rav1d_safe/
lib.rs

1#![allow(non_upper_case_globals)]
2#![cfg_attr(target_arch = "arm", feature(stdarch_arm_feature_detection))]
3#![cfg_attr(
4    any(target_arch = "riscv32", target_arch = "riscv64"),
5    feature(stdarch_riscv_feature_detection)
6)]
7// Crate-wide forbid(unsafe_code) when neither `asm` nor `c-ffi` is enabled.
8// All unsafe must live in separate crates (rav1d-disjoint-mut, rav1d-align, etc.)
9// or be gated behind cfg(feature = "asm") / cfg(feature = "c-ffi").
10// forbid cannot be overridden by #[allow] — any unsafe in the default build is a hard error.
11#![cfg_attr(
12    not(any(feature = "asm", feature = "c-ffi", feature = "unchecked")),
13    forbid(unsafe_code)
14)]
15#![cfg_attr(any(feature = "asm", feature = "c-ffi"), deny(unsafe_op_in_unsafe_fn))]
16#![allow(clippy::all)]
17#![cfg_attr(
18    any(feature = "asm", feature = "c-ffi"),
19    deny(clippy::undocumented_unsafe_blocks)
20)]
21#![cfg_attr(
22    any(feature = "asm", feature = "c-ffi"),
23    deny(clippy::missing_safety_doc)
24)]
25
26#[cfg(not(any(feature = "bitdepth_8", feature = "bitdepth_16")))]
27compile_error!(
28    "No bitdepths enabled. Enable one or more of the following features: `bitdepth_8`, `bitdepth_16`"
29);
30
31pub mod include {
32    pub mod common {
33        pub(crate) mod attributes;
34        pub(crate) mod bitdepth;
35        pub(crate) mod dump;
36        pub(crate) mod intops;
37        pub(crate) mod validate;
38    } // mod common
39    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
40    pub mod dav1d {
41        pub mod common;
42        pub mod data;
43        pub mod dav1d;
44        pub mod headers;
45        pub mod picture;
46    } // mod dav1d
47} // mod include
48pub mod src {
49    // === Module Safety Annotations ===
50    // - Modules with zero unsafe use forbid(unsafe_code) internally
51    // - Modules with isolated unsafe items use item-level #[allow(unsafe_code)]
52    // - Modules that need unsafe only for c-ffi use cfg_attr(feature, allow)
53    // - safe_simd sub-modules set their own forbid/deny (no parent blanket allow)
54
55    // Core primitives
56    pub(crate) mod align;
57    #[cfg(feature = "c-ffi")]
58    pub(crate) mod assume;
59    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
60    pub(crate) mod c_arc;
61    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
62    pub(crate) mod c_box;
63    pub(crate) mod cpu;
64    pub(crate) mod disjoint_mut;
65    mod ffi_safe;
66    mod in_range;
67    pub(super) mod internal;
68    mod intra_edge;
69    #[cfg_attr(not(feature = "c-ffi"), deny(unsafe_code))]
70    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
71    pub(crate) mod log;
72    pub(crate) mod pixels;
73    #[cfg(any(feature = "asm", feature = "c-ffi"))]
74    #[allow(unsafe_code)]
75    pub mod send_sync_non_null;
76    mod tables;
77
78    // Data/picture management
79    mod data;
80    #[cfg_attr(not(feature = "c-ffi"), deny(unsafe_code))]
81    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
82    mod picture;
83
84    // DSP dispatch modules (contain _erased functions and fn ptr dispatch)
85    mod cdef;
86    mod filmgrain;
87    mod ipred;
88    mod itx;
89    mod lf_mask;
90    mod loopfilter;
91    mod looprestoration;
92    mod mc;
93    mod pal;
94    mod recon;
95    #[cfg_attr(feature = "asm", allow(unsafe_code))]
96    mod refmvs;
97
98    // Entropy coding (inline SIMD, safe on both x86_64 and aarch64 when asm off)
99    #[cfg_attr(feature = "asm", allow(unsafe_code))]
100    mod msac;
101
102    // Safe SIMD implementations (internal, not part of the public API)
103    #[cfg(not(feature = "asm"))]
104    pub(crate) mod safe_simd;
105
106    // Rust core API (rav1d_open, rav1d_send_data, etc.)
107    #[cfg_attr(not(feature = "c-ffi"), deny(unsafe_code))]
108    #[cfg_attr(feature = "c-ffi", allow(unsafe_code))]
109    pub(crate) mod lib;
110
111    // C FFI wrappers (dav1d_* extern "C" functions)
112    #[cfg(feature = "c-ffi")]
113    #[allow(unsafe_code)]
114    pub mod dav1d_api;
115
116    // === Modules WITHOUT unsafe_code (enforced by deny) ===
117    mod cdef_apply;
118    mod cdf;
119    mod const_fn;
120    mod ctx;
121    mod cursor;
122    mod decode;
123    mod dequant_tables;
124    pub(crate) mod enum_map;
125    mod env;
126    pub(crate) mod error;
127    mod extensions;
128    mod fg_apply;
129    mod getbits;
130    mod ipred_prepare;
131    mod iter;
132    mod itx_1d;
133    pub(crate) mod levels;
134    mod lf_apply;
135    mod lr_apply;
136    pub(crate) mod mem;
137    mod obu;
138    pub(crate) mod pic_or_buf;
139    mod qm;
140    pub(crate) mod relaxed_atomic;
141    mod scan;
142    pub(crate) mod strided;
143    mod thread_task;
144    mod warpmv;
145    mod wedge;
146    pub(crate) mod with_offset;
147    pub(crate) mod wrap_fn_ptr;
148
149    #[cfg(test)]
150    mod decode_test;
151
152    // === Managed Safe API ===
153    /// 100% safe Rust API for AV1 decoding
154    ///
155    /// This module provides a fully safe, zero-copy API wrapping rav1d's internal decoder.
156    pub mod managed;
157} // mod src
158
159// Re-export the managed API at the crate root for convenience.
160// Users can write `rav1d_safe::Decoder` instead of `rav1d_safe::src::managed::Decoder`.
161pub use src::managed::{
162    ColorInfo, ColorPrimaries, ColorRange, ContentLightLevel, CpuLevel, DecodeFrameType, Decoder,
163    Error, Frame, InloopFilters, MasteringDisplay, MatrixCoefficients, PixelLayout, PlaneView8,
164    PlaneView16, Planes, Planes8, Planes16, Result, Settings, TransferCharacteristics,
165    enabled_features,
166};
rav1d_safe/lib.rs

rav1d_safe/
lib.rs
