feat(host): game-mode integration + dedicated game sessions
Implements design/gamemode-and-dedicated-sessions.md (Parts A1-A5 + B0-B2):
reconciles the merged display-management registry with session-mobile
Bazzite/SteamOS hosts and adds a per-launch dedicated gamescope mode.
- A1 DisplayOwnership {Owned,External,SessionManaged} + poolable_now(): the
registry pools only what it owns, so gamescope managed/attach outputs are no
longer double-owned by the registry AND the gamescope restore worker (fixes
the game-mode-reconnect stale-node wedge).
- A2 validated reuse: (backend,mode,launch,epoch) reuse key + kept_display_alive
liveness probe + reused_gen/mark_failed on a reused-display first-frame failure.
- A3 policy-driven managed restore (keep_alive replaces the hardcoded 5s debounce;
forever = held = gaming-rig truthful) + crash-restore persist + SIGKILL teardown
(kill_unit, applied to our transient unit AND the autologin stop -- validated
live on .181 to avoid the F44 GPU-context leak).
- A4 session epoch: observe_session_instance bumps the epoch + invalidate_backend
on a desktop-compositor instance change; gamescope spawns are exempt.
- A5 per-spawn log + PID-scoped gamescope node discovery.
- B0 game_session {auto,dedicated} policy (top-level, preset-orthogonal) +
pick_gamescope_mode dedicated_launch + steam -silent command shaping.
- B1 free the autologin Steam before a dedicated Steam spawn (single-instance).
- B2 game-exit -> APP_EXITED_CLOSE_CODE (0x52) clean session end.
Adversarially reviewed (11 findings fixed). Validated on glass (.181 Bazzite F44,
RTX 4090): dedicated spawn streams a real game smoothly; keep-alive reuse; the
SIGKILL fix avoids the F44 vkCreateDevice leak. Workspace green
(build / test --workspace / clippy -D warnings / fmt), OpenAPI + C header
regenerated, web console tsc + vite build green. clients/probe: bump the
no-video timeout 8s->45s for gamescope cold starts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -14,7 +14,7 @@
|
||||
//! Input uses gamescope's own libei/EIS socket (`LIBEI_SOCKET`), relayed to the libei backend (see
|
||||
//! `inject/libei.rs`) — wired and live-validated.
|
||||
|
||||
use super::{Mode, VirtualDisplay, VirtualOutput};
|
||||
use super::{DisplayOwnership, Mode, VirtualDisplay, VirtualOutput};
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use std::process::{Child, Command, Stdio};
|
||||
use std::time::{Duration, Instant};
|
||||
@@ -62,6 +62,18 @@ static PENDING_RESTORE: std::sync::Mutex<Option<Instant>> = std::sync::Mutex::ne
|
||||
/// instead of triggering a stop/relaunch.
|
||||
const RESTORE_DEBOUNCE: Duration = Duration::from_secs(5);
|
||||
|
||||
/// Per-spawn instance counter (A5): each bare-spawn gets a unique id addressing its own log so two
|
||||
/// coexisting gamescopes (a kept lingering spawn + a fresh one) never parse each other's node id.
|
||||
static SPAWN_SEQ: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
|
||||
|
||||
/// This spawn instance's log path, under `$XDG_RUNTIME_DIR` (per-user, tmpfs; falls back to `/tmp`
|
||||
/// only if unset). Replaces the shared `/tmp/punktfunk-gamescope.log` so concurrent spawns don't
|
||||
/// clobber each other's `stream available on node ID:` line.
|
||||
fn spawn_log_path(inst: u64) -> std::path::PathBuf {
|
||||
let base = std::env::var("XDG_RUNTIME_DIR").unwrap_or_else(|_| "/tmp".to_string());
|
||||
std::path::Path::new(&base).join(format!("punktfunk-gamescope-{inst}.log"))
|
||||
}
|
||||
|
||||
/// systemd --user transient unit name for the host-managed gamescope-session-plus session.
|
||||
const SESSION_UNIT: &str = "punktfunk-gamescope";
|
||||
/// The gamescope-session-plus launcher script (Bazzite / SteamOS-like hosts).
|
||||
@@ -82,6 +94,80 @@ const STEAMOS_SESSION_TARGET: &str = "gamescope-session.target";
|
||||
/// restart the physical session.
|
||||
static STEAMOS_TOOK_OVER: std::sync::Mutex<bool> = std::sync::Mutex::new(false);
|
||||
|
||||
/// Persisted takeover state (`design/gamemode-and-dedicated-sessions.md` A3): the takeover mechanics
|
||||
/// ([`STOPPED_AUTOLOGIN`] / [`STEAMOS_TOOK_OVER`]) are process memory, so a host **crash** mid-stream
|
||||
/// would strand the box out of gaming mode with no restore. Mirroring the statics to a file lets
|
||||
/// [`restore_takeover_on_startup`] put the TV back after a restart.
|
||||
#[derive(serde::Serialize, serde::Deserialize, Default)]
|
||||
struct TakeoverState {
|
||||
/// Autologin `gamescope-session-plus@*.service` units we stopped (to restart on restore).
|
||||
stopped_autologin: Vec<String>,
|
||||
/// Whether we took over SteamOS's `gamescope-session.target` (restore = remove drop-in + restart).
|
||||
steamos: bool,
|
||||
}
|
||||
|
||||
/// Path of the persisted [`TakeoverState`], under `$XDG_RUNTIME_DIR` (per-user, 0700, tmpfs — cleared
|
||||
/// on reboot, which is correct: a reboot restarts the autologin itself).
|
||||
fn takeover_state_path() -> std::path::PathBuf {
|
||||
let base = std::env::var("XDG_RUNTIME_DIR").unwrap_or_else(|_| "/tmp".to_string());
|
||||
std::path::Path::new(&base).join("punktfunk-session-takeover.json")
|
||||
}
|
||||
|
||||
/// Persist the current takeover mechanics so a host crash doesn't strand the box out of gaming mode.
|
||||
/// Best-effort (a write failure just loses crash-restore, not correctness).
|
||||
fn persist_takeover() {
|
||||
let state = TakeoverState {
|
||||
stopped_autologin: STOPPED_AUTOLOGIN
|
||||
.lock()
|
||||
.unwrap_or_else(|e| e.into_inner())
|
||||
.clone(),
|
||||
steamos: *STEAMOS_TOOK_OVER.lock().unwrap_or_else(|e| e.into_inner()),
|
||||
};
|
||||
if state.stopped_autologin.is_empty() && !state.steamos {
|
||||
clear_takeover();
|
||||
return;
|
||||
}
|
||||
if let Ok(bytes) = serde_json::to_vec(&state) {
|
||||
let _ = std::fs::write(takeover_state_path(), bytes);
|
||||
}
|
||||
}
|
||||
|
||||
/// Remove the persisted takeover file (after a completed restore, or when there's nothing to restore).
|
||||
fn clear_takeover() {
|
||||
let _ = std::fs::remove_file(takeover_state_path());
|
||||
}
|
||||
|
||||
/// On host startup, restore the TV's gaming session if a previous host instance took it over and
|
||||
/// crashed before restoring (`design/gamemode-and-dedicated-sessions.md` A3). Loads the persisted
|
||||
/// [`TakeoverState`] into the statics and schedules a restore after a short reconnect grace (so a
|
||||
/// client reconnecting right after the restart keeps the streamed session instead of bouncing the
|
||||
/// box back to gaming mode). No-op when no takeover file exists (a clean start). Call once from
|
||||
/// `serve` alongside [`start_restore_worker`].
|
||||
pub fn restore_takeover_on_startup() {
|
||||
let Ok(bytes) = std::fs::read(takeover_state_path()) else {
|
||||
return; // no takeover file — clean start
|
||||
};
|
||||
let Ok(state) = serde_json::from_slice::<TakeoverState>(&bytes) else {
|
||||
clear_takeover();
|
||||
return;
|
||||
};
|
||||
if state.stopped_autologin.is_empty() && !state.steamos {
|
||||
clear_takeover();
|
||||
return;
|
||||
}
|
||||
tracing::warn!(
|
||||
units = ?state.stopped_autologin,
|
||||
steamos = state.steamos,
|
||||
"gamescope: found a stranded takeover from a previous host instance — scheduling TV restore"
|
||||
);
|
||||
*STOPPED_AUTOLOGIN.lock().unwrap_or_else(|e| e.into_inner()) = state.stopped_autologin;
|
||||
*STEAMOS_TOOK_OVER.lock().unwrap_or_else(|e| e.into_inner()) = state.steamos;
|
||||
// A generous grace so a client reconnecting right after the restart cancels it (create_managed_session
|
||||
// clears PENDING_RESTORE) and keeps the streamed session rather than bouncing to gaming mode.
|
||||
*PENDING_RESTORE.lock().unwrap_or_else(|e| e.into_inner()) =
|
||||
Some(Instant::now() + Duration::from_secs(15));
|
||||
}
|
||||
|
||||
impl GamescopeDisplay {
|
||||
pub fn new() -> Result<Self> {
|
||||
Ok(GamescopeDisplay::default())
|
||||
@@ -97,6 +183,32 @@ impl VirtualDisplay for GamescopeDisplay {
|
||||
self.cmd = cmd;
|
||||
}
|
||||
|
||||
fn poolable_now(&self) -> bool {
|
||||
// Only a bare SPAWN is registry-poolable (its `create` reports `Owned`); managed
|
||||
// (`PUNKTFUNK_GAMESCOPE_SESSION`) and attach (`PUNKTFUNK_GAMESCOPE_NODE`) report
|
||||
// `SessionManaged`/`External`, so the registry must not reuse a kept spawn for them (same
|
||||
// backend name). Mirrors [`crate::vdisplay::launch_is_nested`]; read under the env lock the
|
||||
// sub-mode ladder writes these keys under.
