On 10/5/2025 8:56 AM, Danilo Krummrich wrote:
>> + let ret = unsafe {
>> + bindings::pci_alloc_irq_vectors(dev.as_raw(), min_vecs,
>> max_vecs, irq_types.as_raw())
>> + };
>> +
>> + to_result(ret)?;
>> + let count = ret as u32;
>> +
>> + // SAFETY: Vectors are 0-based, so valid indices are [0, count-1].
>> + // pci_alloc_irq_vectors guarantees count >= min_vecs > 0, so count
>> - 1 is valid.
>> This is a justification why the range makes sense (which makes sense to keep
>> as
> a separate comment), but it doesn't justify the safety requirement of
> IrqVector::new().
Is the following better? Or did you have some other reasoning you want me to
mention? The safety comes from the fact that both start/end vector indices and
everything in between are valid.
// SAFETY:
// - `pci_alloc_irq_vectors` returns the number of allocated vectors on success.
// - Vectors are 0-based, so valid indices are [0, count-1].
// - `pci_alloc_irq_vectors` guarantees count >= min_vecs > 0, so both 0 and
// count - 1 are valid IRQ vector indices for device `dev`.
// - Vector indices are contiguous, so all vectors in [0, count-1] are valid.
Thanks.
