Merge branch 'main' into rp2040-rtc-alarm

22 files changed, 1988 insertions, 137 deletions

diff --git a/embassy-rp/src/adc.rs b/embassy-rp/src/adc.rs
index ec0c8c46c..2db8e63d7 100644
--- a/embassy-rp/src/adc.rs
+++ b/embassy-rp/src/adc.rs
@@ -21,6 +21,8 @@ static WAKER: AtomicWaker = AtomicWaker::new();
 #[derive(Default)]
 pub struct Config {}
 
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 enum Source<'p> {
     Pin(Peri<'p, AnyPin>),
     TempSensor(Peri<'p, ADC_TEMP_SENSOR>),
diff --git a/embassy-rp/src/clocks.rs b/embassy-rp/src/clocks.rs
index 6694aab66..2eddc0bcc 100644
--- a/embassy-rp/src/clocks.rs
+++ b/embassy-rp/src/clocks.rs
@@ -38,7 +38,7 @@
 //!
 //! ## Examples
 //!
-//! ### Standard 125MHz configuration
+//! ### Standard 125MHz (rp2040) or 150Mhz (rp235x) configuration
 //! ```rust,ignore
 //! let config = ClockConfig::crystal(12_000_000);
 //! ```
@@ -63,7 +63,6 @@
 //! // Set other parameters as needed...
 //! ```
 
-#[cfg(feature = "rp2040")]
 use core::arch::asm;
 use core::marker::PhantomData;
 #[cfg(feature = "rp2040")]
@@ -73,7 +72,6 @@ use core::sync::atomic::{AtomicU32, Ordering};
 use pac::clocks::vals::*;
 
 use crate::gpio::{AnyPin, SealedPin};
-#[cfg(feature = "rp2040")]
 use crate::pac::common::{Reg, RW};
 use crate::{pac, reset, Peri};
 
@@ -82,6 +80,18 @@ use crate::{pac, reset, Peri};
 // be very useful until we have runtime clock reconfiguration. once this
 // happens we can resurrect the commented-out gpin bits.
 
+/// Clock error types.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum ClockError {
+    /// PLL failed to lock within the timeout period.
+    PllLockTimedOut,
+    /// Could not find valid PLL parameters for system clock.
+    InvalidPllParameters,
+    /// Reading the core voltage failed due to an unexpected value in the register.
+    UnexpectedCoreVoltageRead,
+}
+
 struct Clocks {
     xosc: AtomicU32,
     sys: AtomicU32,
@@ -136,15 +146,16 @@ pub enum PeriClkSrc {
     // Gpin1 = ClkPeriCtrlAuxsrc::CLKSRC_GPIN1 as _ ,
 }
 
-/// Core voltage regulator settings for RP2040.
+/// Core voltage regulator settings.
 ///
-/// The RP2040 voltage regulator can be configured for different output voltages.
+/// The voltage regulator can be configured for different output voltages.
 /// Higher voltages allow for higher clock frequencies but increase power consumption and heat.
 #[cfg(feature = "rp2040")]
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
 #[repr(u8)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum CoreVoltage {
-    /// 0.80V - Suitable for lower frequencies
+    /// 0.80V
     V0_80 = 0b0000,
     /// 0.85V
     V0_85 = 0b0110,
@@ -168,11 +179,58 @@ pub enum CoreVoltage {
     V1_30 = 0b1111,
 }
 
-#[cfg(feature = "rp2040")]
+/// Core voltage regulator settings.
+///
+/// The voltage regulator can be configured for different output voltages.
+/// Higher voltages allow for higher clock frequencies but increase power consumption and heat.
+///
+/// **Note**: The maximum voltage is 1.30V, unless unlocked by setting unless the voltage limit
+/// is disabled using the disable_voltage_limit field in the vreg_ctrl register. For lack of practical use at this
+/// point in time, this is not implemented here. So the maximum voltage in this enum is 1.30V for now.
+#[cfg(feature = "_rp235x")]
+#[repr(u8)]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+pub enum CoreVoltage {
+    /// 0.55V
+    V0_55 = 0b00000,
+    /// 0.60V
+    V0_60 = 0b00001,
+    /// 0.65V
+    V0_65 = 0b00010,
+    /// 0.70V
+    V0_70 = 0b00011,
+    /// 0.75V
+    V0_75 = 0b00100,
+    /// 0.80V
+    V0_80 = 0b00101,
+    /// 0.85V
+    V0_85 = 0b00110,
+    /// 0.90V
+    V0_90 = 0b00111,
+    /// 0.95V
+    V0_95 = 0b01000,
+    /// 1.00V
+    V1_00 = 0b01001,
+    /// 1.05V
+    V1_05 = 0b01010,
+    /// 1.10V - Default voltage level
+    V1_10 = 0b01011,
+    /// 1.15V
+    V1_15 = 0b01100,
+    /// 1.20V
+    V1_20 = 0b01101,
+    /// 1.25V
+    V1_25 = 0b01110,
+    /// 1.30V
+    V1_30 = 0b01111,
+}
+
 impl CoreVoltage {
     /// Get the recommended Brown-Out Detection (BOD) setting for this voltage.
     /// Sets the BOD threshold to approximately 80% of the core voltage.
     fn recommended_bod(self) -> u8 {
+        #[cfg(feature = "rp2040")]
         match self {
             CoreVoltage::V0_80 => 0b0100, // 0.645V (~81% of 0.80V)
             CoreVoltage::V0_85 => 0b0101, // 0.688V (~81% of 0.85V)
@@ -180,12 +238,32 @@ impl CoreVoltage {
             CoreVoltage::V0_95 => 0b0111, // 0.774V (~81% of 0.95V)
             CoreVoltage::V1_00 => 0b1000, // 0.817V (~82% of 1.00V)
             CoreVoltage::V1_05 => 0b1000, // 0.817V (~78% of 1.05V)
-            CoreVoltage::V1_10 => 0b1001, // 0.860V (~78% of 1.10V)
+            CoreVoltage::V1_10 => 0b1001, // 0.860V (~78% of 1.10V), the default
             CoreVoltage::V1_15 => 0b1010, // 0.903V (~79% of 1.15V)
             CoreVoltage::V1_20 => 0b1011, // 0.946V (~79% of 1.20V)
             CoreVoltage::V1_25 => 0b1100, // 0.989V (~79% of 1.25V)
             CoreVoltage::V1_30 => 0b1101, // 1.032V (~79% of 1.30V)
         }
+        #[cfg(feature = "_rp235x")]
+        match self {
+            CoreVoltage::V0_55 => 0b00001, // 0.516V (~94% of 0.55V)
+            CoreVoltage::V0_60 => 0b00010, // 0.559V (~93% of 0.60V)
+            CoreVoltage::V0_65 => 0b00011, // 0.602V (~93% of 0.65V)
+            CoreVoltage::V0_70 => 0b00011, // 0.602V (~86% of 0.70V)
+            CoreVoltage::V0_75 => 0b00100, // 0.645V (~86% of 0.75V)
+            CoreVoltage::V0_80 => 0b00101, // 0.688V (~86% of 0.80V)
+            CoreVoltage::V0_85 => 0b00110, // 0.731V (~86% of 0.85V)
+            CoreVoltage::V0_90 => 0b00110, // 0.731V (~81% of 0.90V)
+            CoreVoltage::V0_95 => 0b00111, // 0.774V (~81% of 0.95V)
+            CoreVoltage::V1_00 => 0b01000, // 0.817V (~82% of 1.00V)
+            CoreVoltage::V1_05 => 0b01000, // 0.817V (~78% of 1.05V)
+            CoreVoltage::V1_10 => 0b01001, // 0.860V (~78% of 1.10V), the default
+            CoreVoltage::V1_15 => 0b01001, // 0.860V (~75% of 1.15V)
+            CoreVoltage::V1_20 => 0b01010, // 0.903V (~75% of 1.20V)
+            CoreVoltage::V1_25 => 0b01010, // 0.903V (~72% of 1.25V)
+            CoreVoltage::V1_30 => 0b01011, // 0.946V (~73% of 1.30V)
+                                            // all others: 0.946V (see CoreVoltage: we do not support setting Voltages higher than 1.30V at this point)
+        }
     }
 }
 
@@ -209,12 +287,10 @@ pub struct ClockConfig {
     /// RTC clock configuration.
     #[cfg(feature = "rp2040")]
     pub rtc_clk: Option<RtcClkConfig>,
-    /// Core voltage scaling (RP2040 only). Defaults to 1.10V.
-    #[cfg(feature = "rp2040")]
+    /// Core voltage scaling. Defaults to 1.10V.
     pub core_voltage: CoreVoltage,
     /// Voltage stabilization delay in microseconds.
     /// If not set, defaults will be used based on voltage level.
-    #[cfg(feature = "rp2040")]
     pub voltage_stabilization_delay_us: Option<u32>,
     // See above re gpin handling being commented out
     // gpin0: Option<(u32, Gpin<'static, AnyPin>)>,
@@ -250,9 +326,7 @@ impl Default for ClockConfig {
             adc_clk: None,
             #[cfg(feature = "rp2040")]
             rtc_clk: None,
-            #[cfg(feature = "rp2040")]
             core_voltage: CoreVoltage::V1_10,
-            #[cfg(feature = "rp2040")]
             voltage_stabilization_delay_us: None,
             // See above re gpin handling being commented out
             // gpin0: None,
@@ -323,9 +397,7 @@ impl ClockConfig {
                 div_frac: 0,
                 phase: 0,
             }),
-            #[cfg(feature = "rp2040")]
             core_voltage: CoreVoltage::V1_10, // Use hardware default (1.10V)
-            #[cfg(feature = "rp2040")]
             voltage_stabilization_delay_us: None,
             // See above re gpin handling being commented out
             // gpin0: None,
@@ -368,9 +440,7 @@ impl ClockConfig {
                 div_frac: 171,
                 phase: 0,
             }),
-            #[cfg(feature = "rp2040")]
             core_voltage: CoreVoltage::V1_10, // Use hardware default (1.10V)
-            #[cfg(feature = "rp2040")]
             voltage_stabilization_delay_us: None,
             // See above re gpin handling being commented out
             // gpin0: None,
@@ -391,29 +461,42 @@ impl ClockConfig {
     /// # Returns
     ///
     /// A ClockConfig configured to achieve the requested system frequency using the
-    /// the usual 12Mhz crystal, or panic if no valid parameters can be found.
+    /// the usual 12Mhz crystal, or an error if no valid parameters can be found.
     ///
     /// # Note on core voltage:
+    ///
+    /// **For RP2040**:
     /// To date the only officially documented core voltages (see Datasheet section 2.15.3.1. Instances) are:
     /// - Up to 133MHz: V1_10 (default)
     /// - Above 133MHz: V1_15, but in the context of the datasheet covering reaching up to 200Mhz
     /// That way all other frequencies below 133MHz or above 200MHz are not explicitly documented and not covered here.
     /// In case You want to go below 133MHz or above 200MHz and want a different voltage, You will have to set that manually and with caution.
-    #[cfg(feature = "rp2040")]
-    pub fn system_freq(hz: u32) -> Self {
+    ///
+    /// **For RP235x**:
+    /// At this point in time there is no official manufacturer endorsement for running the chip on other core voltages and/or other clock speeds than the defaults.
+    /// Using this function is experimental and may not work as expected or even damage the chip.
+    ///
+    /// # Returns
+    ///
+    /// A Result containing either the configured ClockConfig or a ClockError.
+    pub fn system_freq(hz: u32) -> Result<Self, ClockError> {
         // Start with the standard configuration from crystal()
         const DEFAULT_CRYSTAL_HZ: u32 = 12_000_000;
         let mut config = Self::crystal(DEFAULT_CRYSTAL_HZ);
 
         // No need to modify anything if target frequency is already 125MHz
         // (which is what crystal() configures by default)
+        #[cfg(feature = "rp2040")]
         if hz == 125_000_000 {
-            return config;
+            return Ok(config);
+        }
+        #[cfg(feature = "_rp235x")]
+        if hz == 150_000_000 {
+            return Ok(config);
         }
 
         // Find optimal PLL parameters for the requested frequency
-        let sys_pll_params = find_pll_params(DEFAULT_CRYSTAL_HZ, hz)
-            .unwrap_or_else(|| panic!("Could not find valid PLL parameters for system clock"));
+        let sys_pll_params = find_pll_params(DEFAULT_CRYSTAL_HZ, hz).ok_or(ClockError::InvalidPllParameters)?;
 
         // Replace the sys_pll configuration with our custom parameters
         if let Some(xosc) = &mut config.xosc {
@@ -429,8 +512,16 @@ impl ClockConfig {
                 _ => CoreVoltage::V1_10, // Use default voltage (V1_10)
             };
         }
+        #[cfg(feature = "_rp235x")]
+        {
+            config.core_voltage = match hz {
+                // There is no official support for running the chip on other core voltages and/or other clock speeds than the defaults.
+                // So for now we have not way of knowing what the voltage should be. Change this if the manufacturer provides more information.
+                _ => CoreVoltage::V1_10, // Use default voltage (V1_10)
+            };
+        }
 
-        config
+        Ok(config)
     }
 
     /// Configure with manual PLL settings for full control over system clock
@@ -525,6 +616,7 @@ impl ClockConfig {
 #[repr(u16)]
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum RoscRange {
     /// Low range.
     Low = pac::rosc::vals::FreqRange::LOW.0,
@@ -631,6 +723,7 @@ pub struct RefClkConfig {
 /// Reference clock source.
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum RefClkSrc {
     /// XOSC.
     Xosc,
@@ -646,6 +739,7 @@ pub enum RefClkSrc {
 /// SYS clock source.
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum SysClkSrc {
     /// REF.
     Ref,
@@ -684,6 +778,7 @@ pub struct SysClkConfig {
 #[repr(u8)]
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum UsbClkSrc {
     /// PLL USB.
     PllUsb = ClkUsbCtrlAuxsrc::CLKSRC_PLL_USB as _,
@@ -712,6 +807,7 @@ pub struct UsbClkConfig {
 #[repr(u8)]
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum AdcClkSrc {
     /// PLL USB.
     PllUsb = ClkAdcCtrlAuxsrc::CLKSRC_PLL_USB as _,
@@ -740,6 +836,7 @@ pub struct AdcClkConfig {
 #[repr(u8)]
 #[non_exhaustive]
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 #[cfg(feature = "rp2040")]
 pub enum RtcClkSrc {
     /// PLL USB.
@@ -791,7 +888,6 @@ pub struct RtcClkConfig {
 /// // Find parameters for 133MHz system clock from 12MHz crystal
 /// let pll_params = find_pll_params(12_000_000, 133_000_000).unwrap();
 /// ```
-#[cfg(feature = "rp2040")]
 fn find_pll_params(input_hz: u32, target_hz: u32) -> Option<PllConfig> {
     // Fixed reference divider for system PLL
     const PLL_SYS_REFDIV: u8 = 1;
@@ -925,18 +1021,31 @@ pub(crate) unsafe fn init(config: ClockConfig) {
     };
     CLOCKS.rosc.store(rosc_freq, Ordering::Relaxed);
 
-    // Set Core Voltage (RP2040 only), if we have config for it and we're not using the default
-    #[cfg(feature = "rp2040")]
+    // Set Core Voltage, if we have config for it and we're not using the default
     {
         let voltage = config.core_voltage;
+
+        #[cfg(feature = "rp2040")]
         let vreg = pac::VREG_AND_CHIP_RESET;
+        #[cfg(feature = "_rp235x")]
+        let vreg = pac::POWMAN;
+
         let current_vsel = vreg.vreg().read().vsel();
         let target_vsel = voltage as u8;
 
         // If the target voltage is different from the current one, we need to change it
         if target_vsel != current_vsel {
-            // Use modify() to preserve the HIZ and EN bits - otherwise we will disable the regulator when changing voltage
+            // Set the voltage regulator to the target voltage
+            #[cfg(feature = "rp2040")]
             vreg.vreg().modify(|w| w.set_vsel(target_vsel));
+            #[cfg(feature = "_rp235x")]
+            // For rp235x changes to the voltage regulator are protected by a password, see datasheet section 6.4 Power Management (POWMAN) Registers
+            // The password is "5AFE" (0x5AFE), it must be set in the top 16 bits of the register
+            vreg.vreg().modify(|w| {
+                w.0 = (w.0 & 0x0000FFFF) | (0x5AFE << 16); // Set the password
+                w.set_vsel(target_vsel);
+                *w
+            });
 