|
||||
crate::vdisplay::with_env_lock(|| {
|
||||
std::env::var_os("PUNKTFUNK_GAMESCOPE_SESSION").is_none()
|
||||
&& std::env::var_os("PUNKTFUNK_GAMESCOPE_NODE").is_none()
|
||||
})
|
||||
}
|
||||
|
||||
fn launch_command(&self) -> Option<String> {
|
||||
// The registry keys keep-alive reuse on (backend, mode, launch): a kept bare-spawn running
|
||||
// game A must never be reused for a session launching game B (A2).
|
||||
self.cmd.clone()
|
||||
}
|
||||
|
||||
fn kept_display_alive(&mut self, node_id: u32) -> bool {
|
||||
// The nested gamescope dies when its game exits (independently of any compositor), leaving a
|
||||
// dead pooled node. Before the registry reuses that node on a reconnect, confirm it still
|
||||
// exists on the daemon; a `false` makes the registry recreate instead of handing back a corpse
|
||||
// (which would then burn a ~10 s first-frame retry before `mark_failed` recovered it).
|
||||
gamescope_node_present(node_id)
|
||||
}
|
||||
|
||||
fn create(&mut self, mode: Mode) -> Result<VirtualOutput> {
|
||||
// Host-managed gamescope-session-plus at the CLIENT's mode (the Bazzite path): launch the
|
||||
// full Steam-Deck-UI session headless at the client's resolution + refresh — so games SEE
|
||||
@@ -121,26 +233,51 @@ impl VirtualDisplay for GamescopeDisplay {
|
||||
};
|
||||
point_injector_at_eis();
|
||||
tracing::info!(node_id, "gamescope: attaching to existing PipeWire node");
|
||||
// ATTACH = mirror a foreign gamescope we don't own → External (no keep-alive/reuse).
|
||||
return Ok(VirtualOutput {
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(()),
|
||||
ownership: DisplayOwnership::External,
|
||||
reused_gen: None,
|
||||
});
|
||||
}
|
||||
check_gamescope_version(); // diagnostic only — warns on known-deadlock-prone versions
|
||||
let proc = GamescopeProc(spawn(
|
||||
// B1: a dedicated STEAM launch needs Steam's single instance free. If the box autologged into
|
||||
// game mode (Bazzite) its Steam holds the instance, and a nested second Steam would see the
|
||||
// first and exit (crashing the spawn) — so free the autologin session first. Its restore is the
|
||||
// A3 takeover machinery (recorded in STOPPED_AUTOLOGIN + persisted; restarted on session end via
|
||||
// schedule_restore_tv_session). Non-Steam launches don't conflict, so they skip this.
|
||||
if self.cmd.as_deref().is_some_and(is_steam_launch) {
|
||||
stop_autologin_sessions();
|
||||
}
|
||||
// A5: a per-spawn instance id addresses this spawn's log + node discovery, so two coexisting
|
||||
// bare-spawns (a kept lingering one + a fresh one) never parse each other's node id from a
|
||||
// shared log. The nested-command's LIBEI relay stays on the global path (per-instance input
|
||||
// isolation is `design/gamescope-multiuser.md` scope, not addressed here).
|
||||
let inst = SPAWN_SEQ.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
|
||||
let log = spawn_log_path(inst);
|
||||
let child = spawn(
|
||||
mode.width,
|
||||
mode.height,
|
||||
mode.refresh_hz.max(1),
|
||||
self.cmd.as_deref(),
|
||||
)?);
|
||||
&log,
|
||||
)?;
|
||||
let child_pid = child.id();
|
||||
let proc = GamescopeProc {
|
||||
child,
|
||||
log: log.clone(),
|
||||
};
|
||||
// gamescope creates its PipeWire node a moment after start; poll for it (the proc is held
|
||||
// alive meanwhile, and killed if we give up).
|
||||
let node_id = wait_for_node(Duration::from_secs(15)).ok_or_else(|| {
|
||||
// alive meanwhile, and killed if we give up). Discovery reads THIS spawn's log, and the
|
||||
// fallback is scoped to this spawn's process tree.
|
||||
let node_id = wait_for_node(Duration::from_secs(15), &log, child_pid).ok_or_else(|| {
|
||||
anyhow!(
|
||||
"gamescope PipeWire node did not appear within 15s — gamescope may have failed to \
|
||||
start or headless capture is unsupported on this GPU/driver (see /tmp/punktfunk-gamescope.log)"
|
||||
start or headless capture is unsupported on this GPU/driver (see {})",
|
||||
log.display()
|
||||
)
|
||||
})?;
|
||||
tracing::info!(
|
||||
@@ -150,12 +287,12 @@ impl VirtualDisplay for GamescopeDisplay {
|
||||
hz = mode.refresh_hz,
|
||||
"gamescope virtual output ready"
|
||||
);
|
||||
Ok(VirtualOutput {
|
||||
// Bare SPAWN: we own the nested gamescope process → registry-poolable (keep-alive-able).
|
||||
Ok(VirtualOutput::owned(
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(proc),
|
||||
})
|
||||
Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
Box::new(proc),
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
@@ -192,12 +329,7 @@ fn create_managed_session(client: &str, mode: Mode) -> Result<VirtualOutput> {
|
||||
hz = mode.refresh_hz,
|
||||
"gamescope session: reusing the running session (same mode — no Steam restart)"
|
||||
);
|
||||
return Ok(VirtualOutput {
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(()),
|
||||
});
|
||||
return Ok(managed_output(node_id, mode));
|
||||
}
|
||||
tracing::warn!("gamescope session: tracked session has no live node — relaunching");
|
||||
*guard = None;
|
||||
@@ -218,12 +350,23 @@ fn create_managed_session(client: &str, mode: Mode) -> Result<VirtualOutput> {
|
||||
hz = mode.refresh_hz,
|
||||
"gamescope session: launched gamescope-session-plus at the client's mode"
|
||||
);
|
||||
Ok(VirtualOutput {
|
||||
Ok(managed_output(node_id, mode))
|
||||
}
|
||||
|
||||
/// The [`VirtualOutput`] for a managed / SteamOS-takeover session: a box-level session whose restore
|
||||
/// lifecycle is (at Part A1) the gamescope module's own machinery (`schedule_restore_tv_session`), so
|
||||
/// it is [`DisplayOwnership::SessionManaged`] — the registry passes it through (no pooling), and the
|
||||
/// capturer's unit keepalive tears nothing down on drop. (Part A3 replaces the unit keepalive with a
|
||||
/// real `ManagedSessionHandle` and flips this to `Owned`.)
|
||||
fn managed_output(node_id: u32, mode: Mode) -> VirtualOutput {
|
||||
VirtualOutput {
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(()),
|
||||
})
|
||||
ownership: DisplayOwnership::SessionManaged,
|
||||
reused_gen: None,
|
||||
}
|
||||
}
|
||||
|
||||
/// SteamOS detection: its session launcher is present and Bazzite's session-plus is NOT (so the
|
||||
@@ -483,12 +626,7 @@ fn create_managed_session_steamos(mode: Mode) -> Result<VirtualOutput> {
|
||||
hz = mode.refresh_hz,
|
||||
"gamescope (SteamOS): reusing the headless session (same mode — no Steam restart)"
|
||||
);
|
||||
return Ok(VirtualOutput {
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(()),
|
||||
});
|
||||
return Ok(managed_output(node_id, mode));
|
||||
}
|
||||
*guard = None; // tracked session lost its node — fall through to a clean restart
|
||||
}
|
||||
@@ -497,9 +635,11 @@ fn create_managed_session_steamos(mode: Mode) -> Result<VirtualOutput> {
|
||||
systemctl_user(&["daemon-reload"]);
|
||||
systemctl_user(&["restart", STEAMOS_SESSION_TARGET]);
|
||||
*STEAMOS_TOOK_OVER.lock().unwrap_or_else(|e| e.into_inner()) = true;
|
||||
// gamescope's node appears within a few seconds of the restart; Steam's first FRAME is slower
|
||||
// (Big Picture cold start) and is awaited by the caller's first-frame retry loop.
|
||||
let node_id = wait_for_node(Duration::from_secs(30)).ok_or_else(|| {
|
||||
persist_takeover(); // A3: survive a host crash mid-stream
|
||||
// gamescope's node appears within a few seconds of the restart; Steam's first FRAME is slower
|
||||
// (Big Picture cold start) and is awaited by the caller's first-frame retry loop. The managed
|
||||
// session logs to journald (not a per-spawn file), so poll `find_gamescope_node` directly.
