refactor(windows-host): confine platform code under windows/ + linux/ folders (Goal-1 stage 6)
Move 36 platform-specific files into per-module `windows/` and `linux/` subfolders (and the
shared HID codecs into `inject/proto/`):
capture/{windows,linux}/ encode/{windows,linux}/ inject/{windows,linux,proto}/
audio/{windows,linux}/ vdisplay/{windows,linux}/
src/windows/ (service, wgc_helper, win_adapter, win_display)
src/linux/ (dmabuf_fence, drm_sync, zerocopy/)
Done with `#[path]`, NOT a module rename: every file moves into its folder while the
`crate::*::*` module names stay FLAT, so all caller paths and every internal `super::`/`crate::`
reference are unchanged — only the parent `mod` decls gained `#[path = "..."]`. This is the
codebase's existing pattern (inject's gamepad_windows) and makes the move byte-identical in
behaviour with ZERO reference churn, far lower risk than collapsing to a single
`crate::capture::windows::` namespace (that deeper rename is an optional follow-on; this delivers
the cfg-sprawl folder confinement the stage is about). Done LAST, after the semantic stages, so
the path churn didn't fight them.
Verified: Linux cargo check + clippy (-D warnings) clean; my mod-decl changes fmt-clean (the 3
remaining fmt diffs are pre-existing local-rustfmt-version skew that moved with their files); all
36 `#[path]` targets exist; no internal `#[path]`/`include!`/file-child-mod in any moved file
(the inline `mod X {` blocks are self-contained). Box build to follow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,207 @@
|
||||
//! Force-composed-flip overlay (Windows) — make the secure (Winlogon: UAC / lock / login) desktop
|
||||
//! capturable by Desktop Duplication.
|
||||
//!
|
||||
//! The secure desktop's dialog/wallpaper presents via **fullscreen independent-flip / MPO**: it scans
|
||||
//! out directly, bypassing DWM composition, so `IDXGIOutputDuplication::AcquireNextFrame` returns
|
||||
//! `DXGI_ERROR_ACCESS_LOST` (born-lost) — there is no composed frame to hand out (the client sees
|
||||
//! black). Independent-flip requires the presenting app to own the ENTIRE output: putting ANY other
|
||||
//! visible window on that output disqualifies it, forcing DWM to **composite**, which DDA can then
|
||||
//! capture. So we keep a tiny, click-through, near-invisible **topmost layered window** alive on the
|
||||
//! *current input desktop* (which is Winlogon while the secure desktop is up). On a desktop switch the
|
||||
//! window is orphaned, so a dedicated thread tracks the input desktop and recreates it there.
|
||||
//!
|
||||
//! This is the non-input alternative to "tap a key to wake the lock screen": it needs no SendInput and
|
||||
//! no system-wide registry change (it does NOT disable MPO globally — it only nudges OUR output to
|
||||
//! composed while a session is live). Effectiveness can be build/driver-dependent; gated by
|
||||
//! `PUNKTFUNK_FORCE_COMPOSED` (default ON; set =0 to disable).
|
||||
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::Arc;
|
||||
use windows::core::w;
|
||||
use windows::Win32::Foundation::{HWND, LPARAM, LRESULT, WPARAM};
|
||||
use windows::Win32::System::LibraryLoader::GetModuleHandleW;
|
||||
use windows::Win32::System::StationsAndDesktops::{
|
||||
CloseDesktop, GetUserObjectInformationW, OpenInputDesktop, SetThreadDesktop,
|
||||
DESKTOP_ACCESS_FLAGS, DESKTOP_CONTROL_FLAGS, UOI_NAME,
|
||||
};
|
||||
use windows::Win32::UI::WindowsAndMessaging::{
|
||||
CreateWindowExW, DefWindowProcW, DestroyWindow, DispatchMessageW, PeekMessageW, RegisterClassW,
|
||||
SetLayeredWindowAttributes, SetWindowPos, ShowWindow, TranslateMessage, HWND_TOPMOST,
|
||||
LWA_ALPHA, MSG, PM_REMOVE, SWP_NOACTIVATE, SWP_NOMOVE, SWP_NOSIZE, SW_SHOWNOACTIVATE,
|
||||
WNDCLASSW, WS_EX_LAYERED, WS_EX_NOACTIVATE, WS_EX_TOOLWINDOW, WS_EX_TOPMOST, WS_EX_TRANSPARENT,
|
||||
WS_POPUP,
|
||||
};
|
||||
|
||||
/// A running force-composed-flip overlay. Drop signals the thread to tear down its window + exit.
|
||||
pub struct ForceComposedFlip {
|
||||
stop: Arc<AtomicBool>,
|
||||
}
|
||||
|
||||
impl ForceComposedFlip {
|
||||
/// Start the overlay (no-op + `None` if disabled via `PUNKTFUNK_FORCE_COMPOSED=0`).
|
||||
pub fn start() -> Option<Self> {
|
||||
if std::env::var("PUNKTFUNK_FORCE_COMPOSED").as_deref() == Ok("0") {
|
||||
tracing::info!("force-composed-flip overlay disabled (PUNKTFUNK_FORCE_COMPOSED=0)");
|
||||
return None;
|
||||
}
|
||||
let stop = Arc::new(AtomicBool::new(false));
|
||||
let st = stop.clone();
|
||||
std::thread::Builder::new()
|
||||
.name("composed-flip".into())
|
||||
.spawn(move || unsafe { run(st) })
|
||||
.ok()?;
|
||||
tracing::info!("force-composed-flip overlay started (Winlogon-aware)");
|
||||
Some(ForceComposedFlip { stop })
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for ForceComposedFlip {
|
||||
fn drop(&mut self) {
|
||||
self.stop.store(true, Ordering::Relaxed);
|
||||
}
|
||||
}
|
||||
|
||||
extern "system" fn wndproc(hwnd: HWND, msg: u32, wp: WPARAM, lp: LPARAM) -> LRESULT {
|
||||
unsafe { DefWindowProcW(hwnd, msg, wp, lp) }
|
||||
}
|
||||
|
||||
/// Read the current input-desktop name (e.g. "Default" / "Winlogon"); `None` if it can't be read.
|
||||
unsafe fn input_desktop_name() -> Option<String> {
|
||||
let desk = OpenInputDesktop(
|
||||
DESKTOP_CONTROL_FLAGS(0),
|
||||
false,
|
||||
DESKTOP_ACCESS_FLAGS(0x0001),
|
||||
)
|
||||
.ok()?;
|
||||
let mut buf = [0u16; 64];
|
||||
let mut needed = 0u32;
|
||||
let ok = GetUserObjectInformationW(
|
||||
windows::Win32::Foundation::HANDLE(desk.0),
|
||||
UOI_NAME,
|
||||
Some(buf.as_mut_ptr() as *mut _),
|
||||
(buf.len() * 2) as u32,
|
||||
Some(&mut needed),
|
||||
)
|
||||
.is_ok();
|
||||
let _ = CloseDesktop(desk);
|
||||
if !ok {
|
||||
return None;
|
||||
}
|
||||
Some(
|
||||
String::from_utf16_lossy(&buf)
|
||||
.trim_end_matches('\u{0}')
|
||||
.to_string(),
|
||||
)
|
||||
}
|
||||
|
||||
/// Create the tiny topmost layered click-through window on the CURRENT thread's desktop. Caller must
|
||||
/// have `SetThreadDesktop`'d to the target input desktop first.
|
||||
unsafe fn make_overlay() -> Option<HWND> {
|
||||
let hinst = GetModuleHandleW(None).ok()?;
|
||||
let class = w!("PunktfunkComposedFlip");
|
||||
// RegisterClassW is idempotent-ish: a second register for the same name fails harmlessly; we
|
||||
// ignore the result and rely on the class existing. (One process, so it registers once.)
|
||||
let wc = WNDCLASSW {
|
||||
lpfnWndProc: Some(wndproc),
|
||||
hInstance: hinst.into(),
|
||||
lpszClassName: class,
|
||||
..Default::default()
|
||||
};
|
||||
let atom = RegisterClassW(&wc);
|
||||
if atom == 0 {
|
||||
let e = windows::Win32::Foundation::GetLastError();
|
||||
// 1410 = ERROR_CLASS_ALREADY_EXISTS is fine (re-register after a desktop switch).
|
||||
if e.0 != 1410 {
|
||||
tracing::warn!(err = e.0, "force-composed-flip: RegisterClassW failed");
|
||||
}
|
||||
}
|
||||
let hwnd = match CreateWindowExW(
|
||||
WS_EX_LAYERED | WS_EX_TRANSPARENT | WS_EX_TOPMOST | WS_EX_NOACTIVATE | WS_EX_TOOLWINDOW,
|
||||
class,
|
||||
w!(""),
|
||||
WS_POPUP,
|
||||
0,
|
||||
0,
|
||||
1,
|
||||
1,
|
||||
None,
|
||||
None,
|
||||
Some(hinst.into()),
|
||||
None,
|
||||
) {
|
||||
Ok(h) => h,
|
||||
Err(e) => {
|
||||
let le = windows::Win32::Foundation::GetLastError();
|
||||
tracing::warn!(err = %format!("{e:?}"), last = le.0,
|
||||
"force-composed-flip: CreateWindowExW failed");
|
||||
return None;
|
||||
}
|
||||
};
|
||||
// alpha=1: technically visible (so it disqualifies independent-flip) but imperceptible.
|
||||
let _ = SetLayeredWindowAttributes(hwnd, windows::Win32::Foundation::COLORREF(0), 1, LWA_ALPHA);
|
||||
let _ = ShowWindow(hwnd, SW_SHOWNOACTIVATE);
|
||||
let _ = SetWindowPos(
|
||||
hwnd,
|
||||
Some(HWND_TOPMOST),
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE,
|
||||
);
|
||||
Some(hwnd)
|
||||
}
|
||||
|
||||
unsafe fn run(stop: Arc<AtomicBool>) {
|
||||
let mut cur_desktop: Option<String> = None;
|
||||
let mut hwnd: Option<HWND> = None;
|
||||
let mut ticks: u32 = 0;
|
||||
while !stop.load(Ordering::Relaxed) {
|
||||
// Follow the input desktop: if it changed (Default↔Winlogon), re-attach this thread and
|
||||
// recreate the window there (a window is bound to the desktop it was created on).
