);