|
||||
let node_id = poll_managed_node(Duration::from_secs(30)).ok_or_else(|| {
|
||||
anyhow!(
|
||||
"SteamOS headless gamescope node did not appear within 30s after restarting \
|
||||
{STEAMOS_SESSION_TARGET} — check `journalctl --user -u gamescope-session.service`"
|
||||
@@ -518,12 +658,7 @@ fn create_managed_session_steamos(mode: Mode) -> Result<VirtualOutput> {
|
||||
hz = mode.refresh_hz,
|
||||
"gamescope (SteamOS): took over gamescope-session.target headless at the client's mode"
|
||||
);
|
||||
Ok(VirtualOutput {
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(()),
|
||||
})
|
||||
Ok(managed_output(node_id, mode))
|
||||
}
|
||||
|
||||
/// ATTACH at the CLIENT's resolution: ensure the box's own game-mode session is running at `mode`'s
|
||||
@@ -670,11 +805,31 @@ fn running_autologin_gamescope_unit() -> Option<String> {
|
||||
.map(|u| u.to_string())
|
||||
}
|
||||
|
||||
/// Tear a gamescope `systemd --user` unit down with **SIGKILL** rather than the default SIGTERM stop
|
||||
/// (`design/gamemode-and-dedicated-sessions.md` A3 / `session-aware-host-followups.md` #1): the
|
||||
/// hypothesis — validated as the fix on the F44 repro box `.181` — is that gamescope's SIGTERM
|
||||
/// teardown handler (the one that SIGSEGVs, exit 139) LEAKS the NVIDIA GPU context, after which every
|
||||
/// subsequent gamescope fails `vkCreateDevice` with `VK_ERROR_INITIALIZATION_FAILED` (-3) until a
|
||||
/// reboot. SIGKILL skips that handler so the driver reclaims the context cleanly via normal process
|
||||
/// exit. Follow with `stop` + `reset-failed` to clear the unit's state so a relaunch is clean.
|
||||
fn kill_unit(unit: &str) {
|
||||
let _ = Command::new("systemctl")
|
||||
.args(["--user", "kill", "--signal=SIGKILL", unit])
|
||||
.status();
|
||||
let _ = Command::new("systemctl")
|
||||
.args(["--user", "stop", unit])
|
||||
.status();
|
||||
let _ = Command::new("systemctl")
|
||||
.args(["--user", "reset-failed", unit])
|
||||
.status();
|
||||
}
|
||||
|
||||
/// Stop every running autologin gaming-mode session (`gamescope-session-plus@*.service`) so its
|
||||
/// single-instance Steam is free for our own host-managed session. Records the units so
|
||||
/// [`schedule_restore_tv_session`] can restart them on disconnect. Our own session is the transient
|
||||
/// `punktfunk-gamescope` unit (not a `@`-instance), so it's never matched here. No-op when nothing
|
||||
/// is autologged in (e.g. a box that boots headless).
|
||||
/// is autologged in (e.g. a box that boots headless). Uses the **SIGKILL** teardown ([`kill_unit`])
|
||||
/// to avoid the F44 GPU-context leak that the autologin's SIGTERM stop triggers.
|
||||
fn stop_autologin_sessions() {
|
||||
let Ok(out) = Command::new("systemctl")
|
||||
.args([
|
||||
@@ -694,12 +849,10 @@ fn stop_autologin_sessions() {
|
||||
for line in String::from_utf8_lossy(&out.stdout).lines() {
|
||||
if let Some(unit) = line.split_whitespace().next() {
|
||||
if unit.starts_with("gamescope-session-plus@") && unit.ends_with(".service") {
|
||||
let _ = Command::new("systemctl")
|
||||
.args(["--user", "stop", unit])
|
||||
.status();
|
||||
kill_unit(unit); // SIGKILL teardown — avoid the F44 GPU-context leak
|
||||
tracing::info!(
|
||||
unit,
|
||||
"freed Steam: stopped the autologin gaming session for this stream"
|
||||
"freed Steam: SIGKILL-stopped the autologin gaming session for this stream"
|
||||
);
|
||||
stopped.push(unit.to_string());
|
||||
}
|
||||
@@ -707,15 +860,57 @@ fn stop_autologin_sessions() {
|
||||
}
|
||||
if !stopped.is_empty() {
|
||||
*STOPPED_AUTOLOGIN.lock().unwrap_or_else(|e| e.into_inner()) = stopped;
|
||||
persist_takeover(); // A3: survive a host crash mid-stream
|
||||
}
|
||||
}
|
||||
|
||||
/// Client disconnected: **schedule** a debounced restore of the TV's autologin gaming session(s) we
|
||||
/// stopped on connect — the actual restore fires [`RESTORE_DEBOUNCE`] later (via [`start_restore_worker`])
|
||||
/// unless a client reconnects first, which cancels it and reuses the warm managed session. Debouncing
|
||||
/// means at most one gamescope stop/relaunch per quiet period instead of one per disconnect — the
|
||||
/// per-connect churn is what leaked GPU context on F44. No-op when nothing was stolen (non-Bazzite /
|
||||
/// headless box). Idempotent / safe to call on every session end.
|
||||
/// Cancel any pending TV-session restore — a client has (re)connected, so the box must stay in the
|
||||
/// streamed session, not bounce back to gaming mode. This covers the **keep-alive reuse** reconnect
|
||||
/// path (a kept dedicated / managed gamescope), which never calls `create_managed_session` (where the
|
||||
/// managed path already clears `PENDING_RESTORE`) — so without this, a dedicated Steam reconnect within
|
||||
/// the linger window would restart the autologin *underneath* the live session (review finding #3).
|
||||
/// Called from the connect path (native `resolve_compositor`, GameStream `open_gs_virtual_source`).
|
||||
/// No-op when nothing is pending; the stopped-unit list stays armed for a later real disconnect.
|
||||
pub fn cancel_pending_restore() {
|
||||
let mut g = PENDING_RESTORE.lock().unwrap_or_else(|e| e.into_inner());
|
||||
if g.is_some() {
|
||||
*g = None;
|
||||
tracing::info!(
|
||||
"gamescope: client (re)connected — cancelled the pending TV-session restore"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/// The delay before restoring the TV's autologin session after the last client disconnects — the
|
||||
/// display-management **keep-alive policy**, replacing the hardcoded [`RESTORE_DEBOUNCE`]
|
||||
/// (`design/gamemode-and-dedicated-sessions.md` A3). The managed gamescope session is a single
|
||||
/// box-level singleton (not a registry pool entry — A1), so its keep-alive lives here rather than in
|
||||
/// the registry, but reads the same policy the pooled backends do:
|
||||
/// * `off` → restore immediately (0 s);
|
||||
/// * `duration(s)` → restore after `s`;
|
||||
/// * `forever` → **`None`**: never auto-restore — the managed session is HELD until host stop or a
|
||||
/// manual return to gaming mode (the `gaming-rig` "the TV model" story, now truthful on gamescope);
|
||||
/// * unconfigured → the historical 5 s [`RESTORE_DEBOUNCE`] (bit-for-bit today's behavior).
|
||||
fn restore_delay() -> Option<Duration> {
|
||||
use crate::vdisplay::policy::{self, Linger};
|
||||
match policy::prefs()
|
||||
.configured_effective()
|
||||
.map(|e| e.keep_alive.linger())
|
||||
{
|
||||
Some(Linger::Immediate) => Some(Duration::from_secs(0)),
|
||||
Some(Linger::For(d)) => Some(d),
|
||||
Some(Linger::Forever) => None,
|
||||
None => Some(RESTORE_DEBOUNCE),
|
||||
}
|
||||
}
|
||||
|
||||
/// Client disconnected: **schedule** a policy-timed restore of the TV's autologin gaming session(s) we
|
||||
/// stopped on connect ([`restore_delay`], via [`start_restore_worker`]) — unless a client reconnects
|
||||
/// first, which cancels it and reuses the warm managed session. Debouncing means at most one gamescope
|
||||
/// stop/relaunch per quiet period instead of one per disconnect — the per-connect churn is what leaked
|
||||
/// GPU context on F44. Under `keep_alive=forever` ([`restore_delay`] `None`) NO restore is scheduled:
|
||||
/// the managed session is pinned (gaming-rig). No-op when nothing was stolen (non-Bazzite / headless
|
||||
/// box). Idempotent / safe to call on every session end.
|
||||
pub fn schedule_restore_tv_session() {
|
||||
let nothing_to_restore = STOPPED_AUTOLOGIN
|
||||
.lock()
|
||||
@@ -725,12 +920,24 @@ pub fn schedule_restore_tv_session() {
|
||||
if nothing_to_restore {
|
||||
return; // nothing was taken over → nothing to restore (also the non-managed path)
|
||||
}
|
||||
*PENDING_RESTORE.lock().unwrap_or_else(|e| e.into_inner()) =
|
||||
Some(Instant::now() + RESTORE_DEBOUNCE);
|
||||
tracing::info!(
|
||||
secs = RESTORE_DEBOUNCE.as_secs(),
|
||||
"gamescope: scheduled debounced TV-session restore (cancelled if a client reconnects)"
|
||||
);
|
||||
match restore_delay() {
|
||||
None => {
|
||||
// keep_alive=forever → pin the managed session; leave PENDING_RESTORE unset.