|
||||
let name = input_desktop_name();
|
||||
if name != cur_desktop {
|
||||
if let Some(h) = hwnd.take() {
|
||||
let _ = DestroyWindow(h);
|
||||
}
|
||||
if let Ok(desk) = OpenInputDesktop(
|
||||
DESKTOP_CONTROL_FLAGS(0),
|
||||
false,
|
||||
DESKTOP_ACCESS_FLAGS(0x1000_0000), // GENERIC_ALL (incl. DESKTOP_CREATEWINDOW=0x0002)
|
||||
) {
|
||||
if SetThreadDesktop(desk).is_ok() {
|
||||
hwnd = make_overlay();
|
||||
tracing::info!(desktop = ?name, created = hwnd.is_some(),
|
||||
"force-composed-flip: overlay (re)created on input desktop");
|
||||
}
|
||||
// Leak `desk` while it's the thread desktop (closing the current thread desktop is UB).
|
||||
}
|
||||
cur_desktop = name;
|
||||
}
|
||||
// Re-assert topmost periodically (other windows on the secure desktop can push us down) and
|
||||
// pump our message queue so the window stays responsive/composited.
|
||||
if let Some(h) = hwnd {
|
||||
let _ = SetWindowPos(
|
||||
h,
|
||||
Some(HWND_TOPMOST),
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE,
|
||||
);
|
||||
let mut msg = MSG::default();
|
||||
while PeekMessageW(&mut msg, Some(h), 0, 0, PM_REMOVE).as_bool() {
|
||||
let _ = TranslateMessage(&msg);
|
||||
DispatchMessageW(&msg);
|
||||
}
|
||||
}
|
||||
ticks = ticks.wrapping_add(1);
|
||||
let _ = ticks;
|
||||
std::thread::sleep(std::time::Duration::from_millis(200));
|
||||
}
|
||||
if let Some(h) = hwnd.take() {
|
||||
let _ = DestroyWindow(h);
|
||||
}
|
||||
tracing::info!("force-composed-flip overlay stopped");
|
||||
}
|
||||
@@ -0,0 +1,134 @@
|
||||
//! Input-desktop watcher (Windows) — the authoritative "normal vs secure desktop" signal for the
|
||||
//! two-process secure-desktop design (docs/windows-secure-desktop.md).
|
||||
//!
|
||||
//! Windows switches the *input desktop* to "Winlogon" (the secure desktop) for UAC elevation, the
|
||||
//! lock screen and the login screen, and back to "Default" for the normal session. WGC captures only
|
||||
//! the normal desktop; DDA-as-SYSTEM captures the secure one. A dedicated thread polls the input
|
||||
//! desktop's NAME (WTS session notifications miss UAC entirely, so the name is the reliable signal)
|
||||
//! and publishes it as an atomic the capture mux + input path read.
|
||||
|
||||
use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
|
||||
use std::sync::Arc;
|
||||
use std::time::Duration;
|
||||
use windows::Win32::Foundation::HANDLE;
|
||||
use windows::Win32::System::StationsAndDesktops::{
|
||||
CloseDesktop, GetUserObjectInformationW, OpenInputDesktop, DESKTOP_ACCESS_FLAGS,
|
||||
DESKTOP_CONTROL_FLAGS, UOI_NAME,
|
||||
};
|
||||
|
||||
/// The normal interactive desktop ("Default") — WGC capture applies.
|
||||
pub const DESKTOP_NORMAL: u8 = 0;
|
||||
/// The secure desktop ("Winlogon": UAC / lock / login) — DDA-as-SYSTEM capture applies.
|
||||
pub const DESKTOP_SECURE: u8 = 1;
|
||||
|
||||
/// Polls the input-desktop name on its own thread and publishes [`DESKTOP_NORMAL`]/[`DESKTOP_SECURE`].
|
||||
pub struct DesktopWatcher {
|
||||
state: Arc<AtomicU8>,
|
||||
stop: Arc<AtomicBool>,
|
||||
}
|
||||
|
||||
impl DesktopWatcher {
|
||||
pub fn start() -> Self {
|
||||
// Compute the CURRENT desktop synchronously before returning, so the first reader (the capture
|
||||
// mux) sees the real state immediately. Otherwise a session that begins already on the secure
|
||||
// desktop (e.g. a reconnect to a locked box) would read DESKTOP_NORMAL for the first poll
|
||||
// interval and relay one stale normal-desktop frame — the "flash of the login screen" bug.
|
||||
let initial = if unsafe { is_secure_desktop() } {
|
||||
DESKTOP_SECURE
|
||||
} else {
|
||||
DESKTOP_NORMAL
|
||||
};
|
||||
let state = Arc::new(AtomicU8::new(initial));
|
||||
let stop = Arc::new(AtomicBool::new(false));
|
||||
let s = state.clone();
|
||||
let st = stop.clone();
|
||||
let _ = std::thread::Builder::new()
|
||||
.name("desktop-watch".into())
|
||||
.spawn(move || {
|
||||
// Debounce: only publish a change after the raw reading has been stable for several
|
||||
// polls. The input desktop flaps Default↔Winlogon transiently during a lock/UAC
|
||||
// transition; publishing every flap makes the capture mux thrash (rebuild storms).
|
||||
const STABLE_POLLS: u32 = 4; // ~80ms
|
||||
let mut published = initial;
|
||||
let mut candidate = initial;
|
||||
let mut stable = 0u32;
|
||||
while !st.load(Ordering::Relaxed) {
|
||||
let v = if unsafe { is_secure_desktop() } {
|
||||
DESKTOP_SECURE
|
||||
} else {
|
||||
DESKTOP_NORMAL
|
||||
};
|
||||
if v == candidate {
|
||||
stable = stable.saturating_add(1);
|
||||
} else {
|
||||
candidate = v;
|
||||
stable = 1;
|
||||
}
|
||||
if stable >= STABLE_POLLS && candidate != published {
|
||||
s.store(candidate, Ordering::Release);
|
||||
published = candidate;
|
||||
tracing::info!(
|
||||
desktop = if candidate == DESKTOP_SECURE {
|
||||
"Winlogon(secure)"
|
||||
} else {
|
||||
"Default"
|
||||
},
|
||||
"input desktop changed (debounced)"
|
||||
);
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(20));
|
||||
}
|
||||
});
|
||||
DesktopWatcher { state, stop }
|
||||
}
|
||||
|
||||
/// The shared atomic ([`DESKTOP_NORMAL`]/[`DESKTOP_SECURE`]) for the capture mux to read.
|
||||
pub fn state(&self) -> Arc<AtomicU8> {
|
||||
self.state.clone()
|
||||
}
|
||||
|
||||
/// True when the secure (Winlogon) desktop is the input desktop right now.
|
||||
pub fn is_secure(&self) -> bool {
|
||||
self.state.load(Ordering::Acquire) == DESKTOP_SECURE
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for DesktopWatcher {
|
||||
fn drop(&mut self) {
|
||||
self.stop.store(true, Ordering::Relaxed);
|
||||
}
|
||||
}
|
||||
|
||||
/// True if the current input desktop is "Winlogon" (the secure desktop). Best-effort: if the desktop
|
||||
/// can't be opened or named, report not-secure (the safe default — keep WGC/normal capture).
|
||||
pub(crate) unsafe fn is_secure_desktop() -> bool {
|
||||
let desk = match OpenInputDesktop(
|
||||
DESKTOP_CONTROL_FLAGS(0),
|
||||
false,
|
||||
DESKTOP_ACCESS_FLAGS(DESKTOP_READOBJECTS),
|
||||
) {
|
||||
Ok(d) => d,
|
||||
Err(_) => return false,
|
||||
};
|
||||
let mut buf = [0u16; 64];
|
||||
let mut needed = 0u32;
|
||||
let ok = GetUserObjectInformationW(
|
||||
HANDLE(desk.0),
|
||||
UOI_NAME,
|
||||
Some(buf.as_mut_ptr() as *mut _),
|
||||
(buf.len() * 2) as u32,
|
||||
Some(&mut needed),
|
||||
)
|
||||
.is_ok();
|
||||
let _ = CloseDesktop(desk);
|
||||
if !ok {
|
||||
return false;
|
||||
}
|
||||
let name = String::from_utf16_lossy(&buf);
|
||||
name.trim_end_matches('\u{0}')
|
||||
.eq_ignore_ascii_case("Winlogon")
|
||||
}
|
||||
|
||||
/// `DESKTOP_READOBJECTS` access right (the windows crate exposes it as a typed flag; we need the raw
|
||||
/// bit for `OpenInputDesktop`'s access mask).
|
||||
const DESKTOP_READOBJECTS: u32 = 0x0001;
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,786 @@
|
||||
//! Windows.Graphics.Capture (WGC) capture backend — the HDR/animation-correct path.
|
||||
//!
|
||||
//! Why WGC over DXGI Desktop Duplication: DDA duplicates only the DWM-composed primary surface, so
|
||||
//! HDR desktop animations the OS routes onto hardware overlay / independent-flip / MPO planes (Start
|
||||
//! menu, Win11 Mica/acrylic, window resize) never enter the surface DDA reads — the stream shows a
|
||||
//! frozen desktop ("broken HDR animations"). Engaging WGC capture pulls that content back through DWM
|
||||
//! composition, so the surface WGC hands back contains the animations. WGC also has no
|
||||
//! ACCESS_LOST-on-overlay-flip churn.
|
||||
//!
|
||||
//! It reuses the rest of the pipeline UNCHANGED: the frame's GPU texture (the OS already composited
|
||||
//! the cursor into it — `IsCursorCaptureEnabled(true)`) goes through the same scRGB→BT.2020-PQ shader
|
||||
//! ([`super::dxgi::HdrConverter`]) into a host-owned `R10G10B10A2` texture (HDR) or is copied into a
|
||||
//! BGRA texture (SDR), which is handed to NVENC zero-copy (registered by pointer, encoded in place).
|
||||
//! Shares the D3D11 device with NVENC via `FramePayload::D3d11`.
|
||||
//!
|
||||
//! Limitation: WGC cannot capture the secure desktop (lock / UAC / login) — the caller falls back to
|
||||
//! the DDA backend ([`super::dxgi::DuplCapturer`]) for those (see capture.rs).
