Merge Upstream Tock: May 2026

.lcignore

@@ -33,3 +33,4 @@
 
 # Files that are autogenerated and cannot be modified to add the header.
 /Cargo.lock
+/tools/svd2regs/uv.lock

.vscode/settings.json

@@ -3,7 +3,7 @@
     "editor.defaultFormatter": "rust-lang.rust-analyzer",
     "editor.formatOnSave": true,
     "rust-analyzer.server.extraEnv": {
-        "RUSTUP_TOOLCHAIN": "nightly-2025-11-03"
+        "RUSTUP_TOOLCHAIN": "nightly-2026-04-21"
     },
     "rust-analyzer.check.allTargets": false,
 }

Cargo.toml

@@ -230,7 +230,8 @@ result_unit_err = "allow"
 unusual-byte-groupings = "allow"
 # We widely use upper case acronyms for hardware registers and fields.
 upper_case_acronyms = "allow"
-
+# Condensing match statements can make code harder to read and inconsistent.
+collapsible-match = "allow"
 
 missing_safety_doc = "allow"
 doc_lazy_continuation = "allow"
@@ -280,7 +281,6 @@ or_fun_call = "allow"
 missing_const_for_fn = "allow"
 equatable_if_let = "allow"
 derive_partial_eq_without_eq = "allow"
-empty_line_after_doc_comments = "allow"
 trait_duplication_in_bounds = "allow"
 useless_let_if_seq = "allow"
 

Makefile

@@ -407,9 +407,15 @@ ci-job-clippy:
 	@cargo clippy -- -D warnings
 	# Run `cargo clippy` in select boards so we run clippy with targets that
 	# actually check the arch-specific functions.
+	# 
+	# - nrf52840dk: cortex-m4
+	# - raspberry_pi_pico: cortex-m0
+	# - hifive1: riscv
+	# - qemu_i486_q35: x86
 	@cd boards/nordic/nrf52840dk && cargo clippy -- -D warnings
+	@cd boards/raspberry_pi_pico && cargo clippy -- -D warnings
 	@cd boards/hifive1 && cargo clippy -- -D warnings
-	@cd boards/qemu_i486_q35 && cargo clippy -- -D warnings
+	@cd boards/qemu_i486_q35 && cargo clippy -Zjson-target-spec -- -D warnings
 
 
 

arch/cortex-m/src/dma_fence.rs

@@ -0,0 +1,87 @@
+// Licensed under the Apache License, Version 2.0 or the MIT License.
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// Copyright Tock Contributors 2026.
+
+//! Cortex-M synchronization implementation for Rust when using DMA.
+
+use kernel::platform::dma_fence::DmaFence;
+
+#[derive(Debug, Copy, Clone)]
+pub struct CortexMDmaFence {
+    _private: (),
+}
+
+/// An implementation of [DmaFence] for ARM Cortex-M systems.
+///
+/// The provided `release` and `acquire` methods use opaque assembly
+/// blocks and the THUMB `DMB` instructions to make prior writes to
+/// shared buffers visible to DMA devices, and DMA writes visible
+/// subsequent memory reads, as specified in the ARM Cortex-M
+/// Programming Guide to Memory Barrier Instructions [1].
+///
+/// [1]: https://developer.arm.com/documentation/dai0321/a/
+impl CortexMDmaFence {
+    /// Construct a new [CortexMDmaFence].
+    ///
+    /// # Safety
+    ///
+    /// Users of this function guarantee that this fence is an appropriate
+    /// implementation of [`DmaFence`] for the platform on which this code is
+    /// running. In practice, this means that users must assert to be running on
+    /// an ARM Cortex-M (ARM-v6m / ARM-v7m) CPU.
+    pub unsafe fn new() -> Self {
+        Self { _private: () }
+    }
+}
+
+#[cfg(all(target_arch = "arm", target_os = "none"))]
+unsafe impl DmaFence for CortexMDmaFence {
+    fn release<T>(self, slice_ptr: *mut [T]) {
+        let slice_start_ptr: *mut T = slice_ptr.cast();
+        unsafe {
+            core::arch::asm!(
+                "
+    // This block is opaque to the compiler; the compiler must assume
+    // that the block could read to the entire buffer from which the
+    // pointer stored in {dma_buffer_ptr_reg} was derived.
+    //
+    // Do not reorder prior memory reads or writes over subsequent
+    // I/O reads or writes.
+    dmb
+                ",
+                dma_buffer_ptr_reg = in(reg) slice_start_ptr,
+            );
+        }
+    }
+
+    fn acquire<T>(self, slice_ptr: *mut [T]) {
+        let slice_start_ptr: *mut T = slice_ptr.cast();
+        unsafe {
+            core::arch::asm!(
+                "
+    // This block is opaque to the compiler; the compiler must assume
+    // that the block could write to the entire buffer from which the
+    // pointer stored in {dma_buffer_ptr_reg} was derived.
+    //
+    // Do not reorder prior I/O reads or writes over subsequent
+    // memory reads or writes.
+    dmb
+                ",
+                dma_buffer_ptr_reg = in(reg) slice_start_ptr,
+            );
+        }
+    }
+}
+
+#[cfg(not(all(target_arch = "arm", target_os = "none")))]
+unsafe impl DmaFence for CortexMDmaFence {
+    fn release<T>(self, _buf: *mut [T]) {
+        // When building for another architecture, such as for tests or CI:
+        unimplemented!("CortexMDmaFence can only be used on cortex-m targets");
+    }
+
+    fn acquire<T>(self, _buf: *mut [T]) {
+        // When building for another architecture, such as for tests or CI:
+        unimplemented!("CortexMDmaFence can only be used on cortex-m targets");
+    }
+}

