enricobuehler
f373dffb5e
The safety half of the rust-safety programme's §8.4: `std::env::set_var`/`remove_var` are
`unsafe fn` in edition 2024, converting the class of bug the programme found the hard way
(the 972af299 environ data race lived in a file with ZERO occurrences of the word
`unsafe`) from invisible to counted and compiler-enforced.
Manifests: [workspace.package] edition 2021→2024, rust-version 1.82→1.85 (the pinned
toolchain is 1.96.0, so no toolchain bump — only the declared floor rises); the 13 crates
pinning `edition = "2021"` literally now inherit it (Trap 1: the root bump alone reaches
only `edition.workspace = true` crates and would have left pf-encode/pf-capture/pf-inject
et al. on 2021 while reading as complete); pf-driver-proto's stale rust-version 1.82 pin
now inherits; pf-vkhdr-layer (a separate workspace, inherits nothing) bumped to 2024. The
four vendored crates (fec-rs, cros-codecs, usbip-sim, the patched ndk) stay on 2021
deliberately — upstream code stays pristine. The excluded usbip-poc standalone PoC is
untouched.
Mechanical, done textually across ALL cfg branches so no platform's half is left behind
(Trap 3 — 44% of the host's unsafe is Windows-only and a one-platform `cargo fix` misses
it): 148 `#[no_mangle]` → `#[unsafe(no_mangle)]` (83 in abi.rs); 12 bare extern blocks →
`unsafe extern`; `gen` is a reserved keyword, so pf-vdisplay's generation stamps
(registry.rs, windows/manager.rs) and the WinUI shell's animation counters rename
gen → generation (internal identifiers only, no serde/wire surface); two
match-ergonomics patterns take the compiler's suggested reference form.
env mutation: every `set_var`/`remove_var` site (20 files) now sits in an `unsafe` block
whose SAFETY comment states the real serialization argument (pf-vdisplay's ENV_LOCK,
CONFIG_DIR_TEST_LOCK, ART_ROOTS_LOCK, vkdecode's gpu_lock, the `--test-threads=1`
contracts of the hardware spikes, or single-threaded startup). Two genuine hazards
surfaced en route — exactly the WP3b-class finds this migration exists to make visible —
and are fixed here:
- windows/service.rs spawned the network-profile warner thread BEFORE `load_host_env()`,
so a child-spawning thread (child spawn snapshots the env block) was live while
`set_var` ran in a loop; the load now precedes the spawn.
- pf-console-ui's `fake_home()` re-set HOME outside its OnceLock on EVERY call, so two
parallel tests could race the write; the set now happens exactly once inside
`get_or_init`.
cbindgen (Trap 2): 0.29.4 parses `#[unsafe(no_mangle)]` — verified empirically; the
header regenerates byte-identical. The ci.yml drift check could never catch "failed to
regenerate" (build.rs demotes a cbindgen failure to a warning and writes nothing, leaving
the checked-in header untouched and the diff clean), so the step now first asserts the
"punktfunk-core: wrote" line and the absence of "cbindgen failed" (sh -e safe: no `!`
pipeline, no tee-masked exit).
rustfmt: style_edition pinned to 2021 at the root — edition 2024 would otherwise flip the
style edition and reformat ~370 untouched files inside this same commit, burying the
migration diff. The drivers workspace pins its already-current 2024 style. Adopting the
2024 style tree-wide is its own future one-line-plus-reformat commit.
Census: the primary metric moves UP BY DESIGN — 2435 → 2453 operations, unsafe blocks
1534 → 1577, and env_set_var is now a counted category (45 ops). The newly counted env
sites are a truer number, not a regression; baseline snapshot saved as punktfunk-planning
design/rust-safety-census-baseline-2026-08-12-edition-2024.txt. Gate C's env ratchet is
now compiler-enforced (the hygiene-script header says so); the two shrunk file counts
(nvenc_cuda 49→2 via the test helpers, shell/tests 2→1) are lowered in the same commit
per the gate's own rule.
Drop order (the semantic change most likely to bite this codebase): the migration lint
`-W tail-expr-drop-order` reports zero findings on the macOS-visible halves of
pf-encode / pf-zerocopy / pf-capture / pf-frame; the Linux and Windows halves run the
same lint on the gate boxes. The four #[ignore]d alloc/drop-cycle tests on the hardware
boxes remain owed, as before this change.
110 lines
5.6 KiB
TOML
110 lines
5.6 KiB
TOML
# Hardware/software video encode (plan §7 / §W6): the per-vendor backends (NVENC, VAAPI, AMF, QSV,
|
|
# Vulkan-Video, PyroWave, openh264) behind one `Encoder` trait + `open_video` selector, extracted
|
|
# from the host so it depends on the shared frame vocabulary (pf-frame) rather than living inside
|
|
# the orchestrator. Speaks pf-frame (CapturedFrame/PixelFormat/dxgi identity) and pf-zerocopy
|
|
# (CUDA), never pf-capture — the capture→encode edge is one-way (plan §2.4).
|
|
[package]
|
|
name = "pf-encode"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host video encode: NVENC/VAAPI/AMF/QSV/Vulkan-Video/PyroWave/openh264 backends behind one Encoder trait."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
pf-frame = { path = "../pf-frame" }
|
|
pf-gpu = { path = "../pf-gpu" }
|
|
pf-host-config = { path = "../pf-host-config" }
|
|
pf-zerocopy = { path = "../pf-zerocopy" }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
|
|
[dev-dependencies]