|
||||
|
||||
use super::dxgi::{
|
||||
find_output, hdr_shader_p010_enabled, make_device, nudge_cursor_onto, D3d11Frame, HdrConverter,
|
||||
HdrP010Converter, VideoConverter, WinCaptureTarget,
|
||||
};
|
||||
use super::{CapturedFrame, Capturer, FramePayload, PixelFormat};
|
||||
use anyhow::{bail, Context, Result};
|
||||
use std::collections::VecDeque;
|
||||
use std::sync::atomic::{AtomicU64, Ordering};
|
||||
use std::sync::{Arc, Condvar, Mutex};
|
||||
use std::time::{Duration, Instant};
|
||||
use windows::core::{IInspectable, Interface};
|
||||
use windows::Foundation::{TimeSpan, TypedEventHandler};
|
||||
use windows::Graphics::Capture::{
|
||||
Direct3D11CaptureFrame, Direct3D11CaptureFramePool, GraphicsCaptureItem, GraphicsCaptureSession,
|
||||
};
|
||||
use windows::Graphics::DirectX::DirectXPixelFormat;
|
||||
use windows::Win32::Foundation::{CloseHandle, HANDLE};
|
||||
use windows::Win32::Graphics::Direct3D11::{
|
||||
ID3D11Device, ID3D11DeviceContext, ID3D11RenderTargetView, ID3D11ShaderResourceView,
|
||||
ID3D11Texture2D, D3D11_BIND_RENDER_TARGET, D3D11_BIND_SHADER_RESOURCE, D3D11_TEXTURE2D_DESC,
|
||||
D3D11_USAGE_DEFAULT,
|
||||
};
|
||||
use windows::Win32::Graphics::Dxgi::Common::{
|
||||
DXGI_COLOR_SPACE_RGB_FULL_G2084_NONE_P2020, DXGI_FORMAT_R10G10B10A2_UNORM,
|
||||
DXGI_FORMAT_R16G16B16A16_FLOAT, DXGI_SAMPLE_DESC,
|
||||
};
|
||||
use windows::Win32::Graphics::Dxgi::{IDXGIDevice, IDXGIOutput6};
|
||||
use windows::Win32::Security::{ImpersonateLoggedOnUser, RevertToSelf};
|
||||
use windows::Win32::System::RemoteDesktop::{WTSGetActiveConsoleSessionId, WTSQueryUserToken};
|
||||
use windows::Win32::System::WinRT::Direct3D11::{
|
||||
CreateDirect3D11DeviceFromDXGIDevice, IDirect3DDxgiInterfaceAccess,
|
||||
};
|
||||
use windows::Win32::System::WinRT::Graphics::Capture::IGraphicsCaptureItemInterop;
|
||||
use windows::Win32::System::WinRT::{RoInitialize, RO_INIT_MULTITHREADED};
|
||||
|
||||
/// Output texture ring depth. The encode loop pipelines one frame deep (NVENC encodes frame N while
|
||||
/// the capturer produces N+1), so two live textures suffice; three gives headroom against a slow
|
||||
/// `lock_bitstream` and matches the WGC frame-pool depth.
|
||||
// Sized for the deep encode pipeline (`PUNKTFUNK_ENCODE_DEPTH`, default 4, clamped ≤ 6): up to DEPTH
|
||||
// frames are in flight in NVENC at once, so the HDR convert ring and the SDR held-frame set must each
|
||||
// keep DEPTH(+headroom) live textures, and the WGC pool needs spare buffers beyond what we hold.
|
||||
const OUT_RING: usize = 8;
|
||||
|
||||
/// SDR zero-copy: how many recent WGC frames to keep alive so NVENC can encode the pool texture in
|
||||
/// place (no `CopyResource`). Each in-flight encode reads a distinct frame, so this must exceed the
|
||||
/// pipeline depth; the oldest is released once `HELD_FRAMES` newer ones exist.
|
||||
const HELD_FRAMES: usize = 8;
|
||||
/// WGC frame-pool buffer count. Must exceed `HELD_FRAMES` so the compositor always has free buffers
|
||||
/// to render into while we hold frames for in-place (zero-copy) SDR encode.
|
||||
const WGC_POOL_BUFFERS: i32 = 10;
|
||||
|
||||
/// The host runs as SYSTEM (so the DDA secure-desktop path works), but WGC will NOT activate under
|
||||
/// the SYSTEM account (`CreateForMonitor` → 0x80070424). Impersonate the interactive console user
|
||||
/// for the WGC activation. Returns the user token (the caller reverts + closes it after activation)
|
||||
/// or `None` (no active user, or the host already runs AS the user — WTSQueryUserToken then fails and
|
||||
/// WGC works without impersonation). SYSTEM-only; harmless under a user-token host.
|
||||
unsafe fn impersonate_active_user() -> Option<HANDLE> {
|
||||
let session = WTSGetActiveConsoleSessionId();
|
||||
if session == 0xFFFF_FFFF {
|
||||
return None;
|
||||
}
|
||||
let mut token = HANDLE::default();
|
||||
if WTSQueryUserToken(session, &mut token).is_ok() {
|
||||
if ImpersonateLoggedOnUser(token).is_ok() {
|
||||
return Some(token);
|
||||
}
|
||||
let _ = CloseHandle(token);
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
/// RAII: reverts the WGC-activation impersonation when it drops (covers every `?` early-return).
|
||||
struct Deimpersonate(Option<HANDLE>);
|
||||
impl Drop for Deimpersonate {
|
||||
fn drop(&mut self) {
|
||||
if let Some(tok) = self.0.take() {
|
||||
unsafe {
|
||||
let _ = RevertToSelf();
|
||||
let _ = CloseHandle(tok);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Signal from the free-threaded FrameArrived callback to the encode thread: a monotonically
|
||||
/// increasing count of arrived frames + a condvar to wake `next_frame`. The encode thread tracks how
|
||||
/// many it has consumed; `TryGetNextFrame` is called exactly `available - consumed` times so we never
|
||||
/// hit the empty-pool ambiguity, and draining to the newest keeps latency at one frame.
|
||||
struct WgcSignal {
|
||||
available: AtomicU64,
|
||||
mtx: Mutex<()>,
|
||||
cv: Condvar,
|
||||
}
|
||||
|
||||
pub struct WgcCapturer {
|
||||
device: ID3D11Device,
|
||||
context: ID3D11DeviceContext,
|
||||
// WGC objects — kept alive for the session's lifetime.
|
||||
pool: Direct3D11CaptureFramePool,
|
||||
session: GraphicsCaptureSession,
|
||||
_item: GraphicsCaptureItem,
|
||||
_frame_arrived_token: i64,
|
||||
signal: Arc<WgcSignal>,
|
||||
consumed: u64,
|
||||
|
||||
width: u32,
|
||||
height: u32,
|
||||
timeout_ms: u64,
|
||||
first_frame: bool,
|
||||
|
||||
hdr: bool,
|
||||
/// The source display's static HDR mastering metadata (ST.2086 + content light level), read from
|
||||
/// `IDXGIOutput6::GetDesc1` at open when the output is HDR. Forwarded to the encoder (in-band SEI)
|
||||
/// and the client (0xCE) by the stream loop. `None` when SDR. (The helper relay path also encodes,
|
||||
/// so this is what gives the secure/normal-desktop HDR stream its mastering SEI.)
|
||||
hdr_meta: Option<punktfunk_core::quic::HdrMeta>,
|
||||
hdr_conv: Option<HdrConverter>,
|
||||
fp16_src: Option<ID3D11Texture2D>,
|
||||
fp16_srv: Option<ID3D11ShaderResourceView>,
|
||||
/// `PUNKTFUNK_HDR_SHADER_P010` path: emit P010 (BT.2020 PQ 10-bit limited range) DIRECTLY from our
|
||||
/// own shader (`HdrP010Converter`) so NVENC takes native P010 and skips its SM-side RGB→YUV CSC.
|
||||
/// Gated by [`hdr_shader_p010_enabled`] AND `self.hdr`; `None`/empty when off → the existing R10 +
|
||||
/// VideoProcessor paths run unchanged. `p010_disabled` latches a runtime failure (e.g. a driver
|
||||
/// that rejects the planar plane RTV) so we fall back to the R10 path and stop retrying.
|
||||
hdr_p010_conv: Option<HdrP010Converter>,
|
||||
p010_out: Vec<ID3D11Texture2D>,
|
||||
p010_idx: usize,
|
||||
p010_disabled: bool,
|
||||
/// Ring of host-owned output textures (BGRA for SDR, R10G10B10A2 for HDR), rotated per processed
|
||||
/// frame. A ring — not one texture — is required because the encode loop is PIPELINED: NVENC
|
||||
/// encodes frame N (in place, registered by pointer) while this capturer produces frame N+1, so
|
||||
/// N+1 must land in a DIFFERENT texture or it clobbers the in-flight encode. (`fp16_src` stays
|
||||
/// single: it's only touched within the D3D11 immediate context, whose op ordering already
|
||||
/// serializes the convert's read against the next copy's write — NVENC's async engine read is the
|
||||
/// only consumer that escapes that ordering, and it reads the ring output, never `fp16_src`.)
|
||||
out_ring: Vec<ID3D11Texture2D>,
|
||||
ring_idx: usize,
|
||||
/// Video-processor RGB→YUV converter (off the 3D engine where possible) + its NV12/P010 output
|
||||
/// ring. Preferred path: the OS-composited capture (cursor already in it) is converted DIRECTLY to
|
||||
/// NVENC's native YUV — no `CopyResource`, no cursor draw, and NVENC skips its internal RGB→YUV.
|
||||
/// `None`/error → falls back to the legacy SDR-zero-copy / HDR-shader paths.
|
||||
video_conv: Option<VideoConverter>,
|
||||
yuv_out: Vec<ID3D11Texture2D>,
|
||||
yuv_idx: usize,
|
||||
yuv_is_hdr: bool,
|
||||
vp_disabled: bool,
|
||||
/// SDR zero-copy: the recent WGC frames we hand to NVENC in place. Held so the pool doesn't
|
||||
/// recycle the texture mid-encode; the oldest is released once `HELD_FRAMES` newer ones exist.
|
||||
held: VecDeque<Direct3D11CaptureFrame>,
|
||||
/// Last presentable GPU texture + format, repeated when no new frame arrived (static desktop).