arch/cortex-m/src/lib.rs

@@ -9,6 +9,7 @@
 use core::fmt::Write;
 
 pub mod dcb;
+pub mod dma_fence;
 pub mod dwt;
 pub mod mpu;
 pub mod nvic;

arch/cortex-m/src/syscall.rs

@@ -58,7 +58,7 @@ const SVC_FRAME_SIZE: usize = 32;
 /// Values for encoding the stored state buffer in a binary slice.
 const VERSION: usize = 1;
 const STORED_STATE_SIZE: usize = size_of::<CortexMStoredState>();
-const TAG: [u8; 4] = [b'c', b't', b'x', b'm'];
+const TAG: [u8; 4] = *b"ctxm";
 const METADATA_LEN: usize = 3;
 
 const VERSION_IDX: usize = 0;
@@ -181,7 +181,7 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
         }
 
         let sp = state.psp as *mut u32;
-        let (r0, r1, r2, r3) = (sp.offset(0), sp.offset(1), sp.offset(2), sp.offset(3));
+        let (r0, r1, r2, r3) = (sp.add(0), sp.add(1), sp.add(2), sp.add(3));
 
         // These operations are only safe so long as
         // - the pointers are properly aligned. This is guaranteed because the
@@ -245,13 +245,13 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
         //  - Instruction addresses require `|1` to indicate thumb code
         //  - Stack offset 4 is R12, which the syscall interface ignores
         let stack_bottom = state.psp as *mut usize;
-        ptr::write(stack_bottom.offset(7), state.psr); //......... -> APSR
-        ptr::write(stack_bottom.offset(6), callback.pc.addr() | 1); //... -> PC
-        ptr::write(stack_bottom.offset(5), state.yield_pc | 1); // -> LR
-        ptr::write(stack_bottom.offset(3), callback.argument3.as_usize()); // -> R3
-        ptr::write(stack_bottom.offset(2), callback.argument2); // -> R2
-        ptr::write(stack_bottom.offset(1), callback.argument1); // -> R1
-        ptr::write(stack_bottom.offset(0), callback.argument0); // -> R0
+        ptr::write(stack_bottom.add(7), state.psr); //......... -> APSR
+        ptr::write(stack_bottom.add(6), callback.pc.addr() | 1); //... -> PC
+        ptr::write(stack_bottom.add(5), state.yield_pc | 1); // -> LR
+        ptr::write(stack_bottom.add(3), callback.argument3.as_usize()); // -> R3
+        ptr::write(stack_bottom.add(2), callback.argument2); // -> R2
+        ptr::write(stack_bottom.add(1), callback.argument1); // -> R1
+        ptr::write(stack_bottom.add(0), callback.argument0); // -> R0
 
         Ok(())
     }
@@ -296,26 +296,26 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
             // syscall (i.e. we return a value to the app immediately) then this
             // will have no effect. If we are doing something like `yield()`,
             // however, then we need to have this state.
-            state.yield_pc = ptr::read(new_stack_pointer.offset(6));
-            state.psr = ptr::read(new_stack_pointer.offset(7));
+            state.yield_pc = ptr::read(new_stack_pointer.add(6));
+            state.psr = ptr::read(new_stack_pointer.add(7));
 
             // Get the syscall arguments and return them along with the syscall.
             // It's possible the app did something invalid, in which case we put
             // the app in the fault state.
-            let r0 = ptr::read(new_stack_pointer.offset(0));
-            let r1 = ptr::read(new_stack_pointer.offset(1));
-            let r2 = ptr::read(new_stack_pointer.offset(2));
-            let r3 = ptr::read(new_stack_pointer.offset(3));
+            let r0 = ptr::read(new_stack_pointer.add(0));
+            let r1 = ptr::read(new_stack_pointer.add(1));
+            let r2 = ptr::read(new_stack_pointer.add(2));
+            let r3 = ptr::read(new_stack_pointer.add(3));
 