             // Wait for the voltage to stabilize. Use the provided delay or default based on voltage
             let settling_time_us = config.voltage_stabilization_delay_us.unwrap_or_else(|| {
@@ -955,10 +1064,17 @@ pub(crate) unsafe fn init(config: ClockConfig) {
             }
 
             // Only now set the BOD level. At this point the voltage is considered stable.
+            #[cfg(feature = "rp2040")]
             vreg.bod().write(|w| {
                 w.set_vsel(voltage.recommended_bod());
                 w.set_en(true); // Enable brownout detection
             });
+            #[cfg(feature = "_rp235x")]
+            vreg.bod().write(|w| {
+                w.0 = (w.0 & 0x0000FFFF) | (0x5AFE << 16); // Set the password
+                w.set_vsel(voltage.recommended_bod());
+                w.set_en(true); // Enable brownout detection
+            });
         }
     }
 
@@ -970,14 +1086,14 @@ pub(crate) unsafe fn init(config: ClockConfig) {
             let pll_sys_freq = match config.sys_pll {
                 Some(sys_pll_config) => match configure_pll(pac::PLL_SYS, config.hz, sys_pll_config) {
                     Ok(freq) => freq,
-                    Err(e) => panic!("Failed to configure PLL_SYS: {}", e),
+                    Err(e) => panic!("Failed to configure PLL_SYS: {:?}", e),
                 },
                 None => 0,
             };
             let pll_usb_freq = match config.usb_pll {
                 Some(usb_pll_config) => match configure_pll(pac::PLL_USB, config.hz, usb_pll_config) {
                     Ok(freq) => freq,
-                    Err(e) => panic!("Failed to configure PLL_USB: {}", e),
+                    Err(e) => panic!("Failed to configure PLL_USB: {:?}", e),
                 },
                 None => 0,
             };
@@ -1283,6 +1399,58 @@ pub fn clk_rtc_freq() -> u16 {
     CLOCKS.rtc.load(Ordering::Relaxed)
 }
 
+/// The core voltage of the chip.
+///
+/// Returns the current core voltage or an error if the voltage register
+/// contains an unknown value.
+pub fn core_voltage() -> Result<CoreVoltage, ClockError> {
+    #[cfg(feature = "rp2040")]
+    {
+        let vreg = pac::VREG_AND_CHIP_RESET;
+        let vsel = vreg.vreg().read().vsel();
+        match vsel {
+            0b0000 => Ok(CoreVoltage::V0_80),
+            0b0110 => Ok(CoreVoltage::V0_85),
+            0b0111 => Ok(CoreVoltage::V0_90),
+            0b1000 => Ok(CoreVoltage::V0_95),
+            0b1001 => Ok(CoreVoltage::V1_00),
+            0b1010 => Ok(CoreVoltage::V1_05),
+            0b1011 => Ok(CoreVoltage::V1_10),
+            0b1100 => Ok(CoreVoltage::V1_15),
+            0b1101 => Ok(CoreVoltage::V1_20),
+            0b1110 => Ok(CoreVoltage::V1_25),
+            0b1111 => Ok(CoreVoltage::V1_30),
+            _ => Err(ClockError::UnexpectedCoreVoltageRead),
+        }
+    }
+
+    #[cfg(feature = "_rp235x")]
+    {
+        let vreg = pac::POWMAN;
+        let vsel = vreg.vreg().read().vsel();
+        match vsel {
+            0b00000 => Ok(CoreVoltage::V0_55),
+            0b00001 => Ok(CoreVoltage::V0_60),
+            0b00010 => Ok(CoreVoltage::V0_65),
+            0b00011 => Ok(CoreVoltage::V0_70),
+            0b00100 => Ok(CoreVoltage::V0_75),
+            0b00101 => Ok(CoreVoltage::V0_80),
+            0b00110 => Ok(CoreVoltage::V0_85),
+            0b00111 => Ok(CoreVoltage::V0_90),
+            0b01000 => Ok(CoreVoltage::V0_95),
+            0b01001 => Ok(CoreVoltage::V1_00),
+            0b01010 => Ok(CoreVoltage::V1_05),
+            0b01011 => Ok(CoreVoltage::V1_10),
+            0b01100 => Ok(CoreVoltage::V1_15),
+            0b01101 => Ok(CoreVoltage::V1_20),
+            0b01110 => Ok(CoreVoltage::V1_25),
+            0b01111 => Ok(CoreVoltage::V1_30),
+            _ => Err(ClockError::UnexpectedCoreVoltageRead),
+            // see CoreVoltage: we do not support setting Voltages higher than 1.30V at this point
+        }
+    }
+}
+
 fn start_xosc(crystal_hz: u32, delay_multiplier: u32) {
     let startup_delay = (((crystal_hz / 1000) * delay_multiplier) + 128) / 256;
     pac::XOSC.startup().write(|w| w.set_delay(startup_delay as u16));
@@ -1295,7 +1463,7 @@ fn start_xosc(crystal_hz: u32, delay_multiplier: u32) {
 
 /// PLL (Phase-Locked Loop) configuration
 #[inline(always)]
-fn configure_pll(p: pac::pll::Pll, input_freq: u32, config: PllConfig) -> Result<u32, &'static str> {
+fn configure_pll(p: pac::pll::Pll, input_freq: u32, config: PllConfig) -> Result<u32, ClockError> {
     // Calculate reference frequency
     let ref_freq = input_freq / config.refdiv as u32;
 
@@ -1366,7 +1534,7 @@ fn configure_pll(p: pac::pll::Pll, input_freq: u32, config: PllConfig) -> Result
         timeout -= 1;
         if timeout == 0 {
             // PLL failed to lock, return 0 to indicate failure
-            return Err("PLL failed to lock");
+            return Err(ClockError::PllLockTimedOut);
         }
     }
 
@@ -1606,7 +1774,8 @@ impl<'d, T: GpoutPin> Drop for Gpout<'d, T> {
 pub struct RoscRng;
 
 impl RoscRng {
-    fn next_u8() -> u8 {
+    /// Get a random u8
+    pub fn next_u8() -> u8 {
         let random_reg = pac::ROSC.randombit();
         let mut acc = 0;
         for _ in 0..u8::BITS {
@@ -1615,31 +1784,65 @@ impl RoscRng {
         }
         acc
     }
+
+    /// Get a random u32
+    pub fn next_u32(&mut self) -> u32 {
+        rand_core_09::impls::next_u32_via_fill(self)
+    }
+
+    /// Get a random u64
+    pub fn next_u64(&mut self) -> u64 {
+        rand_core_09::impls::next_u64_via_fill(self)
+    }
+
+    /// Fill a slice with random bytes
+    pub fn fill_bytes(&mut self, dest: &mut [u8]) {
+        dest.fill_with(Self::next_u8)
+    }
 }
 
-impl rand_core::RngCore for RoscRng {
-    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), rand_core::Error> {
-        Ok(self.fill_bytes(dest))
+impl rand_core_06::RngCore for RoscRng {
+    fn next_u32(&mut self) -> u32 {
+        self.next_u32()
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        self.next_u64()
+    }
+
+    fn fill_bytes(&mut self, dest: &mut [u8]) {
+        self.fill_bytes(dest);
+    }
+
+    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), rand_core_06::Error> {
+        self.fill_bytes(dest);
+        Ok(())
     }
+}
 
+impl rand_core_06::CryptoRng for RoscRng {}
+
+impl rand_core_09::RngCore for RoscRng {
     fn next_u32(&mut self) -> u32 {
-        rand_core::impls::next_u32_via_fill(self)
+        self.next_u32()
     }
 
     fn next_u64(&mut self) -> u64 {
-        rand_core::impls::next_u64_via_fill(self)
+        self.next_u64()
     }
 
     fn fill_bytes(&mut self, dest: &mut [u8]) {
-        dest.fill_with(Self::next_u8)
+        self.fill_bytes(dest);
     }
 }
 
+impl rand_core_09::CryptoRng for RoscRng {}
+
 /// Enter the `DORMANT` sleep state. This will stop *all* internal clocks
 /// and can only be exited through resets, dormant-wake GPIO interrupts,
 /// and RTC interrupts. If RTC is clocked from an internal clock source
 /// it will be stopped and not function as a wakeup source.
-#[cfg(all(target_arch = "arm", feature = "rp2040"))]
+#[cfg(all(target_arch = "arm"))]
 pub fn dormant_sleep() {
     struct Set<T: Copy, F: Fn()>(Reg<T, RW>, T, F);
 
@@ -1937,21 +2140,21 @@ mod tests {
         {
             // Test automatic voltage scaling based on frequency
             // Under 133 MHz should use default voltage (V1_10)
-            let config = ClockConfig::system_freq(125_000_000);
+            let config = ClockConfig::system_freq(125_000_000).unwrap();
             assert_eq!(config.core_voltage, CoreVoltage::V1_10);
 
             // 133-200 MHz should use V1_15
-            let config = ClockConfig::system_freq(150_000_000);
+            let config = ClockConfig::system_freq(150_000_000).unwrap();
             assert_eq!(config.core_voltage, CoreVoltage::V1_15);
-            let config = ClockConfig::system_freq(200_000_000);
+            let config = ClockConfig::system_freq(200_000_000).unwrap();
             assert_eq!(config.core_voltage, CoreVoltage::V1_15);
 
-            // Above 200 MHz should use V1_25
-            let config = ClockConfig::system_freq(250_000_000);
+            // Above 200 MHz should use V1_15
+            let config = ClockConfig::system_freq(250_000_000).unwrap();
             assert_eq!(config.core_voltage, CoreVoltage::V1_15);
 
             // Below 125 MHz should use V1_10
-            let config = ClockConfig::system_freq(100_000_000);
+            let config = ClockConfig::system_freq(100_000_000).unwrap();
             assert_eq!(config.core_voltage, CoreVoltage::V1_10);
         }
     }
diff --git a/embassy-rp/src/flash.rs b/embassy-rp/src/flash.rs
index ef1cd9212..8c809090e 100644
--- a/embassy-rp/src/flash.rs
+++ b/embassy-rp/src/flash.rs
@@ -482,7 +482,11 @@ mod ram_helpers {
     /// # Safety
     ///
     /// `boot2` must contain a valid 2nd stage boot loader which can be called to re-initialize XIP mode
-    unsafe fn flash_function_pointers_with_boot2(erase: bool, write: bool, boot2: &[u32; 64]) -> FlashFunctionPointers {
+    unsafe fn flash_function_pointers_with_boot2(
+        erase: bool,
+        write: bool,
+        boot2: &[u32; 64],
+    ) -> FlashFunctionPointers<'_> {
         let boot2_fn_ptr = (boot2 as *const u32 as *const u8).offset(1);
         let boot2_fn: unsafe extern "C" fn() -> () = core::mem::transmute(boot2_fn_ptr);
         FlashFunctionPointers {
diff --git a/embassy-rp/src/gpio.rs b/embassy-rp/src/gpio.rs
index af0837f6a..f79bf8948 100644
--- a/embassy-rp/src/gpio.rs
+++ b/embassy-rp/src/gpio.rs
@@ -26,6 +26,7 @@ static QSPI_WAKERS: [AtomicWaker; QSPI_PIN_COUNT] = [const { AtomicWaker::new()
 
 /// Represents a digital input or output level.
 #[derive(Debug, Eq, PartialEq, Clone, Copy)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Level {
     /// Logical low.
     Low,
@@ -53,6 +54,7 @@ impl From<Level> for bool {
 
 /// Represents a pull setting for an input.
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Pull {
     /// No pull.
     None,
@@ -64,6 +66,7 @@ pub enum Pull {
 
 /// Drive strength of an output
 #[derive(Debug, Eq, PartialEq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Drive {
     /// 2 mA drive.
     _2mA,
@@ -76,6 +79,7 @@ pub enum Drive {
 }
 /// Slew rate of an output
 #[derive(Debug, Eq, PartialEq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum SlewRate {
     /// Fast slew rate.
     Fast,
@@ -85,6 +89,7 @@ pub enum SlewRate {
 
 /// A GPIO bank with up to 32 pins.
 #[derive(Debug, Eq, PartialEq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub enum Bank {
     /// Bank 0.
     Bank0 = 0,
@@ -108,6 +113,8 @@ pub struct DormantWakeConfig {
 }
 
 /// GPIO input driver.
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct Input<'d> {
     pin: Flex<'d>,
 }
@@ -146,6 +153,12 @@ impl<'d> Input<'d> {
         self.pin.get_level()
     }
 
+    /// Configure the input logic inversion of this pin.
+    #[inline]
+    pub fn set_inversion(&mut self, invert: bool) {
+        self.pin.set_input_inversion(invert)
+    }
+
     /// Wait until the pin is high. If it is already high, return immediately.
     #[inline]
     pub async fn wait_for_high(&mut self) {
@@ -352,6 +365,8 @@ impl<'d> Future for InputFuture<'d> {
 }
 
 /// GPIO output driver.
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct Output<'d> {
     pin: Flex<'d>,
 }
@@ -382,6 +397,12 @@ impl<'d> Output<'d> {
         self.pin.set_slew_rate(slew_rate)
     }
 
+    /// Configure the output logic inversion of this pin.
+    #[inline]
+    pub fn set_inversion(&mut self, invert: bool) {
+        self.pin.set_output_inversion(invert)
+    }
+
     /// Set the output as high.
     #[inline]
     pub fn set_high(&mut self) {
@@ -433,6 +454,8 @@ impl<'d> Output<'d> {
 }
 
 /// GPIO output open-drain.
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct OutputOpenDrain<'d> {
     pin: Flex<'d>,
 }
@@ -580,6 +603,8 @@ impl<'d> OutputOpenDrain<'d> {
 /// This pin can be either an input or output pin. The output level register bit will remain
 /// set while not in output mode, so the pin's level will be 'remembered' when it is not in output
 /// mode.
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct Flex<'d> {
     pin: Peri<'d, AnyPin>,
 }
@@ -685,6 +710,30 @@ impl<'d> Flex<'d> {
         self.pin.sio_oe().value_xor().write_value(self.bit())
     }
 
+    /// Configure the input logic inversion of this pin.
+    #[inline]
+    pub fn set_input_inversion(&mut self, invert: bool) {
+        self.pin.gpio().ctrl().modify(|w| {
+            w.set_inover(if invert {
+                pac::io::vals::Inover::INVERT
+            } else {
+                pac::io::vals::Inover::NORMAL
+            })
+        });
+    }
+
+    /// Configure the output logic inversion of this pin.
+    #[inline]
+    pub fn set_output_inversion(&mut self, invert: bool) {
+        self.pin.gpio().ctrl().modify(|w| {
+            w.set_outover(if invert {
+                pac::io::vals::Outover::INVERT
+            } else {
+                pac::io::vals::Outover::NORMAL
+            })
+        });
+    }
+
     /// Get whether the pin input level is high.
     #[inline]
     pub fn is_high(&self) -> bool {
@@ -815,6 +864,8 @@ impl<'d> Drop for Flex<'d> {
         self.pin.pad_ctrl().write(|_| {});
         self.pin.gpio().ctrl().write(|w| {
             w.set_funcsel(pac::io::vals::Gpio0ctrlFuncsel::NULL as _);
+            w.set_inover(pac::io::vals::Inover::NORMAL);
+            w.set_outover(pac::io::vals::Outover::NORMAL);
         });
         self.pin.io().int_dormant_wake().inte(idx / 8).write_clear(|w| {
             w.set_edge_high(idx % 8, true);
@@ -826,6 +877,8 @@ impl<'d> Drop for Flex<'d> {
 }
 
 /// Dormant wake driver.
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct DormantWake<'w> {
     pin: Peri<'w, AnyPin>,
     cfg: DormantWakeConfig,
@@ -932,6 +985,8 @@ pub trait Pin: PeripheralType + Into<AnyPin> + SealedPin + Sized + 'static {
 }
 