|
||||
last_present: Option<(ID3D11Texture2D, PixelFormat)>,
|
||||
|
||||
/// Owns the SudoVDA keepalive once attached (after WGC is confirmed open) — dropping the capturer
|
||||
/// then REMOVEs the virtual output. `None` between open and attach so a WGC-open failure leaves
|
||||
/// the keepalive with the caller for the DDA fallback.
|
||||
_keepalive: Option<Box<dyn Send>>,
|
||||
}
|
||||
|
||||
// COM + WinRT pointers; confined to the single owning (encode) thread, like DuplCapturer.
|
||||
unsafe impl Send for WgcCapturer {}
|
||||
|
||||
impl WgcCapturer {
|
||||
/// Open WGC capture. Does NOT take the keepalive — the caller attaches it via
|
||||
/// [`attach_keepalive`](Self::attach_keepalive) only after open succeeds, so a failure leaves the
|
||||
/// keepalive with the caller to hand to the DDA fallback.
|
||||
pub fn open(target: WinCaptureTarget, preferred: Option<(u32, u32, u32)>) -> Result<Self> {
|
||||
unsafe {
|
||||
// WGC is WinRT — the calling thread needs a COM/WinRT apartment for the GraphicsCaptureItem
|
||||
// activation factory (RoGetActivationFactory). Initialize MTA; ignore "already initialized"
|
||||
// / "changed mode" (another component on this thread may have init'd a compatible apartment).
|
||||
let ro = RoInitialize(RO_INIT_MULTITHREADED);
|
||||
// Impersonate the interactive user for the duration of WGC activation (host runs as
|
||||
// SYSTEM; WGC won't activate under SYSTEM). Reverted by the guard's Drop on return. The
|
||||
// WGC objects, once created, are accessed from the (SYSTEM) encode thread thereafter.
|
||||
let imp = impersonate_active_user();
|
||||
let _deimp = Deimpersonate(imp);
|
||||
tracing::info!(ro_result = ?ro, impersonated = imp.is_some(), "WGC: RoInitialize(MTA)");
|
||||
// The SudoVDA output appears a beat after the display is created — settle-retry like DDA.
|
||||
let deadline = Instant::now() + Duration::from_millis(2000);
|
||||
let (adapter, output) = loop {
|
||||
if let Some(n) = crate::win_display::resolve_gdi_name(target.target_id) {
|
||||
if let Ok(found) = find_output(&n) {
|
||||
break found;
|
||||
}
|
||||
}
|
||||
if let Ok(found) = find_output(&target.gdi_name) {
|
||||
break found;
|
||||
}
|
||||
if Instant::now() >= deadline {
|
||||
bail!(
|
||||
"WGC: no DXGI output for SudoVDA target {} yet",
|
||||
target.target_id
|
||||
);
|
||||
}
|
||||
std::thread::sleep(Duration::from_millis(100));
|
||||
};
|
||||
|
||||
let (device, context) = make_device(&adapter)?;
|
||||
let od = output.GetDesc().context("output GetDesc")?;
|
||||
let hmonitor = od.Monitor;
|
||||
|
||||
// HDR iff the output's colour space is BT.2020 PQ (G2084) — matches the DDA FP16 detection.
|
||||
// From the same desc, read the source display's mastering metadata (ST.2086) when HDR.
|
||||
let desc1 = output
|
||||
.cast::<IDXGIOutput6>()
|
||||
.ok()
|
||||
.and_then(|o6| o6.GetDesc1().ok());
|
||||
let hdr = desc1
|
||||
.as_ref()
|
||||
.map(|d1| d1.ColorSpace == DXGI_COLOR_SPACE_RGB_FULL_G2084_NONE_P2020)
|
||||
.unwrap_or(false);
|
||||
let hdr_meta = if hdr {
|
||||
desc1.as_ref().map(|d| {
|
||||
crate::hdr::hdr_meta_from_display(
|
||||
(d.RedPrimary[0], d.RedPrimary[1]),
|
||||
(d.GreenPrimary[0], d.GreenPrimary[1]),
|
||||
(d.BluePrimary[0], d.BluePrimary[1]),
|
||||
(d.WhitePoint[0], d.WhitePoint[1]),
|
||||
d.MaxLuminance,
|
||||
d.MinLuminance,
|
||||
0, // MaxCLL: GetDesc1 has no content light level (Apollo zeroes it)
|
||||
0, // MaxFALL
|
||||
)
|
||||
})
|
||||
} else {
|
||||
None
|
||||
};
|
||||
|
||||
// Wrap our D3D11 device as a WinRT IDirect3DDevice so the frame pool allocates on it (the
|
||||
// pool textures land on our device → CopyResource + NVENC are same-device, no readback).
|
||||
let dxgi_device: IDXGIDevice = device.cast().context("ID3D11Device as IDXGIDevice")?;
|
||||
let inspectable: IInspectable = CreateDirect3D11DeviceFromDXGIDevice(&dxgi_device)
|
||||
.context("CreateDirect3D11DeviceFromDXGIDevice")?;
|
||||
let d3d_device: windows::Graphics::DirectX::Direct3D11::IDirect3DDevice = inspectable
|
||||
.cast()
|
||||
.context("IInspectable as IDirect3DDevice")?;
|
||||
|
||||
tracing::info!(hdr, "WGC: device ready, creating capture item");
|
||||
// GraphicsCaptureItem for the monitor (the SudoVDA output enumerates as a normal monitor).
|
||||
let interop: IGraphicsCaptureItemInterop =
|
||||
windows::core::factory::<GraphicsCaptureItem, IGraphicsCaptureItemInterop>()
|
||||
.context("GraphicsCaptureItem interop factory")?;
|
||||
let item: GraphicsCaptureItem = interop
|
||||
.CreateForMonitor(hmonitor)
|
||||
.context("CreateForMonitor")?;
|
||||
let size = item.Size().context("item Size")?;
|
||||
let (width, height) = (size.Width.max(0) as u32, size.Height.max(0) as u32);
|
||||
tracing::info!(
|
||||
width,
|
||||
height,
|
||||
"WGC: capture item created, creating frame pool"
|
||||
);
|
||||
|
||||
let pixel_format = if hdr {
|
||||
DirectXPixelFormat::R16G16B16A16Float // scRGB FP16 — same surface DDA gives on HDR
|
||||
} else {
|
||||
DirectXPixelFormat::B8G8R8A8UIntNormalized
|
||||
};
|
||||
// Extra buffers: SDR zero-copy holds the last `HELD_FRAMES` frames (encoded in place), so
|
||||
// the pool needs headroom beyond that for the producer to keep rendering at 240 Hz.
|
||||
let pool = Direct3D11CaptureFramePool::CreateFreeThreaded(
|
||||
&d3d_device,
|
||||
pixel_format,
|
||||
WGC_POOL_BUFFERS,
|
||||
size,
|
||||
)
|
||||
.context("CreateFreeThreaded frame pool")?;
|
||||
|
||||
let signal = Arc::new(WgcSignal {
|
||||
available: AtomicU64::new(0),
|
||||
mtx: Mutex::new(()),
|
||||
cv: Condvar::new(),
|
||||
});
|
||||
let sig = signal.clone();
|
||||
let handler = TypedEventHandler::<Direct3D11CaptureFramePool, IInspectable>::new(
|
||||
move |_pool, _arg| {
|
||||
sig.available.fetch_add(1, Ordering::Release);
|
||||
sig.cv.notify_one();
|
||||
Ok(())
|
||||
},
|
||||
);
|
||||
let token = pool.FrameArrived(&handler).context("FrameArrived")?;
|
||||
|
||||
tracing::info!("WGC: creating capture session");
|
||||
let session = pool
|
||||
.CreateCaptureSession(&item)
|
||||
.context("CreateCaptureSession")?;
|
||||
// OS composites the cursor into the frame (HDR-correct, no manual composite pass).
|
||||
let _ = session.SetIsCursorCaptureEnabled(true);
|
||||
// Drop the yellow capture border (best-effort — older builds reject it).
|
||||
let _ = session.SetIsBorderRequired(false);
|
||||
// Lift the 60 Hz cap: allow up to the client's refresh (Win11 24H2+; below that this is a
|
||||
// no-op and WGC caps ~60). 100 ns ticks per frame.
|
||||
let refresh = preferred
|
||||
.map(|(_, _, hz)| hz)
|
||||
.filter(|&hz| hz > 0)
|
||||
.unwrap_or(60);
|
||||
let ticks = (10_000_000i64 / refresh.max(1) as i64).max(1);
|
||||
let _ = session.SetMinUpdateInterval(TimeSpan { Duration: ticks });
|
||||
tracing::info!("WGC: StartCapture");
|
||||
session.StartCapture().context("StartCapture")?;
|
||||
// WGC fires FrameArrived on CHANGE; a static desktop may never deliver the first frame
|
||||
// (→ black, then the next_frame deadline ends the session). Nudge the cursor onto the
|
||||
// output to force the first composition change, exactly like the DDA path does.
|
||||
nudge_cursor_onto(&output);
|
||||
|
||||
let timeout_ms = (2000 / refresh.max(1) as u64).max(8);
|
||||
tracing::info!(
|
||||
width,
|
||||
height,
|
||||
hdr,
|
||||
refresh,
|
||||
"WGC capture started ({})",
|
||||
if hdr {
|
||||
"HDR FP16→BT.2020 PQ"
|
||||
} else {
|
||||
"SDR BGRA"
|
||||
}
|
||||
);
|
||||
|
||||
Ok(Self {
|
||||
device,
|
||||
context,
|
||||
pool,
|
||||
session,
|
||||
_item: item,
|
||||
_frame_arrived_token: token,
|
||||
signal,
|
||||
consumed: 0,
|
||||
width,
|
||||
height,
|
||||
timeout_ms,
|
||||
first_frame: true,
|
||||
hdr,
|
||||
hdr_meta,
|
||||
hdr_conv: None,
|
||||
fp16_src: None,
|
||||
fp16_srv: None,
|
||||
hdr_p010_conv: None,
|
||||
p010_out: Vec::new(),
|
||||
p010_idx: 0,
|
||||
p010_disabled: false,
|
||||
out_ring: Vec::new(),
|
||||
ring_idx: 0,
|
||||
video_conv: None,
|
||||
yuv_out: Vec::new(),
|
||||
yuv_idx: 0,
|
||||
yuv_is_hdr: false,
|
||||
vp_disabled: std::env::var_os("PUNKTFUNK_NO_VIDEO_PROCESSOR").is_some(),
|
||||
held: VecDeque::new(),
|
||||
last_present: None,
|
||||
_keepalive: None,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
/// Take ownership of the SudoVDA keepalive once the WGC session is confirmed open.
