// SPDX-License-Identifier: GPL-2.0 //! Memory-mapped IO.//!//! C header: [`include/asm-generic/io.h`](srctree/include/asm-generic/io.h) use crate::{ bindings, prelude::*, //}; pub mod mem;pub mod poll;pub mod resource; pub use resource::Resource; /// Physical address type.////// This is a type alias to either `u32` or `u64` depending on the config option/// `CONFIG_PHYS_ADDR_T_64BIT`, and it can be a u64 even on 32-bit architectures.pub type PhysAddr = bindings::phys_addr_t; /// Resource Size type.////// This is a type alias to either `u32` or `u64` depending on the config option/// `CONFIG_PHYS_ADDR_T_64BIT`, and it can be a u64 even on 32-bit architectures.pub type ResourceSize = bindings::resource_size_t; /// Raw representation of an MMIO region.////// By itself, the existence of an instance of this structure does not provide any guarantees that/// the represented MMIO region does exist or is properly mapped.////// Instead, the bus specific MMIO implementation must convert this raw representation into an/// `Mmio` instance providing the actual memory accessors. Only by the conversion into an `Mmio`/// structure any guarantees are given.pub struct MmioRaw<const SIZE: usize = 0> { addr: usize, maxsize: usize,} impl<const SIZE: usize> MmioRaw<SIZE> { /// Returns a new `MmioRaw` instance on success, an error otherwise. pub fn new(addr: usize, maxsize: usize) -> Result<Self> { if maxsize < SIZE { return Err(EINVAL); } Ok(Self { addr, maxsize }) } /// Returns the base address of the MMIO region. #[inline] pub fn addr(&self) -> usize { self.addr } /// Returns the maximum size of the MMIO region. #[inline] pub fn maxsize(&self) -> usize { self.maxsize }} /// IO-mapped memory region.////// The creator (usually a subsystem / bus such as PCI) is responsible for creating the/// mapping, performing an additional region request etc.////// # Invariant////// `addr` is the start and `maxsize` the length of valid I/O mapped memory region of size/// `maxsize`.////// # Examples////// ```no_run/// use kernel::{/// bindings,/// ffi::c_void,/// io::{/// Io,/// IoKnownSize,/// Mmio,/// MmioRaw,/// PhysAddr,/// },/// };/// use core::ops::Deref;////// // See also `pci::Bar` for a real example./// struct IoMem<const SIZE: usize>(MmioRaw<SIZE>);////// impl<const SIZE: usize> IoMem<SIZE> {/// /// # Safety/// ////// /// [`paddr`, `paddr` + `SIZE`) must be a valid MMIO region that is mappable into the CPUs/// /// virtual address space./// unsafe fn new(paddr: usize) -> Result<Self>{/// // SAFETY: By the safety requirements of this function [`paddr`, `paddr` + `SIZE`) is/// // valid for `ioremap`./// let addr = unsafe { bindings::ioremap(paddr as PhysAddr, SIZE) };/// if addr.is_null() {/// return Err(ENOMEM);/// }////// Ok(IoMem(MmioRaw::new(addr as usize, SIZE)?))/// }/// }////// impl<const SIZE: usize> Drop for IoMem<SIZE> {/// fn drop(&mut self) {/// // SAFETY: `self.0.addr()` is guaranteed to be properly mapped by `Self::new`./// unsafe { bindings::iounmap(self.0.addr() as *mut c_void); };/// }/// }////// impl<const SIZE: usize> Deref for IoMem<SIZE> {/// type Target = Mmio<SIZE>;////// fn deref(&self) -> &Self::Target {/// // SAFETY: The memory range stored in `self` has been properly mapped in `Self::new`./// unsafe { Mmio::from_raw(&self.0) }/// }/// }//////# fn no_run() -> Result<(), Error> {/// // SAFETY: Invalid usage for example purposes./// let iomem = unsafe { IoMem::<{ core::mem::size_of::<u32>() }>::new(0xBAAAAAAD)? };/// iomem.write32(0x42, 0x0);/// assert!(iomem.try_write32(0x42, 0x0).is_ok());/// assert!(iomem.try_write32(0x42, 0x4).is_err());/// # Ok(())/// # }/// ```#[repr(transparent)]pub struct Mmio<const SIZE: usize = 0>(MmioRaw<SIZE>); /// Internal helper macros used to invoke C MMIO read functions.////// This macro is intended to be used by higher-level MMIO access macros (io_define_read) and/// provides a unified expansion for infallible vs. fallible read semantics. It emits a direct call/// into the corresponding C helper and performs the required cast to the Rust return type.