|
||||
*PENDING_RESTORE.lock().unwrap_or_else(|e| e.into_inner()) = None;
|
||||
tracing::info!(
|
||||
"gamescope: keep-alive=forever — managed session held (no TV-restore scheduled; \
|
||||
return to gaming mode or restart the host to free it)"
|
||||
);
|
||||
}
|
||||
Some(delay) => {
|
||||
*PENDING_RESTORE.lock().unwrap_or_else(|e| e.into_inner()) =
|
||||
Some(Instant::now() + delay);
|
||||
tracing::info!(
|
||||
secs = delay.as_secs(),
|
||||
"gamescope: scheduled TV-session restore (keep-alive policy; cancelled on reconnect)"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Tear down our host-managed session (freeing Steam) and restart the autologin gaming session(s)
|
||||
@@ -745,6 +952,7 @@ fn do_restore_tv_session() {
|
||||
let mut took = STEAMOS_TOOK_OVER.lock().unwrap_or_else(|e| e.into_inner());
|
||||
if *took {
|
||||
*took = false;
|
||||
clear_takeover(); // A3: takeover undone — drop the persisted crash-restore marker
|
||||
*MANAGED_SESSION.lock().unwrap_or_else(|e| e.into_inner()) = None;
|
||||
remove_steamos_dropin();
|
||||
systemctl_user(&["daemon-reload"]);
|
||||
@@ -770,6 +978,7 @@ fn do_restore_tv_session() {
|
||||
if units.is_empty() {
|
||||
return; // nothing was stolen → nothing to restore (also the non-Bazzite path)
|
||||
}
|
||||
clear_takeover(); // A3: takeover consumed — drop the persisted crash-restore marker
|
||||
stop_session(SESSION_UNIT); // our gamescope/Steam session, so Steam is free for the autologin
|
||||
*MANAGED_SESSION.lock().unwrap_or_else(|e| e.into_inner()) = None;
|
||||
// Only bring the gaming autologin BACK if the box is still meant to be in gaming mode. If the
|
||||
@@ -923,12 +1132,10 @@ fn launch_session(client: &str, unit_name: &str, mode: Mode) -> Result<u32> {
|
||||
}
|
||||
}
|
||||
|
||||
/// Stop the host-managed session's transient unit (best-effort) and clear the EIS relay so a dead
|
||||
/// session's socket name can't be reconnected.
|
||||
/// Stop the host-managed session's transient unit ([`kill_unit`] — SIGKILL teardown to avoid the F44
|
||||
/// GPU-context leak) and clear the EIS relay so a dead session's socket name can't be reconnected.
|
||||
fn stop_session(unit_name: &str) {
|
||||
let _ = Command::new("systemctl")
|
||||
.args(["--user", "stop", unit_name])
|
||||
.status();
|
||||
kill_unit(unit_name);
|
||||
let _ = std::fs::remove_file(ei_socket_file());
|
||||
}
|
||||
|
||||
@@ -949,13 +1156,36 @@ pub fn ei_socket_file() -> std::path::PathBuf {
|
||||
}
|
||||
}
|
||||
|
||||
/// Shape a resolved launch command for a bare-spawn gamescope session. A Steam URI launch
|
||||
/// (`steam steam://rungameid/<id>`, produced by `library::command_for`) gets `-silent` inserted so
|
||||
/// the game is the gamescope focus with no Steam client window to navigate
|
||||
/// (`design/gamemode-and-dedicated-sessions.md` §5.3). Operator-typed custom commands and non-Steam
|
||||
/// launches are returned unchanged. Idempotent (never double-inserts `-silent`). Pure + unit-tested.
|
||||
/// Does this resolved launch command start Steam (`steam … steam://…`)? Such a launch needs Steam's
|
||||
/// single instance free before a dedicated spawn (B1). Pure + unit-tested.
|
||||
fn is_steam_launch(cmd: &str) -> bool {
|
||||
let mut it = cmd.split_whitespace();
|
||||
it.next() == Some("steam") && cmd.contains("steam://")
|
||||
}
|
||||
|
||||
fn shape_dedicated_command(app: &str) -> String {
|
||||
let mut it = app.split_whitespace();
|
||||
if it.next() == Some("steam") {
|
||||
let rest: Vec<&str> = it.collect();
|
||||
if !rest.contains(&"-silent") && rest.iter().any(|t| t.starts_with("steam://")) {
|
||||
return format!("steam -silent {}", rest.join(" "));
|
||||
}
|
||||
}
|
||||
app.to_string()
|
||||
}
|
||||
|
||||
/// Spawn `gamescope --backend headless -W w -H h -r hz -- <app>`. The app comes from
|
||||
/// `PUNKTFUNK_GAMESCOPE_APP` (default a no-op that just keeps gamescope alive — set it to a real
|
||||
/// game/GL app for actual content, e.g. `steam -gamepadui` for the SteamOS-like session).
|
||||
/// stdout/stderr go to `/tmp/punktfunk-gamescope.log`. The app is launched through a tiny shell
|
||||
/// wrapper that relays gamescope's `LIBEI_SOCKET` (set for its children) to [`ei_socket_file`]
|
||||
/// stdout/stderr go to `log` (this spawn's per-instance log, A5). The app is launched through a tiny
|
||||
/// shell wrapper that relays gamescope's `LIBEI_SOCKET` (set for its children) to [`ei_socket_file`]
|
||||
/// so the input injector can connect to gamescope's EIS server from outside.
|
||||
fn spawn(w: u32, h: u32, hz: u32, cmd: Option<&str>) -> Result<Child> {
|
||||
fn spawn(w: u32, h: u32, hz: u32, cmd: Option<&str>, log: &std::path::Path) -> Result<Child> {
|
||||
// A non-empty per-session command (set via `set_launch_command`) wins; else the
|
||||
// `PUNKTFUNK_GAMESCOPE_APP` env var (the documented manual fallback); else a no-op that keeps
|
||||
// gamescope alive. Each level is taken only if non-empty, so a blank per-session cmd transparently
|
||||
@@ -970,6 +1200,9 @@ fn spawn(w: u32, h: u32, hz: u32, cmd: Option<&str>) -> Result<Child> {
|
||||
})
|
||||
.filter(|s| !s.trim().is_empty())
|
||||
.unwrap_or_else(|| "sleep infinity".to_string());
|
||||
// Dedicated-launch command shaping (Part B): a Steam URI runs with `-silent` so the game is the
|
||||
// gamescope focus with no Steam client window to navigate.
|
||||
let app = shape_dedicated_command(&app);
|
||||
let relay = ei_socket_file();
|
||||
let _ = std::fs::remove_file(&relay); // stale socket path from a previous session
|
||||
let mut cmd = Command::new("gamescope");
|
||||
@@ -990,14 +1223,14 @@ fn spawn(w: u32, h: u32, hz: u32, cmd: Option<&str>) -> Result<Child> {
|
||||
.args(app.split_whitespace())
|
||||
// Prefer the NVIDIA GL vendor for the nested session (harmless on a pure-NVIDIA box).
|
||||
.env("__GLX_VENDOR_LIBRARY_NAME", "nvidia");
|
||||
if let Ok(log) = std::fs::File::create("/tmp/punktfunk-gamescope.log") {
|
||||
if let Ok(log2) = log.try_clone() {
|
||||
cmd.stdout(Stdio::from(log)).stderr(Stdio::from(log2));
|
||||
if let Ok(logf) = std::fs::File::create(log) {
|
||||
if let Ok(log2) = logf.try_clone() {
|
||||
cmd.stdout(Stdio::from(logf)).stderr(Stdio::from(log2));
|
||||
}
|
||||
} else {
|
||||
cmd.stdout(Stdio::null()).stderr(Stdio::null());
|
||||
}
|
||||
tracing::info!(w, h, hz, %app, "spawning gamescope (headless)");
|
||||
tracing::info!(w, h, hz, %app, log = %log.display(), "spawning gamescope (headless)");
|
||||
cmd.spawn()
|
||||
.context("spawn gamescope (is it installed? `apt install gamescope`)")
|
||||
}
|
||||
@@ -1006,22 +1239,59 @@ fn spawn(w: u32, h: u32, hz: u32, cmd: Option<&str>) -> Result<Child> {
|
||||
/// line `stream available on node ID: N` (its node carries `node.name=gamescope` on TWO objects
|
||||
/// — the adapter and the inner stream — and only the advertised id is the correct capture
|
||||
/// target). Falls back to `pw-dump` discovery if the log line doesn't show.
|
||||
fn wait_for_node(timeout: Duration) -> Option<u32> {
|
||||
/// B2 (game-exit detection): confirm a **dedicated** gamescope session's game has exited. gamescope is
|
||||
/// a single-app compositor — it exits when its nested app exits — so once capture is lost, THIS
|
||||
/// session's `node_id` not reappearing within a short confirmation window means the game quit (vs. a
|
||||
/// transient PipeWire hiccup). Scoped to the session's own `node_id` (via [`gamescope_node_present`]),
|
||||
/// so a **coexisting** gamescope (a second dedicated session, or the box's game-mode gamescope beside a
|
||||
/// non-Steam dedicated launch) doesn't mask the exit (review findings #4/#8). Returns `true` when the
|
||||
/// node stays absent across the window.
|
||||
pub fn game_session_exited(node_id: u32) -> bool {
|
||||
let deadline = Instant::now() + Duration::from_millis(1500);
|
||||
loop {
|
||||
if gamescope_node_present(node_id) {
|
||||
return false; // OUR node is (still) present → not an exit (transient loss)
|
||||
}
|
||||
if Instant::now() >= deadline {
|
||||
return true; // our node stayed gone across the window → the game exited
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(250));
|
||||
}
|
||||
}
|
||||
|
||||
/// Poll [`find_gamescope_node`] (unscoped) up to `timeout` — for the managed / SteamOS session, which
|
||||
/// logs to journald (no per-spawn file) and is single-session (no scoping needed).
|
||||
fn poll_managed_node(timeout: Duration) -> Option<u32> {
|
||||
let deadline = Instant::now() + timeout;
|
||||
loop {
|
||||
if let Some(id) = node_from_log() {
|
||||
if let Some(id) = find_gamescope_node() {
|
||||
return Some(id);
|
||||
}
|
||||
if Instant::now() >= deadline {
|
||||
return find_gamescope_node(); // last-resort fallback
|
||||
return None;
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(300));
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse `stream available on node ID: N` from the spawned gamescope's log (ANSI-colored).