|
|
# A test writer for the NVENC backend's unit tests (`with_test_writer().try_init()`).
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
[target.'cfg(target_os = "windows")'.dev-dependencies]
|
|
# The QSV live e2e drives the REAL HdrP010Converter output (an RTV-written, ring-profile P010
|
|
# texture) into the encoder — the one seam the CPU-upload tests can't reach.
|
|
pf-capture = { path = "../pf-capture" }
|
|
|
|
[target.'cfg(any(target_os = "linux", target_os = "windows"))'.dependencies]
|
|
# Software H.264 (openh264, BSD-2) — the GPU-less encode path on both platforms.
|
|
openh264 = "0.9"
|
|
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
# The encode-worker protocol tests measure what an AU costs as a serde_json body — the reason the
|
|
# access units ride a memfd instead (enc/linux/worker.rs).
|
|
serde_json = "1"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# The `punktfunk-encode-worker` protocol (enc/linux/worker.rs). The framing is pf-zerocopy's
|
|
# `ipc`, which is generic over the serde body; the message enums live here and version separately.
|
|
serde = { version = "1", features = ["derive"] }
|
|
# libavcodec (NVENC libav + VAAPI backends). `ffmpeg-sys-next` auto-detects the FFmpeg version, so
|
|
# this pin tracks the crate's own major (which shadows FFmpeg's): 9 = FFmpeg 9 (libavcodec 63,
|
|
# libavutil 61). Arch shipped FFmpeg 9 on 2026-08-08 and every soname moved with it; the packaged
|
|
# host must be BUILT against the FFmpeg it will run on, and packaging/arch/PKGBUILD now derives a
|
|
# soname dep from that link so pacman can no longer walk an install across the break.
|
|
ffmpeg-next = "9"
|
|
libc = "0.2"
|
|
# Vulkan bindings for the raw Vulkan-Video encode + PyroWave compute backends (feature-gated below;
|
|
# the dep stays unconditional to mirror the host's Linux target — unused-but-declared is harmless).
|
|
ash = "0.38"
|
|
# `libnvidia-encode.so.1` is dlopen'd at runtime for the direct-SDK NVENC/CUDA backend.
|
|
libloading = "0.8"
|
|
# Direct-SDK NVENC (raw `sys::nvEncodeAPI` types; entry points resolved at runtime). `ci-check` =
|
|
# vendored bindings, no CUDA toolkit at build.
|
|
nvidia-video-codec-sdk = { version = "0.4", features = ["ci-check"], optional = true }
|
|
# PyroWave (opt-in wired-LAN wavelet codec) — vendored codec + bindgen'd C API, only under `pyrowave`.
|
|
pyrowave-sys = { path = "../pyrowave-sys", optional = true }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# NVENC (direct SDK, D3D11 input) + the shared D3D11/DXGI vocabulary via pf-frame.
|
|
nvidia-video-codec-sdk = { version = "0.4", features = ["ci-check"], optional = true }
|
|
# AMD (AMF) + Intel (QSV) hardware encode via libavcodec (behind `amf-qsv`; link-imports FFmpeg).
|
|
ffmpeg-next = { version = "9", optional = true }
|
|
# `libnvidia-encode`/`nvEncodeAPI64.dll` resolved at runtime; the NVENC status→cause table dlopen.
|
|
libloading = "0.8"
|
|
# Native Intel QSV (VPL): vendored static MIT dispatcher + bindgen'd C API, only under `qsv`.
|
|
libvpl-sys = { path = "../libvpl-sys", optional = true }
|
|
# PyroWave (opt-in wired-LAN wavelet codec) — vendored codec + bindgen'd C API, only under
|
|
# `pyrowave`. The Windows backend is the NV12 zero-copy D3D11→Vulkan encoder; same crate as Linux.
|
|
pyrowave-sys = { path = "../pyrowave-sys", optional = true }
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Graphics_Direct3D",
|
|
"Win32_Graphics_Direct3D11",
|
|
"Win32_Graphics_Dxgi",
|
|
"Win32_Graphics_Dxgi_Common",
|
|
# SECURITY_ATTRIBUTES — the PyroWave backend's IDXGIResource1::CreateSharedHandle signature.
|
|
"Win32_Security",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_LibraryLoader",
|
|
"Win32_System_Threading",
|
|
# D3DKMTSetProcessSchedulingPriorityClass — raise the host's WDDM GPU scheduling priority
|
|
# above a running game so PyroWave's compute-shader encode isn't starved (enc/windows/pyrowave.rs).
|
|
"Wdk_Graphics_Direct3D",
|
|
] }
|
|
|
|
[features]
|
|
default = []
|
|
# NVENC hardware encode (Linux CUDA + Windows D3D11); entry points resolved at runtime.
|
|
nvenc = ["dep:nvidia-video-codec-sdk"]
|
|
# AMD (AMF) + Intel (QSV) hardware encode on Windows via libavcodec.
|
|
amf-qsv = ["dep:ffmpeg-next"]
|
|
# Raw Vulkan-Video HEVC/AV1 encode on Linux (reuses the `ash` bindings; no new dep).
|
|
vulkan-encode = []
|
|
# PyroWave — the opt-in wired-LAN intra-only wavelet codec (Linux encode backend).
|
|
pyrowave = ["dep:pyrowave-sys"]
|
|
# Native Intel QSV via the statically linked VPL dispatcher (Windows; runtime GPU
|
|
# libs come from the Intel driver store). Supersedes the ffmpeg `amf-qsv` QSV path
|
|
# (design/native-qsv-encoder.md). ⚠ Like `nvenc`: hand builds need this feature or
|
|
# Intel boxes fall through to the ffmpeg path / software.
|
|
qsv = ["dep:libvpl-sys"]
|
|
|
|
[lints]
|
|
workspace = true
|