 /// Type-erased GPIO pin
+#[derive(Debug)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
 pub struct AnyPin {
     pin_bank: u8,
 }
diff --git a/embassy-rp/src/i2c.rs b/embassy-rp/src/i2c.rs
index a983b7bc3..ffbef63be 100644
--- a/embassy-rp/src/i2c.rs
+++ b/embassy-rp/src/i2c.rs
@@ -64,18 +64,31 @@ pub enum ConfigError {
 pub struct Config {
     /// Frequency.
     pub frequency: u32,
+    /// Enable internal pullup on SDA.
+    ///
+    /// Using external pullup resistors is recommended for I2C. If you do
+    /// have external pullups you should not enable this.
+    pub sda_pullup: bool,
+    /// Enable internal pullup on SCL.
+    ///
+    /// Using external pullup resistors is recommended for I2C. If you do
+    /// have external pullups you should not enable this.
+    pub scl_pullup: bool,
 }
-
 impl Default for Config {
     fn default() -> Self {
-        Self { frequency: 100_000 }
+        Self {
+            frequency: 100_000,
+            sda_pullup: true,
+            scl_pullup: true,
+        }
     }
 }
-
 /// Size of I2C FIFO.
 pub const FIFO_SIZE: u8 = 16;
 
 /// I2C driver.
+#[derive(Debug)]
 pub struct I2c<'d, T: Instance, M: Mode> {
     phantom: PhantomData<(&'d mut T, M)>,
 }
@@ -358,7 +371,7 @@ impl<T: Instance> interrupt::typelevel::Handler<T::Interrupt> for InterruptHandl
     }
 }
 
-pub(crate) fn set_up_i2c_pin<P, T>(pin: &P)
+pub(crate) fn set_up_i2c_pin<P, T>(pin: &P, pullup: bool)
 where
     P: core::ops::Deref<Target = T>,
     T: crate::gpio::Pin,
@@ -371,7 +384,7 @@ where
         w.set_slewfast(false);
         w.set_ie(true);
         w.set_od(false);
-        w.set_pue(true);
+        w.set_pue(pullup);
         w.set_pde(false);
     });
 }
@@ -383,8 +396,8 @@ impl<'d, T: Instance + 'd, M: Mode> I2c<'d, T, M> {
         crate::reset::unreset_wait(reset);
 
         // Configure SCL & SDA pins
-        set_up_i2c_pin(&scl);
-        set_up_i2c_pin(&sda);
+        set_up_i2c_pin(&scl, config.scl_pullup);
+        set_up_i2c_pin(&sda, config.sda_pullup);
 
         let mut me = Self { phantom: PhantomData };
 
diff --git a/embassy-rp/src/i2c_slave.rs b/embassy-rp/src/i2c_slave.rs
index 7bc14511d..c263047ad 100644
--- a/embassy-rp/src/i2c_slave.rs
+++ b/embassy-rp/src/i2c_slave.rs
@@ -65,6 +65,16 @@ pub struct Config {
     pub addr: u16,
     /// Control if the peripheral should ack to and report general calls.
     pub general_call: bool,
+    /// Enable internal pullup on SDA.
+    ///
+    /// Using external pullup resistors is recommended for I2C. If you do
+    /// have external pullups you should not enable this.
+    pub sda_pullup: bool,
+    /// Enable internal pullup on SCL.
+    ///
+    /// Using external pullup resistors is recommended for I2C. If you do
+    /// have external pullups you should not enable this.
+    pub scl_pullup: bool,
 }
 
 impl Default for Config {
@@ -72,6 +82,8 @@ impl Default for Config {
         Self {
             addr: 0x55,
             general_call: true,
+            sda_pullup: true,
+            scl_pullup: true,
         }
     }
 }
@@ -95,8 +107,8 @@ impl<'d, T: Instance> I2cSlave<'d, T> {
         assert!(config.addr != 0);
 
         // Configure SCL & SDA pins
-        set_up_i2c_pin(&scl);
-        set_up_i2c_pin(&sda);
+        set_up_i2c_pin(&scl, config.scl_pullup);
+        set_up_i2c_pin(&sda, config.sda_pullup);
 
         let mut ret = Self {
             phantom: PhantomData,
diff --git a/embassy-rp/src/lib.rs b/embassy-rp/src/lib.rs
index f549446bc..6fb680b34 100644
--- a/embassy-rp/src/lib.rs
+++ b/embassy-rp/src/lib.rs
@@ -35,7 +35,11 @@ pub mod multicore;
 #[cfg(feature = "_rp235x")]
 pub mod otp;
 pub mod pio_programs;
+#[cfg(feature = "_rp235x")]
+pub mod psram;
 pub mod pwm;
+#[cfg(feature = "_rp235x")]
+pub mod qmi_cs1;
 mod reset;
 pub mod rom_data;
 #[cfg(feature = "rp2040")]
@@ -160,15 +164,18 @@ embassy_hal_internal::interrupt_mod!(
 /// ```rust,ignore
 /// use embassy_rp::{bind_interrupts, usb, peripherals};
 ///
-/// bind_interrupts!(struct Irqs {
-///     USBCTRL_IRQ => usb::InterruptHandler<peripherals::USB>;
-/// });
+/// bind_interrupts!(
+///     /// Binds the USB Interrupts.
+///     struct Irqs {
+///         USBCTRL_IRQ => usb::InterruptHandler<peripherals::USB>;
+///     }
+/// );
 /// ```
 ///
 // developer note: this macro can't be in `embassy-hal-internal` due to the use of `$crate`.
 #[macro_export]
 macro_rules! bind_interrupts {
-    ($vis:vis struct $name:ident {
+    ($(#[$attr:meta])* $vis:vis struct $name:ident {
         $(
             $(#[cfg($cond_irq:meta)])?
             $irq:ident => $(
@@ -178,6 +185,7 @@ macro_rules! bind_interrupts {
         )*
     }) => {
         #[derive(Copy, Clone)]
+        $(#[$attr])*
         $vis struct $name;
 
         $(
@@ -185,11 +193,13 @@ macro_rules! bind_interrupts {
             #[no_mangle]
             $(#[cfg($cond_irq)])?
             unsafe extern "C" fn $irq() {
-                $(
-                    $(#[cfg($cond_handler)])?
-                    <$handler as $crate::interrupt::typelevel::Handler<$crate::interrupt::typelevel::$irq>>::on_interrupt();
+                unsafe {
+                    $(
+                        $(#[cfg($cond_handler)])?
+                        <$handler as $crate::interrupt::typelevel::Handler<$crate::interrupt::typelevel::$irq>>::on_interrupt();
 
-                )*
+                    )*
+                }
             }
 
             $(#[cfg($cond_irq)])?
@@ -375,6 +385,8 @@ embassy_hal_internal::peripherals! {
     SPI0,
     SPI1,
 
+    QMI_CS1,
+
     I2C0,
     I2C1,
 
@@ -563,7 +575,7 @@ unsafe fn install_stack_guard(stack_bottom: *mut usize) -> Result<(), ()> {
     unsafe {
         core.MPU.ctrl.write(5); // enable mpu with background default map
         core.MPU.rbar.write(stack_bottom as u32 & !0xff); // set address
-        core.MPU.rlar.write(1); // enable region
+        core.MPU.rlar.write(((stack_bottom as usize + 255) as u32) | 1);
     }
     Ok(())
 }
diff --git a/embassy-rp/src/multicore.rs b/embassy-rp/src/multicore.rs
index d10b6837c..adedc98ad 100644
--- a/embassy-rp/src/multicore.rs
+++ b/embassy-rp/src/multicore.rs
@@ -38,11 +38,11 @@
 //!
 //!     embassy_rp::multicore::spawn_core1(p.CORE1, unsafe { &mut CORE1_STACK }, move || {
 //!         let executor1 = EXECUTOR1.init(Executor::new());
-//!         executor1.run(|spawner| spawner.spawn(core1_task()).unwrap());
+//!         executor1.run(|spawner| spawner.spawn(core1_task().unwrap()));
 //!     });
 //!
 //!     let executor0 = EXECUTOR0.init(Executor::new());
-//!     executor0.run(|spawner| spawner.spawn(core0_task()).unwrap())
+//!     executor0.run(|spawner| spawner.spawn(core0_task().unwrap()))
 //! }
 //! ```
 
@@ -57,6 +57,26 @@ const PAUSE_TOKEN: u32 = 0xDEADBEEF;
 const RESUME_TOKEN: u32 = !0xDEADBEEF;
 static IS_CORE1_INIT: AtomicBool = AtomicBool::new(false);
 
+/// Represents a partiticular CPU core (SIO_CPUID)
+#[derive(Debug, PartialEq, Eq, Clone, Copy, Hash)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[repr(u8)]
+pub enum CoreId {
+    /// Core 0
+    Core0 = 0x0,
+    /// Core 1
+    Core1 = 0x1,
+}
+
+/// Gets which core we are currently executing from
+pub fn current_core() -> CoreId {
+    if pac::SIO.cpuid().read() == 0 {
+        CoreId::Core0
+    } else {
+        CoreId::Core1
+    }
+}
+
 #[inline(always)]
 unsafe fn core1_setup(stack_bottom: *mut usize) {
     if install_stack_guard(stack_bottom).is_err() {
diff --git a/embassy-rp/src/pio/mod.rs b/embassy-rp/src/pio/mod.rs
index ec698d99c..5f554dfe3 100644
--- a/embassy-rp/src/pio/mod.rs
+++ b/embassy-rp/src/pio/mod.rs
@@ -12,7 +12,7 @@ use fixed::types::extra::U8;
 use fixed::FixedU32;
 use pio::{Program, SideSet, Wrap};
 
-use crate::dma::{Channel, Transfer, Word};
+use crate::dma::{self, Channel, Transfer, Word};
 use crate::gpio::{self, AnyPin, Drive, Level, Pull, SealedPin, SlewRate};
 use crate::interrupt::typelevel::{Binding, Handler, Interrupt};
 use crate::relocate::RelocatedProgram;
@@ -98,6 +98,9 @@ pub enum StatusSource {
     TxFifoLevel = 0,
     /// All-ones if RX FIFO level < N, otherwise all-zeroes.
     RxFifoLevel = 1,
+    /// All-ones if the indexed IRQ flag is raised, otherwise all-zeroes
+    #[cfg(feature = "_rp235x")]
+    Irq = 2,
 }
 
 const RXNEMPTY_MASK: u32 = 1 << 0;
@@ -278,6 +281,18 @@ impl<'l, PIO: Instance> Pin<'l, PIO> {
         });
     }
 
+    /// Configure the output logic inversion of this pin.
+    #[inline]
+    pub fn set_output_inversion(&mut self, invert: bool) {
+        self.pin.gpio().ctrl().modify(|w| {
+            w.set_outover(if invert {
+                pac::io::vals::Outover::INVERT
+            } else {
+                pac::io::vals::Outover::NORMAL
+            })
+        });
+    }
+
     /// Set the pin's input sync bypass.
     pub fn set_input_sync_bypass(&mut self, bypass: bool) {
         let mask = 1 << self.pin();
@@ -357,6 +372,10 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineRx<'d, PIO, SM> {
         FifoInFuture::new(self)
     }
 
+    fn dreq() -> crate::pac::dma::vals::TreqSel {
+        crate::pac::dma::vals::TreqSel::from(PIO::PIO_NO * 8 + SM as u8 + 4)
+    }
+
     /// Prepare DMA transfer from RX FIFO.
     pub fn dma_pull<'a, C: Channel, W: Word>(
         &'a mut self,
@@ -364,7 +383,6 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineRx<'d, PIO, SM> {
         data: &'a mut [W],
         bswap: bool,
     ) -> Transfer<'a, C> {
-        let pio_no = PIO::PIO_NO;
         let p = ch.regs();
         p.write_addr().write_value(data.as_ptr() as u32);
         p.read_addr().write_value(PIO::PIO.rxf(SM).as_ptr() as u32);
@@ -374,8 +392,7 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineRx<'d, PIO, SM> {
         p.trans_count().write(|w| w.set_count(data.len() as u32));
         compiler_fence(Ordering::SeqCst);
         p.ctrl_trig().write(|w| {
-            // Set RX DREQ for this statemachine
-            w.set_treq_sel(crate::pac::dma::vals::TreqSel::from(pio_no * 8 + SM as u8 + 4));
+            w.set_treq_sel(Self::dreq());
             w.set_data_size(W::size());
             w.set_chain_to(ch.number());
             w.set_incr_read(false);
@@ -386,6 +403,36 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineRx<'d, PIO, SM> {
         compiler_fence(Ordering::SeqCst);
         Transfer::new(ch)
     }
+
+    /// Prepare a repeated DMA transfer from RX FIFO.
+    pub fn dma_pull_repeated<'a, C: Channel, W: Word>(&'a mut self, ch: Peri<'a, C>, len: usize) -> Transfer<'a, C> {
+        // This is the read version of dma::write_repeated. This allows us to
+        // discard reads from the RX FIFO through DMA.
+
+        // static mut so it gets allocated in RAM
+        static mut DUMMY: u32 = 0;
+
+        let p = ch.regs();
+        p.write_addr().write_value(core::ptr::addr_of_mut!(DUMMY) as u32);
+        p.read_addr().write_value(PIO::PIO.rxf(SM).as_ptr() as u32);
+
+        #[cfg(feature = "rp2040")]
+        p.trans_count().write(|w| *w = len as u32);
+        #[cfg(feature = "_rp235x")]
+        p.trans_count().write(|w| w.set_count(len as u32));
+
+        compiler_fence(Ordering::SeqCst);
+        p.ctrl_trig().write(|w| {
+            w.set_treq_sel(Self::dreq());
+            w.set_data_size(W::size());
+            w.set_chain_to(ch.number());
+            w.set_incr_read(false);
+            w.set_incr_write(false);
+            w.set_en(true);
+        });
+        compiler_fence(Ordering::SeqCst);
+        Transfer::new(ch)
+    }
 }
 
 /// Type representing a state machine TX FIFO.
@@ -409,7 +456,7 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineTx<'d, PIO, SM> {
         (PIO::PIO.flevel().read().0 >> (SM * 8)) as u8 & 0x0f
     }
 
-    /// Check state machine has stalled on empty TX FIFO.
+    /// Check if state machine has stalled on empty TX FIFO.
     pub fn stalled(&self) -> bool {
         let fdebug = PIO::PIO.fdebug();
         let ret = fdebug.read().txstall() & (1 << SM) != 0;
@@ -448,6 +495,10 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineTx<'d, PIO, SM> {
         FifoOutFuture::new(self, value)
     }
 
+    fn dreq() -> crate::pac::dma::vals::TreqSel {
+        crate::pac::dma::vals::TreqSel::from(PIO::PIO_NO * 8 + SM as u8)
+    }
+
     /// Prepare a DMA transfer to TX FIFO.
     pub fn dma_push<'a, C: Channel, W: Word>(
         &'a mut self,
@@ -455,7 +506,6 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineTx<'d, PIO, SM> {
         data: &'a [W],
         bswap: bool,
     ) -> Transfer<'a, C> {
-        let pio_no = PIO::PIO_NO;
         let p = ch.regs();
         p.read_addr().write_value(data.as_ptr() as u32);
         p.write_addr().write_value(PIO::PIO.txf(SM).as_ptr() as u32);
@@ -465,8 +515,7 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineTx<'d, PIO, SM> {
         p.trans_count().write(|w| w.set_count(data.len() as u32));
         compiler_fence(Ordering::SeqCst);
         p.ctrl_trig().write(|w| {
-            // Set TX DREQ for this statemachine
-            w.set_treq_sel(crate::pac::dma::vals::TreqSel::from(pio_no * 8 + SM as u8));
+            w.set_treq_sel(Self::dreq());
             w.set_data_size(W::size());
             w.set_chain_to(ch.number());
             w.set_incr_read(true);
@@ -477,6 +526,11 @@ impl<'d, PIO: Instance, const SM: usize> StateMachineTx<'d, PIO, SM> {
         compiler_fence(Ordering::SeqCst);
         Transfer::new(ch)
     }
+
+    /// Prepare a repeated DMA transfer to TX FIFO.
+    pub fn dma_push_repeated<'a, C: Channel, W: Word>(&'a mut self, ch: Peri<'a, C>, len: usize) -> Transfer<'a, C> {
+        unsafe { dma::write_repeated(ch, PIO::PIO.txf(SM).as_ptr(), len, Self::dreq()) }
+    }
 }
 