|
||||
pub fn attach_keepalive(&mut self, keepalive: Box<dyn Send>) {
|
||||
self._keepalive = Some(keepalive);
|
||||
}
|
||||
|
||||
/// Block until a new frame arrives (cv), then drain `TryGetNextFrame` to the NEWEST queued frame
|
||||
/// (skip stale → one-frame latency). Returns `None` on timeout (no new frame → caller repeats).
|
||||
fn wait_and_drain(&mut self) -> Option<Direct3D11CaptureFrame> {
|
||||
let wait_ms = if self.first_frame {
|
||||
2000
|
||||
} else {
|
||||
self.timeout_ms
|
||||
};
|
||||
{
|
||||
let mut g = self.signal.mtx.lock().unwrap();
|
||||
while self.signal.available.load(Ordering::Acquire) <= self.consumed {
|
||||
let (ng, res) = self
|
||||
.signal
|
||||
.cv
|
||||
.wait_timeout(g, Duration::from_millis(wait_ms))
|
||||
.unwrap();
|
||||
g = ng;
|
||||
if res.timed_out() {
|
||||
return None;
|
||||
}
|
||||
}
|
||||
}
|
||||
let target = self.signal.available.load(Ordering::Acquire);
|
||||
let mut last = None;
|
||||
while self.consumed < target {
|
||||
if let Ok(f) = self.pool.TryGetNextFrame() {
|
||||
last = Some(f);
|
||||
}
|
||||
self.consumed += 1;
|
||||
}
|
||||
last
|
||||
}
|
||||
|
||||
unsafe fn ensure_fp16_src(&mut self) -> Result<()> {
|
||||
if self.fp16_src.is_some() {
|
||||
return Ok(());
|
||||
}
|
||||
let desc = tex_desc(
|
||||
self.width,
|
||||
self.height,
|
||||
DXGI_FORMAT_R16G16B16A16_FLOAT,
|
||||
(D3D11_BIND_RENDER_TARGET.0 | D3D11_BIND_SHADER_RESOURCE.0) as u32,
|
||||
);
|
||||
let mut t = None;
|
||||
self.device
|
||||
.CreateTexture2D(&desc, None, Some(&mut t))
|
||||
.context("CreateTexture2D(wgc fp16 src)")?;
|
||||
let t = t.context("fp16 src")?;
|
||||
let mut srv = None;
|
||||
self.device
|
||||
.CreateShaderResourceView(&t, None, Some(&mut srv))?;
|
||||
self.fp16_srv = Some(srv.context("fp16 srv")?);
|
||||
self.fp16_src = Some(t);
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Lazily allocate the HDR output texture ring (R10G10B10A2, the convert pass's render target →
|
||||
/// NVENC input), `RENDER_TARGET`-bindable. SDR is zero-copy (encodes the WGC pool texture in
|
||||
/// place) and uses no ring.
|
||||
unsafe fn ensure_out_ring(
|
||||
&mut self,
|
||||
format: windows::Win32::Graphics::Dxgi::Common::DXGI_FORMAT,
|
||||
) -> Result<()> {
|
||||
if !self.out_ring.is_empty() {
|
||||
return Ok(());
|
||||
}
|
||||
let desc = tex_desc(
|
||||
self.width,
|
||||
self.height,
|
||||
format,
|
||||
D3D11_BIND_RENDER_TARGET.0 as u32,
|
||||
);
|
||||
for _ in 0..OUT_RING {
|
||||
let mut t = None;
|
||||
self.device
|
||||
.CreateTexture2D(&desc, None, Some(&mut t))
|
||||
.context("CreateTexture2D(wgc out ring)")?;
|
||||
self.out_ring.push(t.context("wgc out ring tex")?);
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// Convert `input` (the OS-composited WGC pool texture: BGRA or scRGB FP16) → NVENC's native YUV
|
||||
/// (NV12 / P010) on the video processor. Returns the YUV texture (from a ring so consecutive
|
||||
/// encodes don't collide), or `None` to fall back to the legacy RGB paths.
|
||||
unsafe fn convert_to_yuv(
|
||||
&mut self,
|
||||
input: &ID3D11Texture2D,
|
||||
hdr: bool,
|
||||
) -> Option<ID3D11Texture2D> {
|
||||
if self.vp_disabled {
|
||||
return None;
|
||||
}
|
||||
if self.video_conv.is_none() || self.yuv_out.is_empty() || self.yuv_is_hdr != hdr {
|
||||
self.video_conv = None;
|
||||
self.yuv_out.clear();
|
||||
self.yuv_idx = 0;
|
||||
let vc = match VideoConverter::new(
|
||||
&self.device,
|
||||
&self.context,
|
||||
self.width,
|
||||
self.height,
|
||||
hdr,
|
||||
) {
|
||||
Ok(vc) => vc,
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %format!("{e:#}"),
|
||||
"WGC: video processor unavailable — falling back to RGB path");
|
||||
self.vp_disabled = true;
|
||||
return None;
|
||||
}
|
||||
};
|
||||
let fmt = if hdr {
|
||||
windows::Win32::Graphics::Dxgi::Common::DXGI_FORMAT_P010
|
||||
} else {
|
||||
windows::Win32::Graphics::Dxgi::Common::DXGI_FORMAT_NV12
|
||||
};
|
||||
let desc = tex_desc(
|
||||
self.width,
|
||||
self.height,
|
||||
fmt,
|
||||
D3D11_BIND_RENDER_TARGET.0 as u32,
|
||||
);
|
||||
for _ in 0..OUT_RING {
|
||||
let mut t = None;
|
||||
if self
|
||||
.device
|
||||
.CreateTexture2D(&desc, None, Some(&mut t))
|
||||
.is_err()
|
||||
{
|
||||
tracing::warn!("WGC: CreateTexture2D(YUV) failed — falling back to RGB path");
|
||||
self.vp_disabled = true;
|
||||
self.yuv_out.clear();
|
||||
return None;
|
||||
}
|
||||
let Some(tex) = t else {
|
||||
self.vp_disabled = true;
|
||||
self.yuv_out.clear();
|
||||
return None;
|
||||
};
|
||||
self.yuv_out.push(tex);
|
||||
}
|
||||
self.video_conv = Some(vc);
|
||||
self.yuv_is_hdr = hdr;
|
||||
tracing::info!(
|
||||
hdr,
|
||||
"WGC: video-processor YUV path active ({})",
|
||||
if hdr { "P010" } else { "NV12" }
|
||||
);
|
||||
}
|
||||
let slot = self.yuv_idx;
|
||||
self.yuv_idx = (self.yuv_idx + 1) % self.yuv_out.len();
|
||||
let out = self.yuv_out[slot].clone();
|
||||
if let Err(e) = self.video_conv.as_ref()?.convert(input, &out) {
|
||||
tracing::warn!(error = %format!("{e:#}"),
|
||||
"WGC: VideoProcessorBlt failed — falling back to RGB path");
|
||||
self.vp_disabled = true;
|
||||
self.video_conv = None;
|
||||
self.yuv_out.clear();
|
||||
return None;
|
||||
}
|
||||
Some(out)
|
||||
}
|
||||
|
||||
/// `PUNKTFUNK_HDR_SHADER_P010` path: convert the OS-composited FP16 scRGB capture DIRECTLY to a
|
||||
/// host-owned P010 texture (BT.2020 PQ, 10-bit limited range) via [`HdrP010Converter`] — two
|
||||
/// shader passes writing the P010 planes. NVENC then takes native P010 and skips its internal
|
||||
/// RGB→YUV CSC. Returns the next ring slot's P010 texture, or `Err` if the converter / a planar
|
||||
/// plane RTV fails (the caller latches `p010_disabled` and falls back to the R10 path).
|
||||
unsafe fn hdr_to_p010(&mut self, src: &ID3D11Texture2D) -> Result<ID3D11Texture2D> {
|
||||
let slot = self.p010_idx;
|
||||
// Lazily allocate the FP16 source (shared with the R10 path) + the P010 output ring.
|
||||
self.ensure_fp16_src()?;
|
||||
let fp16 = self.fp16_src.clone().context("fp16 src")?;
|
||||
self.context.CopyResource(&fp16, src);
|
||||
if self.p010_out.is_empty() {
|
||||
let desc = tex_desc(
|
||||
self.width,
|
||||
self.height,
|
||||
windows::Win32::Graphics::Dxgi::Common::DXGI_FORMAT_P010,
|
||||
D3D11_BIND_RENDER_TARGET.0 as u32,
|
||||
);
|
||||
for _ in 0..OUT_RING {
|
||||
let mut t = None;
|
||||
self.device
|
||||
.CreateTexture2D(&desc, None, Some(&mut t))
|
||||
.context("CreateTexture2D(wgc p010 ring)")?;
|
||||
self.p010_out.push(t.context("wgc p010 ring tex")?);
|
||||
}
|
||||
}
|
||||
self.p010_idx = (self.p010_idx + 1) % self.p010_out.len();
|
||||
let out = self.p010_out[slot].clone();
|
||||
if self.hdr_p010_conv.is_none() {
|
||||
self.hdr_p010_conv = Some(HdrP010Converter::new(&self.device)?);
|
||||
}
|
||||
let srv = self.fp16_srv.clone().context("fp16 srv")?;
|
||||
self.hdr_p010_conv.as_ref().unwrap().convert(
|
||||
&self.device,
|
||||
&self.context,
|
||||
&srv,
|
||||
&out,
|
||||
self.width,
|
||||
self.height,
|
||||
)?;
|
||||
Ok(out)
|
||||
}
|
||||
|
||||
fn process_frame(&mut self, frame: Direct3D11CaptureFrame) -> Result<CapturedFrame> {
|
||||
unsafe {
|
||||
let surface = frame.Surface().context("frame Surface")?;
|
||||
let access: IDirect3DDxgiInterfaceAccess = surface
|
||||
.cast()
|
||||
.context("surface as IDirect3DDxgiInterfaceAccess")?;
|
||||
let src: ID3D11Texture2D = access
|
||||
.GetInterface()
|
||||
.context("GetInterface ID3D11Texture2D")?;
|
||||
|
||||
// GATED P010-shader path (`PUNKTFUNK_HDR_SHADER_P010`): for HDR, emit P010 (BT.2020 PQ
|
||||
// 10-bit limited range) DIRECTLY from our shader so NVENC takes native P010 and skips its
|
||||
// SM-side RGB→YUV CSC. Runs BEFORE the R10 + VideoProcessor path. A converter/plane-RTV
|
||||
// failure latches `p010_disabled` → we fall through to the unchanged R10 path for the rest
|
||||
// of the session. Default OFF → none of this executes and behaviour is byte-for-byte as
|
||||
// today.