|
||||
fn node_from_log() -> Option<u32> {
|
||||
let log = std::fs::read_to_string("/tmp/punktfunk-gamescope.log").ok()?;
|
||||
fn wait_for_node(timeout: Duration, log: &std::path::Path, child_pid: u32) -> Option<u32> {
|
||||
let deadline = Instant::now() + timeout;
|
||||
loop {
|
||||
if let Some(id) = node_from_log(log) {
|
||||
return Some(id);
|
||||
}
|
||||
if Instant::now() >= deadline {
|
||||
// Last-resort fallback scoped to THIS spawn's process tree (A5), so a coexisting gamescope's
|
||||
// node isn't picked by mistake.
|
||||
return find_gamescope_node_scoped(Some(child_pid));
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(300));
|
||||
}
|
||||
}
|
||||
|
||||
/// Parse `stream available on node ID: N` from a spawned gamescope's per-instance log (ANSI-colored).
|
||||
fn node_from_log(log: &std::path::Path) -> Option<u32> {
|
||||
let log = std::fs::read_to_string(log).ok()?;
|
||||
for line in log.lines().rev() {
|
||||
if let Some(pos) = line.find("stream available on node ID:") {
|
||||
let tail = &line[pos + "stream available on node ID:".len()..];
|
||||
@@ -1034,6 +1304,27 @@ fn node_from_log() -> Option<u32> {
|
||||
None
|
||||
}
|
||||
|
||||
/// Is a PipeWire node with exactly `node_id` present on the default daemon right now? Used by the
|
||||
/// keep-alive reuse liveness probe ([`GamescopeDisplay::kept_display_alive`]): a kept gamescope node
|
||||
/// vanishes when its nested game exits, so a missing id means "recreate, don't reuse the corpse".
|
||||
fn gamescope_node_present(node_id: u32) -> bool {
|
||||
let Ok(out) = Command::new("pw-dump").arg(node_id.to_string()).output() else {
|
||||
// pw-dump unavailable → don't block reuse (mark_failed is the backstop on a genuinely dead node).
|
||||
return true;
|
||||
};
|
||||
let Ok(dump) = serde_json::from_slice::<serde_json::Value>(&out.stdout) else {
|
||||
return true;
|
||||
};
|
||||
dump.as_array()
|
||||
.map(|objs| {
|
||||
objs.iter().any(|o| {
|
||||
o.get("id").and_then(|i| i.as_u64()) == Some(node_id as u64)
|
||||
&& o.get("type").and_then(|t| t.as_str()) == Some("PipeWire:Interface:Node")
|
||||
})
|
||||
})
|
||||
.unwrap_or(true)
|
||||
}
|
||||
|
||||
/// Find the `gamescope` `Video/Source` node id in a `pw-dump` snapshot of the default daemon.
|
||||
///
|
||||
/// `node.name=gamescope` appears on TWO objects (the adapter *and* the inner stream node); only
|
||||
@@ -1041,10 +1332,18 @@ fn node_from_log() -> Option<u32> {
|
||||
/// other wedges the link. So we require `Video/Source` first and fall back to a bare name match
|
||||
/// only if no class-tagged node is present (older gamescope that doesn't set media.class).
|
||||
fn find_gamescope_node() -> Option<u32> {
|
||||
find_gamescope_node_scoped(None)
|
||||
}
|
||||
|
||||
/// Like [`find_gamescope_node`], but when `scope` is `Some(pid)` only a node whose owning process
|
||||
/// (`application.process.id`) is `pid` or a descendant of it qualifies (A5 — a spawn's node must
|
||||
/// belong to OUR gamescope's process tree, so a coexisting foreign / other-session gamescope node is
|
||||
/// never mistaken for ours). `None` = any gamescope node (the managed/attach paths, single-session).
|
||||
fn find_gamescope_node_scoped(scope: Option<u32>) -> Option<u32> {
|
||||
let out = Command::new("pw-dump").output().ok()?;
|
||||
let dump: serde_json::Value = serde_json::from_slice(&out.stdout).ok()?;
|
||||
let nodes = dump.as_array()?;
|
||||
let node_props = |obj: &serde_json::Value| -> Option<(u32, String, String)> {
|
||||
let node_props = |obj: &serde_json::Value| -> Option<(u32, String, String, Option<u32>)> {
|
||||
if obj.get("type").and_then(|t| t.as_str()) != Some("PipeWire:Interface:Node") {
|
||||
return None;
|
||||
}
|
||||
@@ -1060,20 +1359,40 @@ fn find_gamescope_node() -> Option<u32> {
|
||||
.and_then(|n| n.as_str())
|
||||
.unwrap_or("")
|
||||
.to_string();
|
||||
Some((id, name, class))
|
||||
// PipeWire records the owning process id as a string or an int depending on version.
|
||||
let pid = props
|
||||
.and_then(|p| p.get("application.process.id"))
|
||||
.and_then(|v| {
|
||||
v.as_u64()
|
||||
.or_else(|| v.as_str().and_then(|s| s.parse().ok()))
|
||||
.map(|n| n as u32)
|
||||
});
|
||||
Some((id, name, class, pid))
|
||||
};
|
||||
// Preferred: a Video/Source node named (or containing) "gamescope".
|
||||
// A node is in-scope when no scope is asked, or its owning pid descends from the scope pid. When
|
||||
// the pid prop is absent (older gamescope / PipeWire) we DON'T exclude it — falling back to the
|
||||
// per-instance log is the primary addressing (design §7 risk note).
|
||||
let in_scope = |pid: Option<u32>| -> bool {
|
||||
match scope {
|
||||
None => true,
|
||||
Some(root) => pid.map(|p| descends_from(p, root)).unwrap_or(true),
|
||||
}
|
||||
};
|
||||
// Preferred: a Video/Source node named (or containing) "gamescope", in scope.
|
||||
for obj in nodes {
|
||||
if let Some((id, name, class)) = node_props(obj) {
|
||||
if class == "Video/Source" && (name == "gamescope" || name.contains("gamescope")) {
|
||||
if let Some((id, name, class, pid)) = node_props(obj) {
|
||||
if class == "Video/Source"
|
||||
&& (name == "gamescope" || name.contains("gamescope"))
|
||||
&& in_scope(pid)
|
||||
{
|
||||
return Some(id);
|
||||
}
|
||||
}
|
||||
}
|
||||
// Fallback: a node literally named "gamescope" with no usable class tag.
|
||||
// Fallback: a node literally named "gamescope" with no usable class tag, in scope.
|
||||
for obj in nodes {
|
||||
if let Some((id, name, _)) = node_props(obj) {
|
||||
if name == "gamescope" {
|
||||
if let Some((id, name, _, pid)) = node_props(obj) {
|
||||
if name == "gamescope" && in_scope(pid) {
|
||||
tracing::warn!(
|
||||
node_id = id,
|
||||
"gamescope node has no media.class=Video/Source tag — capturing it anyway"
|
||||
@@ -1168,22 +1487,62 @@ fn parse_version(text: &str) -> Option<(u32, u32, u32)> {
|
||||
None
|
||||
}
|
||||
|
||||
/// Owns the spawned gamescope process; killing it tears the virtual output down.
|
||||
struct GamescopeProc(Child);
|
||||
/// Owns the spawned gamescope process (and its per-instance log, A5); killing it tears the virtual
|
||||
/// output down.
|
||||
struct GamescopeProc {
|
||||
child: Child,
|
||||
log: std::path::PathBuf,
|
||||
}
|
||||
|
||||
impl Drop for GamescopeProc {
|
||||
fn drop(&mut self) {
|
||||
let _ = self.0.kill();
|
||||
let _ = self.0.wait();
|
||||
let _ = self.child.kill();
|
||||
let _ = self.child.wait();
|
||||
// Clear the relayed EIS socket name so the host-lifetime injector can't reconnect to this
|
||||
// now-dead session's socket between sessions (the stale path is the "Connection refused").
|
||||
let _ = std::fs::remove_file(ei_socket_file());
|
||||
// Drop this spawn's per-instance log (A5) so `$XDG_RUNTIME_DIR` doesn't accumulate them.
|
||||
let _ = std::fs::remove_file(&self.log);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::{parse_version, MIN_GAMESCOPE};
|
||||
use super::{is_steam_launch, parse_version, shape_dedicated_command, MIN_GAMESCOPE};
|
||||
|
||||
#[test]
|
||||
fn steam_launch_detection() {
|
||||
assert!(is_steam_launch("steam steam://rungameid/570"));
|
||||
assert!(is_steam_launch("steam -silent steam://rungameid/570"));
|
||||
assert!(!is_steam_launch("vkcube"));
|
||||
assert!(!is_steam_launch("lutris lutris:rungameid/42"));
|
||||
assert!(!is_steam_launch("steam -bigpicture")); // no URI = not a game launch
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn dedicated_command_shaping() {
|
||||
// Steam URI → -silent inserted so the game is the gamescope focus.
|
||||
assert_eq!(
|
||||
shape_dedicated_command("steam steam://rungameid/570"),
|
||||
"steam -silent steam://rungameid/570"
|
||||
);
|
||||
// Idempotent: an already-silent command is left alone.
|
||||
assert_eq!(
|
||||
shape_dedicated_command("steam -silent steam://rungameid/570"),
|
||||
"steam -silent steam://rungameid/570"
|
||||
);
|
||||
// Non-Steam launches and operator custom commands are untouched.
