feat(windows-drivers): driver workspace + wdk-probe on windows-drivers-rs (M1)

Stand up packaging/windows/drivers/ — the unified driver workspace on crates.io
windows-drivers-rs (wdk 0.4.1 / wdk-sys + wdk-build 0.5.1), retiring the dev-box
../../crates/wdk* path-deps. First member: wdk-probe, the smallest UMDF2 driver
(DriverEntry -> WdfDriverCreate -> EvtDeviceAdd -> WdfDeviceCreate) that
force-links the shared pf-vdisplay-proto ABI crate. It validates on the runner:
wdk-sys bindgen + WDF stub link against the WDK + LLVM, the cross-workspace
no_std proto path-dep, and the produced DLL's PE FORCE_INTEGRITY bit.

windows-drivers.yml gains a driver-build job: cargo build -p wdk-probe (pinning
Version_Number=10.0.26100.0) + a PE inspection that prints whether /INTEGRITYCHECK
is set — the M0 self-signed-load question.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packaging/windows/drivers/Cargo.toml

@@ -0,0 +1,33 @@
+# Unified in-tree workspace for punktfunk's all-Rust UMDF drivers, on microsoft/windows-drivers-rs
+# (crates.io wdk/wdk-sys/wdk-build — NOT the dev-box ../../crates/wdk* path-deps). Part of the
+# Windows-host rewrite (docs/windows-host-rewrite.md, M1). pf-vdisplay + the gamepad drivers move here.
+#
+# Separate from the main cargo workspace (own [workspace] root) because driver crates are cdylibs built
+# with the WDK toolchain (cargo-wdk / wdk-build) on Windows only. Path-deps the shared ABI crate
+# crates/pf-vdisplay-proto from the main tree.
+[workspace]
+resolver = "2"
+members = ["wdk-probe"]
+
+[workspace.package]
+edition = "2024"
+version = "0.0.1"
+license = "MIT OR Apache-2.0"
+publish = false
+
+[workspace.dependencies]
+wdk = "0.4.1"
+wdk-sys = "0.5.1"
+wdk-build = "0.5.1"
+pf-vdisplay-proto = { path = "../../../crates/pf-vdisplay-proto" }
+
+# windows-drivers-rs marks a driver workspace with this section (per-package driver-model overrides it).
+[workspace.metadata.wdk]
+
+[profile.dev]
+panic = "abort"
+lto = true
+
+[profile.release]
+panic = "abort"
+lto = true

packaging/windows/drivers/wdk-probe/Cargo.toml

@@ -0,0 +1,26 @@
+# M0/M1 toolchain probe: the smallest possible UMDF2 driver on windows-drivers-rs (crates.io wdk 0.5).
+# Purpose: prove on the windows-amd64 runner that (1) wdk-sys bindgen + WDF stub link works against the
+# runner's WDK + LLVM, (2) the shared no_std pf-vdisplay-proto ABI crate path-deps cleanly into a driver
+# build graph, and (3) what the produced DLL's PE FORCE_INTEGRITY (/INTEGRITYCHECK) bit is. NOT shipped.
+[package]
+name = "wdk-probe"
+edition.workspace = true
+version.workspace = true
+license.workspace = true
+publish = false
+
+[package.metadata.wdk.driver-model]
+driver-type = "UMDF"
+umdf-version-major = 2
+target-umdf-version-minor = 31
+
+[lib]
+crate-type = ["cdylib"]
+
+[build-dependencies]
+wdk-build.workspace = true
+
+[dependencies]
+wdk.workspace = true
+wdk-sys.workspace = true
+pf-vdisplay-proto.workspace = true

packaging/windows/drivers/wdk-probe/build.rs

@@ -0,0 +1,6 @@
+//! Emits the WDK link flags for the cdylib (the same call the gamepad drivers use). If wdk-build adds
+//! `/INTEGRITYCHECK`, it shows up in the produced DLL's PE DllCharacteristics — which the CI step
+//! inspects to answer the M0 self-signed-load question.
+fn main() -> Result<(), wdk_build::ConfigError> {
+    wdk_build::configure_wdk_binary_build()
+}

packaging/windows/drivers/wdk-probe/src/lib.rs

@@ -0,0 +1,54 @@
+//! Minimal UMDF2 driver — the M0/M1 toolchain + `/INTEGRITYCHECK` probe (see this crate's Cargo.toml).
+//! DriverEntry → WdfDriverCreate → (EvtDeviceAdd) WdfDeviceCreate: enough to exercise the wdk-sys WDF
+//! stub link without any device logic. Also force-links the shared `pf-vdisplay-proto` ABI crate to
+//! prove it compiles + links into a driver (no_std + bytemuck) across the workspace boundary.
+
+#![allow(non_snake_case, clippy::missing_safety_doc)]
+
+use wdk_sys::{
+    call_unsafe_wdf_function_binding, NTSTATUS, PCUNICODE_STRING, PDRIVER_OBJECT, PWDFDEVICE_INIT,
+    ULONG, WDFDEVICE, WDFDRIVER, WDF_DRIVER_CONFIG, WDF_NO_HANDLE, WDF_NO_OBJECT_ATTRIBUTES,
+};
+
+const STATUS_SUCCESS: NTSTATUS = 0;
+
+/// Force `pf-vdisplay-proto` to actually link into the driver build graph (validates the cross-workspace
+/// path-dep + that the no_std bytemuck ABI crate compiles for a UMDF cdylib). `#[used]` keeps it.
+#[used]
+static PROTO_GUID_LO: u64 = pf_vdisplay_proto::PF_VDISPLAY_INTERFACE_GUID_U128 as u64;
+
+#[unsafe(export_name = "DriverEntry")]
+pub unsafe extern "system" fn driver_entry(
+    driver: PDRIVER_OBJECT,
+    registry_path: PCUNICODE_STRING,
+) -> NTSTATUS {
+    // SAFETY: zeroed then Size + the device-add callback set, per the WDF_DRIVER_CONFIG contract.
+    let mut config: WDF_DRIVER_CONFIG = unsafe { core::mem::zeroed() };
+    config.Size = core::mem::size_of::<WDF_DRIVER_CONFIG>() as ULONG;
+    config.EvtDriverDeviceAdd = Some(evt_device_add);
+    // SAFETY: driver + registry_path are the loader-provided pointers; config is valid for the call.
+    unsafe {
+        call_unsafe_wdf_function_binding!(
+            WdfDriverCreate,
+            driver,
+            registry_path,
+            WDF_NO_OBJECT_ATTRIBUTES,
+            &mut config,
+            WDF_NO_HANDLE.cast::<WDFDRIVER>()
+        )
+    }
+}
+
+extern "C" fn evt_device_add(_driver: WDFDRIVER, mut device_init: PWDFDEVICE_INIT) -> NTSTATUS {
+    let mut device: WDFDEVICE = core::ptr::null_mut();
+    // SAFETY: device_init is the framework-provided init; attributes null; device receives the handle.
+    let _ = unsafe {
+        call_unsafe_wdf_function_binding!(
+            WdfDeviceCreate,
+            &mut device_init,
+            WDF_NO_OBJECT_ATTRIBUTES,
+            &mut device
+        )
+    };
+    STATUS_SUCCESS
+}