Re: [PATCH v2 06/11] rust: io: add view type

[Gary Guo]

On Tue Apr 28, 2026 at 11:53 AM BST, Andreas Hindborg wrote:
> Gary Guo <gary@xxxxxxxxxxx> writes:
>
>> The view may be created statically via I/O projection using `io_project!()`
>> macro to perform compile-time checks, or created by type-casting an
>> existing view type with `try_cast()` function, where the size and alignment
>> checks are performed at runtime.
>>
>> Reviewed-by: Andreas Hindborg <a.hindborg@xxxxxxxxxx>
>> Signed-off-by: Gary Guo <gary@xxxxxxxxxxx>
>> ---
>>  rust/kernel/io.rs | 147 +++++++++++++++++++++++++++++++++++++++++++++++++++++-
>>  1 file changed, 146 insertions(+), 1 deletion(-)
>>
>> diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
>> index a13be8c5fd2d..869071d47a13 100644
>> --- a/rust/kernel/io.rs
>> +++ b/rust/kernel/io.rs
>> @@ -7,7 +7,11 @@
>>  use crate::{
>>      bindings,
>>      prelude::*,
>> -    ptr::KnownSize, //
>> +    ptr::KnownSize,
>> +    transmute::{
>> +        AsBytes,
>> +        FromBytes, //
>> +    }, //
>>  };
>>  
>>  pub mod mem;
>> @@ -297,6 +301,13 @@ pub trait Io {
>>      /// Type of this I/O region. For untyped I/O regions, [`Region`] type can be used.
>>      type Type: ?Sized + KnownSize;
>>  
>> +    /// Get a [`View`] covering the entire region.
>> +    #[inline]
>> +    fn as_view(&self) -> View<'_, Self, Self::Type> {
>> +        // SAFETY: This is an empty projection, so it trivially satisfies the invariant.
>> +        unsafe { View::new_unchecked(self, self.as_ptr()) }
>> +    }
>> +
>
> Sorry, I missed your reply on v1. This is better. Should it be "identity
> projection" rather than "empty projection", or is "emtpy projection" the
> correct term?

I thought about this but settled on empty as Benno's field projection design
document also refers to this case as "projection being empty".

We also have an equivalent case with our macro:

    ptr::project!(ptr, )

where the "proj" part of the macro is visually empty.

I suppose "identity" makes sense from a mathematical POV.

>
> However, I don't see why we cannot put:
>
> SAFETY:
>  - By existence of `&self`, `self.as_ptr()` is aligned.
>  - `self.as_ptr()` has same provenance as `self.as_ptr()`.
>  - `self.byte_offset_from(self.as_ptr())` is 0.

I think it's too verbose and harder to reason about then the simpler concepts of
projection. If this is normal memory we would just say "self.as_ptr()" is valid,
and I don't want to make this overly verbose just because it's I/O memory and we
don't have a term to describe "valid".

Best,
Gary