[Kirby Kuehl (kkuehl)]

Summary

Adds the API surface, examples, and tests needed to build WDM file-system
minifilter and Windows Filtering Platform (WFP) callout drivers, plus the
fallible allocation primitives they need to stay loadable on older Windows
builds.

Motivation

Writing a minifilter or WFP callout driver in Rust today requires hand-written
bindings or accepting a raised minimum-OS floor. This change adds the bindings
and two downlevel shims so such drivers can be written on top of the existing
wdk stack, targeting Windows 10 RS2 (1703) and later.

Changes

wdk-sys

• Minifilter (fltKernel.h) and WFP (fwpsk.h) API subsets behind the
  minifilter and wfp cargo features.
• MDL, registry, file, process/thread/section, and PE image bindings.
• Runtime-resolved ExAllocatePool2 and lookaside-list shims that keep
  consumers loadable on Windows 10 RS2 (1703) and later, instead of raising the
  load floor to 2004 / 22H2.
• A complete FILE_INFORMATION_CLASS enum and related structures.

wdk-alloc

• Fallible allocation primitives (try_box, try_vec_with_capacity,
  FallibleVec) so driver code has no path to handle_alloc_error.

wdk

• FormatBuffer reworked to remove runtime panic paths.

wdk-build

• Minifilter and Wfp library/linker cases.

Examples

• sample-minifilter-driver (a port of the WDK passThrough sample).
• sample-wfp-callout-driver (a port of the WDK inspect sample).

Tests

• config-minifilter and config-wfp binding tests.

Testing

• cargo build --locked --all-features
• cargo clippy --locked --all-features
• cargo +nightly fmt --all -- --check
• typos / taplo fmt --check / cargo sort --check
• config-minifilter binding tests (18 passed)
• config-wfp binding tests (6 passed)
• wdk-alloc, wdk, and wdk-panic unit tests (49 passed)

[Kirby Kuehl (kkuehl)]

Kirby Kuehl (Kirby Kuehl (@kkuehl)) please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.

@microsoft-github-policy-service agree [company="{your company}"]

Options:

• (default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.

@microsoft-github-policy-service agree

• (when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.

@microsoft-github-policy-service agree company="Microsoft"

Contributor License Agreement

@microsoft-github-policy-service agree company="Mimic Networks"

[Copilot]

🟡 Changes recommended

Unresolved critical issues can cause undefined behavior, violate allocation and callout contracts, and prevent supported configurations from building or loading.

11 open issues

• Clippy denies reject supported UMDF builds · New
• Fallback drops required pool allocation flags · New
• Lookaside counters have unsynchronized data races · New
• Fallback groups multiple unsafe operations in one block · New
• Handwritten MDL types conflict with bindgen aliases · New
• New FFI declarations fail warnings-as-errors builds · New
• INF template is garbled UTF-16LE · New
• Static import breaks the stated RS2 minimum · New
• Inspection callout returns an incompatible action · New
• Taplo setup clears RUSTFLAGS for later tasks · New
• Minifilter link directive bypasses opt-out gates · New

What changed in this PR

Extends the WDK Rust stack with minifilter and Windows Filtering Platform support, alongside allocation shims intended to preserve compatibility with older Windows releases.

Changes:

• Adds kernel API bindings, supporting types, feature gates, and library linkage.
• Introduces downlevel allocation/lookaside shims, fallible allocation helpers, and panic-path reductions.
• Adds driver samples and binding checks, and updates build orchestration and lint settings.

