* > So the driver takes a SpiDevice with a dummy CS pin, and the real CS pin separately

Yes

> That's equivalent to the driver taking a SpiBus and a CS pin: works, but doesn't allow safely sharing the bus between multiple drivers

Maybe I misunderstand but I don't see how it's any "safer" or less safe (in terms of Rust language sense of "safe" at least) -- programmer could just as easily use the wrong CS pin somewhere and have equally bad consequences, or make a dummy CS pin struct and insert it as suggested without ever using `unsafe`. I guess the advantage of `SpiDevice` is that it's already semantically defining that it's a single thing on a shared bus and the implementation is still guaranteeing the exclusivity of the bus which can be re-used even though CS is now manually managed, if that makes sense