enricobuehler
f373dffb5e
The safety half of the rust-safety programme's §8.4: `std::env::set_var`/`remove_var` are
`unsafe fn` in edition 2024, converting the class of bug the programme found the hard way
(the 972af299 environ data race lived in a file with ZERO occurrences of the word
`unsafe`) from invisible to counted and compiler-enforced.
Manifests: [workspace.package] edition 2021→2024, rust-version 1.82→1.85 (the pinned
toolchain is 1.96.0, so no toolchain bump — only the declared floor rises); the 13 crates
pinning `edition = "2021"` literally now inherit it (Trap 1: the root bump alone reaches
only `edition.workspace = true` crates and would have left pf-encode/pf-capture/pf-inject
et al. on 2021 while reading as complete); pf-driver-proto's stale rust-version 1.82 pin
now inherits; pf-vkhdr-layer (a separate workspace, inherits nothing) bumped to 2024. The
four vendored crates (fec-rs, cros-codecs, usbip-sim, the patched ndk) stay on 2021
deliberately — upstream code stays pristine. The excluded usbip-poc standalone PoC is
untouched.
Mechanical, done textually across ALL cfg branches so no platform's half is left behind
(Trap 3 — 44% of the host's unsafe is Windows-only and a one-platform `cargo fix` misses
it): 148 `#[no_mangle]` → `#[unsafe(no_mangle)]` (83 in abi.rs); 12 bare extern blocks →
`unsafe extern`; `gen` is a reserved keyword, so pf-vdisplay's generation stamps
(registry.rs, windows/manager.rs) and the WinUI shell's animation counters rename
gen → generation (internal identifiers only, no serde/wire surface); two
match-ergonomics patterns take the compiler's suggested reference form.
env mutation: every `set_var`/`remove_var` site (20 files) now sits in an `unsafe` block
whose SAFETY comment states the real serialization argument (pf-vdisplay's ENV_LOCK,
CONFIG_DIR_TEST_LOCK, ART_ROOTS_LOCK, vkdecode's gpu_lock, the `--test-threads=1`
contracts of the hardware spikes, or single-threaded startup). Two genuine hazards
surfaced en route — exactly the WP3b-class finds this migration exists to make visible —
and are fixed here:
- windows/service.rs spawned the network-profile warner thread BEFORE `load_host_env()`,
so a child-spawning thread (child spawn snapshots the env block) was live while
`set_var` ran in a loop; the load now precedes the spawn.
- pf-console-ui's `fake_home()` re-set HOME outside its OnceLock on EVERY call, so two
parallel tests could race the write; the set now happens exactly once inside
`get_or_init`.
cbindgen (Trap 2): 0.29.4 parses `#[unsafe(no_mangle)]` — verified empirically; the
header regenerates byte-identical. The ci.yml drift check could never catch "failed to
regenerate" (build.rs demotes a cbindgen failure to a warning and writes nothing, leaving
the checked-in header untouched and the diff clean), so the step now first asserts the
"punktfunk-core: wrote" line and the absence of "cbindgen failed" (sh -e safe: no `!`
pipeline, no tee-masked exit).
rustfmt: style_edition pinned to 2021 at the root — edition 2024 would otherwise flip the
style edition and reformat ~370 untouched files inside this same commit, burying the
migration diff. The drivers workspace pins its already-current 2024 style. Adopting the
2024 style tree-wide is its own future one-line-plus-reformat commit.
Census: the primary metric moves UP BY DESIGN — 2435 → 2453 operations, unsafe blocks
1534 → 1577, and env_set_var is now a counted category (45 ops). The newly counted env
sites are a truer number, not a regression; baseline snapshot saved as punktfunk-planning
design/rust-safety-census-baseline-2026-08-12-edition-2024.txt. Gate C's env ratchet is
now compiler-enforced (the hygiene-script header says so); the two shrunk file counts
(nvenc_cuda 49→2 via the test helpers, shell/tests 2→1) are lowered in the same commit
per the gate's own rule.
Drop order (the semantic change most likely to bite this codebase): the migration lint
`-W tail-expr-drop-order` reports zero findings on the macOS-visible halves of
pf-encode / pf-zerocopy / pf-capture / pf-frame; the Linux and Windows halves run the
same lint on the gate boxes. The four #[ignore]d alloc/drop-cycle tests on the hardware
boxes remain owed, as before this change.
