rewrite NVIC to use derive-mmio

robamu · robamu · commit 01e39c0f3265 · 2026-04-27T14:03:02.000+02:00
diff --git a/cortex-m/Cargo.toml b/cortex-m/Cargo.toml
@@ -15,6 +15,7 @@ rust-version = "1.85"
 [dependencies]
 bare-metal = { version = "0.2.4", features = ["const-fn"] }
 critical-section = "1.0.0"
+derive-mmio = "0.6"
 volatile-register = "0.2.2"
 bitfield = "0.13.2"
 eh0 = { package = "embedded-hal", version = "0.2.4" }
diff --git a/cortex-m/src/peripheral/mod.rs b/cortex-m/src/peripheral/mod.rs
@@ -206,9 +206,7 @@ impl Peripherals {
                 MPU: MPU {
                     _marker: PhantomData,
                 },
-                NVIC: NVIC {
-                    _marker: PhantomData,
-                },
+                NVIC: NVIC::steal(),
                 SAU: SAU {
                     _marker: PhantomData,
                 },
@@ -536,30 +534,36 @@ impl ops::Deref for MPU {
 }
 
 /// Nested Vector Interrupt Controller
-pub struct NVIC {
-    _marker: PhantomData<*const ()>,
-}
+pub struct NVIC(nvic::MmioRegisterBlock<'static>);
 
 unsafe impl Send for NVIC {}
 
 impl NVIC {
-    /// Pointer to the register block
-    pub const PTR: *const nvic::RegisterBlock = 0xE000_E100 as *const _;
-
-    /// Returns a pointer to the register block
-    #[inline(always)]
-    #[deprecated(since = "0.7.5", note = "Use the associated constant `PTR` instead")]
-    pub const fn ptr() -> *const nvic::RegisterBlock {
-        Self::PTR
+    /// Unsafely steal an instance of the NVIC.
+    ///
+    /// # Safety
+    ///
+    /// This potentially allows to create multiple instances of the NVIC register block, which
+    /// might only be valid in certain multi-core environments.
+    #[inline]
+    pub unsafe fn steal() -> Self {
+        NVIC(unsafe { nvic::RegisterBlock::new_mmio_fixed() })
     }
 }
 
 impl ops::Deref for NVIC {
-    type Target = self::nvic::RegisterBlock;
+    type Target = nvic::MmioRegisterBlock<'static>;
 
     #[inline(always)]
     fn deref(&self) -> &Self::Target {
-        unsafe { &*Self::PTR }
+        &self.0
+    }
+}
+
+impl ops::DerefMut for NVIC {
+    #[inline(always)]
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.0
     }
 }
 
diff --git a/cortex-m/src/peripheral/nvic.rs b/cortex-m/src/peripheral/nvic.rs
@@ -1,46 +1,45 @@
 //! Nested Vector Interrupt Controller
-
-use volatile_register::RW;
-#[cfg(not(armv6m))]
-use volatile_register::{RO, WO};
-
 use crate::interrupt::InterruptNumber;
 use crate::peripheral::NVIC;
 
-/// Register block
+/// NVIC base address.
+pub const BASE_ADDRESS: usize = 0xE000_E100;
+
+/// NVIC register block.
+#[derive(derive_mmio::Mmio)]
 #[repr(C)]
 pub struct RegisterBlock {
     /// Interrupt Set-Enable
-    pub iser: [RW<u32>; 16],
+    iser: [u32; 16],
 
     _reserved0: [u32; 16],
 
     /// Interrupt Clear-Enable
-    pub icer: [RW<u32>; 16],
+    icer: [u32; 16],
 
     _reserved1: [u32; 16],
 
     /// Interrupt Set-Pending
-    pub ispr: [RW<u32>; 16],
+    ispr: [u32; 16],
 
     _reserved2: [u32; 16],
 
     /// Interrupt Clear-Pending
-    pub icpr: [RW<u32>; 16],
+    icpr: [u32; 16],
 
     _reserved3: [u32; 16],
 
     /// Interrupt Active Bit (not present on Cortex-M0 variants)
     #[cfg(not(armv6m))]
-    pub iabr: [RO<u32>; 16],
+    iabr: [u32; 16],
     #[cfg(armv6m)]
     _reserved4: [u32; 16],
 
     _reserved5: [u32; 16],
 
     #[cfg(armv8m)]
     /// Interrupt Target Non-secure (only present on Arm v8-M)
-    pub itns: [RW<u32>; 16],
+    itns: [u32; 16],
     #[cfg(not(armv8m))]
     _reserved6: [u32; 16],
 
@@ -58,7 +57,7 @@ pub struct RegisterBlock {
     /// so convenient byte-sized representation wouldn't work on that
     /// architecture.
     #[cfg(not(armv6m))]
-    pub ipr: [RW<u8>; 496],
+    ipr: [u32; 124],
 
     /// Interrupt Priority
     ///
@@ -72,14 +71,27 @@ pub struct RegisterBlock {
     /// so convenient byte-sized representation wouldn't work on that
     /// architecture.
     #[cfg(armv6m)]
-    pub ipr: [RW<u32>; 8],
+    ipr: [u32; 8],
 