////// # Parameters////// * `$c_fn` – The C function performing the MMIO read./// * `$self` – The I/O backend object./// * `$ty` – The type of the value to be read./// * `$addr` – The MMIO address to read.////// This macro does not perform any validation; all invariants must be upheld by the higher-level/// abstraction invoking it.macro_rules! call_mmio_read { (infallible, $c_fn:ident, $self:ident, $type:ty, $addr:expr) => { // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($addr as *const c_void) as $type } }; (fallible, $c_fn:ident, $self:ident, $type:ty, $addr:expr) => {{ // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. Ok(unsafe { bindings::$c_fn($addr as *const c_void) as $type }) }};} /// Internal helper macros used to invoke C MMIO write functions.////// This macro is intended to be used by higher-level MMIO access macros (io_define_write) and/// provides a unified expansion for infallible vs. fallible write semantics. It emits a direct call/// into the corresponding C helper and performs the required cast to the Rust return type.////// # Parameters////// * `$c_fn` – The C function performing the MMIO write./// * `$self` – The I/O backend object./// * `$ty` – The type of the written value./// * `$addr` – The MMIO address to write./// * `$value` – The value to write.////// This macro does not perform any validation; all invariants must be upheld by the higher-level/// abstraction invoking it.macro_rules! call_mmio_write { (infallible, $c_fn:ident, $self:ident, $ty:ty, $addr:expr, $value:expr) => { // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($value, $addr as *mut c_void) } }; (fallible, $c_fn:ident, $self:ident, $ty:ty, $addr:expr, $value:expr) => {{ // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($value, $addr as *mut c_void) }; Ok(()) }};} /// Generates an accessor method for reading from an I/O backend.////// This macro reduces boilerplate by automatically generating either compile-time bounds-checked/// (infallible) or runtime bounds-checked (fallible) read methods. It abstracts the address/// calculation and bounds checking, and delegates the actual I/O read operation to a specified/// helper macro, making it generic over different I/O backends.////// # Parameters////// * `infallible` / `fallible` - Determines the bounds-checking strategy. `infallible` relies on/// `IoKnownSize` for compile-time checks and returns the value directly. `fallible` performs/// runtime checks against `maxsize()` and returns a `Result<T>`./// * `$(#[$attr:meta])*` - Optional attributes to apply to the generated method (e.g.,/// `#[cfg(CONFIG_64BIT)]` or inline directives)./// * `$vis:vis` - The visibility of the generated method (e.g., `pub`)./// * `$name:ident` / `$try_name:ident` - The name of the generated method (e.g., `read32`,/// `try_read8`)./// * `$call_macro:ident` - The backend-specific helper macro used to emit the actual I/O call/// (e.g., `call_mmio_read`)./// * `$c_fn:ident` - The backend-specific C function or identifier to be passed into the/// `$call_macro`./// * `$type_name:ty` - The Rust type of the value being read (e.g., `u8`, `u32`).#[macro_export]macro_rules! io_define_read { (infallible, $(#[$attr:meta])* $vis:vis $name:ident, $call_macro:ident($c_fn:ident) -> $type_name:ty) => { /// Read IO data from a given offset known at compile time. /// /// Bound checks are performed on compile time, hence if the offset is not known at compile /// time, the build will fail. $(#[$attr])* // Always inline to optimize out error path of `io_addr_assert`. #[inline(always)] $vis fn $name(&self, offset: usize) -> $type_name { let addr = self.io_addr_assert::<$type_name>(offset); // SAFETY: By the type invariant `addr` is a valid address for IO operations. $call_macro!(infallible, $c_fn, self, $type_name, addr) } }; (fallible, $(#[$attr:meta])* $vis:vis $try_name:ident, $call_macro:ident($c_fn:ident) -> $type_name:ty) => { /// Read IO data from a given offset. /// /// Bound checks are performed on runtime, it fails if the offset (plus the type size) is /// out of bounds. $(#[$attr])* $vis fn $try_name(&self, offset: usize) -> Result<$type_name> { let addr = self.io_addr::<$type_name>(offset)?; // SAFETY: By the type invariant `addr` is a valid address for IO operations. $call_macro!