|
||||
if self.hdr && !self.p010_disabled && hdr_shader_p010_enabled() {
|
||||
match self.hdr_to_p010(&src) {
|
||||
Ok(p010) => {
|
||||
// The P010 output is host-owned (the ring), and the FP16 CopyResource read
|
||||
// `src` synchronously on the immediate context before the shader passes — so we
|
||||
// do NOT need to hold `frame` past here (unlike the SDR/R10 in-place paths).
|
||||
// Dropping it returns the pool buffer to WGC immediately.
|
||||
drop(frame);
|
||||
self.last_present = Some((p010.clone(), PixelFormat::P010));
|
||||
return Ok(self.d3d11_frame(p010, PixelFormat::P010));
|
||||
}
|
||||
Err(e) => {
|
||||
tracing::warn!(error = %format!("{e:#}"),
|
||||
"WGC: HDR P010 shader path failed — disabling it, falling back to R10");
|
||||
self.p010_disabled = true;
|
||||
self.hdr_p010_conv = None;
|
||||
self.p010_out.clear();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Preferred path: convert the OS-composited capture (cursor already in it) DIRECTLY to
|
||||
// NVENC's native YUV on the video processor — no CopyResource, no cursor draw, and NVENC
|
||||
// skips its internal RGB→YUV (the contended 3D step). WGC's multi-buffer pool + held set
|
||||
// means reading the pool texture directly does NOT serialize (unlike DDA's single-frame
|
||||
// model). The frame is held until the async Blt finishes. (HDR: the video processor can't
|
||||
// ingest FP16 scRGB, so the Blt fails and we fall back to the R10 path below; the
|
||||
// `PUNKTFUNK_HDR_SHADER_P010` branch above is the off-the-SM HDR path.)
|
||||
if let Some(yuv) = self.convert_to_yuv(&src, self.hdr) {
|
||||
let fmt = if self.hdr {
|
||||
PixelFormat::P010
|
||||
} else {
|
||||
PixelFormat::Nv12
|
||||
};
|
||||
self.last_present = Some((yuv.clone(), fmt));
|
||||
let out = self.d3d11_frame(yuv, fmt);
|
||||
self.held.push_back(frame);
|
||||
while self.held.len() > HELD_FRAMES {
|
||||
self.held.pop_front();
|
||||
}
|
||||
return Ok(out);
|
||||
}
|
||||
|
||||
// --- fallback (video processor unavailable) ---
|
||||
if self.hdr {
|
||||
// Next ring slot — the in-flight encode reads the slot we handed out last time, so
|
||||
// this capture must land in a different one (see `out_ring`).
|
||||
let slot = self.ring_idx;
|
||||
self.ring_idx = (self.ring_idx + 1) % OUT_RING;
|
||||
// FP16 (cursor already composited by the OS) → BT.2020 PQ 10-bit for NVENC.
|
||||
self.ensure_fp16_src()?;
|
||||
let fp16 = self.fp16_src.clone().context("fp16 src")?;
|
||||
self.context.CopyResource(&fp16, &src);
|
||||
self.ensure_out_ring(DXGI_FORMAT_R10G10B10A2_UNORM)?;
|
||||
let out = self.out_ring[slot].clone();
|
||||
if self.hdr_conv.is_none() {
|
||||
self.hdr_conv = Some(HdrConverter::new(&self.device)?);
|
||||
}
|
||||
let srv = self.fp16_srv.clone().context("fp16 srv")?;
|
||||
let mut rtv: Option<ID3D11RenderTargetView> = None;
|
||||
self.device
|
||||
.CreateRenderTargetView(&out, None, Some(&mut rtv))?;
|
||||
let rtv = rtv.context("hdr10 rtv")?;
|
||||
self.hdr_conv.as_ref().unwrap().convert(
|
||||
&self.context,
|
||||
&srv,
|
||||
&rtv,
|
||||
self.width,
|
||||
self.height,
|
||||
);
|
||||
self.last_present = Some((out.clone(), PixelFormat::Rgb10a2));
|
||||
Ok(self.d3d11_frame(out, PixelFormat::Rgb10a2))
|
||||
} else {
|
||||
// SDR ZERO-COPY: hand NVENC the WGC pool texture DIRECTLY — no `CopyResource`. The
|
||||
// per-frame copy otherwise queues on the graphics engine behind a GPU-saturating game
|
||||
// and stalls `lock_bitstream` ~20 ms (NVENC sits idle waiting for its input). Encoding
|
||||
// the pool texture in place removes that graphics-queue dependency (Apollo's model).
|
||||
// We must keep the frame alive until its async encode finishes, so retain the last
|
||||
// `HELD_FRAMES`; the pool has spare buffers so the producer never starves.
|
||||
self.last_present = Some((src.clone(), PixelFormat::Bgra));
|
||||
let out = self.d3d11_frame(src, PixelFormat::Bgra);
|
||||
self.held.push_back(frame);
|
||||
while self.held.len() > HELD_FRAMES {
|
||||
self.held.pop_front();
|
||||
}
|
||||
Ok(out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn d3d11_frame(&self, texture: ID3D11Texture2D, format: PixelFormat) -> CapturedFrame {
|
||||
CapturedFrame {
|
||||
width: self.width,
|
||||
height: self.height,
|
||||
pts_ns: now_ns(),
|
||||
format,
|
||||
payload: FramePayload::D3d11(D3d11Frame {
|
||||
texture,
|
||||
device: self.device.clone(),
|
||||
}),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Capturer for WgcCapturer {
|
||||
fn hdr_meta(&self) -> Option<punktfunk_core::quic::HdrMeta> {
|
||||
self.hdr_meta
|
||||
}
|
||||
|
||||
fn next_frame(&mut self) -> Result<CapturedFrame> {
|
||||
let overall = Instant::now() + Duration::from_secs(20);
|
||||
loop {
|
||||
if let Some(frame) = self.wait_and_drain() {
|
||||
self.first_frame = false;
|
||||
return self.process_frame(frame);
|
||||
}
|
||||
// No new frame within the wait — repeat the last presented frame (static desktop).
|
||||
if let Some((tex, fmt)) = &self.last_present {
|
||||
return Ok(self.d3d11_frame(tex.clone(), *fmt));
|
||||
}
|
||||
if Instant::now() > overall {
|
||||
bail!("no WGC frame within 20s (SudoVDA monitor not lit / no capture access?)");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn try_latest(&mut self) -> Result<Option<CapturedFrame>> {
|
||||
let target = self.signal.available.load(Ordering::Acquire);
|
||||
if target <= self.consumed {
|
||||
return Ok(None);
|
||||
}
|
||||
let mut last = None;
|
||||
while self.consumed < target {
|
||||
if let Ok(f) = self.pool.TryGetNextFrame() {
|
||||
last = Some(f);
|
||||
}
|
||||
self.consumed += 1;
|
||||
}
|
||||
match last {
|
||||
Some(frame) => self.process_frame(frame).map(Some),
|
||||
None => Ok(None),
|
||||
}
|
||||
}
|
||||
// set_active: the trait default (no-op) is correct — WGC keeps its session running across the
|
||||
// active/idle gate (cheap; the frame pool just recycles), like the DDA duplication.
|
||||
}
|
||||
|
||||
impl Drop for WgcCapturer {
|
||||
fn drop(&mut self) {
|
||||
let _ = self.session.Close();
|
||||
let _ = self.pool.Close();
|
||||
// _keepalive drops after, REMOVEing the SudoVDA monitor.
|
||||
}
|
||||
}
|
||||
|
||||
fn tex_desc(
|
||||
width: u32,
|
||||
height: u32,
|
||||
format: windows::Win32::Graphics::Dxgi::Common::DXGI_FORMAT,
|
||||
bind: u32,
|
||||
) -> D3D11_TEXTURE2D_DESC {
|
||||
D3D11_TEXTURE2D_DESC {
|
||||
Width: width,
|
||||
Height: height,
|
||||
MipLevels: 1,
|
||||
ArraySize: 1,
|
||||
Format: format,
|
||||
SampleDesc: DXGI_SAMPLE_DESC {
|
||||
Count: 1,
|
||||
Quality: 0,
|
||||
},
|
||||
Usage: D3D11_USAGE_DEFAULT,
|
||||
BindFlags: bind,
|
||||
CPUAccessFlags: 0,
|
||||
MiscFlags: 0,
|
||||
}
|
||||
}
|
||||
|
||||
fn now_ns() -> u64 {
|
||||
std::time::SystemTime::now()
|
||||
.duration_since(std::time::UNIX_EPOCH)
|
||||
.map(|d| d.as_nanos() as u64)
|
||||
.unwrap_or(0)
|
||||
}
|
||||
@@ -0,0 +1,446 @@
|
||||
//! Host-side WGC helper relay (Windows two-process secure-desktop design,
|
||||
//! docs/windows-secure-desktop.md — step 4).
|
||||
//!
|
||||
//! WGC won't activate under the SYSTEM account, so the SYSTEM host can't capture the normal desktop
|
||||
//! itself. Instead it spawns `punktfunk-host wgc-helper` in the **interactive user session** (so WGC works)
|
||||
//! via `CreateProcessAsUserW`, with the helper's **stdout** redirected to an anonymous pipe the host
|
||||
//! reads. The helper ships framed Annex-B access units; this module parses them back into AUs the
|
||||
//! host relays onto the live QUIC session (same `EncodedFrame` flow, just sourced over a pipe instead
|
||||
//! of a local encoder). A second pipe carries a tiny **control** channel to the helper (stdin: force
|
||||
//! keyframe), and the helper's **stderr** is forwarded line-by-line into host tracing so its logs are
|
||||
//! visible from the SYSTEM host's console.
|
||||
//!