 /// A type representing a single PIO state machine.
@@ -736,6 +790,7 @@ impl<'d, PIO: Instance + 'd, const SM: usize> StateMachine<'d, PIO, SM> {
             w.set_status_sel(match config.status_sel {
                 StatusSource::TxFifoLevel => pac::pio::vals::ExecctrlStatusSel::TXLEVEL,
                 StatusSource::RxFifoLevel => pac::pio::vals::ExecctrlStatusSel::RXLEVEL,
+                StatusSource::Irq => pac::pio::vals::ExecctrlStatusSel::IRQ,
             });
             #[cfg(feature = "rp2040")]
             w.set_status_sel(match config.status_sel {
@@ -922,13 +977,27 @@ impl<'d, PIO: Instance + 'd, const SM: usize> StateMachine<'d, PIO, SM> {
         self.set_enable(enabled);
     }
 
+    #[cfg(feature = "rp2040")]
+    fn pin_base() -> u8 {
+        0
+    }
+
+    #[cfg(feature = "_rp235x")]
+    fn pin_base() -> u8 {
+        if PIO::PIO.gpiobase().read().gpiobase() {
+            16
+        } else {
+            0
+        }
+    }
+
     /// Sets pin directions. This pauses the current state machine to run `SET` commands
     /// and temporarily unsets the `OUT_STICKY` bit.
     pub fn set_pin_dirs(&mut self, dir: Direction, pins: &[&Pin<'d, PIO>]) {
         self.with_paused(|sm| {
             for pin in pins {
                 Self::this_sm().pinctrl().write(|w| {
-                    w.set_set_base(pin.pin());
+                    w.set_set_base(pin.pin() - Self::pin_base());
                     w.set_set_count(1);
                 });
                 // SET PINDIRS, (dir)
@@ -943,7 +1012,7 @@ impl<'d, PIO: Instance + 'd, const SM: usize> StateMachine<'d, PIO, SM> {
         self.with_paused(|sm| {
             for pin in pins {
                 Self::this_sm().pinctrl().write(|w| {
-                    w.set_set_base(pin.pin());
+                    w.set_set_base(pin.pin() - Self::pin_base());
                     w.set_set_count(1);
                 });
                 // SET PINS, (dir)
@@ -1306,6 +1375,7 @@ impl<'d, PIO: Instance> Pio<'d, PIO> {
         PIO::state().users.store(5, Ordering::Release);
         PIO::state().used_pins.store(0, Ordering::Release);
         PIO::Interrupt::unpend();
+
         unsafe { PIO::Interrupt::enable() };
         Self {
             common: Common {
diff --git a/embassy-rp/src/pio_programs/i2s.rs b/embassy-rp/src/pio_programs/i2s.rs
index b967f0160..2382a3f9f 100644
--- a/embassy-rp/src/pio_programs/i2s.rs
+++ b/embassy-rp/src/pio_programs/i2s.rs
@@ -1,14 +1,106 @@
-//! Pio backed I2s output
+//! Pio backed I2s output and output drivers
 
 use fixed::traits::ToFixed;
 
 use crate::dma::{AnyChannel, Channel, Transfer};
+use crate::gpio::Pull;
 use crate::pio::{
     Common, Config, Direction, FifoJoin, Instance, LoadedProgram, PioPin, ShiftConfig, ShiftDirection, StateMachine,
 };
 use crate::Peri;
 
+/// This struct represents an i2s receiver & controller driver program
+pub struct PioI2sInProgram<'d, PIO: Instance> {
+    prg: LoadedProgram<'d, PIO>,
+}
+
+impl<'d, PIO: Instance> PioI2sInProgram<'d, PIO> {
+    /// Load the input program into the given pio
+    pub fn new(common: &mut Common<'d, PIO>) -> Self {
+        let prg = pio::pio_asm! {
+            ".side_set 2",
+            "   set x, 14               side 0b01",
+            "left_data:",
+            "   in pins, 1              side 0b00", // read one left-channel bit from SD
+            "   jmp x-- left_data       side 0b01",
+            "   in pins, 1              side 0b10", // ws changes 1 clock before MSB
+            "   set x, 14               side 0b11",
+            "right_data:",
+            "   in pins, 1             side 0b10",
+            "   jmp x-- right_data     side 0b11",
+            "   in pins, 1             side 0b00" // ws changes 1 clock before ms
+        };
+        let prg = common.load_program(&prg.program);
+        Self { prg }
+    }
+}
+
+/// Pio backed I2s input driver
+pub struct PioI2sIn<'d, P: Instance, const S: usize> {
+    dma: Peri<'d, AnyChannel>,
+    sm: StateMachine<'d, P, S>,
+}
+
+impl<'d, P: Instance, const S: usize> PioI2sIn<'d, P, S> {
+    /// Configure a state machine to act as both the controller (provider of SCK and WS) and receiver (of SD) for an I2S signal
+    pub fn new(
+        common: &mut Common<'d, P>,
+        mut sm: StateMachine<'d, P, S>,
+        dma: Peri<'d, impl Channel>,
+        // Whether or not to use the MCU's internal pull-down resistor, as the
+        // Pico 2 is known to have problems with the inbuilt pulldowns, many
+        // opt to just use an external pull down resistor to meet requirements of common
+        // i2s microphones such as the INMP441
+        data_pulldown: bool,
+        data_pin: Peri<'d, impl PioPin>,
+        bit_clock_pin: Peri<'d, impl PioPin>,
+        lr_clock_pin: Peri<'d, impl PioPin>,
+        sample_rate: u32,
+        bit_depth: u32,
+        channels: u32,
+        program: &PioI2sInProgram<'d, P>,
+    ) -> Self {
+        let mut data_pin = common.make_pio_pin(data_pin);
+        if data_pulldown {
+            data_pin.set_pull(Pull::Down);
+        }
+        let bit_clock_pin = common.make_pio_pin(bit_clock_pin);
+        let left_right_clock_pin = common.make_pio_pin(lr_clock_pin);
+
+        let cfg = {
+            let mut cfg = Config::default();
+            cfg.use_program(&program.prg, &[&bit_clock_pin, &left_right_clock_pin]);
+            cfg.set_in_pins(&[&data_pin]);
+            let clock_frequency = sample_rate * bit_depth * channels;
+            cfg.clock_divider = (crate::clocks::clk_sys_freq() as f64 / clock_frequency as f64 / 2.).to_fixed();
+            cfg.shift_in = ShiftConfig {
+                threshold: 32,
+                direction: ShiftDirection::Left,
+                auto_fill: true,
+            };
+            // join fifos to have twice the time to start the next dma transfer
+            cfg.fifo_join = FifoJoin::RxOnly; // both control signals are sent via side-setting
+            cfg
+        };
+        sm.set_config(&cfg);
+        sm.set_pin_dirs(Direction::In, &[&data_pin]);
+        sm.set_pin_dirs(Direction::Out, &[&left_right_clock_pin, &bit_clock_pin]);
+        sm.set_enable(true);
+
+        Self { dma: dma.into(), sm }
+    }
+
+    /// Return an in-prograss dma transfer future. Awaiting it will guarentee a complete transfer.
+    pub fn read<'b>(&'b mut self, buff: &'b mut [u32]) -> Transfer<'b, AnyChannel> {
+        self.sm.rx().dma_pull(self.dma.reborrow(), buff, false)
+    }
+}
+
 /// This struct represents an i2s output driver program
+///
+/// The sample bit-depth is set through scratch register `Y`.
+/// `Y` has to be set to sample bit-depth - 2.
+/// (14 = 16bit, 22 = 24bit, 30 = 32bit)
 pub struct PioI2sOutProgram<'d, PIO: Instance> {
     prg: LoadedProgram<'d, PIO>,
 }
@@ -17,17 +109,17 @@ impl<'d, PIO: Instance> PioI2sOutProgram<'d, PIO> {
     /// Load the program into the given pio
     pub fn new(common: &mut Common<'d, PIO>) -> Self {
         let prg = pio::pio_asm!(
-            ".side_set 2",
-            "    set x, 14          side 0b01", // side 0bWB - W = Word Clock, B = Bit Clock
+            ".side_set 2",                      // side 0bWB - W = Word Clock, B = Bit Clock
+            "    mov x, y           side 0b01", // y stores sample depth - 2 (14 = 16bit, 22 = 24bit, 30 = 32bit)
             "left_data:",
             "    out pins, 1        side 0b00",
             "    jmp x-- left_data  side 0b01",
-            "    out pins 1         side 0b10",
-            "    set x, 14          side 0b11",
+            "    out pins, 1        side 0b10",
+            "    mov x, y           side 0b11",
             "right_data:",
-            "    out pins 1         side 0b10",
+            "    out pins, 1         side 0b10",
             "    jmp x-- right_data side 0b11",
-            "    out pins 1         side 0b00",
+            "    out pins, 1         side 0b00",
         );
 
         let prg = common.load_program(&prg.program);
@@ -53,7 +145,6 @@ impl<'d, P: Instance, const S: usize> PioI2sOut<'d, P, S> {
         lr_clock_pin: Peri<'d, impl PioPin>,
         sample_rate: u32,
         bit_depth: u32,
-        channels: u32,
         program: &PioI2sOutProgram<'d, P>,
     ) -> Self {
         let data_pin = common.make_pio_pin(data_pin);
@@ -64,7 +155,7 @@ impl<'d, P: Instance, const S: usize> PioI2sOut<'d, P, S> {
             let mut cfg = Config::default();
             cfg.use_program(&program.prg, &[&bit_clock_pin, &left_right_clock_pin]);
             cfg.set_out_pins(&[&data_pin]);
-            let clock_frequency = sample_rate * bit_depth * channels;
+            let clock_frequency = sample_rate * bit_depth * 2;
             cfg.clock_divider = (crate::clocks::clk_sys_freq() as f64 / clock_frequency as f64 / 2.).to_fixed();
             cfg.shift_out = ShiftConfig {
                 threshold: 32,
@@ -78,6 +169,11 @@ impl<'d, P: Instance, const S: usize> PioI2sOut<'d, P, S> {
         sm.set_config(&cfg);
         sm.set_pin_dirs(Direction::Out, &[&data_pin, &left_right_clock_pin, &bit_clock_pin]);
 
+        // Set the `y` register up to configure the sample depth
+        // The SM counts down to 0 and uses one clock cycle to set up the counter,
+        // which results in bit_depth - 2 as register value.
+        unsafe { sm.set_y(bit_depth - 2) };
+
         sm.set_enable(true);
 
         Self { dma: dma.into(), sm }
diff --git a/embassy-rp/src/pio_programs/mod.rs b/embassy-rp/src/pio_programs/mod.rs
index 8eac328b3..d05ba3884 100644
--- a/embassy-rp/src/pio_programs/mod.rs
+++ b/embassy-rp/src/pio_programs/mod.rs
@@ -6,6 +6,7 @@ pub mod i2s;
 pub mod onewire;
 pub mod pwm;
 pub mod rotary_encoder;
+pub mod spi;
 pub mod stepper;
 pub mod uart;
 pub mod ws2812;
diff --git a/embassy-rp/src/pio_programs/onewire.rs b/embassy-rp/src/pio_programs/onewire.rs
index 287ddab41..980d0fe5f 100644
--- a/embassy-rp/src/pio_programs/onewire.rs
+++ b/embassy-rp/src/pio_programs/onewire.rs
@@ -52,7 +52,8 @@ impl<'a, PIO: Instance> PioOneWireProgram<'a, PIO> {
 
                     ; The low pulse was already done, we only need to delay and poll the bit in case we are reading
                     write_1:
-                        nop                     side 0 [( 6 / CLK) - 1]     ; Delay before sampling the input pin
+                        jmp y--, continue_1     side 0 [( 6 / CLK) - 1]     ; Delay before sampling input. Always decrement y
+                    continue_1:
                         in pins, 1              side 0 [(48 / CLK) - 1]     ; This writes the state of the pin into the ISR
                         ; Fallthrough
 
@@ -61,9 +62,24 @@ impl<'a, PIO: Instance> PioOneWireProgram<'a, PIO> {
                     .wrap_target
                         out x, 1                side 0 [(12 / CLK) - 1]     ; Stalls if no data available in TX FIFO and OSR
                         jmp x--, write_1        side 1 [( 6 / CLK) - 1]     ; Do the always low part of a bit, jump to write_1 if we want to write a 1 bit
-                        in null, 1              side 1 [(54 / CLK) - 1]     ; Do the remainder of the low part of a 0 bit
-                                                                            ; This writes 0 into the ISR so that the shift count stays in sync
+                        jmp y--, continue_0     side 1 [(48 / CLK) - 1]     ; Do the remainder of the low part of a 0 bit
+                        jmp pullup              side 1 [( 6 / CLK) - 1]     ; Remain low while jumping
+                    continue_0:
+                        in null, 1              side 1 [( 6 / CLK) - 1]     ; This writes 0 into the ISR so that the shift count stays in sync
                     .wrap
+
+                    ; Assume that strong pullup commands always have MSB (the last bit) = 0,
+                    ; since the rising edge can be used to start the operation.
+                    ; That's the case for DS18B20 (44h and 48h).
+                    pullup:
+                        set pins, 1             side 1[( 6 / CLK) - 1]      ; Drive pin high output immediately.
+                                                                            ; Strong pullup must be within 10us of rise.
+                        in null, 1              side 1[( 6 / CLK) - 1]      ; Keep ISR in sync. Must occur after the y--.
+                        out null, 8             side 1[( 6 / CLK) - 1]      ; Wait for write_bytes_pullup() delay to complete.
+                                                                            ; The delay is hundreds of ms, so done externally.
+                        set pins, 0             side 0[( 6 / CLK) - 1]      ; Back to open drain, pin low when driven
+                        in null, 8              side 1[( 6 / CLK) - 1]      ; Inform write_bytes_pullup() it's ready
+                        jmp next_bit            side 0[( 6 / CLK) - 1]      ; Continue
             "#
         );
 
@@ -98,6 +114,7 @@ impl<'d, PIO: Instance, const SM: usize> PioOneWire<'d, PIO, SM> {
         let mut cfg = Config::default();
         cfg.use_program(&program.prg, &[&pin]);
         cfg.set_in_pins(&[&pin]);
+        cfg.set_set_pins(&[&pin]);
 
         let shift_cfg = ShiftConfig {
             auto_fill: true,
@@ -146,6 +163,19 @@ impl<'d, PIO: Instance, const SM: usize> PioOneWire<'d, PIO, SM> {
 
     /// Write bytes to the onewire bus
     pub async fn write_bytes(&mut self, data: &[u8]) {
+        unsafe { self.sm.set_y(u32::MAX as u32) };
+        let (rx, tx) = self.sm.rx_tx();
+        for b in data {
+            tx.wait_push(*b as u32).await;
+
+            // Empty the buffer that is being filled with every write
+            let _ = rx.wait_pull().await;
+        }
+    }
+
+    /// Write bytes to the onewire bus, then apply a strong pullup
+    pub async fn write_bytes_pullup(&mut self, data: &[u8], pullup_time: embassy_time::Duration) {
+        unsafe { self.sm.set_y(data.len() as u32 * 8 - 1) };
         let (rx, tx) = self.sm.rx_tx();
         for b in data {
             tx.wait_push(*b as u32).await;
@@ -153,10 +183,19 @@ impl<'d, PIO: Instance, const SM: usize> PioOneWire<'d, PIO, SM> {
             // Empty the buffer that is being filled with every write
             let _ = rx.wait_pull().await;
         }
+
+        // Perform the delay, usually hundreds of ms.
+        embassy_time::Timer::after(pullup_time).await;
+
+        // Signal that delay has completed
+        tx.wait_push(0 as u32).await;
+        // Wait until it's back at 0 low, open drain
+        let _ = rx.wait_pull().await;
     }
 
