Files

T

enricobuehler 95a08e99c3 feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2)

Frame ring (pf-vdisplay) and both gamepad SHM channels move off named Global\
objects (openable by any sibling LocalService) to UNNAMED sections/events whose
handles the host DuplicateHandles into the driver's verified WUDFHost with least
access — frame delivery over the SYSTEM+admins-only IOCTL_SET_FRAME_CHANNEL,
pads over a 32-byte named bootstrap mailbox (pid + handle value only, DoS-bounded;
HID minidrivers have no control device). Driver-validated pad_index kills
cross-pad redirects; v1↔v2 mixes fail closed with diagnosis logs on both sides.
Sibling-LocalService denial proven empirically (design/idd-push-security.md,
design/gamepad-channel-sealing.md).

Driver-side raw ops now live behind pf-umdf-util (checked shm accessors, the
forbid(unsafe_code) ChannelClient state machine, WDF request tokens) — the pad
drivers' logic is 100% safe Rust; whole drivers workspace clippy-gated in CI.

driver install --gamepad now sweeps SWD\punktfunk phantom devnodes: a re-created
SwDevice REVIVES the old devnode with its previously-bound driver (never
re-ranks), so an upgrade otherwise leaves the old driver serving — or, across
the v1→v2 fence, a dead pad (found live on the RTX box).

On-glass validated on the RTX 4090 box: frame path 7007 frames p50 2.06 ms
cross-machine; DualSense + XUSB "sealed pad channel mapped"/proto=2 attach via
both the test harness and a real streaming session; phantom-sweep repro.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-03 12:08:56 +00:00

src

feat(host/windows): seal the host↔driver channels (frame + gamepad, proto v2)

2026-07-03 12:08:56 +00:00

Cargo.toml

refactor: rename pf-vdisplay-proto -> pf-driver-proto (it spans all drivers)

2026-06-26 05:38:21 +00:00

README.md

feat(protocol,clients): codec preference negotiation + Linux client decodes per Welcome (Phase 2a)

2026-07-02 00:13:26 +00:00

README.md

pf-driver-proto

The shared host ↔ driver binary contract for punktfunk's Windows pf-vdisplay virtual display — the control IOCTLs and the IDD-push frame transport, defined exactly once.

It's a path dependency of both the host workspace (crates/punktfunk-host) and the out-of-workspace driver workspace (packaging/windows/drivers/), so it must resolve identically from either build graph. That's why it's deliberately self-contained: no_std (+ alloc), platform-neutral (GUID/LUID are plain integers each side converts to its own OS type), and free of *.workspace = true inheritance.

Defining every wire struct here — with const size/offset asserts and bytemuck round-trips — turns host↔driver ABI drift into a compile error instead of a silent frame or IOCTL corruption.

See the crate root (src/) for the wire types; the Windows virtual-display design is in design/windows-virtual-display-rust-port.md.