enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
40 lines
1.9 KiB
TOML
40 lines
1.9 KiB
TOML
# The Linux GPU zero-copy plumbing (plan §9 / §W6), extracted into a leaf crate so the shared
|
|
# frame vocabulary (pf-frame `FramePayload::Cuda`), the encode backends (CUDA copies/context),
|
|
# and the capture import machinery can all reach it WITHOUT the host orchestrator in between.
|
|
# Content is Linux-only; the crate compiles to an empty lib elsewhere so dependents can carry a
|
|
# plain (non-target-gated) dependency.
|
|
[package]
|
|
name = "pf-zerocopy"
|
|
version.workspace = true
|
|
edition = "2021"
|
|
# Inherit the workspace MSRV: clippy keys MSRV-gated lints off it (without this, e.g.
|
|
# `manual_is_multiple_of` fires on code the host crate compiles clean).
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host Linux zero-copy GPU plumbing: CUDA context/buffers, EGL/Vulkan dmabuf import, the isolated import worker, and dmabuf implicit-fence sync."
|
|
publish = false
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
libc = "0.2"
|
|
# `libcuda.so.1` is dlopen'd at runtime (NOT link-time) so one Linux binary runs on NVIDIA
|
|
# (zero-copy via CUDA) AND on AMD/Intel (VAAPI, no NVIDIA driver present) — see `cuda::ffi`.
|
|
libloading = "0.8"
|
|
# EGL imports the PipeWire dmabuf, CUDA maps it (`dynamic` = load the NVIDIA libEGL at runtime).
|
|
khronos-egl = { version = "6", features = ["dynamic"] }
|
|
# Vulkan bridge for LINEAR dmabufs (gamescope): VK_EXT_external_memory_dma_buf import,
|
|
# GPU-copy into an exportable allocation, export OPAQUE_FD → cuImportExternalMemory.
|
|
ash = "0.38"
|
|
# The isolated import worker's control protocol: small serde_json blobs over a Unix socket
|
|
# (SCM_RIGHTS carries the fds; pixels never cross the socket).
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
|
|
# Linux-only like the code under test: the render-node scan is exercised against a fixture tree.
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
tempfile = "3"
|
|
|
|
[lints]
|
|
workspace = true
|