|
||||
//! Wire framing (must match `wgc_helper::write_au`): per AU
|
||||
//! `[u32 magic "PFAU" LE][u32 len LE][u64 pts_ns LE][u8 keyframe][len bytes data]`.
|
||||
|
||||
use crate::capture::dxgi::WinCaptureTarget;
|
||||
use anyhow::{bail, Context, Result};
|
||||
use std::io::{BufRead, BufReader, Read};
|
||||
use std::sync::mpsc::{Receiver, SyncSender};
|
||||
use std::sync::Mutex;
|
||||
use windows::core::PWSTR;
|
||||
use windows::Win32::Foundation::SetHandleInformation;
|
||||
use windows::Win32::Foundation::{CloseHandle, HANDLE};
|
||||
use windows::Win32::Foundation::{HANDLE_FLAGS, HANDLE_FLAG_INHERIT};
|
||||
use windows::Win32::Security::{
|
||||
DuplicateTokenEx, SecurityImpersonation, TokenPrimary, SECURITY_ATTRIBUTES, TOKEN_ALL_ACCESS,
|
||||
};
|
||||
use windows::Win32::System::Environment::{CreateEnvironmentBlock, DestroyEnvironmentBlock};
|
||||
use windows::Win32::System::Pipes::CreatePipe;
|
||||
use windows::Win32::System::RemoteDesktop::{WTSGetActiveConsoleSessionId, WTSQueryUserToken};
|
||||
use windows::Win32::System::Threading::{
|
||||
CreateProcessAsUserW, TerminateProcess, CREATE_NO_WINDOW, CREATE_UNICODE_ENVIRONMENT,
|
||||
PROCESS_INFORMATION, STARTF_USESTDHANDLES, STARTUPINFOW,
|
||||
};
|
||||
|
||||
/// Must match [`crate::wgc_helper`]'s `AU_MAGIC` ("PFAU").
|
||||
const AU_MAGIC: u32 = 0x5046_4155;
|
||||
|
||||
/// One access unit relayed from the helper, in the helper's (= the host's, same machine) monotonic
|
||||
/// clock — `pts_ns` is directly comparable to the host's `now_ns()`.
|
||||
pub struct RelayAu {
|
||||
pub data: Vec<u8>,
|
||||
pub pts_ns: u64,
|
||||
pub keyframe: bool,
|
||||
}
|
||||
|
||||
/// A running USER-session WGC helper whose AUs the SYSTEM host relays. Drop kills the child + closes
|
||||
/// the pipes; the reader threads then end on the broken pipe.
|
||||
pub struct HelperRelay {
|
||||
proc: HANDLE,
|
||||
thread: HANDLE,
|
||||
/// Host write end of the helper's stdin — control commands (force keyframe). Mutex so the relay
|
||||
/// can be shared while the encode thread requests keyframes.
|
||||
stdin_w: Mutex<HANDLE>,
|
||||
/// Parsed AUs from the helper's stdout reader thread.
|
||||
rx: Receiver<RelayAu>,
|
||||
}
|
||||
|
||||
// HANDLEs are just kernel handle values; we own them for the relay's lifetime and close them on Drop.
|
||||
unsafe impl Send for HelperRelay {}
|
||||
unsafe impl Sync for HelperRelay {}
|
||||
|
||||
/// Control byte on the helper's stdin: force the next encoded frame to be an IDR (client decode
|
||||
/// recovery). Mirrors `enc.request_keyframe()` in the single-process path.
|
||||
const CTL_KEYFRAME: u8 = 0x01;
|
||||
|
||||
impl HelperRelay {
|
||||
/// Spawn the helper in the interactive user session and start relaying its AUs. `target` is the
|
||||
/// SudoVDA output the host already created (captured by GDI name only — the helper never touches
|
||||
/// display topology). `(w, h, hz)` is the negotiated mode; `bitrate_kbps` the negotiated bitrate.
|
||||
pub fn spawn(
|
||||
target: &WinCaptureTarget,
|
||||
mode: (u32, u32, u32),
|
||||
bitrate_kbps: u32,
|
||||
bit_depth: u8,
|
||||
) -> Result<HelperRelay> {
|
||||
let exe = std::env::current_exe().context("current_exe for helper spawn")?;
|
||||
let exe = exe.to_string_lossy().into_owned();
|
||||
let (w, h, hz) = mode;
|
||||
// CreateProcessAsUserW takes a single mutable command line (argv[0] = exe).
|
||||
let cmdline = format!(
|
||||
"\"{exe}\" wgc-helper --gdi \"{}\" --target-id {} --mode {w}x{h}x{hz} --bitrate {bitrate_kbps} --bit-depth {bit_depth}",
|
||||
target.gdi_name, target.target_id
|
||||
);
|
||||
tracing::info!(cmd = %cmdline, "spawning WGC helper in user session");
|
||||
|
||||
unsafe { spawn_inner(&cmdline, w, h, hz) }
|
||||
}
|
||||
|
||||
/// Receive the next relayed AU. Distinguishes a `Timeout` (helper slow/stalled — keep waiting)
|
||||
/// from `Disconnected` (helper exited → its stdout closed → reader thread ended → channel
|
||||
/// dropped), which returns *immediately* and means the relay must stop, not spin.
|
||||
pub fn recv_timeout(
|
||||
&self,
|
||||
dur: std::time::Duration,
|
||||
) -> Result<RelayAu, std::sync::mpsc::RecvTimeoutError> {
|
||||
self.rx.recv_timeout(dur)
|
||||
}
|
||||
|
||||
/// Non-blocking receive — used to drain stale buffered AUs (encoded while the secure desktop was
|
||||
/// the live source) before resuming the relay. `Ok` while AUs remain, `Err` once empty.
|
||||
pub fn try_recv(&self) -> Result<RelayAu, std::sync::mpsc::TryRecvError> {
|
||||
self.rx.try_recv()
|
||||
}
|
||||
|
||||
/// Ask the helper's encoder for an IDR on the next frame (client decode recovery). Best-effort:
|
||||
/// a write failure means the helper is gone — the caller's recv loop will see the disconnect.
|
||||
pub fn request_keyframe(&self) {
|
||||
let h = self.stdin_w.lock().unwrap();
|
||||
let mut written = 0u32;
|
||||
unsafe {
|
||||
let _ = windows::Win32::Storage::FileSystem::WriteFile(
|
||||
*h,
|
||||
Some(&[CTL_KEYFRAME]),
|
||||
Some(&mut written),
|
||||
None,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for HelperRelay {
|
||||
fn drop(&mut self) {
|
||||
unsafe {
|
||||
// Terminate the child first so its WGC capture + NVENC session tear down, then close our
|
||||
// handles (the reader threads end on the resulting broken pipe).
|
||||
let _ = TerminateProcess(self.proc, 1);
|
||||
let _ = CloseHandle(*self.stdin_w.lock().unwrap());
|
||||
let _ = CloseHandle(self.proc);
|
||||
let _ = CloseHandle(self.thread);
|
||||
}
|
||||
tracing::info!("WGC helper relay torn down");
|
||||
}
|
||||
}
|
||||
|
||||
/// Inheritable anonymous pipe (read, write). The caller marks whichever end the host keeps as
|
||||
/// non-inheritable so the child only inherits its own end.
|
||||
unsafe fn make_pipe() -> Result<(HANDLE, HANDLE)> {
|
||||
let mut read = HANDLE::default();
|
||||
let mut write = HANDLE::default();
|
||||
let sa = SECURITY_ATTRIBUTES {
|
||||
nLength: std::mem::size_of::<SECURITY_ATTRIBUTES>() as u32,
|
||||
lpSecurityDescriptor: std::ptr::null_mut(),
|
||||
bInheritHandle: true.into(),
|
||||
};
|
||||
CreatePipe(&mut read, &mut write, Some(&sa), 0).context("CreatePipe")?;
|
||||
Ok((read, write))
|
||||
}
|
||||
|
||||
/// Mark a handle non-inheritable (the host keeps it; the child must not get a copy).
|
||||
unsafe fn no_inherit(h: HANDLE) {
|
||||
let _ = SetHandleInformation(h, HANDLE_FLAG_INHERIT.0, HANDLE_FLAGS(0));
|
||||
}
|
||||
|
||||
/// Build a child environment block: the target session's block (so DLL/PATH/SystemRoot resolve) with
|
||||
/// this process's `PUNKTFUNK_*` vars overlaid, so the child runs with the SAME settings this process
|
||||
/// has (`PUNKTFUNK_ENCODER=nvenc`, `PUNKTFUNK_ZEROCOPY`, …) instead of the target shell's. Returns a
|
||||
/// UTF-16, double-null-terminated block suitable for `CREATE_UNICODE_ENVIRONMENT`. Shared by the WGC
|
||||
/// helper spawn (here) and the Windows service launching the host into the active session.
|
||||
pub(crate) unsafe fn merged_env_block(user_block: *const u16) -> Vec<u16> {
|
||||
// Parse the user block ("VAR=VALUE\0" … "\0") into entries.
|
||||
let mut entries: Vec<String> = Vec::new();
|
||||
if !user_block.is_null() {
|
||||
let mut p = user_block;
|
||||
loop {
|
||||
let mut len = 0isize;
|
||||
while *p.offset(len) != 0 {
|
||||
len += 1;
|
||||
}
|
||||
if len == 0 {
|
||||
break; // the trailing empty string = end of block
|
||||
}
|
||||
let slice = std::slice::from_raw_parts(p, len as usize);
|
||||
entries.push(String::from_utf16_lossy(slice));
|
||||
p = p.offset(len + 1);
|
||||
}
|
||||
}
|
||||
// Overlay "our" settings — PUNKTFUNK_* and RUST_LOG — dropping whatever the target block had.
|
||||
let is_ours = |k: &str| k.starts_with("PUNKTFUNK_") || k == "RUST_LOG";
|
||||
entries.retain(|e| !is_ours(e.split('=').next().unwrap_or("")));
|
||||
for (k, v) in std::env::vars().filter(|(k, _)| is_ours(k)) {
|
||||
entries.push(format!("{k}={v}"));
|
||||
}
|
||||
// Serialize back to a UTF-16 double-null-terminated block.
|
||||
let mut block: Vec<u16> = Vec::new();
|
||||
for e in entries {
|
||||
block.extend(e.encode_utf16());
|
||||
block.push(0);
|
||||
}
|
||||
block.push(0);
|
||||
block
|
||||
}
|
||||
|
||||
unsafe fn spawn_inner(cmdline: &str, w: u32, h: u32, hz: u32) -> Result<HelperRelay> {
|
||||
// The user token of the active console session (requires the host to be SYSTEM).