File	Description
tests/​Makefile.toml	Includes the new binding-test packages.
tests/​config-wfp/​tests/​wfp_bindings.rs	Checks WFP constants, structures, and callbacks.
tests/​config-wfp/​src/​lib.rs	Checks WFP routine signatures at compile time.
tests/​config-wfp/​Cargo.toml	Configures WDM tests with WFP bindings.
tests/​config-minifilter/​src/​lib.rs	Checks Filter Manager routine signatures.
tests/​config-minifilter/​Cargo.toml	Configures WDM tests with minifilter bindings.
Makefile.toml	Adds a pinned Taplo installation task.
examples/​sample-wfp-callout-driver/​src/​lib.rs	Implements an outbound TCP inspection sample.
examples/​sample-wfp-callout-driver/​sample_wfp_callout_driver.inx	Adds the WFP installation template.
examples/​sample-wfp-callout-driver/​README.md	Documents building, installing, and exercising the sample.
examples/​sample-wfp-callout-driver/​Makefile.toml	Reuses shared driver packaging tasks.
examples/​sample-wfp-callout-driver/​Cargo.toml	Defines the WFP sample package and dependencies.
examples/​sample-wfp-callout-driver/​build.rs	Configures WDK binary linking.
examples/​sample-wdm-driver/​src/​lib.rs	Separates and documents unsafe registry-path reads.
examples/​sample-wdm-driver/​Cargo.toml	Forwards minifilter and WFP features.
examples/​sample-umdf-driver/​src/​lib.rs	Uses explicit raw pointers for WDF output arguments.
examples/​sample-minifilter-driver/​src/​lib.rs	Implements file-open monitoring callbacks.
examples/​sample-minifilter-driver/​sample_minifilter_driver.inx	Adds minifilter service and instance installation settings.
examples/​sample-minifilter-driver/​README.md	Documents minifilter setup and testing.
examples/​sample-minifilter-driver/​Makefile.toml	Reuses shared driver packaging tasks.
examples/​sample-minifilter-driver/​Cargo.toml	Defines the minifilter sample package and dependencies.
examples/​sample-minifilter-driver/​build.rs	Configures WDK binary linking.
examples/​sample-kmdf-driver/​src/​lib.rs	Uses explicit raw pointers for WDF output arguments.
examples/​sample-kmdf-driver/​Cargo.toml	Forwards minifilter and WFP features.
examples/​Makefile.toml	Includes both new driver samples.
crates/​wdk/​src/​lib.rs	Rejects unsupported breakpoint architectures at compile time.
crates/​wdk/​src/​fmt.rs	Replaces panic-prone buffer operations and adds boundary tests.
crates/​wdk-sys/​src/​wfp.rs	Exposes generated, versioned WFP routines.
crates/​wdk-sys/​src/​types.rs	Adds MDL, file, registry, and PE types.
crates/​wdk-sys/​src/​ntddk/​lookaside_downlevel.rs	Adds runtime-resolved lookaside operations and fallbacks.
crates/​wdk-sys/​src/​ntddk/​allocate_pool_downlevel.rs	Adds runtime-resolved pool allocation and a legacy fallback.
crates/​wdk-sys/​src/​ntddk.rs	Exposes compatibility shims and additional kernel routines.
crates/​wdk-sys/​src/​minifilter.rs	Exposes Filter Manager routines and manual constants.
crates/​wdk-sys/​src/​lib.rs	Gates new modules and adds object-attribute initialization.
crates/​wdk-sys/​src/​constants.rs	Adds access rights, file-information classes, and memory constants.
crates/​wdk-sys/​Cargo.toml	Declares minifilter and WFP features.
crates/​wdk-sys/​build.rs	Generates bindings, links libraries, and compiles WFP GUID definitions.
crates/​wdk-panic/​Cargo.toml	Reorders the inherited lint configuration.
crates/​wdk-build/​src/​lib.rs	Adds API subsets, header selection, and NDIS preprocessing.
crates/​wdk-build/​src/​bindgen.rs	Makes problematic NDIS compatibility records opaque.
crates/​wdk-alloc/​src/​lib.rs	Exposes fallible helpers and checks non-executable pool selection.
crates/​wdk-alloc/​src/​fallible.rs	Adds fallible box/vector operations and unit tests.
CONTRIBUTING.md	Explains why the pinned Taplo revision is required.
clippy.toml	Allows selected panic-related operations in tests.
Cargo.toml	Excludes new standalone packages and tightens workspace lints.
.typos.toml	Allowlists the WDK PUNICODE_STRING identifier.

_{Review effort: Balanced}

[Kirby Kuehl (kkuehl)]

Copilot review

[Copilot]

🟡 Changes recommended

The allocation fallback drops required raise-on-failure behavior, while duplicate type declarations break pointer compatibility and existing Default usage.

7 open issues

• Preserve raise-on-failure behavior in the pool fallback · New
• Static import breaks the stated RS2 minimum
• Lookaside counters have unsynchronized data races
• Clippy denies reject supported UMDF builds
• Remove the duplicate FILE_NAME_INFORMATION declaration · New
• Gate fallback declarations to kernel builds · New
• Minifilter link directive bypasses opt-out gates

7 resolved since last review

• Inspection callout returns an incompatible action
• INF template is garbled UTF-16LE
• New FFI declarations fail warnings-as-errors builds
• Handwritten MDL types conflict with bindgen aliases
• Fallback groups multiple unsafe operations in one block
• Fallback drops required pool allocation flags
• Taplo setup clears RUSTFLAGS for later tasks

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Kernel-mode Clippy checks fail because the lookaside code combines multiple unsafe operations in single blocks and omits required safety comments.

5 open issues

• Split unsafe pointer dereference and atomic conversion blocks · New
• Add safety comments for size and tag reads · New
• Test try_box allocation failure and exactly-once drop · New
• Preserve stripping of interior NULs in print macros · New
• Document legacy INF installation for Windows 10 1703–1809 · New

7 resolved since last review

• Preserve raise-on-failure behavior in the pool fallback
• Static import breaks the stated RS2 minimum
• Lookaside counters have unsynchronized data races
• Clippy denies reject supported UMDF builds
• Gate fallback declarations to kernel builds
• Remove the duplicate FILE_NAME_INFORMATION declaration
• Minifilter link directive bypasses opt-out gates

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The test allocator’s shared failure flag can abort the test process or miss the intended allocation, while its missing safety justification causes Clippy to reject the unsafe implementation.

2 open issues

• Document the test allocator's unsafe implementation · New
• Scope allocation failure injection to the test thread · New

5 resolved since last review

• Add safety comments for size and tag reads
• Split unsafe pointer dereference and atomic conversion blocks
• Preserve stripping of interior NULs in print macros
• Test try_box allocation failure and exactly-once drop
• Document legacy INF installation for Windows 10 1703–1809

_{Review effort: Balanced}

[hagz0r (hagz0r)]

Hi
Your PR would be very useful to me

[Copilot]

🟡 Changes recommended

The test allocator lacks a required SAFETY comment, causing the configured Clippy flow to reject it, and its process-wide failure injection can affect unrelated allocations, causing flaky assertions or process aborts.

3 open issues

• Document the unsafe allocator implementation · New
• Scope allocation failure injection to the test thread
• Document the test allocator's unsafe implementation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The process-wide allocation failure flag can be consumed by another test or the harness, making the failure test unreliable and potentially aborting the entire test process.

1 open issue

• Scope allocation failure injection to the test thread

2 resolved since last review

• Document the unsafe allocator implementation
• Document the test allocator's unsafe implementation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because extended file-information structures can expose padding as Windows flags, while allocation fallback semantics vary by OS and runtime resolution.

No open issues 🎉

1 resolved since last review

• Scope allocation failure injection to the test thread

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to evaluate inconsistent fallback pool-allocation semantics, exception propagation across FFI, and missing coverage for failed vector growth.

No open issues 🎉

_{Review effort: Balanced}