(fallible, $c_fn, self, $type_name, addr) } };}pub use io_define_read; /// Generates an accessor method for writing to an I/O backend.////// This macro reduces boilerplate by automatically generating either compile-time bounds-checked/// (infallible) or runtime bounds-checked (fallible) write methods. It abstracts the address/// calculation and bounds checking, and delegates the actual I/O write operation to a specified/// helper macro, making it generic over different I/O backends.////// # Parameters////// * `infallible` / `fallible` - Determines the bounds-checking strategy. `infallible` relies on/// `IoKnownSize` for compile-time checks and returns `()`. `fallible` performs runtime checks/// against `maxsize()` and returns a `Result`./// * `$(#[$attr:meta])*` - Optional attributes to apply to the generated method (e.g.,/// `#[cfg(CONFIG_64BIT)]` or inline directives)./// * `$vis:vis` - The visibility of the generated method (e.g., `pub`)./// * `$name:ident` / `$try_name:ident` - The name of the generated method (e.g., `write32`,/// `try_write8`)./// * `$call_macro:ident` - The backend-specific helper macro used to emit the actual I/O call/// (e.g., `call_mmio_write`)./// * `$c_fn:ident` - The backend-specific C function or identifier to be passed into the/// `$call_macro`./// * `$type_name:ty` - The Rust type of the value being written (e.g., `u8`, `u32`). Note the use/// of `<-` before the type to denote a write operation.#[macro_export]macro_rules! io_define_write { (infallible, $(#[$attr:meta])* $vis:vis $name:ident, $call_macro:ident($c_fn:ident) <- $type_name:ty) => { /// Write IO data from a given offset known at compile time. /// /// Bound checks are performed on compile time, hence if the offset is not known at compile /// time, the build will fail. $(#[$attr])* // Always inline to optimize out error path of `io_addr_assert`. #[inline(always)] $vis fn $name(&self, value: $type_name, offset: usize) { let addr = self.io_addr_assert::<$type_name>(offset); $call_macro!(infallible, $c_fn, self, $type_name, addr, value); } }; (fallible, $(#[$attr:meta])* $vis:vis $try_name:ident, $call_macro:ident($c_fn:ident) <- $type_name:ty) => { /// Write IO data from a given offset. /// /// Bound checks are performed on runtime, it fails if the offset (plus the type size) is /// out of bounds. $(#[$attr])* $vis fn $try_name(&self, value: $type_name, offset: usize) -> Result { let addr = self.io_addr::<$type_name>(offset)?; $call_macro!(fallible, $c_fn, self, $type_name, addr, value) } };}pub use io_define_write; /// Checks whether an access of type `U` at the given `offset`/// is valid within this region.#[inline]const fn offset_valid<U>(offset: usize, size: usize) -> bool { let type_size = core::mem::size_of::<U>(); if let Some(end) = offset.checked_add(type_size) { end <= size && offset % type_size == 0 } else { false }} /// Marker trait indicating that an I/O backend supports operations of a certain type.////// Different I/O backends can implement this trait to expose only the operations they support.////// For example, a PCI configuration space may implement `IoCapable<u8>`, `IoCapable<u16>`,/// and `IoCapable<u32>`, but not `IoCapable<u64>`, while an MMIO region on a 64-bit/// system might implement all four.pub trait IoCapable<T> {} /// Types implementing this trait (e.g. MMIO BARs or PCI config regions)/// can perform I/O operations on regions of memory.////// This is an abstract representation to be implemented by arbitrary I/O/// backends (e.g. MMIO, PCI config space, etc.).////// The [`Io`] trait provides:/// - Base address and size information/// - Helper methods for offset validation and address calculation/// - Fallible (runtime checked) accessors for different data widths////// Which I/O methods are available depends on which [`IoCapable<T>`] traits/// are implemented for the type.