enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
81 lines
3.9 KiB
TOML
81 lines
3.9 KiB
TOML
# Input injection (plan §W6): the per-OS injector backends (wlroots virtual-input, KWin fake_input,
|
|
# libei/reis, gamescope-EI on Linux; SendInput on Windows) + the virtual-gamepad HID stack (DualSense/
|
|
# DualShock4/Switch Pro/Steam Controller/Deck over uhid/usbip and the Windows UMDF drivers), extracted
|
|
# into a subsystem crate. Consumes punktfunk_core::input (the neutral GamepadEvent/InputEvent vocabulary,
|
|
# moved to core in W5) and the pf-driver-proto wire contract; NEVER reaches the orchestrator (the one
|
|
# gamescope-EI socket path is the shared pf-paths contract, not a vdisplay reach-in).
|
|
[package]
|
|
name = "pf-inject"
|
|
version.workspace = true
|
|
edition = "2021"
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host input injection: per-OS keyboard/mouse injectors + the virtual-gamepad HID backends behind one InputInjector trait."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
pf-driver-proto = { path = "../pf-driver-proto" }
|
|
pf-host-config = { path = "../pf-host-config" }
|
|
pf-paths = { path = "../pf-paths" }
|
|
# The Windows gamepad-channel bootstrap reuses the IDD-push WUDFHost verification + the resident-mouse
|
|
# compose-kick hook (both live in pf-capture).
|
|
pf-capture = { path = "../pf-capture" }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
libc = "0.2"
|
|
parking_lot = "0.12"
|
|
# The RemoteDesktop portal for the libei injector on KWin/GNOME (headless grant via kde-authorized).
|
|
ashpd = { version = "0.13", features = ["remote_desktop"] }
|
|
# Input injection into headless Sway via the wlroots virtual-input Wayland protocols.
|
|
wayland-client = "0.31"
|
|
wayland-protocols-wlr = { version = "0.3", features = ["client"] }
|
|
wayland-protocols-misc = { version = "0.3", features = ["client"] }
|
|
wayland-protocols = { version = "0.32", features = ["client"] }
|
|
# Codegen for KDE's `org_kde_kwin_fake_input` (vendored in `protocols/fake-input.xml`); the generated
|
|
# interface tables reference `wayland-backend`.
|
|
wayland-scanner = "0.31"
|
|
wayland-backend = "0.3"
|
|
# libei (EI sender) for the portable input path on KWin/GNOME (RemoteDesktop portal) + gamescope-EI.
|
|
reis = { version = "0.6.1", features = ["tokio"] }
|
|
futures-util = "0.3"
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "net", "time"] }
|
|
# Builds/validates the xkb keymap uploaded to the virtual keyboard + tracks modifier state.
|
|
xkbcommon = "0.8"
|
|
# Vendored + trimmed usbip server core — presents a virtual Steam Deck over USB/IP for Steam Input.
|
|
usbip-sim = { path = "../punktfunk-host/vendor/usbip-sim" }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# The streamed-output desktop rect (CCD source rect) absolute input maps into — the same
|
|
# resolver the cursor-readback poller uses, so inject and readback always agree.
|
|
pf-win-display = { path = "../pf-win-display" }
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Security",
|
|
"Win32_Security_Authorization",
|
|
"Win32_Devices_DeviceAndDriverInstallation",
|
|
"Win32_Devices_Enumeration_Pnp",
|
|
# SwDeviceCreate's SW_DEVICE_CREATE_INFO references DEVPROPKEY (Properties).
|
|
"Win32_Devices_Properties",
|
|
# The channel proof: HidD_GetIndexedString + GUID_DEVINTERFACE_HID (the pads/mouse leg) and
|
|
# CreateFileW to open the device interface the proof is asked over.
|
|
"Win32_Devices_HumanInterfaceDevice",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_Memory",
|
|
"Win32_System_IO",
|
|
"Win32_System_StationsAndDesktops",
|
|
"Win32_System_Threading",
|
|
"Win32_UI_Input_KeyboardAndMouse",
|
|
# Synthetic pointer devices (PT_PEN / PT_TOUCH) — the pen/touch injectors. The device
|
|
# create/destroy + POINTER_TYPE_INFO live under Controls in this metadata layout;
|
|
# InjectSyntheticPointerInput + POINTER_*_INFO under Input_Pointer.
|
|
"Win32_UI_Controls",
|
|
"Win32_UI_Input_Pointer",
|
|
"Win32_UI_WindowsAndMessaging",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|