     /// Read bytes from the onewire bus
     pub async fn read_bytes(&mut self, data: &mut [u8]) {
+        unsafe { self.sm.set_y(u32::MAX as u32) };
         let (rx, tx) = self.sm.rx_tx();
         for b in data {
             // Write all 1's so that we can read what the device responds
diff --git a/embassy-rp/src/pio_programs/spi.rs b/embassy-rp/src/pio_programs/spi.rs
new file mode 100644
index 000000000..b10fc6628
--- /dev/null
+++ b/embassy-rp/src/pio_programs/spi.rs
@@ -0,0 +1,474 @@
+//! PIO backed SPi drivers
+
+use core::marker::PhantomData;
+
+use embassy_futures::join::join;
+use embassy_hal_internal::Peri;
+use embedded_hal_02::spi::{Phase, Polarity};
+use fixed::traits::ToFixed;
+use fixed::types::extra::U8;
+
+use crate::clocks::clk_sys_freq;
+use crate::dma::{AnyChannel, Channel};
+use crate::gpio::Level;
+use crate::pio::{Common, Direction, Instance, LoadedProgram, Pin, PioPin, ShiftDirection, StateMachine};
+use crate::spi::{Async, Blocking, Config, Mode};
+
+/// This struct represents an SPI program loaded into pio instruction memory.
+struct PioSpiProgram<'d, PIO: Instance> {
+    prg: LoadedProgram<'d, PIO>,
+    phase: Phase,
+}
+
+impl<'d, PIO: Instance> PioSpiProgram<'d, PIO> {
+    /// Load the spi program into the given pio
+    pub fn new(common: &mut Common<'d, PIO>, phase: Phase) -> Self {
+        // These PIO programs are taken straight from the datasheet (3.6.1 in
+        // RP2040 datasheet, 11.6.1 in RP2350 datasheet)
+
+        // Pin assignments:
+        // - SCK is side-set pin 0
+        // - MOSI is OUT pin 0
+        // - MISO is IN pin 0
+        //
+        // Auto-push and auto-pull must be enabled, and the serial frame size is set by
+        // configuring the push/pull threshold. Shift left/right is fine, but you must
+        // justify the data yourself. This is done most conveniently for frame sizes of
+        // 8 or 16 bits by using the narrow store replication and narrow load byte
+        // picking behavior of RP2040's IO fabric.
+
+        let prg = match phase {
+            Phase::CaptureOnFirstTransition => {
+                let prg = pio::pio_asm!(
+                    r#"
+                        .side_set 1
+
+                        ; Clock phase = 0: data is captured on the leading edge of each SCK pulse, and
+                        ; transitions on the trailing edge, or some time before the first leading edge.
+
+                        out pins, 1 side 0 [1] ; Stall here on empty (sideset proceeds even if
+                        in pins, 1  side 1 [1] ; instruction stalls, so we stall with SCK low)
+                    "#
+                );
+
+                common.load_program(&prg.program)
+            }
+            Phase::CaptureOnSecondTransition => {
+                let prg = pio::pio_asm!(
+                    r#"
+                        .side_set 1
+
+                        ; Clock phase = 1: data transitions on the leading edge of each SCK pulse, and
+                        ; is captured on the trailing edge.
+
+                        out x, 1    side 0     ; Stall here on empty (keep SCK de-asserted)
+                        mov pins, x side 1 [1] ; Output data, assert SCK (mov pins uses OUT mapping)
+                        in pins, 1  side 0     ; Input data, de-assert SCK
+                    "#
+                );
+
+                common.load_program(&prg.program)
+            }
+        };
+
+        Self { prg, phase }
+    }
+}
+
+/// PIO SPI errors.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[non_exhaustive]
+pub enum Error {
+    // No errors for now
+}
+
+/// PIO based Spi driver.
+/// Unlike other PIO programs, the PIO SPI driver owns and holds a reference to
+/// the PIO memory it uses. This is so that it can be reconfigured at runtime if
+/// desired.
+pub struct Spi<'d, PIO: Instance, const SM: usize, M: Mode> {
+    sm: StateMachine<'d, PIO, SM>,
+    cfg: crate::pio::Config<'d, PIO>,
+    program: Option<PioSpiProgram<'d, PIO>>,
+    clk_pin: Pin<'d, PIO>,
+    tx_dma: Option<Peri<'d, AnyChannel>>,
+    rx_dma: Option<Peri<'d, AnyChannel>>,
+    phantom: PhantomData<M>,
+}
+
+impl<'d, PIO: Instance, const SM: usize, M: Mode> Spi<'d, PIO, SM, M> {
+    #[allow(clippy::too_many_arguments)]
+    fn new_inner(
+        pio: &mut Common<'d, PIO>,
+        mut sm: StateMachine<'d, PIO, SM>,
+        clk_pin: Peri<'d, impl PioPin>,
+        mosi_pin: Peri<'d, impl PioPin>,
+        miso_pin: Peri<'d, impl PioPin>,
+        tx_dma: Option<Peri<'d, AnyChannel>>,
+        rx_dma: Option<Peri<'d, AnyChannel>>,
+        config: Config,
+    ) -> Self {
+        let program = PioSpiProgram::new(pio, config.phase);
+
+        let mut clk_pin = pio.make_pio_pin(clk_pin);
+        let mosi_pin = pio.make_pio_pin(mosi_pin);
+        let miso_pin = pio.make_pio_pin(miso_pin);
+
+        if let Polarity::IdleHigh = config.polarity {
+            clk_pin.set_output_inversion(true);
+        } else {
+            clk_pin.set_output_inversion(false);
+        }
+
+        let mut cfg = crate::pio::Config::default();
+
+        cfg.use_program(&program.prg, &[&clk_pin]);
+        cfg.set_out_pins(&[&mosi_pin]);
+        cfg.set_in_pins(&[&miso_pin]);
+
+        cfg.shift_in.auto_fill = true;
+        cfg.shift_in.direction = ShiftDirection::Left;
+        cfg.shift_in.threshold = 8;
+
+        cfg.shift_out.auto_fill = true;
+        cfg.shift_out.direction = ShiftDirection::Left;
+        cfg.shift_out.threshold = 8;
+
+        cfg.clock_divider = calculate_clock_divider(config.frequency);
+
+        sm.set_config(&cfg);
+
+        sm.set_pins(Level::Low, &[&clk_pin, &mosi_pin]);
+        sm.set_pin_dirs(Direction::Out, &[&clk_pin, &mosi_pin]);
+        sm.set_pin_dirs(Direction::In, &[&miso_pin]);
+
+        sm.set_enable(true);
+
+        Self {
+            sm,
+            program: Some(program),
+            cfg,
+            clk_pin,
+            tx_dma,
+            rx_dma,
+            phantom: PhantomData,
+        }
+    }
+
+    fn blocking_read_u8(&mut self) -> Result<u8, Error> {
+        while self.sm.rx().empty() {}
+        let value = self.sm.rx().pull() as u8;
+
+        Ok(value)
+    }
+
+    fn blocking_write_u8(&mut self, v: u8) -> Result<(), Error> {
+        let value = u32::from_be_bytes([v, 0, 0, 0]);
+
+        while !self.sm.tx().try_push(value) {}
+
+        // need to clear here for flush to work correctly
+        self.sm.tx().stalled();
+
+        Ok(())
+    }
+
+    /// Read data from SPI blocking execution until done.
+    pub fn blocking_read(&mut self, data: &mut [u8]) -> Result<(), Error> {
+        for v in data {
+            self.blocking_write_u8(0)?;
+            *v = self.blocking_read_u8()?;
+        }
+        self.flush()?;
+        Ok(())
+    }
+
+    /// Write data to SPI blocking execution until done.
+    pub fn blocking_write(&mut self, data: &[u8]) -> Result<(), Error> {
+        for v in data {
+            self.blocking_write_u8(*v)?;
+            let _ = self.blocking_read_u8()?;
+        }
+        self.flush()?;
+        Ok(())
+    }
+
+    /// Transfer data to SPI blocking execution until done.
+    pub fn blocking_transfer(&mut self, read: &mut [u8], write: &[u8]) -> Result<(), Error> {
+        let len = read.len().max(write.len());
+        for i in 0..len {
+            let wb = write.get(i).copied().unwrap_or(0);
+            self.blocking_write_u8(wb)?;
+
+            let rb = self.blocking_read_u8()?;
+            if let Some(r) = read.get_mut(i) {
+                *r = rb;
+            }
+        }
+        self.flush()?;
+        Ok(())
+    }
+
+    /// Transfer data in place to SPI blocking execution until done.
+    pub fn blocking_transfer_in_place(&mut self, data: &mut [u8]) -> Result<(), Error> {
+        for v in data {
+            self.blocking_write_u8(*v)?;
+            *v = self.blocking_read_u8()?;
+        }
+        self.flush()?;
+        Ok(())
+    }
+
+    /// Block execution until SPI is done.
+    pub fn flush(&mut self) -> Result<(), Error> {
+        // Wait for all words in the FIFO to have been pulled by the SM
+        while !self.sm.tx().empty() {}
+
+        // Wait for last value to be written out to the wire
+        while !self.sm.tx().stalled() {}
+
+        Ok(())
+    }
+
+    /// Set SPI frequency.
+    pub fn set_frequency(&mut self, freq: u32) {
+        self.sm.set_enable(false);
+
+        let divider = calculate_clock_divider(freq);
+
+        // save into the config for later but dont use sm.set_config() since
+        // that operation is relatively more expensive than just setting the
+        // clock divider
+        self.cfg.clock_divider = divider;
+        self.sm.set_clock_divider(divider);
+
+        self.sm.set_enable(true);
+    }
+
+    /// Set SPI config.
+    ///
+    /// This operation will panic if the PIO program needs to be reloaded and
+    /// there is insufficient room. This is unlikely since the programs for each
+    /// phase only differ in size by a single instruction.
+    pub fn set_config(&mut self, pio: &mut Common<'d, PIO>, config: &Config) {
+        self.sm.set_enable(false);
+
+        self.cfg.clock_divider = calculate_clock_divider(config.frequency);
+
+        if let Polarity::IdleHigh = config.polarity {
+            self.clk_pin.set_output_inversion(true);
+        } else {
+            self.clk_pin.set_output_inversion(false);
+        }
+
+        if self.program.as_ref().unwrap().phase != config.phase {
+            let old_program = self.program.take().unwrap();
+
+            // SAFETY: the state machine is disabled while this happens
+            unsafe { pio.free_instr(old_program.prg.used_memory) };
+
+            let new_program = PioSpiProgram::new(pio, config.phase);
+
+            self.cfg.use_program(&new_program.prg, &[&self.clk_pin]);
+            self.program = Some(new_program);
+        }
+
+        self.sm.set_config(&self.cfg);
+        self.sm.restart();
+
+        self.sm.set_enable(true);
+    }
+}
+
+fn calculate_clock_divider(frequency_hz: u32) -> fixed::FixedU32<U8> {
+    // we multiply by 4 since each clock period is equal to 4 instructions
+
+    let sys_freq = clk_sys_freq().to_fixed::<fixed::FixedU64<U8>>();
+    let target_freq = (frequency_hz * 4).to_fixed::<fixed::FixedU64<U8>>();
+    (sys_freq / target_freq).to_fixed()
+}
+
+impl<'d, PIO: Instance, const SM: usize> Spi<'d, PIO, SM, Blocking> {
+    /// Create an SPI driver in blocking mode.
+    pub fn new_blocking(
+        pio: &mut Common<'d, PIO>,
+        sm: StateMachine<'d, PIO, SM>,
+        clk: Peri<'d, impl PioPin>,
+        mosi: Peri<'d, impl PioPin>,
+        miso: Peri<'d, impl PioPin>,
+        config: Config,
+    ) -> Self {
+        Self::new_inner(pio, sm, clk, mosi, miso, None, None, config)
+    }
+}
+
+impl<'d, PIO: Instance, const SM: usize> Spi<'d, PIO, SM, Async> {
+    /// Create an SPI driver in async mode supporting DMA operations.
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        pio: &mut Common<'d, PIO>,
+        sm: StateMachine<'d, PIO, SM>,
+        clk: Peri<'d, impl PioPin>,
+        mosi: Peri<'d, impl PioPin>,
+        miso: Peri<'d, impl PioPin>,
+        tx_dma: Peri<'d, impl Channel>,
+        rx_dma: Peri<'d, impl Channel>,
+        config: Config,
+    ) -> Self {
+        Self::new_inner(
+            pio,
+            sm,
+            clk,
+            mosi,
+            miso,
+            Some(tx_dma.into()),
+            Some(rx_dma.into()),
+            config,
+        )
+    }
+
+    /// Read data from SPI using DMA.
+    pub async fn read(&mut self, buffer: &mut [u8]) -> Result<(), Error> {
+        let (rx, tx) = self.sm.rx_tx();
+
+        let len = buffer.len();
+
+        let rx_ch = self.rx_dma.as_mut().unwrap().reborrow();
+        let rx_transfer = rx.dma_pull(rx_ch, buffer, false);
+
+        let tx_ch = self.tx_dma.as_mut().unwrap().reborrow();
+        let tx_transfer = tx.dma_push_repeated::<_, u8>(tx_ch, len);
+
+        join(tx_transfer, rx_transfer).await;
+
+        Ok(())
+    }
+
+    /// Write data to SPI using DMA.
+    pub async fn write(&mut self, buffer: &[u8]) -> Result<(), Error> {
+        let (rx, tx) = self.sm.rx_tx();
+
+        let rx_ch = self.rx_dma.as_mut().unwrap().reborrow();
+        let rx_transfer = rx.dma_pull_repeated::<_, u8>(rx_ch, buffer.len());
+
+        let tx_ch = self.tx_dma.as_mut().unwrap().reborrow();
+        let tx_transfer = tx.dma_push(tx_ch, buffer, false);
+
+        join(tx_transfer, rx_transfer).await;
+
+        Ok(())
+    }
+
+    /// Transfer data to SPI using DMA.
+    pub async fn transfer(&mut self, rx_buffer: &mut [u8], tx_buffer: &[u8]) -> Result<(), Error> {
+        self.transfer_inner(rx_buffer, tx_buffer).await
+    }
+
+    /// Transfer data in place to SPI using DMA.
+    pub async fn transfer_in_place(&mut self, words: &mut [u8]) -> Result<(), Error> {
+        self.transfer_inner(words, words).await
+    }
+
+    async fn transfer_inner(&mut self, rx_buffer: *mut [u8], tx_buffer: *const [u8]) -> Result<(), Error> {
+        let (rx, tx) = self.sm.rx_tx();
+
+        let mut rx_ch = self.rx_dma.as_mut().unwrap().reborrow();
+        let rx_transfer = async {
+            rx.dma_pull(rx_ch.reborrow(), unsafe { &mut *rx_buffer }, false).await;
+
+            if tx_buffer.len() > rx_buffer.len() {
+                let read_bytes_len = tx_buffer.len() - rx_buffer.len();
+
+                rx.dma_pull_repeated::<_, u8>(rx_ch, read_bytes_len).await;
+            }
+        };
+
+        let mut tx_ch = self.tx_dma.as_mut().unwrap().reborrow();
+        let tx_transfer = async {
+            tx.dma_push(tx_ch.reborrow(), unsafe { &*tx_buffer }, false).await;
+
+            if rx_buffer.len() > tx_buffer.len() {
+                let write_bytes_len = rx_buffer.len() - tx_buffer.len();
+
+                tx.dma_push_repeated::<_, u8>(tx_ch, write_bytes_len).await;
+            }
+        };
+
+        join(tx_transfer, rx_transfer).await;
+
+        Ok(())
+    }
+}
+
+// ====================
+
+impl<'d, PIO: Instance, const SM: usize, M: Mode> embedded_hal_02::blocking::spi::Transfer<u8> for Spi<'d, PIO, SM, M> {
+    type Error = Error;
+    fn transfer<'w>(&mut self, words: &'w mut [u8]) -> Result<&'w [u8], Self::Error> {
+        self.blocking_transfer_in_place(words)?;
+        Ok(words)
+    }
+}
+
+impl<'d, PIO: Instance, const SM: usize, M: Mode> embedded_hal_02::blocking::spi::Write<u8> for Spi<'d, PIO, SM, M> {
+    type Error = Error;
+
+    fn write(&mut self, words: &[u8]) -> Result<(), Self::Error> {
+        self.blocking_write(words)
+    }
+}
+
+impl embedded_hal_1::spi::Error for Error {
+    fn kind(&self) -> embedded_hal_1::spi::ErrorKind {
+        match *self {}
+    }
+}
+
+impl<'d, PIO: Instance, const SM: usize, M: Mode> embedded_hal_1::spi::ErrorType for Spi<'d, PIO, SM, M> {
+    type Error = Error;
+}
+
+impl<'d, PIO: Instance, const SM: usize, M: Mode> embedded_hal_1::spi::SpiBus<u8> for Spi<'d, PIO, SM, M> {
+    fn flush(&mut self) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    fn read(&mut self, words: &mut [u8]) -> Result<(), Self::Error> {
+        self.blocking_transfer(words, &[])
+    }
+
+    fn write(&mut self, words: &[u8]) -> Result<(), Self::Error> {
+        self.blocking_write(words)
+    }
+
+    fn transfer(&mut self, read: &mut [u8], write: &[u8]) -> Result<(), Self::Error> {
+        self.blocking_transfer(read, write)
+    }
+
+    fn transfer_in_place(&mut self, words: &mut [u8]) -> Result<(), Self::Error> {
+        self.blocking_transfer_in_place(words)
+    }
+}
+
+impl<'d, PIO: Instance, const SM: usize> embedded_hal_async::spi::SpiBus<u8> for Spi<'d, PIO, SM, Async> {
+    async fn flush(&mut self) -> Result<(), Self::Error> {
+        Ok(())
+    }
+
+    async fn write(&mut self, words: &[u8]) -> Result<(), Self::Error> {
+        self.write(words).await
+    }
+
+    async fn read(&mut self, words: &mut [u8]) -> Result<(), Self::Error> {
+        self.read(words).await
+    }
+
+    async fn transfer(&mut self, read: &mut [u8], write: &[u8]) -> Result<(), Self::Error> {
+        self.transfer(read, write).await
+    }
+
+    async fn transfer_in_place(&mut self, words: &mut [u8]) -> Result<(), Self::Error> {
+        self.transfer_in_place(words).await
+    }
+}
diff --git a/embassy-rp/src/pio_programs/ws2812.rs b/embassy-rp/src/pio_programs/ws2812.rs
index 578937e11..37dd1c4e0 100644
--- a/embassy-rp/src/pio_programs/ws2812.rs
+++ b/embassy-rp/src/pio_programs/ws2812.rs
@@ -2,7 +2,7 @@
 