96 lines
5.1 KiB
TOML
96 lines
5.1 KiB
TOML
# Virtual-display orchestration (plan §W6): the on-demand client-sized headless output — per-compositor
|
|
# Linux backends (KWin zkde-screencast, wlroots swaymsg, Mutter RemoteDesktop, Hyprland) and the
|
|
# Windows IddCx/pf-vdisplay driver backend — behind one VirtualDisplay trait, plus the mode-conflict
|
|
# admission registry and the DDC/CI panel control. Extracted into a subsystem crate; depends on the
|
|
# shared leaves (pf-frame's DXGI identity, pf-win-display's CCD helpers, pf-gpu, pf-paths) + pf-encode
|
|
# (the NVENC session-budget admission gate), never on capture/inject or the orchestrator (the display
|
|
# lifecycle events invert to a host-registered sink).
|
|
[package]
|
|
name = "pf-vdisplay"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host virtual-display orchestration: per-compositor Linux backends + the Windows IddCx driver backend behind one VirtualDisplay trait."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
pf-host-config = { path = "../pf-host-config" }
|
|
pf-paths = { path = "../pf-paths" }
|
|
pf-win-display = { path = "../pf-win-display" }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
# The platform-neutral policy/identity/custom-preset state is serde-serialized (persisted + the mgmt
|
|
# API), and the policy/preset types derive utoipa `ToSchema` for the OpenAPI document.
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
utoipa = { version = "5", features = ["axum_extras"] }
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
|
|
[dev-dependencies]
|
|
# The `#[ignore]`d on-glass cases drive the manager/backend through code paths whose only account of
|
|
# what they chose is `tracing`. A bare test harness installs no subscriber, so those runs were blind:
|
|
# `live_a_failed_first_isolate_is_recovered_by_adopting_the_next` could see the panel stay dark but
|
|
# not whether the adoption arm fired, or whether the dark-desk backstop ran and failed. Dev-only, so
|
|
# the shipped host's dependency closure through this crate is unchanged.
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
|
|
# `proc`'s process-group tree guard is Unix-wide, not Linux-only: the module is compiled on every
|
|
# platform and its tests run on whatever the developer is sitting at (macOS, here).
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = "0.2"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
# The Mutter backend drives D-Bus RemoteDesktop + ScreenCast.RecordVirtual via ashpd on a tokio
|
|
# runtime; the gamescope restore worker + portal handshakes use tokio too.
|
|
ashpd = { version = "0.13", features = ["screencast", "remote_desktop"] }
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "net", "time"] }
|
|
futures-util = "0.3"
|
|
# KWin virtual-output creation via the privileged `zkde_screencast_unstable_v1` protocol (vendored in
|
|
# `protocols/`); the generated interface tables reference `wayland-backend`.
|
|
wayland-client = "0.31"
|
|
wayland-scanner = "0.31"
|
|
wayland-backend = "0.3"
|
|
# wayland-scanner emits `bitflags::bitflags!` for the KDE output-device protocol's bitfield enums
|
|
# (kde-output-device-v2 `capability`/`flags`); needs the crate in scope (kwin_output_mgmt.rs).
|
|
bitflags = "2"
|
|
# The gamescope bare-spawn splash client (gamescope/splash.rs): pure-Rust X11 core protocol (the
|
|
# same no-libxcb-link stance as pf-capture's XFixes cursor source), no extension features needed.
|
|
x11rb = { version = "0.13", default-features = false }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# Windows-only, all three, and gated here rather than unconditionally so the LINUX build does not
|
|
# drag their closures in for nothing: `pf-frame` for the DXGI capture identity + the CTA-861.3 HDR
|
|
# luminance fields, `pf-gpu` for the render-adapter LUID, and `pf-encode` for the admission gate's
|
|
# NVENC session budget (`can_open_another_session`, admission.rs, itself `#[cfg(windows)]`). Every
|
|
# use site of all three is Windows-gated — verified by grep — and between them they pull FFmpeg,
|
|
# ash and openh264, none of which a Linux host reaches through this crate.
|
|
pf-frame = { path = "../pf-frame" }
|
|
pf-gpu = { path = "../pf-gpu" }
|
|
pf-encode = { path = "../pf-encode" }
|
|
# The host<->driver wire contract for the pf-vdisplay IddCx backend (control IOCTLs + Pod structs).
|
|
pf-driver-proto = { path = "../pf-driver-proto" }
|
|
bytemuck = { version = "1.19", features = ["derive"] }
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
# The single-instance mutex is created with an explicit SDDL DACL and its owner is checked, so
|
|
# a lower-privileged process (the LocalService plugin runner) can neither open it nor squat the
|
|
# name unnoticed — see manager/instance.rs (security-review 2026-08-05 L-16).
|
|
"Win32_Security",
|
|
"Win32_Security_Authorization",
|
|
"Win32_Devices_DeviceAndDriverInstallation",
|
|
"Win32_Devices_Display",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_IO",
|
|
# `proc`'s budget ends the helper's whole process TREE: every Windows helper is reached through
|
|
# a shell, so the process that hangs is a grandchild `Child::kill` cannot reach.
|
|
"Win32_System_JobObjects",
|
|
"Win32_System_Threading",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|