|
||||
assert_eq!(shape_dedicated_command("vkcube"), "vkcube");
|
||||
assert_eq!(
|
||||
shape_dedicated_command("lutris lutris:rungameid/42"),
|
||||
"lutris lutris:rungameid/42"
|
||||
);
|
||||
// A bare `steam` with no URI is left alone (not a game launch).
|
||||
assert_eq!(
|
||||
shape_dedicated_command("steam -bigpicture"),
|
||||
"steam -bigpicture"
|
||||
);
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parses_version_banner() {
|
||||
|
||||
@@ -212,12 +212,11 @@ impl VirtualDisplay for KwinDisplay {
|
||||
});
|
||||
// Layout position (§6.2) is applied by the registry via `apply_position` right after create
|
||||
// (it owns the display group, so it computes auto-row / manual placement over the whole group).
|
||||
Ok(VirtualOutput {
|
||||
Ok(VirtualOutput::owned(
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, achieved_hz)),
|
||||
keepalive: Box::new(StopGuard { stop }),
|
||||
})
|
||||
Some((mode.width, mode.height, achieved_hz)),
|
||||
Box::new(StopGuard { stop }),
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -97,12 +97,11 @@ impl VirtualDisplay for MutterDisplay {
|
||||
h = mode.height,
|
||||
"Mutter virtual monitor ready"
|
||||
);
|
||||
Ok(VirtualOutput {
|
||||
Ok(VirtualOutput::owned(
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode: Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
keepalive: Box::new(StopGuard(stop)),
|
||||
})
|
||||
Some((mode.width, mode.height, mode.refresh_hz)),
|
||||
Box::new(StopGuard(stop)),
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -19,7 +19,7 @@
|
||||
//! `systemctl --user`, see `scripts/headless/prepare-session.sh`), with the ScreenCast
|
||||
//! interface routed to xdpw (`scripts/headless/portals.conf`).
|
||||
|
||||
use super::{Mode, VirtualDisplay, VirtualOutput};
|
||||
use super::{DisplayOwnership, Mode, VirtualDisplay, VirtualOutput};
|
||||
use anyhow::{anyhow, bail, Context, Result};
|
||||
use std::os::fd::OwnedFd;
|
||||
use std::process::Command;
|
||||
@@ -130,6 +130,11 @@ impl VirtualDisplay for WlrootsDisplay {
|
||||
_stop: StopGuard(stop),
|
||||
_output: output,
|
||||
}),
|
||||
// Owned (the compositor output is ours to tear down), but not registry-poolable: the
|
||||
// portal fd can't be re-opened per attach, so the registry passes it through on
|
||||
// `remote_fd.is_some()` (keep-alive stays off for wlroots until fresh-portal re-attach).
|
||||
ownership: DisplayOwnership::Owned,
|
||||
reused_gen: None,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -158,6 +158,22 @@ pub struct Layout {
|
||||
pub positions: BTreeMap<String, Position>,
|
||||
}
|
||||
|
||||
/// How a session that **launches a game** (a library id on the Hello / apps.json / Decky pin) is
|
||||
/// served (`design/gamemode-and-dedicated-sessions.md` §5.2). Orthogonal to the preset/lifecycle axes
|
||||
/// — a top-level [`DisplayPolicy`] field, NOT part of [`EffectivePolicy`], so a preset never clobbers
|
||||
/// it. Linux-only in effect (a launching Windows session opens into the one desktop).
|
||||
#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
|
||||
#[serde(rename_all = "snake_case")]
|
||||
pub enum GameSession {
|
||||
/// Today's routing: the launch rides whatever session the box is in (managed Steam session on
|
||||
/// Bazzite/SteamOS, bare spawn on plain distros, spawned into the live desktop on KWin/Mutter/wlroots).
|
||||
#[default]
|
||||
Auto,
|
||||
/// A launching session always gets its OWN headless gamescope at the client's mode, nesting just
|
||||
/// the game — no Steam Big Picture, no game mode. Degrades to `auto` when gamescope is unavailable.
|
||||
Dedicated,
|
||||
}
|
||||
|
||||
/// A named bundle of the fields below. `Custom` (the default) means the explicit fields rule; any
|
||||
/// other preset ignores the stored fields and expands to its own ([`DisplayPolicy::effective`]).
|
||||
#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
|
||||
@@ -202,6 +218,11 @@ pub struct DisplayPolicy {
|
||||
/// Upper bound on simultaneously-live virtual displays (clamped to `1..=16` on write).
|
||||
#[serde(default = "default_max_displays")]
|
||||
pub max_displays: u32,
|
||||
/// How a game-launching session is served (`design/gamemode-and-dedicated-sessions.md` §5.2).
|
||||
/// Orthogonal to `preset`/lifecycle — preserved across preset changes; `#[serde(default)]` = `Auto`
|
||||
/// so existing `display-settings.json` files are untouched.
|
||||
#[serde(default)]
|
||||
pub game_session: GameSession,
|
||||
}
|
||||
|
||||
fn one() -> u32 {
|
||||
@@ -224,6 +245,7 @@ impl Default for DisplayPolicy {
|
||||
identity: Identity::default(),
|
||||
layout: Layout::default(),
|
||||
max_displays: 4,
|
||||
game_session: GameSession::default(),
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -279,7 +301,11 @@ impl EffectivePolicy {
|
||||
/// transform, factored out pure so arranging displays stays orthogonal to the other axes and is
|
||||
/// unit-tested without touching the global store. (`Custom` so the explicit fields — incl. the new
|
||||
/// layout — rule; a named preset would ignore them.)
|
||||
pub fn with_manual_layout(&self, positions: BTreeMap<String, Position>) -> DisplayPolicy {
|
||||
pub fn with_manual_layout(
|
||||
&self,
|
||||
positions: BTreeMap<String, Position>,
|
||||
game_session: GameSession,
|
||||
) -> DisplayPolicy {
|
||||
DisplayPolicy {
|
||||
version: 1,
|
||||
preset: Preset::Custom,
|
||||
@@ -292,6 +318,8 @@ impl EffectivePolicy {
|
||||
positions,
|
||||
},
|
||||
max_displays: self.max_displays,
|
||||
// Preserve the orthogonal game-session axis (EffectivePolicy doesn't carry it).
|
||||
game_session,
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -398,6 +426,13 @@ impl DisplayPolicyStore {
|
||||
self.configured().map(|p| p.effective())
|
||||
}
|
||||
|
||||
/// The game-session routing axis (`design/gamemode-and-dedicated-sessions.md` §5.2). Orthogonal to
|
||||
/// the preset — read directly off the stored policy (or the default `Auto` when unconfigured), so a
|
||||
/// preset selection never resets it.
|
||||
pub fn game_session(&self) -> GameSession {
|
||||
self.get().game_session
|
||||
}
|
||||
|
||||
/// Persist + adopt a new policy (sanitized first). The in-memory value changes only if the disk
|
||||
/// write succeeds, so a full disk can't leave memory and file disagreeing.
|
||||
pub fn set(&self, policy: DisplayPolicy) -> Result<()> {
|
||||
@@ -560,7 +595,9 @@ mod tests {
|
||||
let mut positions = BTreeMap::new();
|
||||
positions.insert("1".to_string(), Position { x: 0, y: 0 });
|
||||
positions.insert("7".to_string(), Position { x: 2560, y: 0 });
|
||||
let p = eff.with_manual_layout(positions);
|
||||
let p = eff.with_manual_layout(positions, GameSession::Dedicated);
|
||||
// The orthogonal game-session axis is preserved through the layout transform.
|
||||
assert_eq!(p.game_session, GameSession::Dedicated);
|
||||
// Preset drops to Custom so the explicit fields (incl. the layout) rule…
|
||||
assert_eq!(p.preset, Preset::Custom);
|
||||
// …every other behavior axis is preserved verbatim…
|
||||
|
||||
@@ -164,6 +164,28 @@ pub fn release(slot: Option<u64>) -> usize {
|
||||
}
|
||||
}
|
||||
|
||||
/// Tear down a **reused-but-dead** pool entry by its generation stamp (A2). Called by the pipeline
|
||||
/// builder when the first frame fails on a display [`acquire`] handed back as REUSED — so the retry
|
||||
/// loop's next `acquire` creates fresh instead of re-wedging on the same corpse. No-op off Linux / if
|
||||
/// the entry is already gone (idempotent — the subsequent stale-gen lease drop no-ops too).
|
||||
pub fn mark_failed(gen: u64) {
|
||||
#[cfg(target_os = "linux")]
|
||||
linux::mark_failed(gen);
|
||||
#[cfg(not(target_os = "linux"))]
|
||||
let _ = gen;
|
||||
}
|
||||
|
||||
/// Invalidate every kept display of `backend` — its compositor instance is gone (a Game↔Desktop switch
|
||||
/// tore it down), so `/display/state` must stop listing it and its keepalive must be reaped
|
||||
/// (`design/gamemode-and-dedicated-sessions.md` A4). Called from the session-switch watcher / a
|
||||
/// per-connect re-detect that finds the previous backend's compositor gone. No-op off Linux.
|
||||
pub fn invalidate_backend(backend: &str) {
|
||||
#[cfg(target_os = "linux")]
|
||||
linux::invalidate_backend(backend);
|
||||
#[cfg(not(target_os = "linux"))]
|
||||
let _ = backend;
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------------------------
|
||||
// Linux keep-alive pool
|
||||
// ---------------------------------------------------------------------------------------------
|
||||
@@ -202,6 +224,13 @@ mod linux {
|
||||
/// exclusive session); on teardown it hands off to a surviving sibling, and only runs when the
|
||||
/// group's last member drops. `None` for extend/primary and non-first / non-exclusive members.
