From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: rust: io: add view type
Date: Thu, 23 Apr 2026 08:25:46 +1000
Message-ID: <review-patch6-20260421-io_projection-v2-6-4c251c692ef4@garyguo.net>
In-Reply-To: <20260421-io_projection-v2-6-4c251c692ef4@garyguo.net>
References: <20260421-io_projection-v2-0-4c251c692ef4@garyguo.net> <20260421-io_projection-v2-6-4c251c692ef4@garyguo.net>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

Introduces `View<'a, IO, T>` -- the core new abstraction. A view borrows an I/O region and holds a pointer to a sub-region within it.

The invariants are well-stated:
```rust
/// - `ptr` is aligned for `T`
/// - `ptr` has same provenance as `io.as_ptr()`
/// - `ptr.byte_offset_from(io.as_ptr())` is between 0 to
///   `KnownSize::size(io.as_ptr()) - KnownSize::size(ptr)`.
```

The `io_project!` macro leverages the existing `project!` pointer projection infrastructure and wraps the result in a `View`, which is clean.

The `try_cast` method requires `FromBytes + AsBytes` bounds, which correctly ensures safe reinterpretation. It checks both size and alignment:
```rust
if size_of::<U>() > KnownSize::size(self.ptr) {
    return Err(EINVAL);
}
if self.ptr.addr() % align_of::<U>() != 0 {
    return Err(EINVAL);
}
```

One design note: `View` is `Copy`, which is appropriate since it's just a reference + pointer pair, but means it can't enforce unique access. This is fine since I/O is inherently shared and the safety contracts are on the callers.

---
Generated by Claude Code Patch Reviewer