     #[cfg(not(armv6m))]
     _reserved8: [u32; 580],
 
     /// Software Trigger Interrupt
     #[cfg(not(armv6m))]
-    pub stir: WO<u32>,
+    stir: u32,
+}
+
+impl RegisterBlock {
+    /// Creates a new instance of the NVIC register block.
+    ///
+    /// # Safety
+    ///
+    /// This potentially allows to create multiple instances of the NVIC register block, which
+    /// might only be valid in certain multi-core environments.
+    #[inline]
+    pub const unsafe fn new_mmio_fixed() -> MmioRegisterBlock<'static> {
+        unsafe { RegisterBlock::new_mmio_at(BASE_ADDRESS) }
+    }
 }
 
 impl NVIC {
@@ -100,9 +112,7 @@ impl NVIC {
     {
         let nr = interrupt.number();
 
-        unsafe {
-            self.stir.write(u32::from(nr));
-        }
+        self.write_stir(u32::from(nr));
     }
 
     /// Disables `interrupt`
@@ -113,7 +123,9 @@ impl NVIC {
     {
         let nr = interrupt.number();
         // NOTE(unsafe) this is a write to a stateless register
-        unsafe { (*Self::PTR).icer[usize::from(nr / 32)].write(1 << (nr % 32)) }
+        let mut nvic = unsafe { Self::steal() };
+        nvic.write_icer(usize::from(nr / 32), 1 << (nr % 32))
+            .expect("invalid interrupt number");
     }
 
     /// Enables `interrupt`
@@ -124,11 +136,11 @@ impl NVIC {
     where
         I: InterruptNumber,
     {
-        unsafe {
-            let nr = interrupt.number();
-            // NOTE(ptr) this is a write to a stateless register
-            (*Self::PTR).iser[usize::from(nr / 32)].write(1 << (nr % 32))
-        }
+        let nr = interrupt.number();
+        // NOTE(ptr) this is a write to a stateless register
+        let mut nvic = unsafe { Self::steal() };
+        nvic.write_iser(usize::from(nr / 32), 1 << (nr % 32))
+            .expect("invalid interrupt number");
     }
 
     /// Returns the NVIC priority of `interrupt`
@@ -144,16 +156,25 @@ impl NVIC {
         #[cfg(not(armv6m))]
         {
             let nr = interrupt.number();
-            // NOTE(unsafe) atomic read with no side effects
-            unsafe { (*Self::PTR).ipr[usize::from(nr)].read() }
+            // note(unsafe) atomic read with no side effects
+            let nvic = unsafe { Self::steal() };
+            let ipr_ptr = nvic.pointer_to_ipr_start() as *const u8;
+            // This should never happen for correct `InterruptNumber` implementations.
+            if nr >= 124 {
+                panic!("unexpected interrupt number");
+            }
+            // note(unsafe) atomic read with no side effects
+            unsafe { core::ptr::read_volatile(ipr_ptr.offset(nr as isize)) }
         }
 
         #[cfg(armv6m)]
         {
-            // NOTE(unsafe) atomic read with no side effects
-            let ipr_n = unsafe { (*Self::PTR).ipr[Self::ipr_index(interrupt)].read() };
-            let prio = (ipr_n >> Self::ipr_shift(interrupt)) & 0x0000_00ff;
-            prio as u8
+            // note(unsafe) atomic read with no side effects
+            let nvic = unsafe { Self::steal() };
+            let ipr_n = nvic
+                .read_ipr(Self::ipr_index(interrupt))
+                .expect("unexpected interrupt number");
+            ((ipr_n >> Self::ipr_shift(interrupt)) & 0x0000_00ff) as u8
         }
     }
 
@@ -167,8 +188,12 @@ impl NVIC {
         let nr = interrupt.number();
         let mask = 1 << (nr % 32);
 
-        // NOTE(unsafe) atomic read with no side effects
-        unsafe { ((*Self::PTR).iabr[usize::from(nr / 32)].read() & mask) == mask }
+        // note(unsafe) atomic read with no side effects
+        let nvic = unsafe { Self::steal() };
+        nvic.read_iabr(usize::from(nr / 32))
+            .expect("unexpected interrupt number")
+            & mask
+            == mask
     }
 
     /// Checks if `interrupt` is enabled
@@ -180,8 +205,12 @@ impl NVIC {
         let nr = interrupt.number();
         let mask = 1 << (nr % 32);
 
-        // NOTE(unsafe) atomic read with no side effects
-        unsafe { ((*Self::PTR).iser[usize::from(nr / 32)].read() & mask) == mask }
+        // note(unsafe) atomic read with no side effects
+        let nvic = unsafe { Self::steal() };
+        nvic.read_iser(usize::from(nr / 32))
+            .expect("unexpected interrupt number")
+            & mask
+            == mask
     }
 
     /// Checks if `interrupt` is pending
@@ -193,8 +222,12 @@ impl NVIC {
         let nr = interrupt.number();
         let mask = 1 << (nr % 32);
 