 use embassy_time::Timer;
 use fixed::types::U24F8;
-use smart_leds::RGB8;
+use smart_leds::{RGB8, RGBW};
 
 use crate::clocks::clk_sys_freq;
 use crate::dma::{AnyChannel, Channel};
@@ -50,7 +50,7 @@ impl<'a, PIO: Instance> PioWs2812Program<'a, PIO> {
     }
 }
 
-/// Pio backed ws2812 driver
+/// Pio backed RGB ws2812 driver
 /// Const N is the number of ws2812 leds attached to this pin
 pub struct PioWs2812<'d, P: Instance, const S: usize, const N: usize> {
     dma: Peri<'d, AnyChannel>,
@@ -111,3 +111,69 @@ impl<'d, P: Instance, const S: usize, const N: usize> PioWs2812<'d, P, S, N> {
         Timer::after_micros(55).await;
     }
 }
+
+/// Pio backed RGBW ws2812 driver
+/// This version is intended for ws2812 leds with 4 addressable lights
+/// Const N is the number of ws2812 leds attached to this pin
+pub struct RgbwPioWs2812<'d, P: Instance, const S: usize, const N: usize> {
+    dma: Peri<'d, AnyChannel>,
+    sm: StateMachine<'d, P, S>,
+}
+
+impl<'d, P: Instance, const S: usize, const N: usize> RgbwPioWs2812<'d, P, S, N> {
+    /// Configure a pio state machine to use the loaded ws2812 program.
+    pub fn new(
+        pio: &mut Common<'d, P>,
+        mut sm: StateMachine<'d, P, S>,
+        dma: Peri<'d, impl Channel>,
+        pin: Peri<'d, impl PioPin>,
+        program: &PioWs2812Program<'d, P>,
+    ) -> Self {
+        // Setup sm0
+        let mut cfg = Config::default();
+
+        // Pin config
+        let out_pin = pio.make_pio_pin(pin);
+        cfg.set_out_pins(&[&out_pin]);
+        cfg.set_set_pins(&[&out_pin]);
+
+        cfg.use_program(&program.prg, &[&out_pin]);
+
+        // Clock config, measured in kHz to avoid overflows
+        let clock_freq = U24F8::from_num(clk_sys_freq() / 1000);
+        let ws2812_freq = U24F8::from_num(800);
+        let bit_freq = ws2812_freq * CYCLES_PER_BIT;
+        cfg.clock_divider = clock_freq / bit_freq;
+
+        // FIFO config
+        cfg.fifo_join = FifoJoin::TxOnly;
+        cfg.shift_out = ShiftConfig {
+            auto_fill: true,
+            threshold: 32,
+            direction: ShiftDirection::Left,
+        };
+
+        sm.set_config(&cfg);
+        sm.set_enable(true);
+
+        Self { dma: dma.into(), sm }
+    }
+
+    /// Write a buffer of [smart_leds::RGBW] to the ws2812 string
+    pub async fn write(&mut self, colors: &[RGBW<u8>; N]) {
+        // Precompute the word bytes from the colors
+        let mut words = [0u32; N];
+        for i in 0..N {
+            let word = (u32::from(colors[i].g) << 24)
+                | (u32::from(colors[i].r) << 16)
+                | (u32::from(colors[i].b) << 8)
+                | u32::from(colors[i].a.0);
+            words[i] = word;
+        }
+
+        // DMA transfer
+        self.sm.tx().dma_push(self.dma.reborrow(), &words, false).await;
+
+        Timer::after_micros(55).await;
+    }
+}
diff --git a/embassy-rp/src/psram.rs b/embassy-rp/src/psram.rs
new file mode 100644
index 000000000..ae43dd5aa
--- /dev/null
+++ b/embassy-rp/src/psram.rs
@@ -0,0 +1,682 @@
+//! PSRAM driver for APS6404L and compatible devices
+//!
+//! This driver provides support for PSRAM (Pseudo-Static RAM) devices connected via QMI CS1.
+//! It handles device verification, initialization, and memory-mapped access configuration.
+//!
+//! This driver is only available on RP235x chips as it requires the QMI CS1 peripheral.
+
+// Credit: Initially based on https://github.com/Altaflux/gb-rp2350 (also licensed Apache 2.0 + MIT).
+// Copyright (c) Altaflux
+
+#![cfg(feature = "_rp235x")]
+
+use critical_section::{acquire, release, CriticalSection, RestoreState};
+
+use crate::pac;
+use crate::qmi_cs1::QmiCs1;
+
+/// PSRAM errors.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[cfg_attr(feature = "defmt", derive(defmt::Format))]
+#[non_exhaustive]
+pub enum Error {
+    /// PSRAM device is not detected or not supported
+    DeviceNotFound,
+    /// Invalid configuration
+    InvalidConfig,
+    /// Detected PSRAM size does not match the expected size
+    SizeMismatch,
+}
+
+/// PSRAM device verification type.
+#[derive(Clone, Copy)]
+pub enum VerificationType {
+    /// Skip device verification
+    None,
+    /// Verify as APS6404L device
+    Aps6404l,
+}
+
+/// Memory configuration.
+#[derive(Clone)]
+pub struct Config {
+    /// System clock frequency in Hz
+    pub clock_hz: u32,
+    /// Maximum memory operating frequency in Hz
+    pub max_mem_freq: u32,
+    /// Maximum CS assert time in microseconds (must be <= 8 us)
+    pub max_select_us: u32,
+    /// Minimum CS deassert time in nanoseconds (must be >= 18 ns)
+    pub min_deselect_ns: u32,
+    /// Cooldown period between operations (in SCLK cycles)
+    pub cooldown: u8,
+    /// Page break size for memory operations
+    pub page_break: PageBreak,
+    /// Clock divisor for direct mode operations during initialization
+    pub init_clkdiv: u8,
+    /// Enter Quad Mode command
+    pub enter_quad_cmd: Option<u8>,
+    /// Quad Read command (fast read with 4-bit data)
+    pub quad_read_cmd: u8,
+    /// Quad Write command (page program with 4-bit data)
+    pub quad_write_cmd: Option<u8>,
+    /// Number of dummy cycles for quad read operations
+    pub dummy_cycles: u8,
+    /// Read format configuration
+    pub read_format: FormatConfig,
+    /// Write format configuration
+    pub write_format: Option<FormatConfig>,
+    /// Expected memory size in bytes
+    pub mem_size: usize,
+    /// Device verification type
+    pub verification_type: VerificationType,
+    /// Whether the memory is writable via XIP (e.g., PSRAM vs. read-only flash)
+    pub xip_writable: bool,
+}
+
+/// Page break configuration for memory window operations.
+#[derive(Clone, Copy)]
+pub enum PageBreak {
+    /// No page breaks
+    None,
+    /// Break at 256-byte boundaries
+    _256,
+    /// Break at 1024-byte boundaries
+    _1024,
+    /// Break at 4096-byte boundaries
+    _4096,
+}
+
+/// Format configuration for read/write operations.
+#[derive(Clone)]
+pub struct FormatConfig {
+    /// Width of command prefix phase
+    pub prefix_width: Width,
+    /// Width of address phase
+    pub addr_width: Width,
+    /// Width of command suffix phase
+    pub suffix_width: Width,
+    /// Width of dummy/turnaround phase
+    pub dummy_width: Width,
+    /// Width of data phase
+    pub data_width: Width,
+    /// Length of prefix (None or 8 bits)
+    pub prefix_len: bool,
+    /// Length of suffix (None or 8 bits)
+    pub suffix_len: bool,
+}
+
+/// Interface width for different phases of SPI transfer.
+#[derive(Clone, Copy)]
+pub enum Width {
+    /// Single-bit (standard SPI)
+    Single,
+    /// Dual-bit (2 data lines)
+    Dual,
+    /// Quad-bit (4 data lines)
+    Quad,
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        Self::aps6404l()
+    }
+}
+
+impl Config {
+    /// Create configuration for APS6404L PSRAM.
+    pub fn aps6404l() -> Self {
+        Self {
+            clock_hz: 125_000_000,        // Default to 125MHz
+            max_mem_freq: 133_000_000,    // APS6404L max frequency
+            max_select_us: 8,             // 8 microseconds max CS assert
+            min_deselect_ns: 18,          // 18 nanoseconds min CS deassert
+            cooldown: 1,                  // 1 SCLK cycle cooldown
+            page_break: PageBreak::_1024, // 1024-byte page boundaries
+            init_clkdiv: 10,              // Medium clock for initialization
+            enter_quad_cmd: Some(0x35),   // Enter Quad Mode
+            quad_read_cmd: 0xEB,          // Fast Quad Read
+            quad_write_cmd: Some(0x38),   // Quad Page Program
+            dummy_cycles: 24,             // 24 dummy cycles for quad read
+            read_format: FormatConfig {
+                prefix_width: Width::Quad,
+                addr_width: Width::Quad,
+                suffix_width: Width::Quad,
+                dummy_width: Width::Quad,
+                data_width: Width::Quad,
+                prefix_len: true,  // 8-bit prefix
+                suffix_len: false, // No suffix
+            },
+            write_format: Some(FormatConfig {
+                prefix_width: Width::Quad,
+                addr_width: Width::Quad,
+                suffix_width: Width::Quad,
+                dummy_width: Width::Quad,
+                data_width: Width::Quad,
+                prefix_len: true,  // 8-bit prefix
+                suffix_len: false, // No suffix
+            }),
+            mem_size: 8 * 1024 * 1024, // 8MB for APS6404L
+            verification_type: VerificationType::Aps6404l,
+            xip_writable: true, // PSRAM is writable
+        }
+    }
+
+    /// Create a custom memory configuration.
+    pub fn custom(
+        clock_hz: u32,
+        max_mem_freq: u32,
+        max_select_us: u32,
+        min_deselect_ns: u32,
+        cooldown: u8,
+        page_break: PageBreak,
+        init_clkdiv: u8,
+        enter_quad_cmd: Option<u8>,
+        quad_read_cmd: u8,
+        quad_write_cmd: Option<u8>,
+        dummy_cycles: u8,
+        read_format: FormatConfig,
+        write_format: Option<FormatConfig>,
+        mem_size: usize,
+        verification_type: VerificationType,
+        xip_writable: bool,
+    ) -> Self {
+        Self {
+            clock_hz,
+            max_mem_freq,
+            max_select_us,
+            min_deselect_ns,
+            cooldown,
+            page_break,
+            init_clkdiv,
+            enter_quad_cmd,
+            quad_read_cmd,
+            quad_write_cmd,
+            dummy_cycles,
+            read_format,
+            write_format,
+            mem_size,
+            verification_type,
+            xip_writable,
+        }
+    }
+}
+
+/// PSRAM driver.
+pub struct Psram<'d> {
+    #[allow(dead_code)]
+    qmi_cs1: QmiCs1<'d>,
+    size: usize,
+}
+
+impl<'d> Psram<'d> {
+    /// Create a new PSRAM driver instance.
+    ///
+    /// This will detect the PSRAM device and configure it for memory-mapped access.
+    pub fn new(qmi_cs1: QmiCs1<'d>, config: Config) -> Result<Self, Error> {
+        let qmi = pac::QMI;
+        let xip = pac::XIP_CTRL;
+
+        // Verify PSRAM device if requested
+        match config.verification_type {
+            VerificationType::Aps6404l => {
+                Self::verify_aps6404l(&qmi, config.mem_size)?;
+                debug!("APS6404L PSRAM verified, size: {:#x}", config.mem_size);
+            }
+            VerificationType::None => {
+                debug!("Skipping PSRAM verification, assuming size: {:#x}", config.mem_size);
+            }
+        }
+
+        // Initialize PSRAM with proper timing
+        Self::init_psram(&qmi, &xip, &config)?;
+
+        Ok(Self {
+            qmi_cs1,
+            size: config.mem_size,
+        })
+    }
+
+    /// Get the detected PSRAM size in bytes.
+    pub fn size(&self) -> usize {
+        self.size
+    }
+
+    /// Get the base address for memory-mapped access.
+    ///
+    /// After initialization, PSRAM can be accessed directly through memory mapping.
+    /// The base address for CS1 is typically 0x11000000.
+    pub fn base_address(&self) -> *mut u8 {
+        0x1100_0000 as *mut u8
+    }
+
+    /// Verify APS6404L PSRAM device matches expected configuration.
+    #[link_section = ".data.ram_func"]
+    #[inline(never)]
+    fn verify_aps6404l(qmi: &pac::qmi::Qmi, expected_size: usize) -> Result<(), Error> {
+        // APS6404L-specific constants
+        const EXPECTED_KGD: u8 = 0x5D;
+        crate::multicore::pause_core1();
+        core::sync::atomic::compiler_fence(core::sync::atomic::Ordering::SeqCst);
+
+        {
+            // Helper for making sure `release` is called even if `f` panics.
+            struct Guard {
+                state: RestoreState,
+            }
+
+            impl Drop for Guard {
+                #[inline(always)]
+                fn drop(&mut self) {
+                    unsafe { release(self.state) }
+                }
+            }
+
+            let state = unsafe { acquire() };
+            let _guard = Guard { state };
+
+            let _cs = unsafe { CriticalSection::new() };
+
+            let (kgd, eid) = unsafe { Self::read_aps6404l_kgd_eid(qmi) };
+
+            let mut detected_size: u32 = 0;
+            if kgd == EXPECTED_KGD as u32 {
+                detected_size = 1024 * 1024;
+                let size_id = eid >> 5;
+                if eid == 0x26 || size_id == 2 {
+                    // APS6404L-3SQR-SN or 8MB variants
+                    detected_size *= 8;
+                } else if size_id == 0 {
+                    detected_size *= 2;
+                } else if size_id == 1 {
+                    detected_size *= 4;
+                }
+            }
+
+            // Verify the detected size matches the expected size
+            if detected_size as usize != expected_size {
+                return Err(Error::SizeMismatch);
+            }
+
+            Ok(())
+        }?;
+
+        crate::multicore::resume_core1();
+
+        Ok(())
+    }
+
+    #[link_section = ".data.ram_func"]
+    #[inline(never)]
+    unsafe fn read_aps6404l_kgd_eid(qmi: &pac::qmi::Qmi) -> (u32, u32) {
+        const RESET_ENABLE_CMD: u8 = 0xf5;
+        const READ_ID_CMD: u8 = 0x9f;
+
+        #[allow(unused_assignments)]
+        let mut kgd: u32 = 0;
+        #[allow(unused_assignments)]
+        let mut eid: u32 = 0;
+
+        let qmi_base = qmi.as_ptr() as usize;
+
+        #[cfg(target_arch = "arm")]
+        core::arch::asm!(
+        // Configure DIRECT_CSR: shift clkdiv (30) to bits 29:22 and set EN (bit 0)
+        "movs {temp}, #30",
+        "lsls {temp}, {temp}, #22",
+        "orr {temp}, {temp}, #1",        // Set EN bit
+        "str {temp}, [{qmi_base}]",
+
+        // Poll for BUSY to clear before first operation
+        "1:",
+        "ldr {temp}, [{qmi_base}]",
+        "lsls {temp}, {temp}, #30",      // Shift BUSY bit to sign position
+        "bmi 1b",                        // Branch if negative (BUSY = 1)
+
+        // Assert CS1N (bit 3)
+        "ldr {temp}, [{qmi_base}]",
+        "orr {temp}, {temp}, #8",        // Set ASSERT_CS1N bit (bit 3)
+        "str {temp}, [{qmi_base}]",
+
+        // Transmit RESET_ENABLE_CMD as quad
+        // DIRECT_TX: OE=1 (bit 19), IWIDTH=2 (bits 17:16), DATA=RESET_ENABLE_CMD
+        "movs {temp}, {reset_enable_cmd}",
+        "orr {temp}, {temp}, #0x80000",  // Set OE (bit 19)
+        "orr {temp}, {temp}, #0x20000",  // Set IWIDTH=2 (quad, bits 17:16)
+        "str {temp}, [{qmi_base}, #4]",  // Store to DIRECT_TX
+
+        // Wait for BUSY to clear
+        "2:",
+        "ldr {temp}, [{qmi_base}]",
+        "lsls {temp}, {temp}, #30",
+        "bmi 2b",
+
+        // Read and discard RX data
+        "ldr {temp}, [{qmi_base}, #8]",
+
+        // Deassert CS1N
+        "ldr {temp}, [{qmi_base}]",
+        "bic {temp}, {temp}, #8",        // Clear ASSERT_CS1N bit
+        "str {temp}, [{qmi_base}]",
+
+        // Assert CS1N again
+        "ldr {temp}, [{qmi_base}]",
+        "orr {temp}, {temp}, #8",        // Set ASSERT_CS1N bit
+        "str {temp}, [{qmi_base}]",
+
+        // Read ID loop (7 iterations)
+        "movs {counter}, #0",            // Initialize counter
+
+        "3:",                            // Loop start
+        "cmp {counter}, #0",
+        "bne 4f",                        // If not first iteration, send 0xFF
+
+        // First iteration: send READ_ID_CMD
+        "movs {temp}, {read_id_cmd}",
+        "b 5f",
+        "4:",                            // Other iterations: send 0xFF