////// # Examples////// For MMIO regions, all widths (u8, u16, u32, and u64 on 64-bit systems) are typically/// supported. For PCI configuration space, u8, u16, and u32 are supported but u64 is not.pub trait Io { /// Returns the base address of this mapping. fn addr(&self) -> usize; /// Returns the maximum size of this mapping. fn maxsize(&self) -> usize; /// Returns the absolute I/O address for a given `offset`, /// performing runtime bound checks. #[inline] fn io_addr<U>(&self, offset: usize) -> Result<usize> { if !offset_valid::<U>(offset, self.maxsize()) { return Err(EINVAL); } // Probably no need to check, since the safety requirements of `Self::new` guarantee that // this can't overflow. self.addr().checked_add(offset).ok_or(EINVAL) } /// Fallible 8-bit read with runtime bounds check. #[inline(always)] fn try_read8(&self, _offset: usize) -> Result<u8> where Self: IoCapable<u8>, { build_error!("Backend does not support fallible 8-bit read") } /// Fallible 16-bit read with runtime bounds check. #[inline(always)] fn try_read16(&self, _offset: usize) -> Result<u16> where Self: IoCapable<u16>, { build_error!("Backend does not support fallible 16-bit read") } /// Fallible 32-bit read with runtime bounds check. #[inline(always)] fn try_read32(&self, _offset: usize) -> Result<u32> where Self: IoCapable<u32>, { build_error!("Backend does not support fallible 32-bit read") } /// Fallible 64-bit read with runtime bounds check. #[inline(always)] fn try_read64(&self, _offset: usize) -> Result<u64> where Self: IoCapable<u64>, { build_error!("Backend does not support fallible 64-bit read") } /// Fallible 8-bit write with runtime bounds check. #[inline(always)] fn try_write8(&self, _value: u8, _offset: usize) -> Result where Self: IoCapable<u8>, { build_error!("Backend does not support fallible 8-bit write") } /// Fallible 16-bit write with runtime bounds check. #[inline(always)] fn try_write16(&self, _value: u16, _offset: usize) -> Result where Self: IoCapable<u16>, { build_error!("Backend does not support fallible 16-bit write") } /// Fallible 32-bit write with runtime bounds check. #[inline(always)] fn try_write32(&self, _value: u32, _offset: usize) -> Result where Self: IoCapable<u32>, { build_error!("Backend does not support fallible 32-bit write") } /// Fallible 64-bit write with runtime bounds check. #[inline(always)] fn try_write64(&self, _value: u64, _offset: usize) -> Result where Self: IoCapable<u64>, { build_error!("Backend does not support fallible 64-bit write") } /// Infallible 8-bit read with compile-time bounds check. #[inline(always)] fn read8(&self, _offset: usize) -> u8 where Self: IoKnownSize + IoCapable<u8>, { build_error!("Backend does not support infallible 8-bit read") } /// Infallible 16-bit read with compile-time bounds check. #[inline(always)] fn read16(&self, _offset: usize) -> u16 where Self: IoKnownSize + IoCapable<u16>, { build_error!("Backend does not support infallible 16-bit read") } /// Infallible 32-bit read with compile-time bounds check. #[inline(always)] fn read32(&self, _offset: usize) -> u32 where Self: IoKnownSize + IoCapable<u32>, { build_error!("Backend does not support infallible 32-bit read") } /// Infallible 64-bit read with compile-time bounds check. #[inline(always)] fn read64(&self, _offset: usize) -> u64 where Self: IoKnownSize + IoCapable<u64>, { build_error!("Backend does not support infallible 64-bit read") } /// Infallible 8-bit write with compile-time bounds check. #[inline(always)] fn write8(&self, _value: u8, _offset: usize) where Self: IoKnownSize + IoCapable<u8>, { build_error!("Backend does not support infallible 8-bit write") } /// Infallible 16-bit write with compile-time bounds check. #[inline(always)] fn write16(&self, _value: u16, _offset: usize) where Self: IoKnownSize + IoCapable<u16>, { build_error!("Backend does not support infallible 16-bit write") } /// Infallible 32-bit write with compile-time bounds check. #[inline(always)] fn write32(&self, _value: u32, _offset: usize) where Self: IoKnownSize + IoCapable<u32>,Lines 1–500 of 655. Load more