-        // NOTE(unsafe) atomic read with no side effects
-        unsafe { ((*Self::PTR).ispr[usize::from(nr / 32)].read() & mask) == mask }
+        // note(unsafe) atomic read with no side effects
+        let nvic = unsafe { Self::steal() };
+        nvic.read_ispr(usize::from(nr / 32))
+            .expect("unexpected interrupt number")
+            & mask
+            == mask
     }
 
     /// Forces `interrupt` into pending state
@@ -206,7 +239,9 @@ impl NVIC {
         let nr = interrupt.number();
 
         // NOTE(unsafe) atomic stateless write; ICPR doesn't store any state
-        unsafe { (*Self::PTR).ispr[usize::from(nr / 32)].write(1 << (nr % 32)) }
+        let mut nvic = unsafe { Self::steal() };
+        nvic.write_ispr(usize::from(nr / 32), 1 << (nr % 32))
+            .expect("unexpected interrupt number")
     }
 
     /// Sets the "priority" of `interrupt` to `prio`
@@ -226,22 +261,31 @@ impl NVIC {
     where
         I: InterruptNumber,
     {
-        unsafe {
-            #[cfg(not(armv6m))]
-            {
-                let nr = interrupt.number();
-                self.ipr[usize::from(nr)].write(prio)
+        #[cfg(not(armv6m))]
+        {
+            let nr = interrupt.number();
+            // NOTE(unsafe) atomic stateless write; IPR doesn't store any state
+            let nvic = unsafe { Self::steal() };
+            let ipr_ptr = nvic.pointer_to_ipr_start() as *mut u8;
+            // This should never happen for correct `InterruptNumber` implementations.
+            if nr >= 124 {
+                panic!("unexpected interrupt number");
             }
+            // NOTE(unsafe) atomic stateless write; IPR doesn't store any state
+            unsafe { core::ptr::write_volatile(ipr_ptr.offset(nr as isize), prio) }
+        }
 
-            #[cfg(armv6m)]
-            {
-                self.ipr[Self::ipr_index(interrupt)].modify(|value| {
-                    let mask = 0x0000_00ff << Self::ipr_shift(interrupt);
-                    let prio = u32::from(prio) << Self::ipr_shift(interrupt);
-
-                    (value & !mask) | prio
-                })
-            }
+        #[cfg(armv6m)]
+        {
+            // NOTE(unsafe) atomic stateless write; IPR doesn't store any state
+            let mut nvic = unsafe { Self::steal() };
+            nvic.modify_ipr(Self::ipr_index(interrupt), |mut value| {
+                let mask = 0x0000_00ff << Self::ipr_shift(interrupt);
+                let prio = u32::from(prio) << Self::ipr_shift(interrupt);
+
+                (value & !mask) | prio
+            })
+            .expect("unexpected interrupt number");
         }
     }
 
@@ -254,7 +298,9 @@ impl NVIC {
         let nr = interrupt.number();
 
         // NOTE(unsafe) atomic stateless write; ICPR doesn't store any state
-        unsafe { (*Self::PTR).icpr[usize::from(nr / 32)].write(1 << (nr % 32)) }
+        let mut nvic = unsafe { Self::steal() };
+        nvic.write_icpr(usize::from(nr / 32), 1 << (nr % 32))
+            .expect("unexpected interrupt number")
     }
 
     #[cfg(armv6m)]
diff --git a/cortex-m/src/peripheral/test.rs b/cortex-m/src/peripheral/test.rs
@@ -109,16 +109,16 @@ fn mpu() {
 
 #[test]
 fn nvic() {
-    let nvic = unsafe { &*crate::peripheral::NVIC::PTR };
-
-    assert_eq!(address(&nvic.iser), 0xE000E100);
-    assert_eq!(address(&nvic.icer), 0xE000E180);
-    assert_eq!(address(&nvic.ispr), 0xE000E200);
-    assert_eq!(address(&nvic.icpr), 0xE000E280);
-    assert_eq!(address(&nvic.iabr), 0xE000E300);
-    assert_eq!(address(&nvic.ipr), 0xE000E400);
+    let nvic = unsafe { crate::peripheral::NVIC::steal() };
+
+    assert_eq!(address(nvic.pointer_to_iser_start()), 0xE000E100);
+    assert_eq!(address(nvic.pointer_to_icer_start()), 0xE000E180);
+    assert_eq!(address(nvic.pointer_to_ispr_start()), 0xE000E200);
+    assert_eq!(address(nvic.pointer_to_icpr_start()), 0xE000E280);
+    assert_eq!(address(nvic.pointer_to_iabr_start()), 0xE000E300);
+    assert_eq!(address(nvic.pointer_to_ipr_start()), 0xE000E400);
     #[cfg(not(armv6m))]
-    assert_eq!(address(&nvic.stir), 0xE000EF00);
+    assert_eq!(address(nvic.pointer_to_stir()), 0xE000EF00);
 }
 
 #[test]