+        "movs {temp}, #0xFF",
+        "5:",
+        "str {temp}, [{qmi_base}, #4]",  // Store to DIRECT_TX
+
+        // Wait for TXEMPTY
+        "6:",
+        "ldr {temp}, [{qmi_base}]",
+        "lsls {temp}, {temp}, #20",      // Shift TXEMPTY (bit 11) to bit 31
+        "bpl 6b",                        // Branch if positive (TXEMPTY = 0)
+
+        // Wait for BUSY to clear
+        "7:",
+        "ldr {temp}, [{qmi_base}]",
+        "lsls {temp}, {temp}, #30",      // Shift BUSY bit to sign position
+        "bmi 7b",                        // Branch if negative (BUSY = 1)
+
+        // Read RX data
+        "ldr {temp}, [{qmi_base}, #8]",
+        "uxth {temp}, {temp}",           // Extract lower 16 bits
+
+        // Store KGD or EID based on iteration
+        "cmp {counter}, #5",
+        "bne 8f",
+        "mov {kgd}, {temp}",             // Store KGD
+        "b 9f",
+        "8:",
+        "cmp {counter}, #6",
+        "bne 9f",
+        "mov {eid}, {temp}",             // Store EID
+
+        "9:",
+        "adds {counter}, #1",
+        "cmp {counter}, #7",
+        "blt 3b",                        // Continue loop if counter < 7
+
+        // Disable direct mode: clear EN and ASSERT_CS1N
+        "movs {temp}, #0",
+        "str {temp}, [{qmi_base}]",
+
+        // Memory barriers
+        "dmb",
+        "dsb",
+        "isb",
+        qmi_base = in(reg) qmi_base,
+        temp = out(reg) _,
+        counter = out(reg) _,
+        kgd = out(reg) kgd,
+        eid = out(reg) eid,
+        reset_enable_cmd = const RESET_ENABLE_CMD as u32,
+        read_id_cmd = const READ_ID_CMD as u32,
+        options(nostack),
+        );
+
+        #[cfg(target_arch = "riscv32")]
+        unimplemented!("APS6404L PSRAM verification not implemented for RISC-V");
+
+        (kgd, eid)
+    }
+
+    /// Initialize PSRAM with proper timing.
+    #[link_section = ".data.ram_func"]
+    #[inline(never)]
+    fn init_psram(qmi: &pac::qmi::Qmi, xip_ctrl: &pac::xip_ctrl::XipCtrl, config: &Config) -> Result<(), Error> {
+        // Set PSRAM timing for APS6404
+        //
+        // Using an rxdelay equal to the divisor isn't enough when running the APS6404 close to 133 MHz.
+        // So: don't allow running at divisor 1 above 100 MHz (because delay of 2 would be too late),
+        // and add an extra 1 to the rxdelay if the divided clock is > 100 MHz (i.e., sys clock > 200 MHz).
+        let clock_hz = config.clock_hz;
+        let max_psram_freq = config.max_mem_freq;
+
+        let mut divisor: u32 = (clock_hz + max_psram_freq - 1) / max_psram_freq;
+        if divisor == 1 && clock_hz > 100_000_000 {
+            divisor = 2;
+        }
+        let mut rxdelay: u32 = divisor;
+        if clock_hz / divisor > 100_000_000 {
+            rxdelay += 1;
+        }
+
+        // - Max select must be <= 8 us. The value is given in multiples of 64 system clocks.
+        // - Min deselect must be >= 18ns. The value is given in system clock cycles - ceil(divisor / 2).
+        let clock_period_fs: u64 = 1_000_000_000_000_000_u64 / u64::from(clock_hz);
+        let max_select: u8 = ((config.max_select_us as u64 * 1_000_000) / clock_period_fs) as u8;
+        let min_deselect: u32 = ((config.min_deselect_ns as u64 * 1_000_000 + (clock_period_fs - 1)) / clock_period_fs
+            - u64::from(divisor + 1) / 2) as u32;
+
+        crate::multicore::pause_core1();
+        core::sync::atomic::compiler_fence(core::sync::atomic::Ordering::SeqCst);
+
+        if let Some(enter_quad_cmd) = config.enter_quad_cmd {
+            // Helper for making sure `release` is called even if `f` panics.
+            struct Guard {
+                state: RestoreState,
+            }
+
+            impl Drop for Guard {
+                #[inline(always)]
+                fn drop(&mut self) {
+                    unsafe { release(self.state) }
+                }
+            }
+
+            let state = unsafe { acquire() };
+            let _guard = Guard { state };
+
+            let _cs = unsafe { CriticalSection::new() };
+
+            unsafe { Self::direct_csr_send_init_command(config, enter_quad_cmd) };
+
+            qmi.mem(1).timing().write(|w| {
+                w.set_cooldown(config.cooldown);
+                w.set_pagebreak(match config.page_break {
+                    PageBreak::None => pac::qmi::vals::Pagebreak::NONE,
+                    PageBreak::_256 => pac::qmi::vals::Pagebreak::_256,
+                    PageBreak::_1024 => pac::qmi::vals::Pagebreak::_1024,
+                    PageBreak::_4096 => pac::qmi::vals::Pagebreak::_4096,
+                });
+                w.set_max_select(max_select);
+                w.set_min_deselect(min_deselect as u8);
+                w.set_rxdelay(rxdelay as u8);
+                w.set_clkdiv(divisor as u8);
+            });
+
+            // Set PSRAM commands and formats
+            qmi.mem(1).rfmt().write(|w| {
+                let width_to_pac = |w: Width| match w {
+                    Width::Single => pac::qmi::vals::PrefixWidth::S,
+                    Width::Dual => pac::qmi::vals::PrefixWidth::D,
+                    Width::Quad => pac::qmi::vals::PrefixWidth::Q,
+                };
+
+                w.set_prefix_width(width_to_pac(config.read_format.prefix_width));
+                w.set_addr_width(match config.read_format.addr_width {
+                    Width::Single => pac::qmi::vals::AddrWidth::S,
+                    Width::Dual => pac::qmi::vals::AddrWidth::D,
+                    Width::Quad => pac::qmi::vals::AddrWidth::Q,
+                });
+                w.set_suffix_width(match config.read_format.suffix_width {
+                    Width::Single => pac::qmi::vals::SuffixWidth::S,
+                    Width::Dual => pac::qmi::vals::SuffixWidth::D,
+                    Width::Quad => pac::qmi::vals::SuffixWidth::Q,
+                });
+                w.set_dummy_width(match config.read_format.dummy_width {
+                    Width::Single => pac::qmi::vals::DummyWidth::S,
+                    Width::Dual => pac::qmi::vals::DummyWidth::D,
+                    Width::Quad => pac::qmi::vals::DummyWidth::Q,
+                });
+                w.set_data_width(match config.read_format.data_width {
+                    Width::Single => pac::qmi::vals::DataWidth::S,
+                    Width::Dual => pac::qmi::vals::DataWidth::D,
+                    Width::Quad => pac::qmi::vals::DataWidth::Q,
+                });
+                w.set_prefix_len(if config.read_format.prefix_len {
+                    pac::qmi::vals::PrefixLen::_8
+                } else {
+                    pac::qmi::vals::PrefixLen::NONE
+                });
+                w.set_suffix_len(if config.read_format.suffix_len {
+                    pac::qmi::vals::SuffixLen::_8
+                } else {
+                    pac::qmi::vals::SuffixLen::NONE
+                });
+                w.set_dummy_len(match config.dummy_cycles {
+                    0 => pac::qmi::vals::DummyLen::NONE,
+                    4 => pac::qmi::vals::DummyLen::_4,
+                    8 => pac::qmi::vals::DummyLen::_8,
+                    12 => pac::qmi::vals::DummyLen::_12,
+                    16 => pac::qmi::vals::DummyLen::_16,
+                    20 => pac::qmi::vals::DummyLen::_20,
+                    24 => pac::qmi::vals::DummyLen::_24,
+                    28 => pac::qmi::vals::DummyLen::_28,
+                    _ => pac::qmi::vals::DummyLen::_24, // Default to 24
+                });
+            });
+
+            qmi.mem(1).rcmd().write(|w| w.set_prefix(config.quad_read_cmd));
+
+            if let Some(ref write_format) = config.write_format {
+                qmi.mem(1).wfmt().write(|w| {
+                    w.set_prefix_width(match write_format.prefix_width {
+                        Width::Single => pac::qmi::vals::PrefixWidth::S,
+                        Width::Dual => pac::qmi::vals::PrefixWidth::D,
+                        Width::Quad => pac::qmi::vals::PrefixWidth::Q,
+                    });
+                    w.set_addr_width(match write_format.addr_width {
+                        Width::Single => pac::qmi::vals::AddrWidth::S,
+                        Width::Dual => pac::qmi::vals::AddrWidth::D,
+                        Width::Quad => pac::qmi::vals::AddrWidth::Q,
+                    });
+                    w.set_suffix_width(match write_format.suffix_width {
+                        Width::Single => pac::qmi::vals::SuffixWidth::S,
+                        Width::Dual => pac::qmi::vals::SuffixWidth::D,
+                        Width::Quad => pac::qmi::vals::SuffixWidth::Q,
+                    });
+                    w.set_dummy_width(match write_format.dummy_width {
+                        Width::Single => pac::qmi::vals::DummyWidth::S,
+                        Width::Dual => pac::qmi::vals::DummyWidth::D,
+                        Width::Quad => pac::qmi::vals::DummyWidth::Q,
+                    });
+                    w.set_data_width(match write_format.data_width {
+                        Width::Single => pac::qmi::vals::DataWidth::S,
+                        Width::Dual => pac::qmi::vals::DataWidth::D,
+                        Width::Quad => pac::qmi::vals::DataWidth::Q,
+                    });
+                    w.set_prefix_len(if write_format.prefix_len {
+                        pac::qmi::vals::PrefixLen::_8
+                    } else {
+                        pac::qmi::vals::PrefixLen::NONE
+                    });
+                    w.set_suffix_len(if write_format.suffix_len {
+                        pac::qmi::vals::SuffixLen::_8
+                    } else {
+                        pac::qmi::vals::SuffixLen::NONE
+                    });
+                });
+            }
+
+            if let Some(quad_write_cmd) = config.quad_write_cmd {
+                qmi.mem(1).wcmd().write(|w| w.set_prefix(quad_write_cmd));
+            }
+
+            if config.xip_writable {
+                // Enable XIP writable mode for PSRAM
+                xip_ctrl.ctrl().modify(|w| w.set_writable_m1(true));
+            } else {
+                // Disable XIP writable mode
+                xip_ctrl.ctrl().modify(|w| w.set_writable_m1(false));
+            }
+        }
+        crate::multicore::resume_core1();
+
+        Ok(())
+    }
+
+    #[link_section = ".data.ram_func"]
+    #[inline(never)]
+    unsafe fn direct_csr_send_init_command(config: &Config, init_cmd: u8) {
+        #[cfg(target_arch = "arm")]
+        core::arch::asm!(
+        // Full memory barrier
+        "dmb",
+        "dsb",
+        "isb",
+
+        // Configure QMI Direct CSR register
+        // Load base address of QMI (0x400D0000)
+        "movw {base}, #0x0000",
+        "movt {base}, #0x400D",
+
+        // Load init_clkdiv and shift to bits 29:22
+        "lsl {temp}, {clkdiv}, #22",
+
+        // OR with EN (bit 0) and AUTO_CS1N (bit 7)
+        "orr {temp}, {temp}, #0x81",
+
+        // Store to DIRECT_CSR register
+        "str {temp}, [{base}, #0]",
+
+        // Memory barrier
+        "dmb",
+
+        // First busy wait loop
+        "1:",
+        "ldr {temp}, [{base}, #0]",      // Load DIRECT_CSR
+        "tst {temp}, #0x2",              // Test BUSY bit (bit 1)
+        "bne 1b",                        // Branch if busy
+
+        // Write to Direct TX register
+        "mov {temp}, {enter_quad_cmd}",
+
+        // OR with NOPUSH (bit 20)
+        "orr {temp}, {temp}, #0x100000",
+
+        // Store to DIRECT_TX register (offset 0x4)
+        "str {temp}, [{base}, #4]",
+
+        // Memory barrier
+        "dmb",
+
+        // Second busy wait loop
+        "2:",
+        "ldr {temp}, [{base}, #0]",      // Load DIRECT_CSR
+        "tst {temp}, #0x2",              // Test BUSY bit (bit 1)
+        "bne 2b",                        // Branch if busy
+
+        // Disable Direct CSR
+        "mov {temp}, #0",
+        "str {temp}, [{base}, #0]",      // Clear DIRECT_CSR register
+
+        // Full memory barrier to ensure no prefetching
+        "dmb",
+        "dsb",
+        "isb",
+        base = out(reg) _,
+        temp = out(reg) _,
+        clkdiv = in(reg) config.init_clkdiv as u32,
+        enter_quad_cmd = in(reg) u32::from(init_cmd),
+        options(nostack),
+        );
+
+        #[cfg(target_arch = "riscv32")]
+        unimplemented!("Direct CSR command sending is not implemented for RISC-V yet");
+    }
+}
diff --git a/embassy-rp/src/pwm.rs b/embassy-rp/src/pwm.rs
index 6dfb90fef..1e1ccc4c6 100644
--- a/embassy-rp/src/pwm.rs
+++ b/embassy-rp/src/pwm.rs
@@ -464,6 +464,10 @@ impl<'d> Drop for Pwm<'d> {
         pac::PWM.ch(self.slice).csr().write_clear(|w| w.set_en(false));
         if let Some(pin) = &self.pin_a {
             pin.gpio().ctrl().write(|w| w.set_funcsel(31));
+            // Enable pin PULL-DOWN
+            pin.pad_ctrl().modify(|w| {
+                w.set_pde(true);
+            });
         }
         if let Some(pin) = &self.pin_b {
             pin.gpio().ctrl().write(|w| w.set_funcsel(31));
@@ -472,6 +476,10 @@ impl<'d> Drop for Pwm<'d> {
             pin.pad_ctrl().modify(|w| {
                 w.set_ie(false);
             });
+            // Enable pin PULL-DOWN
+            pin.pad_ctrl().modify(|w| {
+                w.set_pde(true);
+            });
         }
     }
 }
diff --git a/embassy-rp/src/qmi_cs1.rs b/embassy-rp/src/qmi_cs1.rs
new file mode 100644
index 000000000..b8ae41e35
--- /dev/null
+++ b/embassy-rp/src/qmi_cs1.rs
@@ -0,0 +1,57 @@
+//! QMI CS1 peripheral for RP235x
+//!
+//! This module provides access to the QMI CS1 functionality for use with external memory devices
+//! such as PSRAM. The QMI (Quad SPI) controller supports CS1 as a second chip select signal.
+//!
+//! This peripheral is only available on RP235x chips.
+
+#![cfg(feature = "_rp235x")]
+
+use embassy_hal_internal::{Peri, PeripheralType};
+
+use crate::gpio::Pin as GpioPin;
+use crate::{pac, peripherals};
+
+/// QMI CS1 driver.
+pub struct QmiCs1<'d> {
+    _inner: Peri<'d, peripherals::QMI_CS1>,
+}
+
+impl<'d> QmiCs1<'d> {
+    /// Create a new QMI CS1 instance.
+    pub fn new(qmi_cs1: Peri<'d, peripherals::QMI_CS1>, cs1: Peri<'d, impl QmiCs1Pin>) -> Self {
+        // Configure CS1 pin for QMI function (funcsel = 9)
+        cs1.gpio().ctrl().write(|w| w.set_funcsel(9));
+
+        // Configure pad settings for high-speed operation
+        cs1.pad_ctrl().write(|w| {
+            #[cfg(feature = "_rp235x")]
+            w.set_iso(false);
+            w.set_ie(true);
+            w.set_drive(pac::pads::vals::Drive::_12M_A);
+            w.set_slewfast(true);
+        });
+
+        Self { _inner: qmi_cs1 }
+    }
+}
+
+trait SealedInstance {}
+
+/// QMI CS1 instance trait.
+#[allow(private_bounds)]
+pub trait Instance: SealedInstance + PeripheralType {}
+
+impl SealedInstance for peripherals::QMI_CS1 {}
+
+impl Instance for peripherals::QMI_CS1 {}
+
+/// CS1 pin trait for QMI.
+pub trait QmiCs1Pin: GpioPin {}
+
+// Implement pin traits for CS1-capable GPIO pins
+impl QmiCs1Pin for peripherals::PIN_0 {}
+impl QmiCs1Pin for peripherals::PIN_8 {}
+impl QmiCs1Pin for peripherals::PIN_19 {}
+#[cfg(feature = "rp235xb")]
+impl QmiCs1Pin for peripherals::PIN_47 {}
diff --git a/embassy-rp/src/relocate.rs b/embassy-rp/src/relocate.rs
index 34487819f..6ff40ddd7 100644
--- a/embassy-rp/src/relocate.rs
+++ b/embassy-rp/src/relocate.rs
@@ -39,7 +39,7 @@ pub struct RelocatedProgram<'a, const PROGRAM_SIZE: usize> {
 }
 