             // Get the actual SVC number.
             // Read the PC from the stack as a *const u16 (i.e. we're treating instructions as
             // u16).
             let pcptr_ptr: *const usize = new_stack_pointer;
             let pcptr_ptr: *const *const u16 = pcptr_ptr.cast();
-            let pcptr = ptr::read(pcptr_ptr.offset(6));
+            let pcptr = ptr::read(pcptr_ptr.add(6));
             // The svc instruction is the last instruction before the PC, and should be 16 bits.
             // Read it by offsetting the PC.
-            let svc_instr = ptr::read(pcptr.offset(-1));
+            let svc_instr = ptr::read(pcptr.sub(1));
             let svc_num = (svc_instr & 0xff) as u8;
 
             // Use the helper function to convert these raw values into a Tock
@@ -367,14 +367,14 @@ impl<A: CortexMVariant> kernel::syscall::UserspaceKernelBoundary for SysCall<A>
                 0xBAD00BAD,
             )
         } else {
-            let r0 = ptr::read(stack_pointer.offset(0));
-            let r1 = ptr::read(stack_pointer.offset(1));
-            let r2 = ptr::read(stack_pointer.offset(2));
-            let r3 = ptr::read(stack_pointer.offset(3));
-            let r12 = ptr::read(stack_pointer.offset(4));
-            let lr = ptr::read(stack_pointer.offset(5));
-            let pc = ptr::read(stack_pointer.offset(6));
-            let xpsr = ptr::read(stack_pointer.offset(7));
+            let r0 = ptr::read(stack_pointer.add(0));
+            let r1 = ptr::read(stack_pointer.add(1));
+            let r2 = ptr::read(stack_pointer.add(2));
+            let r3 = ptr::read(stack_pointer.add(3));
+            let r12 = ptr::read(stack_pointer.add(4));
+            let lr = ptr::read(stack_pointer.add(5));
+            let pc = ptr::read(stack_pointer.add(6));
+            let xpsr = ptr::read(stack_pointer.add(7));
             (r0, r1, r2, r3, r12, lr, pc, xpsr)
         };
 

arch/cortex-m0/src/lib.rs

@@ -33,14 +33,14 @@ struct HardFaultStackedRegisters {
 /// by the naked hard_fault_handler function.
 unsafe extern "C" fn hard_fault_handler_kernel(faulting_stack: *mut u32) -> ! {
     let hardfault_stacked_registers = HardFaultStackedRegisters {
-        r0: *faulting_stack.offset(0),
-        r1: *faulting_stack.offset(1),
-        r2: *faulting_stack.offset(2),
-        r3: *faulting_stack.offset(3),
-        r12: *faulting_stack.offset(4),
-        lr: *faulting_stack.offset(5),
-        pc: *faulting_stack.offset(6),
-        xpsr: *faulting_stack.offset(7),
+        r0: *faulting_stack.add(0),
+        r1: *faulting_stack.add(1),
+        r2: *faulting_stack.add(2),
+        r3: *faulting_stack.add(3),
+        r12: *faulting_stack.add(4),
+        lr: *faulting_stack.add(5),
+        pc: *faulting_stack.add(6),
+        xpsr: *faulting_stack.add(7),
     };
 
     panic!(

arch/cortex-m4f/src/lib.rs

@@ -21,6 +21,7 @@ pub mod mpu {
     }
 }
 
+pub use cortexm::dma_fence;
 pub use cortexm::dwt;
 pub use cortexm::initialize_ram_jump_to_main;
 pub use cortexm::nvic;

arch/cortex-v7m/src/lib.rs

@@ -288,14 +288,14 @@ unsafe extern "C" fn hard_fault_handler_arm_v7m_kernel(
         panic!("kernel stack overflow");
     } else {
         // Show the normal kernel hardfault message.
-        let stacked_r0: u32 = *faulting_stack.offset(0);
-        let stacked_r1: u32 = *faulting_stack.offset(1);
-        let stacked_r2: u32 = *faulting_stack.offset(2);
-        let stacked_r3: u32 = *faulting_stack.offset(3);
-        let stacked_r12: u32 = *faulting_stack.offset(4);
-        let stacked_lr: u32 = *faulting_stack.offset(5);
-        let stacked_pc: u32 = *faulting_stack.offset(6);
-        let stacked_xpsr: u32 = *faulting_stack.offset(7);
+        let stacked_r0: u32 = *faulting_stack.add(0);
+        let stacked_r1: u32 = *faulting_stack.add(1);
+        let stacked_r2: u32 = *faulting_stack.add(2);
+        let stacked_r3: u32 = *faulting_stack.add(3);
+        let stacked_r12: u32 = *faulting_stack.add(4);
+        let stacked_lr: u32 = *faulting_stack.add(5);
+        let stacked_pc: u32 = *faulting_stack.add(6);
+        let stacked_xpsr: u32 = *faulting_stack.add(7);
 
         let mode_str = "Kernel";