// SPDX-License-Identifier: GPL-2.0 //! Memory-mapped IO. //! //! C header: [`include/asm-generic/io.h`](srctree/include/asm-generic/io.h) use crate::{ bindings, prelude::*, // }; pub mod mem; pub mod poll; pub mod resource; pub use resource::Resource; /// Physical address type. /// /// This is a type alias to either `u32` or `u64` depending on the config option /// `CONFIG_PHYS_ADDR_T_64BIT`, and it can be a u64 even on 32-bit architectures. pub type PhysAddr = bindings::phys_addr_t; /// Resource Size type. /// /// This is a type alias to either `u32` or `u64` depending on the config option /// `CONFIG_PHYS_ADDR_T_64BIT`, and it can be a u64 even on 32-bit architectures. pub type ResourceSize = bindings::resource_size_t; /// Raw representation of an MMIO region. /// /// By itself, the existence of an instance of this structure does not provide any guarantees that /// the represented MMIO region does exist or is properly mapped. /// /// Instead, the bus specific MMIO implementation must convert this raw representation into an /// `Mmio` instance providing the actual memory accessors. Only by the conversion into an `Mmio` /// structure any guarantees are given. pub struct MmioRaw<const SIZE: usize = 0> { addr: usize, maxsize: usize, } impl<const SIZE: usize> MmioRaw<SIZE> { /// Returns a new `MmioRaw` instance on success, an error otherwise. pub fn new(addr: usize, maxsize: usize) -> Result<Self> { if maxsize < SIZE { return Err(EINVAL); } Ok(Self { addr, maxsize }) } /// Returns the base address of the MMIO region. #[inline] pub fn addr(&self) -> usize { self.addr } /// Returns the maximum size of the MMIO region. #[inline] pub fn maxsize(&self) -> usize { self.maxsize } } /// IO-mapped memory region. /// /// The creator (usually a subsystem / bus such as PCI) is responsible for creating the /// mapping, performing an additional region request etc. /// /// # Invariant /// /// `addr` is the start and `maxsize` the length of valid I/O mapped memory region of size /// `maxsize`. /// /// # Examples /// /// ```no_run /// use kernel::{ /// bindings, /// ffi::c_void, /// io::{ /// Io, /// IoKnownSize, /// Mmio, /// MmioRaw, /// PhysAddr, /// }, /// }; /// use core::ops::Deref; /// /// // See also `pci::Bar` for a real example. /// struct IoMem<const SIZE: usize>(MmioRaw<SIZE>); /// /// impl<const SIZE: usize> IoMem<SIZE> { /// /// # Safety /// /// /// /// [`paddr`, `paddr` + `SIZE`) must be a valid MMIO region that is mappable into the CPUs /// /// virtual address space. /// unsafe fn new(paddr: usize) -> Result<Self>{ /// // SAFETY: By the safety requirements of this function [`paddr`, `paddr` + `SIZE`) is /// // valid for `ioremap`. /// let addr = unsafe { bindings::ioremap(paddr as PhysAddr, SIZE) }; /// if addr.is_null() { /// return Err(ENOMEM); /// } /// /// Ok(IoMem(MmioRaw::new(addr as usize, SIZE)?)) /// } /// } /// /// impl<const SIZE: usize> Drop for IoMem<SIZE> { /// fn drop(&mut self) { /// // SAFETY: `self.0.addr()` is guaranteed to be properly mapped by `Self::new`. /// unsafe { bindings::iounmap(self.0.addr() as *mut c_void); }; /// } /// } /// /// impl<const SIZE: usize> Deref for IoMem<SIZE> { /// type Target = Mmio<SIZE>; /// /// fn deref(&self) -> &Self::Target { /// // SAFETY: The memory range stored in `self` has been properly mapped in `Self::new`. /// unsafe { Mmio::from_raw(&self.0) } /// } /// } /// ///# fn no_run() -> Result<(), Error> { /// // SAFETY: Invalid usage for example purposes. /// let iomem = unsafe { IoMem::<{ core::mem::size_of::<u32>() }>::new(0xBAAAAAAD)? }; /// iomem.write32(0x42, 0x0); /// assert!(iomem.try_write32(0x42, 0x0).is_ok()); /// assert!