atagen

monolith

public
Star0
Fork0
Watch0
98 commits1 branch0 tags0 releases1.5 MiB

Commit 35d6f20f8eb6

tarball

atagen <boss@atagen.co>2026-10-17 05:08 UTC

4 files changed+12-0
render-vk: state the Vulkan safety invariant once and mark the exceptions

Nearly every unsafe block is a Vulkan call that is sound for the same reason, and repeating it at 80 sites would bury the few that are not. Those few are raw slices over client memory, push constant bytes, and fd ownership across the external memory calls.
crates/render-vk/src/dmabuf.rs+3
@@ -253,6 +253,8 @@ pub(crate) fn import(
253253 let memory = match unsafe { d.allocate_memory(&alloc, None) } {
254254 Ok(m) => m,
255255 Err(e) => {
256+ // SAFETY: a failed import leaves the fd with us, per
257+ // VK_KHR_external_memory_fd.
256258 drop(unsafe { OwnedFd::from_raw_fd(raw) });
257259 destroy();
258260 return Err(e.into());
@@ -332,6 +334,7 @@ pub(crate) fn export(
332334 .handle_type(vk::ExternalMemoryHandleTypeFlags::DMA_BUF_EXT),
333335 )?
334336 };
337+ // SAFETY: vkGetMemoryFdKHR hands the caller a new fd to own.
335338 let fd = unsafe { OwnedFd::from_raw_fd(raw) };
336339 let mut props = vk::ImageDrmFormatModifierPropertiesEXT::default();
337340 unsafe {
crates/render-vk/src/lib.rs+6
@@ -2,6 +2,12 @@
22 //!
33 //! A frame records its draws as a list of operations and submits them in one
44 //! command buffer when it finishes, returning a fence as its sync point.
5+//!
6+//! Most `unsafe` here is a plain Vulkan call. Those rely on one invariant,
7+//! stated once instead of at each call. Every handle is created from the
8+//! `Shared` device that an `Arc` keeps alive past it, it is destroyed only by
9+//! its owner's `Drop`, and command buffers are recorded on the thread that
10+//! owns the renderer. `// SAFETY:` marks the sites that need more than that.
511
612 mod barrier;
713 mod device;
crates/render-vk/src/pipeline.rs+1
@@ -19,6 +19,7 @@ pub(crate) struct Push {
1919
2020 impl Push {
2121 pub fn bytes(&self) -> &[u8] {
22+ // SAFETY: `Push` is `repr(C)` and all f32, so it has no padding bytes.
2223 unsafe { std::slice::from_raw_parts((self as *const Self).cast::<u8>(), size_of::<Self>()) }
2324 }
2425 }
crates/render-vk/src/renderer/shm.rs+2
@@ -80,6 +80,8 @@ impl ImportMemWl for VulkanRenderer {
8080 } else if let Some(region) = region {
8181 let x = region.loc.x as usize * BYTES_PER_PIXEL;
8282 let rw = region.size.w as usize * BYTES_PER_PIXEL;
83+ // SAFETY: the bounds check above keeps every row of the
84+ // clipped region inside the `len` bytes smithay mapped.
8385 self.upload_with(&texture.0, region, |y| unsafe {
8486 std::slice::from_raw_parts(ptr.add(offset + y * stride + x), rw)
8587 })?;