enricobuehler
5219107177
`packaging/windows/drivers/*` has run `deny(unsafe_op_in_unsafe_fn)` +
`deny(clippy::undocumented_unsafe_blocks)` for a while, with `forbid(unsafe_code)`
on the modules that need no unsafe at all. The main workspace had no lint config
whatsoever, so nothing stopped a clean crate from quietly growing an `unsafe`, and
nothing distinguished the handful of genuinely-unsafe lines inside a 600-line
`unsafe fn` from the safe ones surrounding them.
Three things, all mechanical:
* `#![forbid(unsafe_code)]` on the eight crates that already contain zero unsafe
(`pf-driver-proto`, `pf-host-config`, `pf-paths`, the three clean clients, both
tools). These were clean by accident, not by contract; now they are clean by
contract.
* `unsafe_op_in_unsafe_fn = "warn"` workspace-wide. `unsafe fn` states a contract
the CALLER must uphold — it was never meant to switch off checking for the whole
body. Measured fallout is 300 sites on Linux, and they are concentrated: six
files carry all of them, while `punktfunk-core`, `pf-frame`, `pf-clipboard` and
`pf-vdisplay` are already at zero. `warn` (not `deny`) so the build stays green
while those six are worked down; it flips to `deny` once they are. This is also
the Rust 2024 default, so it pays off the edition migration early.
* `proc::current_uid()` replaces eight `unsafe { libc::getuid() }` blocks. Each
site had copied out the same SAFETY note verbatim, which is the tell: `getuid()`
is parameterless, always succeeds and touches no memory, so there is no contract
for a caller to uphold and no reason for the unsafe to be visible eight times.
One `unsafe` behind a safe wrapper, none at the call sites.
Verified: `pf-vdisplay` builds clean on Linux (Nobara) at zero E0133; the
macOS-buildable crates build clean locally. No behaviour change.
24 lines
1.2 KiB
TOML
24 lines
1.2 KiB
TOML
# Shared host<->driver binary contract for the punktfunk pf-vdisplay virtual display.
|
|
#
|
|
# Deliberately self-contained (no `*.workspace = true` inheritance, no Windows deps): this crate is a
|
|
# path dependency of BOTH the host workspace (crates/punktfunk-host) AND the out-of-workspace driver
|
|
# workspace (packaging/windows/drivers/), so it must resolve identically from either build graph. It is
|
|
# `no_std` (+ alloc) and platform-neutral; the GUID/LUID are plain integers each side converts to its
|
|
# own OS type. Defining every wire struct ONCE here — with `const` size/offset asserts + bytemuck
|
|
# round-trips — makes host<->driver ABI drift a COMPILE error instead of a silent frame/IOCTL corruption.
|
|
[package]
|
|
name = "pf-driver-proto"
|
|
version = "0.0.1"
|
|
edition = "2021"
|
|
rust-version = "1.82"
|
|
license = "MIT OR Apache-2.0"
|
|
description = "Shared host<->driver binary contract for the punktfunk pf-vdisplay virtual display (control IOCTLs + IDD-push frame transport)."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
# `min_const_generics`: Pod/Zeroable for `[u8; N]` of any N (the gamepad SHM reserved tails are >32).
|
|
bytemuck = { version = "1.19", features = ["derive", "min_const_generics"] }
|
|
|
|
[lints]
|
|
workspace = true
|