 impl<'a, const PROGRAM_SIZE: usize> RelocatedProgram<'a, PROGRAM_SIZE> {
-    pub fn new_with_origin(program: &Program<PROGRAM_SIZE>, origin: u8) -> RelocatedProgram<PROGRAM_SIZE> {
+    pub fn new_with_origin(program: &Program<PROGRAM_SIZE>, origin: u8) -> RelocatedProgram<'_, PROGRAM_SIZE> {
         RelocatedProgram { program, origin }
     }
 
diff --git a/embassy-rp/src/rom_data/mod.rs b/embassy-rp/src/rom_data/mod.rs
index e5fcf8e3c..a4aba5737 100644
--- a/embassy-rp/src/rom_data/mod.rs
+++ b/embassy-rp/src/rom_data/mod.rs
@@ -1,29 +1,29 @@
 #![cfg_attr(
     feature = "rp2040",
     doc = r"
-//! Functions and data from the RPI Bootrom.
-//!
-//! From the [RP2040 datasheet](https://datasheets.raspberrypi.org/rp2040/rp2040-datasheet.pdf), Section 2.8.2.1:
-//!
-//! > The Bootrom contains a number of public functions that provide useful
-//! > RP2040 functionality that might be needed in the absence of any other code
-//! > on the device, as well as highly optimized versions of certain key
-//! > functionality that would otherwise have to take up space in most user
-//! > binaries.
+Functions and data from the RPI Bootrom.
+
+From the [RP2040 datasheet](https://datasheets.raspberrypi.org/rp2040/rp2040-datasheet.pdf), Section 2.8.2.1:
+
+> The Bootrom contains a number of public functions that provide useful
+> RP2040 functionality that might be needed in the absence of any other code
+> on the device, as well as highly optimized versions of certain key
+> functionality that would otherwise have to take up space in most user
+> binaries.
 "
 )]
 #![cfg_attr(
     feature = "_rp235x",
     doc = r"
-//! Functions and data from the RPI Bootrom.
-//!
-//! From [Section 5.4](https://rptl.io/rp2350-datasheet#section_bootrom) of the
-//! RP2350 datasheet:
-//!
-//! > Whilst some ROM space is dedicated to the implementation of the boot
-//! > sequence and USB/UART boot interfaces, the bootrom also contains public
-//! > functions that provide useful RP2350 functionality that may be useful for
-//! > any code or runtime running on the device
+Functions and data from the RPI Bootrom.
+
+From [Section 5.4](https://rptl.io/rp2350-datasheet#section_bootrom) of the
+RP2350 datasheet:
+
+> Whilst some ROM space is dedicated to the implementation of the boot
+> sequence and USB/UART boot interfaces, the bootrom also contains public
+> functions that provide useful RP2350 functionality that may be useful for
+> any code or runtime running on the device
 "
 )]
 
diff --git a/embassy-rp/src/trng.rs b/embassy-rp/src/trng.rs
index a8a0172be..a3f23c1f2 100644
--- a/embassy-rp/src/trng.rs
+++ b/embassy-rp/src/trng.rs
@@ -7,7 +7,6 @@ use core::task::Poll;
 
 use embassy_hal_internal::{Peri, PeripheralType};
 use embassy_sync::waitqueue::AtomicWaker;
-use rand_core::Error;
 
 use crate::interrupt::typelevel::{Binding, Interrupt};
 use crate::peripherals::TRNG;
@@ -369,7 +368,7 @@ impl<'d, T: Instance> Trng<'d, T> {
     }
 }
 
-impl<'d, T: Instance> rand_core::RngCore for Trng<'d, T> {
+impl<'d, T: Instance> rand_core_06::RngCore for Trng<'d, T> {
     fn next_u32(&mut self) -> u32 {
         self.blocking_next_u32()
     }
@@ -379,16 +378,32 @@ impl<'d, T: Instance> rand_core::RngCore for Trng<'d, T> {
     }
 
     fn fill_bytes(&mut self, dest: &mut [u8]) {
-        self.blocking_fill_bytes(dest)
+        self.blocking_fill_bytes(dest);
     }
 
-    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), Error> {
+    fn try_fill_bytes(&mut self, dest: &mut [u8]) -> Result<(), rand_core_06::Error> {
         self.blocking_fill_bytes(dest);
         Ok(())
     }
 }
 
-impl<'d, T: Instance> rand_core::CryptoRng for Trng<'d, T> {}
+impl<'d, T: Instance> rand_core_06::CryptoRng for Trng<'d, T> {}
+
+impl<'d, T: Instance> rand_core_09::RngCore for Trng<'d, T> {
+    fn next_u32(&mut self) -> u32 {
+        self.blocking_next_u32()
+    }
+
+    fn next_u64(&mut self) -> u64 {
+        self.blocking_next_u64()
+    }
+
+    fn fill_bytes(&mut self, dest: &mut [u8]) {
+        self.blocking_fill_bytes(dest);
+    }
+}
+
+impl<'d, T: Instance> rand_core_09::CryptoRng for Trng<'d, T> {}
 
 /// TRNG interrupt handler.
 pub struct InterruptHandler<T: Instance> {
diff --git a/embassy-rp/src/uart/mod.rs b/embassy-rp/src/uart/mod.rs
index c3a15fda5..6f4e2ee07 100644
--- a/embassy-rp/src/uart/mod.rs
+++ b/embassy-rp/src/uart/mod.rs
@@ -495,52 +495,58 @@ impl<'d> UartRx<'d, Async> {
         unreachable!("unrecognized rx error");
     }
 
-    /// Read from the UART, waiting for a line break.
+    /// Read from the UART, waiting for a break.
     ///
     /// We read until one of the following occurs:
     ///
-    /// * We read `buffer.len()` bytes without a line break
+    /// * We read `buffer.len()` bytes without a break
     ///     * returns `Err(ReadToBreakError::MissingBreak(buffer.len()))`
-    /// * We read `n` bytes then a line break occurs
+    /// * We read `n` bytes then a break occurs
     ///     * returns `Ok(n)`
-    /// * We encounter some error OTHER than a line break
+    /// * We encounter some error OTHER than a break
     ///     * returns `Err(ReadToBreakError::Other(error))`
     ///
     /// **NOTE**: you MUST provide a buffer one byte larger than your largest expected
     /// message to reliably detect the framing on one single call to `read_to_break()`.
     ///
-    /// * If you expect a message of 20 bytes + line break, and provide a 20-byte buffer:
+    /// * If you expect a message of 20 bytes + break, and provide a 20-byte buffer:
     ///     * The first call to `read_to_break()` will return `Err(ReadToBreakError::MissingBreak(20))`
-    ///     * The next call to `read_to_break()` will immediately return `Ok(0)`, from the "stale" line break
-    /// * If you expect a message of 20 bytes + line break, and provide a 21-byte buffer:
+    ///     * The next call to `read_to_break()` will immediately return `Ok(0)`, from the "stale" break
+    /// * If you expect a message of 20 bytes + break, and provide a 21-byte buffer:
     ///     * The first call to `read_to_break()` will return `Ok(20)`.
     ///     * The next call to `read_to_break()` will work as expected
+    ///
+    /// **NOTE**: In the UART context, a break refers to a break condition (the line being held low for
+    /// for longer than a single character), not an ASCII line break.
     pub async fn read_to_break(&mut self, buffer: &mut [u8]) -> Result<usize, ReadToBreakError> {
         self.read_to_break_with_count(buffer, 0).await
     }
 
-    /// Read from the UART, waiting for a line break as soon as at least `min_count` bytes have been read.
+    /// Read from the UART, waiting for a break as soon as at least `min_count` bytes have been read.
     ///
     /// We read until one of the following occurs:
     ///
-    /// * We read `buffer.len()` bytes without a line break
+    /// * We read `buffer.len()` bytes without a break
     ///     * returns `Err(ReadToBreakError::MissingBreak(buffer.len()))`
-    /// * We read `n > min_count` bytes then a line break occurs
+    /// * We read `n > min_count` bytes then a break occurs
     ///     * returns `Ok(n)`
-    /// * We encounter some error OTHER than a line break
+    /// * We encounter some error OTHER than a break
     ///     * returns `Err(ReadToBreakError::Other(error))`
     ///
-    /// If a line break occurs before `min_count` bytes have been read, the break will be ignored and the read will continue
+    /// If a break occurs before `min_count` bytes have been read, the break will be ignored and the read will continue
     ///
     /// **NOTE**: you MUST provide a buffer one byte larger than your largest expected
     /// message to reliably detect the framing on one single call to `read_to_break()`.
     ///
-    /// * If you expect a message of 20 bytes + line break, and provide a 20-byte buffer:
+    /// * If you expect a message of 20 bytes + break, and provide a 20-byte buffer:
     ///     * The first call to `read_to_break()` will return `Err(ReadToBreakError::MissingBreak(20))`
     ///     * The next call to `read_to_break()` will immediately return `Ok(0)`, from the "stale" line break
-    /// * If you expect a message of 20 bytes + line break, and provide a 21-byte buffer:
+    /// * If you expect a message of 20 bytes + break, and provide a 21-byte buffer:
     ///     * The first call to `read_to_break()` will return `Ok(20)`.
     ///     * The next call to `read_to_break()` will work as expected
+    ///
+    /// **NOTE**: In the UART context, a break refers to a break condition (the line being held low for
+    /// for longer than a single character), not an ASCII line break.
     pub async fn read_to_break_with_count(
         &mut self,
         buffer: &mut [u8],
diff --git a/embassy-rp/src/usb.rs b/embassy-rp/src/usb.rs
index 96541ade6..671ecbd32 100644
--- a/embassy-rp/src/usb.rs
+++ b/embassy-rp/src/usb.rs
@@ -153,6 +153,7 @@ impl<'d, T: Instance> Driver<'d, T> {
     fn alloc_endpoint<D: Dir>(
         &mut self,
         ep_type: EndpointType,
+        ep_addr: Option<EndpointAddress>,
         max_packet_size: u16,
         interval_ms: u8,
     ) -> Result<Endpoint<'d, T, D>, driver::EndpointAllocError> {
@@ -169,12 +170,25 @@ impl<'d, T: Instance> Driver<'d, T> {
             Direction::In => &mut self.ep_in,
         };
 
-        let index = alloc.iter_mut().enumerate().find(|(i, ep)| {
-            if *i == 0 {
-                return false; // reserved for control pipe
+        let index = if let Some(addr) = ep_addr {
+            // Use the specified endpoint address
+            let requested_index = addr.index();
+            if requested_index == 0 || requested_index >= EP_COUNT {
+                return Err(EndpointAllocError);
             }
-            !ep.used
-        });
+            if alloc[requested_index].used {
+                return Err(EndpointAllocError);
+            }
+            Some((requested_index, &mut alloc[requested_index]))
+        } else {
+            // Find any available endpoint
+            alloc.iter_mut().enumerate().find(|(i, ep)| {
+                if *i == 0 {
+                    return false; // reserved for control pipe
+                }
+                !ep.used
+            })
+        };
 
         let (index, ep) = index.ok_or(EndpointAllocError)?;
         assert!(!ep.used);
@@ -299,19 +313,21 @@ impl<'d, T: Instance> driver::Driver<'d> for Driver<'d, T> {
     fn alloc_endpoint_in(
         &mut self,
         ep_type: EndpointType,
+        ep_addr: Option<EndpointAddress>,
         max_packet_size: u16,
         interval_ms: u8,
     ) -> Result<Self::EndpointIn, driver::EndpointAllocError> {
-        self.alloc_endpoint(ep_type, max_packet_size, interval_ms)
+        self.alloc_endpoint(ep_type, ep_addr, max_packet_size, interval_ms)
     }
 
     fn alloc_endpoint_out(
         &mut self,
         ep_type: EndpointType,
+        ep_addr: Option<EndpointAddress>,
         max_packet_size: u16,
         interval_ms: u8,
     ) -> Result<Self::EndpointOut, driver::EndpointAllocError> {
-        self.alloc_endpoint(ep_type, max_packet_size, interval_ms)
+        self.alloc_endpoint(ep_type, ep_addr, max_packet_size, interval_ms)
     }
 
     fn start(self, control_max_packet_size: u16) -> (Self::Bus, Self::ControlPipe) {