Undefined Behavior and Safe Register Access

The C standard (§3.4) sorts everything it does not fully specify into three bins, and the difference between them is the whole lesson.

Implementation-defined behaviour is fine to rely on when you know your target; it is how (volatile uint32_t *)0x40021000 works at all. Undefined behaviour is different in kind. It is not “the result is unpredictable”; it is that the program containing it is not a valid C program, and the compiler may assume it never runs.

Optimisers reason from the assumption that undefined behaviour does not occur, because a correct program never triggers it. Regehr’s guide gives the canonical example:

int32_t x = …;
if (x + 1 < x) { /* overflow handler */ }

Signed overflow is undefined, so for a valid program x + 1 < x is always false, so the branch is dead, so it is removed. The check is gone precisely because it was written in terms of the thing it was trying to detect. Similarly, once *p has been executed, p cannot be NULL in a valid program, so a later if (p == NULL) is dead. A loop for (int i = 0; i >= 0; i++) can be compiled as an infinite loop, because i reaching INT_MAX and wrapping would be undefined.

None of this happens at -O0, which is why “it worked in debug” is the usual first symptom. The behaviour is not the compiler being malicious; it is the language being taken at its word.

Now the other half of the title. REG |= BIT is not one operation. It compiles to a load, an OR and a store, and between the load and the store the world can change. Suppose main code sets bit 0 of a shared interrupt-enable register while an interrupt handler sets bit 3 of the same register:

↑ This step uses the figure at the top of the page.

Play the sequence. Main loads 0x0, computes 0x1, is interrupted; the handler’s own read-modify-write leaves 0x8 in the register; main resumes and stores its stale 0x1. Bit 3 is gone. Nothing was undefined behaviour here; both pieces of code were correct C in isolation. The hazard is a data race, and it is not a corner case: it will happen the first time the interrupt lands in that two-instruction window, which at thousands of interrupts per second is soon.

volatile does not help (lesson 5): it guarantees the load and store happen, not that nothing happens between them.

Atomic set/clear aliases. The RP2040 maps every peripheral register three more times: a write to the register’s address + 0x2000 sets the written bits, + 0x3000 clears them, + 0x1000 XORs them, each in a single bus write with no read (datasheet §2.1.2). *(volatile uint32_t *)(REG_ADDR + 0x2000) = BIT; cannot be interrupted halfway because there is no halfway.

Write-only set/reset registers. STM32’s GPIOx_BSRR (RM0090 §8.4.7) is the same idea for one peripheral: one store sets or resets the chosen pins. Many timers and interrupt controllers have separate SET/CLR registers for the same reason. Prefer them whenever the register map offers them.

Critical sections. Where the hardware offers nothing, disable interrupts around the sequence: on Cortex-M, save PRIMASK, __disable_irq(), do the read-modify-write, restore. Keep the section to a few instructions, because every microsecond inside it is latency added to every interrupt.

Language atomics. C11 <stdatomic.h> gives atomic_fetch_or and friends for variables shared with an ISR; on Cortex-M3 and above the compiler implements them with LDREX/STREX loops. They are the right tool for a shared counter or flag in RAM. They are not a substitute for the hardware alias when the object is a peripheral register, because exclusive accesses to peripheral space are generally not supported.

Main code must set bit 0 of IRQ_EN at 0x4001_0040 while an ISR may set bit 3 at any time.

Wrong (lost update possible):

IRQ_EN |= (1u << 0);

RP2040 atomic alias (one store, no read):

*(volatile uint32_t *)(0x40010040u + 0x2000u) = (1u << 0);

Dedicated set register (if the map has IRQ_EN_SET at 0x44):

IRQ_EN_SET = (1u << 0);

Critical section (portable, costs interrupt latency):

uint32_t pm = __get_PRIMASK();
__disable_irq();
IRQ_EN |= (1u << 0);
__set_PRIMASK(pm);

All four leave bit 3 alone if the ISR sets it at any moment. The first three do it in one instruction; the last does it by making sure nothing else runs. The alias and the set register are also the fastest, which is why the datasheet built them: the RP2040 text says outright that they are “the best solution” for updating part of a register.