|
||||
topology_restore: Option<Restore>,
|
||||
/// The launch command this display was created with (`design/gamemode-and-dedicated-sessions.md`
|
||||
/// A2): keep-alive reuse requires an exact match, so a kept spawn running game A never serves a
|
||||
/// session launching game B. `None` = a plain desktop / no nested command.
|
||||
launch: Option<String>,
|
||||
/// The session epoch at creation (A4). Reuse requires an epoch match; the linger timer reaps
|
||||
/// entries whose epoch is stale (their compositor instance was replaced under them).
|
||||
epoch: u64,
|
||||
/// Generation stamp: a [`DisplayLease`] only releases if its gen still matches (a stale lease
|
||||
/// — its entry was reused + re-stamped — is a no-op).
|
||||
gen: u64,
|
||||
@@ -210,6 +239,18 @@ mod linux {
|
||||
/// A per-group topology-restore action (see [`Entry::topology_restore`]).
|
||||
type Restore = Box<dyn FnOnce() + Send>;
|
||||
|
||||
/// The result of the keep-alive reuse lookup (A2 validated reuse): a live kept display was reused,
|
||||
/// a dead one was pulled out (recreate), or nothing matched.
|
||||
enum ReuseOutcome {
|
||||
/// A live kept display — the session-facing output to return.
|
||||
Reused(VirtualOutput),
|
||||
/// A dead kept display, removed from the pool, plus its group restore (run before the corpse's
|
||||
/// keepalive drops); the caller falls through to a fresh create.
|
||||
Dead(Entry, Option<Restore>),
|
||||
/// No matching kept display.
|
||||
Miss,
|
||||
}
|
||||
|
||||
/// Hand off a torn-down display's topology restore (design §6.1 — per-group restore): if a
|
||||
/// same-group (backend) sibling survives in `remaining`, MOVE the restore onto it (a later teardown
|
||||
/// runs it); if the group is now empty, RETURN the action so the caller runs it (before dropping the
|
||||
@@ -245,6 +286,19 @@ mod linux {
|
||||
})
|
||||
}
|
||||
|
||||
/// Does a pooled entry's session `epoch` still match the current one for reuse / expiry purposes?
|
||||
/// The session epoch tracks the box's **active-session (desktop) compositor** instance (KWin /
|
||||
/// Mutter / wlroots) — whose PipeWire node dies with the compositor, so a stale-epoch kept output
|
||||
/// is a corpse. A **gamescope** spawn is the exact opposite: an independent nested session (its own
|
||||
/// group), whose node lives with its own child process, wholly unrelated to whatever desktop /
|
||||
/// game-mode compositor the epoch tracks. So gamescope entries are EXEMPT from the epoch — a desktop
|
||||
/// switch, or a game-mode gamescope restart, must never invalidate a kept dedicated game session
|
||||
/// (review findings #2/#5/#6/#7/#10). Their liveness is the `kept_display_alive` node probe + the B2
|
||||
/// game-exit path + `mark_failed`, not the epoch.
|
||||
fn epoch_matches(backend: &str, entry_epoch: u64, cur_epoch: u64) -> bool {
|
||||
backend == "gamescope" || entry_epoch == cur_epoch
|
||||
}
|
||||
|
||||
/// The linger resolution for Linux: the console policy's `keep_alive` when configured, else
|
||||
/// **Immediate** (today's behavior — a Linux disconnect tears the output down at once).
|
||||
fn linger() -> Linger {
|
||||
@@ -262,9 +316,17 @@ mod linux {
|
||||
fn take_expired(entries: &mut Vec<Entry>, now: Instant) -> (Vec<Entry>, Vec<Restore>) {
|
||||
let mut expired = Vec::new();
|
||||
let mut restores = Vec::new();
|
||||
// A4 backstop: also reap a KEPT (non-Active) DESKTOP display whose session epoch is stale — its
|
||||
// compositor instance was replaced (a Game↔Desktop switch / same-kind restart), so its node id
|
||||
// now means nothing. gamescope spawns are exempt (`epoch_matches` — independent nested sessions).
|
||||
// An Active entry is left to its own session's capture-loss rebuild (which, under the bumped
|
||||
// epoch, won't reuse it); `invalidate_backend` clears a whole desktop backend on a known switch.
|
||||
let cur_epoch = crate::vdisplay::session_epoch();
|
||||
let mut i = 0;
|
||||
while i < entries.len() {
|
||||
if entries[i].life.poll_expiry(now) {
|
||||
let dead_epoch = !epoch_matches(entries[i].backend, entries[i].epoch, cur_epoch)
|
||||
&& !matches!(entries[i].life, lifecycle::State::Active { .. });
|
||||
if entries[i].life.poll_expiry(now) || dead_epoch {
|
||||
let mut e = entries.remove(i);
|
||||
let backend = e.backend;
|
||||
if let Some(r) = hand_off_restore(entries, backend, e.topology_restore.take()) {
|
||||
@@ -312,13 +374,18 @@ mod linux {
|
||||
preferred_mode: Option<(u32, u32, u32)>,
|
||||
gen: u64,
|
||||
quit: Arc<AtomicBool>,
|
||||
reused: bool,
|
||||
) -> VirtualOutput {
|
||||
VirtualOutput {
|
||||
// The pooled display is registry-owned; the session holds a gen-stamped lease as its keepalive.
|
||||
let mut out = VirtualOutput::owned(
|
||||
node_id,
|
||||
remote_fd: None,
|
||||
preferred_mode,
|
||||
keepalive: Box::new(DisplayLease { gen, quit }),
|
||||
}
|
||||
Box::new(DisplayLease { gen, quit }),
|
||||
);
|
||||
// A2: tell the pipeline builder this was a REUSED kept display, so a first-frame failure can
|
||||
// `mark_failed(gen)` (tear the corpse down) rather than re-wedge the retry loop on the same node.
|
||||
out.reused_gen = reused.then_some(gen);
|
||||
out
|
||||
}
|
||||
|
||||
pub(super) fn acquire(
|
||||
@@ -328,6 +395,10 @@ mod linux {
|
||||
) -> Result<VirtualOutput> {
|
||||
ensure_timer();
|
||||
let backend = vd.name();
|
||||
// A2 reuse key: the launch command this acquire carries (a kept spawn running game A must never
|
||||
// be reused for a session launching game B). A4 reuse key: the current session epoch.
|
||||
let launch = vd.launch_command();
|
||||
let cur_epoch = crate::vdisplay::session_epoch();
|
||||
let r = reg();
|
||||
|
||||
// Reap expired first (run any group restores + drop outside the lock).
|
||||
@@ -340,28 +411,94 @@ mod linux {
|
||||
}
|
||||
drop(expired);
|
||||
|
||||
// Reuse: a kept (lingering/pinned) display of the same backend + mode. A reconnecting session
|
||||
// re-attaches a fresh PipeWire consumer to the still-live `node_id`.
|
||||
{
|
||||
let mut es = r.entries.lock().unwrap();
|
||||
if let Some(e) = es.iter_mut().find(|e| {
|
||||
matches!(
|
||||
e.life,
|
||||
lifecycle::State::Lingering { .. } | lifecycle::State::Pinned
|
||||
) && e.backend == backend
|
||||
&& e.mode == mode
|
||||
}) {
|
||||
// Lingering/Pinned → Active (Acquire::Reuse); side effect matters, value is known.
|
||||
e.life.acquire();
|
||||
let gen = r.gen.fetch_add(1, Ordering::Relaxed);
|
||||
e.gen = gen;
|
||||
let out = output_for(e.node_id, e.preferred_mode, gen, quit);
|
||||
tracing::info!(
|
||||
backend,
|
||||
node_id = e.node_id,
|
||||
"virtual display reused (keep-alive reconnect)"
|
||||
);
|
||||
return Ok(out);
|
||||
// Reuse: a kept (lingering/pinned) display of the same backend + mode + launch + epoch. A
|
||||
// reconnecting session re-attaches a fresh PipeWire consumer to the still-live `node_id`. Gated
|
||||
// on `vd.poolable_now()` (A1): a gamescope managed/attach acquire must NOT reuse a kept bare-spawn
|
||||
// (they share the backend name `"gamescope"`); its `create` builds a `SessionManaged`/`External`
|
||||
// output that passes through below.
|
||||
if vd.poolable_now() {
|
||||
// Reuse a kept display, matching backend + mode + launch (+ epoch for the desktop backends;
|
||||
// gamescope spawns are independent nested sessions, exempt from the active-session epoch —
|
||||
// see `epoch_matches`). The liveness probe (`kept_display_alive`, which may shell `pw-dump`
|
||||
// for gamescope) must NOT run under the pool lock (it can block / hang the daemon), so:
|
||||
// 1. find the candidate + snapshot (gen, node_id) UNDER the lock, then release it;
|
||||
// 2. probe liveness OUTSIDE the lock;
|
||||
// 3. re-lock and re-find the SAME entry by its gen (another thread may have reused/removed
|
||||
// it meanwhile — then we just miss and create fresh).
