// rust/kernel/net/phy/reg.rs（节选）
impl Register for C22 {
    fn read(&self, dev: &mut Device) -> Result<u16> {
        let phydev = dev.0.get();
        // SAFETY: `phydev` is pointing to a valid object by the type invariant of `Device`.
        // So it's just an FFI call, open code of `phy_read()` with a valid `phy_device` pointer
        let ret = unsafe {
            bindings::mdiobus_read((*phydev).mdio.bus, (*phydev).mdio.addr, self.0.into())
        };
        to_result(ret)?;
        Ok(ret as u16)
    }

    fn write(&self, dev: &mut Device, val: u16) -> Result {
        let phydev = dev.0.get();
        // SAFETY: ... (同上)
        to_result(unsafe {
            bindings::mdiobus_write((*phydev).mdio.bus, (*phydev).mdio.addr, self.0.into(), val)
        })
    }
}

// rust/kernel/fs/file.rs（节选）
pub fn flags(&self) -> u32 {
    // This `read_volatile` is intended to correspond to a READ_ONCE call.
    //
    // SAFETY: The file is valid because the shared reference guarantees a nonzero refcount.
    //
    // FIXME(read_once): Replace with `read_once` when available on the Rust side.
    unsafe { core::ptr::addr_of!((*self.as_ptr()).f_flags).read_volatile() }
}

// rust/kernel/dma.rs（节选）
pub unsafe fn field_read<F: FromBytes>(&self, field: *const F) -> F {
    // SAFETY:
    // - By the safety requirements field is valid.
    // - Using read_volatile() here is not sound as per the usual rules, the usage here is
    // a special exception with the following notes in place. When dealing with a potential
    // race from a hardware or code outside kernel (e.g. user-space program), we need that
    // read on a valid memory is not UB. Currently read_volatile() is used for this, and the
    // rationale behind is that it should generate the same code as READ_ONCE() which the
    // kernel already relies on to avoid UB on data races. Note that the usage of
    // read_volatile() is limited to this particular case, it cannot be used to prevent
    // the UB caused by racing between two kernel functions nor do they provide atomicity.
    unsafe { field.read_volatile() }
}

pub unsafe fn field_write<F: AsBytes>(&self, field: *mut F, val: F) {
    // SAFETY: ... (与 READ_ONCE 对应地，此处对应 WRITE_ONCE)
    unsafe { field.write_volatile(val) }
}

// rust/kernel/io/mem.rs（节选）
fn ioremap(resource: &Resource) -> Result<Self> {
    // ...
    let addr = if resource.flags().contains(io::resource::Flags::IORESOURCE_MEM_NONPOSTED) {
        // SAFETY:
        // - `res_start` and `size` are read from a presumably valid `struct resource`.
        // - `size` is known not to be zero at this point.
        unsafe { bindings::ioremap_np(res_start, size) }
    } else {
        unsafe { bindings::ioremap(res_start, size) }
    };
    // ...
}

impl<const SIZE: usize> Drop for IoMem<SIZE> {
    fn drop(&mut self) {
        // SAFETY: Safe as by the invariant of `Io`.
        unsafe { bindings::iounmap(self.io.addr() as *mut c_void) }
    }
}