(iomem.try_write32(0x42, 0x4).is_err()); /// # Ok(()) /// # } /// ``` #[repr(transparent)] pub struct Mmio<const SIZE: usize = 0>(MmioRaw<SIZE>); /// Internal helper macros used to invoke C MMIO read functions. /// /// This macro is intended to be used by higher-level MMIO access macros (io_define_read) and /// provides a unified expansion for infallible vs. fallible read semantics. It emits a direct call /// into the corresponding C helper and performs the required cast to the Rust return type. /// /// # Parameters /// /// * `$c_fn` – The C function performing the MMIO read. /// * `$self` – The I/O backend object. /// * `$ty` – The type of the value to be read. /// * `$addr` – The MMIO address to read. /// /// This macro does not perform any validation; all invariants must be upheld by the higher-level /// abstraction invoking it. macro_rules! call_mmio_read { (infallible, $c_fn:ident, $self:ident, $type:ty, $addr:expr) => { // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($addr as *const c_void) as $type } }; (fallible, $c_fn:ident, $self:ident, $type:ty, $addr:expr) => {{ // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. Ok(unsafe { bindings::$c_fn($addr as *const c_void) as $type }) }}; } /// Internal helper macros used to invoke C MMIO write functions. /// /// This macro is intended to be used by higher-level MMIO access macros (io_define_write) and /// provides a unified expansion for infallible vs. fallible write semantics. It emits a direct call /// into the corresponding C helper and performs the required cast to the Rust return type. /// /// # Parameters /// /// * `$c_fn` – The C function performing the MMIO write. /// * `$self` – The I/O backend object. /// * `$ty` – The type of the written value. /// * `$addr` – The MMIO address to write. /// * `$value` – The value to write. /// /// This macro does not perform any validation; all invariants must be upheld by the higher-level /// abstraction invoking it. macro_rules! call_mmio_write { (infallible, $c_fn:ident, $self:ident, $ty:ty, $addr:expr, $value:expr) => { // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($value, $addr as *mut c_void) } }; (fallible, $c_fn:ident, $self:ident, $ty:ty, $addr:expr, $value:expr) => {{ // SAFETY: By the type invariant `addr` is a valid address for MMIO operations. unsafe { bindings::$c_fn($value, $addr as *mut c_void) }; Ok(()) }}; } /// Generates an accessor method for reading from an I/O backend. /// /// This macro reduces boilerplate by automatically generating either compile-time bounds-checked /// (infallible) or runtime bounds-checked (fallible) read methods. It abstracts the address /// calculation and bounds checking, and delegates the actual I/O read operation to a specified /// helper macro, making it generic over different I/O backends. /// /// # Parameters /// /// * `infallible` / `fallible` - Determines the bounds-checking strategy. `infallible` relies on /// `IoKnownSize` for compile-time checks and returns the value directly. `fallible` performs /// runtime checks against `maxsize()` and returns a `Result<T>`. /// * `$(#[$attr:meta])*` - Optional attributes to apply to the generated method (e.g., /// `#[cfg(CONFIG_64BIT)]` or inline directives). /// * `$vis:vis` - The visibility of the generated method (e.g., `pub`). /// * `$name:ident` / `$try_name:ident` - The name of the generated method (e.g., `read32`, /// `try_read8`). /// * `$call_macro:ident` - The backend-specific helper macro used to emit the actual I/O call /// (e.g., `call_mmio_read`). /// * `$c_fn:ident` - The backend-specific C function or identifier to be passed into the /// `$call_macro`. /// * `$type_name:ty` - The Rust type of the value being read (e.g., `u8`, `u32`). #[macro_export] macro_rules! io_define_read { (infallible, $(#[$attr:meta])* $vis:vis $name:ident, $call_macro:ident($c_fn:ident) -> $type_name:ty) => { /// Read IO data from a given offset known at compile time. /// /// Bound checks are performed on compile time, hence if the offset is not known at compile /// time, the build will fail. $(#[$attr])* // Always inline to optimize out error path of `io_addr_assert`. #[inline(always)] $vis fn $name(&self, offset: usize) -> $type_name { let addr = self.io_addr_assert::<$type_name>(offset); // SAFETY: By the type invariant `addr` is a valid address for IO operations. $call_macro!(infallible, $c_fn, self, $type_name, addr) } }; (fallible, $(#[$attr:meta])* $vis:vis $try_name:ident, $call_macro:ident($c_fn:ident) -> $type_name:ty) => { /// Read IO data from a given offset. /// /// Bound checks are performed on runtime, it fails if the offset (plus the type size) is /// out of bounds. $(#[$attr])* $vis fn $try_name(&self, offset: usize) -> Result<$type_name> { let addr = self.io_addr::<$type_name>(offset)?; // SAFETY: By the type invariant `addr` is a valid address for IO operations. $call_macro!