|
||||
let candidate = {
|
||||
let es = r.entries.lock().unwrap();
|
||||
es.iter()
|
||||
.find(|e| {
|
||||
matches!(
|
||||
e.life,
|
||||
lifecycle::State::Lingering { .. } | lifecycle::State::Pinned
|
||||
) && e.backend == backend
|
||||
&& e.mode == mode
|
||||
&& e.launch == launch
|
||||
&& epoch_matches(e.backend, e.epoch, cur_epoch)
|
||||
})
|
||||
.map(|e| (e.gen, e.node_id))
|
||||
};
|
||||
if let Some((cand_gen, node_id)) = candidate {
|
||||
let alive = vd.kept_display_alive(node_id); // OUTSIDE the lock (may block)
|
||||
let reuse = {
|
||||
let mut es = r.entries.lock().unwrap();
|
||||
// Re-find the SAME entry by its snapshot gen; skip if it's gone or no longer kept
|
||||
// (a concurrent reconnect adopted it) — we then miss and create fresh.
|
||||
match es.iter().position(|e| {
|
||||
e.gen == cand_gen
|
||||
&& matches!(
|
||||
e.life,
|
||||
lifecycle::State::Lingering { .. } | lifecycle::State::Pinned
|
||||
)
|
||||
}) {
|
||||
Some(idx) if alive => {
|
||||
es[idx].life.acquire();
|
||||
let gen = r.gen.fetch_add(1, Ordering::Relaxed);
|
||||
es[idx].gen = gen;
|
||||
let preferred_mode = es[idx].preferred_mode;
|
||||
tracing::info!(
|
||||
backend,
|
||||
node_id,
|
||||
"virtual display reused (keep-alive reconnect)"
|
||||
);
|
||||
ReuseOutcome::Reused(output_for(
|
||||
node_id,
|
||||
preferred_mode,
|
||||
gen,
|
||||
quit.clone(),
|
||||
true,
|
||||
))
|
||||
}
|
||||
Some(idx) => {
|
||||
// Dead kept display: remove it, hand off its group restore, create fresh.
|
||||
let mut dead = es.remove(idx);
|
||||
let restore = hand_off_restore(
|
||||
&mut es,
|
||||
dead.backend,
|
||||
dead.topology_restore.take(),
|
||||
);
|
||||
ReuseOutcome::Dead(dead, restore)
|
||||
}
|
||||
None => ReuseOutcome::Miss, // adopted/removed by another thread
|
||||
}
|
||||
};
|
||||
match reuse {
|
||||
ReuseOutcome::Reused(out) => return Ok(out),
|
||||
ReuseOutcome::Dead(dead, restore) => {
|
||||
// Outside the lock: re-enable physicals (if the group emptied) then drop the
|
||||
// corpse's keepalive (may block) — then fall through to a fresh create below.
|
||||
if let Some(rst) = restore {
|
||||
rst();
|
||||
}
|
||||
tracing::info!(
|
||||
backend,
|
||||
"virtual display: kept display was dead — recreating (validated reuse)"
|
||||
);
|
||||
drop(dead);
|
||||
}
|
||||
ReuseOutcome::Miss => {}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -381,13 +518,18 @@ mod linux {
|
||||
// the group arrangement (manual per-slot positions) + the state slot.
|
||||
let identity_slot = vd.last_identity_slot();
|
||||
|
||||
// wlroots (remote_fd = Some, sandboxed xdpw portal) can't be kept without re-opening the
|
||||
// portal fd per attach — pass it through unchanged (capturer owns it, teardown on drop). The
|
||||
// poolable backends put their node on the default daemon (remote_fd = None).
|
||||
if real.remote_fd.is_some() {
|
||||
// Pool ONLY a registry-owned display on the default PipeWire daemon
|
||||
// (design/gamemode-and-dedicated-sessions.md A1). Pass through, unchanged (capturer owns the
|
||||
// keepalive, teardown on drop), everything else:
|
||||
// * `External`/`SessionManaged` — gamescope attach / managed session: the gamescope module
|
||||
// owns their lifecycle (its own restore machinery), so the registry must not keep them
|
||||
// (the stale-node reuse wedge). Their unit keepalive tears nothing down on drop.
|
||||
// * `remote_fd = Some` — wlroots' sandboxed xdpw portal fd can't be re-opened per attach.
|
||||
if real.ownership != crate::vdisplay::DisplayOwnership::Owned || real.remote_fd.is_some() {
|
||||
tracing::debug!(
|
||||
backend,
|
||||
"virtual display not poolable (portal fd) — keep-alive off for this backend"
|
||||
ownership = ?real.ownership,
|
||||
"virtual display not registry-poolable — keep-alive off (owner keeps it / portal fd)"
|
||||
);
|
||||
return Ok(real);
|
||||
}
|
||||
@@ -410,6 +552,8 @@ mod linux {
|
||||
backend,
|
||||
identity_slot,
|
||||
topology_restore,
|
||||
launch: launch.clone(),
|
||||
epoch: cur_epoch,
|
||||
gen,
|
||||
};
|
||||
|
||||
@@ -455,7 +599,7 @@ mod linux {
|
||||
if (position.x, position.y) != (0, 0) {
|
||||
vd.apply_position(position.x, position.y);
|
||||
}
|
||||
Ok(output_for(node_id, preferred_mode, gen, quit))
|
||||
Ok(output_for(node_id, preferred_mode, gen, quit, false))
|
||||
}
|
||||
|
||||
/// The [`DisplayLease`] `Drop` path: release the session's hold on the pooled display. The
|
||||
@@ -704,6 +848,71 @@ mod linux {
|
||||
n
|
||||
}
|
||||
|
||||
/// A2 — tear down a reused-but-dead pool entry by its generation stamp. Removes it (hand off /
|
||||
/// run its group restore), drops the keepalive outside the lock. Idempotent (already gone → no-op).
|
||||
pub(super) fn mark_failed(gen: u64) {
|
||||
let Some(r) = REG.get() else { return };
|
||||
let (torn, restore) = {
|
||||
let mut es = r.entries.lock().unwrap();
|
||||
let Some(idx) = es.iter().position(|e| e.gen == gen) else {
|
||||
return; // already gone — the subsequent stale-gen lease drop no-ops too
|
||||
};
|
||||
let mut e = es.remove(idx);
|
||||
let backend = e.backend;
|
||||
let restore = hand_off_restore(&mut es, backend, e.topology_restore.take());
|
||||
(e, restore)
|
||||
};
|
||||
if let Some(rst) = restore {
|
||||
rst(); // outside the lock, before the keepalive drops
|
||||
}
|
||||
tracing::warn!(
|
||||
backend = torn.backend,
|
||||
"virtual display: reused kept display was dead on first frame — torn down (A2 mark_failed)"
|
||||
);
|
||||
drop(torn); // keepalive Drop outside the lock (may block)
|
||||
}
|
||||
|
||||
/// A4 — invalidate every kept display of `backend` (its compositor instance is gone). Removes them
|
||||
/// all (any lifecycle state — a dead compositor's Active entries are doomed too; their sessions
|
||||
/// rebuild), runs/hands off group restores, drops keepalives outside the lock (they hit dead
|
||||
/// sockets and fail fast). Mirrors `force_release`'s shape but selects by backend, not slot/state.
|
||||
pub(super) fn invalidate_backend(backend: &str) {
|
||||
let Some(r) = REG.get() else { return };
|
||||
let (removed, restores) = {
|
||||
let mut es = r.entries.lock().unwrap();
|
||||
let mut out = Vec::new();
|
||||
let mut restores = Vec::new();
|
||||
let mut i = 0;
|
||||
while i < es.len() {
|
||||
if es[i].backend == backend {
|
||||
let mut e = es.remove(i);
|
||||
let b = e.backend;
|
||||
if let Some(rst) = hand_off_restore(&mut es, b, e.topology_restore.take()) {
|
||||
restores.push(rst);
|
||||
}
|
||||
out.push(e);
|
||||
} else {
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
(out, restores)
|
||||
};
|
||||
if removed.is_empty() {
|
||||
return;
|
||||
}
|
||||
for restore in restores {
|
||||
restore();
|
||||
}
|
||||
tracing::info!(
|
||||
backend,
|
||||
count = removed.len(),
|
||||
"virtual displays invalidated — compositor instance gone (A4 session switch)"
|
||||
);
|
||||
for e in removed {
|
||||
drop(e); // outside the lock
|
||||
}
|
||||
}
|
||||
|
||||
/// The session's refcount handle — the `keepalive` the capturer holds. `Drop` releases the
|
||||
/// registry hold; a stale lease (its entry was reused + re-stamped, or torn down) is a no-op.
|
||||
struct DisplayLease {
|
||||
@@ -744,6 +953,8 @@ mod linux {
|
||||
backend,
|
||||
identity_slot: None,
|
||||
topology_restore: restore,
|
||||
launch: None,
|
||||
epoch: 0,
|
||||
gen,
|
||||
}
|
||||
}
|
||||
|
||||
@@ -31,7 +31,7 @@ use windows::Win32::System::Threading::{
|
||||
CreateMutexW, OpenProcess, WaitForSingleObject, PROCESS_SYNCHRONIZE,
|
||||
};
|
||||
|
||||
use super::{Mode, VirtualOutput};
|
||||
use super::{DisplayOwnership, Mode, VirtualOutput};
|
||||
use crate::win_display::{
|
||||
force_extend_topology, isolate_displays_ccd, resolve_gdi_name, restore_displays_ccd,
|
||||
set_active_mode, set_virtual_primary_ccd, SavedConfig,
|
||||
@@ -531,6 +531,9 @@ impl VirtualDisplayManager {
|
||||
mgr: self,
|
||||
gen: mon.gen,
|
||||
}),
|
||||
// The Windows manager owns the monitor lifecycle (refcount/linger/pin), so the registry
|
||||
// (which delegates to it via `vd.create`) treats it as Owned.
|
||||
ownership: DisplayOwnership::Owned,
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user