wip

Author: jimblandy

Cargo.lock

@@ -24,6 +24,7 @@ members = [
     "wgpu-types",
     "wgpu",
     "xtask",
+    "wgpu-remote",
 ]
 exclude = []
 default-members = [

Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "wgpu-remote"
+edition.workspace = true
+rust-version.workspace = true
+keywords.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+version.workspace = true
+authors.workspace = true
+
+[features]
+default = ["serde"]
+
+[[bin]]
+name = "parse-webidl"
+path = "webidl/main.rs"
+
+[dependencies]
+hashbrown = { workspace = true }
+weedle = "0.13"
+
+[dependencies.serde]
+optional = true
+version = "1.0"
+features = ["derive"]
+
+[lints]
+workspace = true

wgpu-remote/Cargo.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "nightly"
+components = ["rustfmt", "clippy", "miri"]

wgpu-remote/rust-toolchain.toml

@@ -0,0 +1,128 @@
+//! Definition of the [`Block`] type.
+
+use std::mem::ManuallyDrop;
+
+/// A block of bytes, with a callback to free it.
+///
+/// A `Block` represents a slice of bytes managed by an external allocator. The
+/// `Block` also keeps a callback that will return the bytes to that external
+/// allocator when the `Block` is dropped.
+///
+/// This crate uses `Block`s to track regions of shared memory obtained from a
+/// [`Sender`] implementation, subdividing that into smaller allocations for
+/// individual `wgpu` buffers using [`Pool`].
+///
+/// [`Sender`]: crate::transport::Sender
+/// [`Pool`]: crate::Pool
+//
+// If `allocator_api` were stabilized, then this could just be `Box<[u8]>`.
+pub struct Block {
+    /// A block of bytes, aligned on an eight-byte boundary.
+    // TODO: use NonNull?
+    bytes: *mut [u8],
+
+    /// The function to which `bytes` should be passed when this `Block` is dropped.
+    // TODO: make the allocator a type parameter to `Block`.
+    free: ManuallyDrop<Box<dyn FnOnce(*mut [u8]) + Send + 'static>>,
+}
+
+/// Safety: Raw pointers like `Block::bytes` are not `Send` by
+/// default, but we only expose `bytes` when given a `&mut self`, so
+/// it should be fine.
+unsafe impl Send for Block {}
+unsafe impl Sync for Block {}
+
+impl Block {
+    /// Create a [`Block`] tracking `bytes`.
+    ///
+    /// When the returned `Block` is dropped, it will call `free`,
+    /// passing it the pointer to the block's bytes.
+    ///
+    /// # Safety
+    ///
+    /// The given `bytes` pointer must be valid for reading and writing the
+    /// entire slice. It must remain so until it is passed to `free` by the new
+    /// `Block`'s [`Drop`] implementation.
+    ///
+    /// The given `bytes` must not be accessed through any other pointer until
+    /// after the new `Block` is dropped.
+    pub unsafe fn new(bytes: *mut [u8], free: impl FnOnce(*mut [u8]) + Send + 'static) -> Block {
+        Self {
+            bytes,
+            free: ManuallyDrop::new(Box::new(free)),
+        }
+    }
+
+    /// Return the length in bytes of the slice this `Block` manages.
+    #[inline]
+    #[expect(clippy::len_without_is_empty)]
+    pub fn len(&self) -> usize {
+        self.bytes.len()
+    }
+
+    /// Return a pointer to the memory this `Block` manages.
+    ///
+    /// The returned memory remains allocated until this `Block` is dropped.
+    #[inline]
+    pub fn bytes_mut(&self) -> *mut [u8] {
+        self.bytes
+    }
+}
+
+impl Drop for Block {
+    fn drop(&mut self) {
+        // Safety: We are in the `Drop` method, so `self.free` will
+        // never be used after we return, and this method doesn't use
+        // it either.
+        let free = unsafe { ManuallyDrop::take(&mut self.free) };
+        (free)(self.bytes);
+    }
+}
+
+#[cfg(test)]
+impl Block {
+    pub fn from_vec(vec: Vec<u8>) -> Block {
+        let slice = vec.into_boxed_slice();
+        let slice_ptr = Box::into_raw(slice);
+        let free = |slice_ptr| {
+            // Safety: `slice_ptr` was obtained from a `Vec` in the first place.
+            drop(Vec::from(unsafe { Box::from_raw(slice_ptr) }));
+        };
+
+        // Safety: `free` is designed to receive a `*mut [u8]` obtained from a
+        // `Vec<u8>`.
+        unsafe { Self::new(slice_ptr, free) }
+    }
+}
+
+/// `Block` implements `Send`.
+#[test]
+fn block_is_send() {
+    fn require_send<T: Send>(_t: T) {}
+    let block = unsafe { Block::new(&mut [], |_bytes| ()) };
+    require_send(block);
+}
+
+/// When a `Block` is dropped, the callback gets invoked.
+#[test]
+fn drop_called() {
+    use std::sync::Arc;
+    fn require_send<T: Send>(_t: T) {}
+
+    let counter = Arc::new(());
+
+    // Brute force the `Arc<()>` into a `*mut [u8]`.
+    let bytes = Arc::into_raw(Arc::clone(&counter)) as *mut ();
+    let bytes = std::ptr::slice_from_raw_parts_mut(bytes as *mut u8, 0);
+
+    let free_bytes = move |bytes| {
+        // Brute force the `*mut [u8]` back into an `Arc<()>`.
+        let bytes = bytes as *mut u8 as *mut ();
+        let clone_of_counter = unsafe { Arc::from_raw(bytes) };
+        drop(clone_of_counter);
+    };
+    let block = unsafe { Block::new(bytes, free_bytes) };
+    assert_eq!(Arc::strong_count(&counter), 2);
+    require_send(block);
+    assert_eq!(Arc::strong_count(&counter), 1);
+}

wgpu-remote/src/block.rs

@@ -0,0 +1,37 @@
+/*! Process isolation for wgpu.
+
+This crate implements a backend for `wgpu` that forwards operations
+across an inter-process communication channel, so that the actual GPU
+access takes place in a different process from the code driving the
+`wgpu` API. You can use this to isolate GPU access to improve security
+or robustness, or perhaps, in the other direction, to isolate the code
+using wgpu.
+
+Code using the `wgpu` API with this crate as a backend is considered
+to be the "client", and the code responding to its requests and
+driving the GPU is considered the "server".
+
+The client and server communicate via implementations of the
+[`transport`] module's [`Sender`] and [`Receiver`] traits. These are
+meant to be easily implemented on most platforms, or integrated with
+an application's existing IPC mechanisms. They provide a low level
+interface, with methods for creating blocks of shared memory, and
+exchanging messages held in that memory. This crate also provides a
+few basic implementations of `Sender` and `Receiver`; see the
+[`transport`] module documentation for details.
+
+This crate requires the client and server to be able to share memory.
+It is probably not suitable for allowing the two parties to run on
+entirely different machines and communicate over a network.
+
+[`Sender`]: transport::Sender
+[`Receiver`]: transport::Receiver
+
+*/
+
+mod block;
+mod pool;
+pub mod transport;
+
+pub use block::Block;
+pub use pool::Pool;