>> >> >> Yeah, but my point being: is there a reason why the underlying list has to >> remain read-only? Is this a safety requirement or an invariant that is >> established >> by the code above? > I'm not fully sure if it's an invariant or a safety requirement, but anyone > creating a C list head on the rust side must guarantee that it is not > modified. > Since rust has no visibility on the C side, I believe it is a Rust invariant > here that the existence of CListHead assumes that the list cannot be modified > once Rust has access over it. That is up to the creator (user) of the > CListHead > to guarantee. In the DRM buddy case, once the list is allocated and accessible > from Rust, C code will not modify it while the Rust object exists. > > Does that make sense, or is there a better way to document this? > > -- > Joel Fernandes
In which case, I recommend moving this to a safety requirement when creating the list. I assume the purpose of not modifying the list on the C side is to avoid corrupting the list in Rust somehow? — Daniel