(fallible, $c_fn, self, $type_name, addr) } }; } pub use io_define_read; /// Generates an accessor method for writing to an I/O backend. /// /// This macro reduces boilerplate by automatically generating either compile-time bounds-checked /// (infallible) or runtime bounds-checked (fallible) write methods. It abstracts the address /// calculation and bounds checking, and delegates the actual I/O write operation to a specified /// helper macro, making it generic over different I/O backends. /// /// # Parameters /// /// * `infallible` / `fallible` - Determines the bounds-checking strategy. `infallible` relies on /// `IoKnownSize` for compile-time checks and returns `()`. `fallible` performs runtime checks /// against `maxsize()` and returns a `Result`. /// * `$(#[$attr:meta])*` - Optional attributes to apply to the generated method (e.g., /// `#[cfg(CONFIG_64BIT)]` or inline directives). /// * `$vis:vis` - The visibility of the generated method (e.g., `pub`). /// * `$name:ident` / `$try_name:ident` - The name of the generated method (e.g., `write32`, /// `try_write8`). /// * `$call_macro:ident` - The backend-specific helper macro used to emit the actual I/O call /// (e.g., `call_mmio_write`). /// * `$c_fn:ident` - The backend-specific C function or identifier to be passed into the /// `$call_macro`. /// * `$type_name:ty` - The Rust type of the value being written (e.g., `u8`, `u32`). Note the use /// of `<-` before the type to denote a write operation. #[macro_export] macro_rules! io_define_write { (infallible, $(#[$attr:meta])* $vis:vis $name:ident, $call_macro:ident($c_fn:ident) <- $type_name:ty) => { /// Write IO data from a given offset known at compile time. /// /// Bound checks are performed on compile time, hence if the offset is not known at compile /// time, the build will fail. $(#[$attr])* // Always inline to optimize out error path of `io_addr_assert`. #[inline(always)] $vis fn $name(&self, value: $type_name, offset: usize) { let addr = self.io_addr_assert::<$type_name>(offset); $call_macro!(infallible, $c_fn, self, $type_name, addr, value); } }; (fallible, $(#[$attr:meta])* $vis:vis $try_name:ident, $call_macro:ident($c_fn:ident) <- $type_name:ty) => { /// Write IO data from a given offset. /// /// Bound checks are performed on runtime, it fails if the offset (plus the type size) is /// out of bounds. $(#[$attr])* $vis fn $try_name(&self, value: $type_name, offset: usize) -> Result { let addr = self.io_addr::<$type_name>(offset)?; $call_macro!(fallible, $c_fn, self, $type_name, addr, value) } }; } pub use io_define_write; /// Checks whether an access of type `U` at the given `offset` /// is valid within this region. #[inline] const fn offset_valid<U>(offset: usize, size: usize) -> bool { let type_size = core::mem::size_of::<U>(); if let Some(end) = offset.checked_add(type_size) { end <= size && offset % type_size == 0 } else { false } } /// Marker trait indicating that an I/O backend supports operations of a certain type. /// /// Different I/O backends can implement this trait to expose only the operations they support. /// /// For example, a PCI configuration space may implement `IoCapable<u8>`, `IoCapable<u16>`, /// and `IoCapable<u32>`, but not `IoCapable<u64>`, while an MMIO region on a 64-bit /// system might implement all four. pub trait IoCapable<T> {} /// Types implementing this trait (e.g. MMIO BARs or PCI config regions) /// can perform I/O operations on regions of memory. /// /// This is an abstract representation to be implemented by arbitrary I/O /// backends (e.g. MMIO, PCI config space, etc.). /// /// The [`Io`] trait provides: /// - Base address and size information /// - Helper methods for offset validation and address calculation /// - Fallible (runtime checked) accessors for different data widths /// /// Which I/O methods are available depends on which [`IoCapable<T>`] traits /// are implemented for the type. /// /// # Examples /// /// For MMIO regions, all widths (u8, u16, u32, and u64 on 64-bit systems) are typically /// supported. For PCI configuration space, u8, u16, and u32 are supported but u64 is not. pub trait Io { /// Returns the base address of this mapping. fn addr(&self) -> usize; /// Returns the maximum size of this mapping. fn maxsize(&self) -> usize; /// Returns the absolute I/O address for a given `offset`, /// performing runtime bound checks. #[inline] fn io_addr<U>(&self, offset: usize) -> Result<usize> { if !offset_valid::<U>(offset, self.maxsize()) { return Err(EINVAL); } // Probably no need to check, since the safety requirements of `Self::new` guarantee that // this can't overflow. self.addr().checked_add(offset).ok_or(EINVAL) } /// Fallible 8-bit read with runtime bounds check. #[inline(always)] fn try_read8(&self, _offset: usize) -> Result<u8> where Self: IoCapable<u8>, { build_error!("Backend does not support fallible 8-bit read") } /// Fallible 16-bit read with runtime bounds check. #[inline(always)] fn try_read16(&self, _offset: usize) -> Result<u16> where Self: IoCapable<u16>, { build_error!("Backend does not support fallible 16-bit read") } /// Fallible 32-bit read with runtime bounds check. #[inline(always)] fn try_read32(&self, _offset: usize) -> Result<u32> where Self: IoCapable<u32>, { build_error!("Backend does not support fallible 32-bit read") } /// Fallible 64-bit read with runtime bounds check. #[inline(always)] fn try_read64(&self, _offset: usize) -> Result<u64> where Self: IoCapable<u64>, { build_error!("Backend does not support fallible 64-bit read") } /// Fallible 8-bit write with runtime bounds check. #[inline(always)] fn try_write8(&self, _value: u8, _offset: usize) -> Result where Self: IoCapable<u8>, { build_error!("Backend does not support fallible 8-bit write") } /// Fallible 16-bit write with runtime bounds check. #[inline(always)] fn try_write16(&self, _value: u16, _offset: usize) -> Result where Self: IoCapable<u16>, { build_error!("Backend does not support fallible 16-bit write") } /// Fallible 32-bit write with runtime bounds check. #[inline(always)] fn try_write32(&self, _value: u32, _offset: usize) -> Result where Self: IoCapable<u32>, { build_error!("Backend does not support fallible 32-bit write") } /// Fallible 64-bit write with runtime bounds check. #[inline(always)] fn try_write64(&self, _value: u64, _offset: usize) -> Result where Self: IoCapable<u64>, { build_error!("Backend does not support fallible 64-bit write") } /// Infallible 8-bit read with compile-time bounds check. #[inline(always)] fn read8(&self, _offset: usize) -> u8 where Self: IoKnownSize + IoCapable<u8>, { build_error!("Backend does not support infallible 8-bit read") } /// Infallible 16-bit read with compile-time bounds check. #[inline(always)] fn read16(&self, _offset: usize) -> u16 where Self: IoKnownSize + IoCapable<u16>, { build_error!("Backend does not support infallible 16-bit read") } /// Infallible 32-bit read with compile-time bounds check. #[inline(always)] fn read32(&self, _offset: usize) -> u32 where Self: IoKnownSize + IoCapable<u32>, { build_error!("Backend does not support infallible 32-bit read") } /// Infallible 64-bit read with compile-time bounds check. #[inline(always)] fn read64(&self, _offset: usize) -> u64 where Self: IoKnownSize + IoCapable<u64>, { build_error!("Backend does not support infallible 64-bit read") } /// Infallible 8-bit write with compile-time bounds check. #[inline(always)] fn write8(&self, _value: u8, _offset: usize) where Self: IoKnownSize + IoCapable<u8>, { build_error!("Backend does not support infallible 8-bit write") } /// Infallible 16-bit write with compile-time bounds check. #[inline(always)] fn write16(&self, _value: u16, _offset: usize) where Self: IoKnownSize + IoCapable<u16>, { build_error!("Backend does not support infallible 16-bit write") } /// Infallible 32-bit write with compile-time bounds check. #[inline(always)] fn write32(&self, _value: u32, _offset: usize) where Self: IoKnownSize + IoCapable<u32>,