|
||||
let session = WTSGetActiveConsoleSessionId();
|
||||
if session == 0xFFFF_FFFF {
|
||||
bail!("no active console session (WTSGetActiveConsoleSessionId)");
|
||||
}
|
||||
let mut user_token = HANDLE::default();
|
||||
WTSQueryUserToken(session, &mut user_token)
|
||||
.context("WTSQueryUserToken (host must run as SYSTEM)")?;
|
||||
|
||||
// A primary token for CreateProcessAsUserW.
|
||||
let mut primary = HANDLE::default();
|
||||
let dup = DuplicateTokenEx(
|
||||
user_token,
|
||||
TOKEN_ALL_ACCESS,
|
||||
None,
|
||||
SecurityImpersonation,
|
||||
TokenPrimary,
|
||||
&mut primary,
|
||||
);
|
||||
let _ = CloseHandle(user_token);
|
||||
dup.context("DuplicateTokenEx(TokenPrimary)")?;
|
||||
|
||||
// The user's environment block (PATH, USERPROFILE, SystemRoot → DLL resolution), MERGED with the
|
||||
// host's PUNKTFUNK_* vars. CreateProcessAsUserW would otherwise give the helper the *user's* env
|
||||
// only, dropping PUNKTFUNK_ENCODER=nvenc / PUNKTFUNK_ZEROCOPY/… that the host runs with — so the
|
||||
// helper would fall back to the software (H.264-only) encoder. We parse the user block, strip any
|
||||
// PUNKTFUNK_* it has, append the host's, and pass the merged block.
|
||||
let mut env_block: *mut core::ffi::c_void = std::ptr::null_mut();
|
||||
let _ = CreateEnvironmentBlock(&mut env_block, Some(primary), false);
|
||||
let merged_env = merged_env_block(env_block as *const u16);
|
||||
if !env_block.is_null() {
|
||||
let _ = DestroyEnvironmentBlock(env_block);
|
||||
}
|
||||
|
||||
// Three pipes: stdout (helper→host AUs), stdin (host→helper control), stderr (helper→host logs).
|
||||
let (out_r, out_w) = make_pipe().context("stdout pipe")?;
|
||||
let (in_r, in_w) = make_pipe().context("stdin pipe")?;
|
||||
let (err_r, err_w) = make_pipe().context("stderr pipe")?;
|
||||
// The host keeps out_r / in_w / err_r — none inheritable; the child inherits out_w/in_r/err_w.
|
||||
no_inherit(out_r);
|
||||
no_inherit(in_w);
|
||||
no_inherit(err_r);
|
||||
|
||||
let mut si = STARTUPINFOW {
|
||||
cb: std::mem::size_of::<STARTUPINFOW>() as u32,
|
||||
dwFlags: STARTF_USESTDHANDLES,
|
||||
hStdInput: in_r,
|
||||
hStdOutput: out_w,
|
||||
hStdError: err_w,
|
||||
..Default::default()
|
||||
};
|
||||
// WGC needs the interactive desktop.
|
||||
let mut desktop: Vec<u16> = "winsta0\\default\0".encode_utf16().collect();
|
||||
si.lpDesktop = PWSTR(desktop.as_mut_ptr());
|
||||
|
||||
let mut cmd: Vec<u16> = cmdline.encode_utf16().chain(std::iter::once(0)).collect();
|
||||
let mut pi = PROCESS_INFORMATION::default();
|
||||
|
||||
let created = CreateProcessAsUserW(
|
||||
Some(primary),
|
||||
None,
|
||||
Some(PWSTR(cmd.as_mut_ptr())),
|
||||
None,
|
||||
None,
|
||||
true, // inherit handles (the child's std ends)
|
||||
CREATE_UNICODE_ENVIRONMENT | CREATE_NO_WINDOW,
|
||||
Some(merged_env.as_ptr() as *const core::ffi::c_void),
|
||||
None,
|
||||
&si,
|
||||
&mut pi,
|
||||
);
|
||||
|
||||
// Clean up regardless of outcome: the child now owns its inherited ends; close our copies.
|
||||
let _ = CloseHandle(out_w);
|
||||
let _ = CloseHandle(in_r);
|
||||
let _ = CloseHandle(err_w);
|
||||
let _ = CloseHandle(primary);
|
||||
|
||||
if let Err(e) = created {
|
||||
let _ = CloseHandle(out_r);
|
||||
let _ = CloseHandle(in_w);
|
||||
let _ = CloseHandle(err_r);
|
||||
return Err(e).context("CreateProcessAsUserW(wgc-helper)");
|
||||
}
|
||||
tracing::info!(pid = pi.dwProcessId, mode = %format!("{w}x{h}@{hz}"), "WGC helper spawned");
|
||||
|
||||
// The helper does the WGC capture + NVENC encode, but it runs under the user's UAC-FILTERED token
|
||||
// (no SE_INC_BASE_PRIORITY), so it can't raise its OWN GPU scheduling-priority class — under a
|
||||
// GPU-saturating game NVENC then gets starved (the "240→40 fps in-game collapse"). The SYSTEM host
|
||||
// holds the privilege, so stamp the HIGH GPU priority class onto the child here, right after spawn
|
||||
// (the process-level class applies to the GPU contexts the helper creates afterwards).
|
||||
crate::capture::dxgi::set_child_gpu_priority_class(pi.hProcess);
|
||||
|
||||
// stderr → host tracing, line by line.
|
||||
let err_handle = HandleReader(err_r);
|
||||
std::thread::Builder::new()
|
||||
.name("wgc-helper-log".into())
|
||||
.spawn(move || {
|
||||
let r = BufReader::new(err_handle);
|
||||
for line in r.lines() {
|
||||
match line {
|
||||
Ok(l) if !l.trim().is_empty() => tracing::info!(target: "wgc_helper", "{l}"),
|
||||
Ok(_) => {}
|
||||
Err(_) => break,
|
||||
}
|
||||
}
|
||||
})
|
||||
.ok();
|
||||
|
||||
// stdout → parsed AUs. Bounded so a stalled relay applies backpressure (the pipe then fills and
|
||||
// the helper blocks on write — the same backpressure the single-process channel gives).
|
||||
let (tx, rx) = std::sync::mpsc::sync_channel::<RelayAu>(3);
|
||||
let out_handle = HandleReader(out_r);
|
||||
std::thread::Builder::new()
|
||||
.name("wgc-helper-au".into())
|
||||
.spawn(move || au_reader(out_handle, tx))
|
||||
.ok();
|
||||
|
||||
Ok(HelperRelay {
|
||||
proc: pi.hProcess,
|
||||
thread: pi.hThread,
|
||||
stdin_w: Mutex::new(in_w),
|
||||
rx,
|
||||
})
|
||||
}
|
||||
|
||||
/// Parse the AU framing off the helper's stdout and forward each AU. Ends (returns) when the pipe
|
||||
/// breaks (helper exit) or the channel's receiver is dropped (relay torn down).
|
||||
fn au_reader(mut r: HandleReader, tx: SyncSender<RelayAu>) {
|
||||
loop {
|
||||
let mut hdr = [0u8; 4 + 4 + 8 + 1];
|
||||
if r.read_exact(&mut hdr).is_err() {
|
||||
break;
|
||||
}
|
||||
let magic = u32::from_le_bytes([hdr[0], hdr[1], hdr[2], hdr[3]]);
|
||||
if magic != AU_MAGIC {
|
||||
tracing::error!(
|
||||
magic = format!("{magic:#x}"),
|
||||
"WGC helper AU stream desync — aborting relay"
|
||||
);
|
||||
break;
|
||||
}
|
||||
let len = u32::from_le_bytes([hdr[4], hdr[5], hdr[6], hdr[7]]) as usize;
|
||||
let pts_ns = u64::from_le_bytes([
|
||||
hdr[8], hdr[9], hdr[10], hdr[11], hdr[12], hdr[13], hdr[14], hdr[15],
|
||||
]);
|
||||
let keyframe = hdr[16] != 0;
|
||||
// Bound the allocation — a corrupt length must not OOM the host. 64 MiB is far above any real
|
||||
// AU (a 5K keyframe is a few MB).
|
||||
if len > 64 * 1024 * 1024 {
|
||||
tracing::error!(len, "WGC helper AU length implausible — aborting relay");
|
||||
break;
|
||||
}
|
||||
let mut data = vec![0u8; len];
|
||||
if r.read_exact(&mut data).is_err() {
|
||||
break;
|
||||
}
|
||||
if tx
|
||||
.send(RelayAu {
|
||||
data,
|
||||
pts_ns,
|
||||
keyframe,
|
||||
})
|
||||
.is_err()
|
||||
{
|
||||
break; // relay dropped
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Minimal `Read` over a Win32 pipe HANDLE (the windows crate doesn't impl `Read` on HANDLE).
|
||||
struct HandleReader(HANDLE);
|
||||
unsafe impl Send for HandleReader {}
|
||||
impl Read for HandleReader {
|
||||
fn read(&mut self, buf: &mut [u8]) -> std::io::Result<usize> {
|
||||
let mut read = 0u32;
|
||||
let ok = unsafe {
|
||||
windows::Win32::Storage::FileSystem::ReadFile(self.0, Some(buf), Some(&mut read), None)
|
||||
};
|
||||
match ok {
|
||||
Ok(()) => Ok(read as usize),
|
||||
// A broken pipe (helper exited) reads as ERROR_BROKEN_PIPE → report EOF (0).
|
||||
Err(_) => Ok(0),
|
||||
}
|
||||
}
|
||||
}
|
||||
impl Drop for HandleReader {
|
||||
fn drop(&mut self) {
|
||||
unsafe {
|
||||
let _ = CloseHandle(self.0);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Is this process running as the LOCAL SYSTEM account? Used to decide whether the two-process
|
||||
/// secure-desktop path applies (only SYSTEM can `WTSQueryUserToken` + capture the Winlogon desktop).
|
||||
pub fn running_as_system() -> bool {
|
||||
use windows::Win32::Security::{GetTokenInformation, TokenUser, TOKEN_QUERY, TOKEN_USER};
|
||||
use windows::Win32::System::Threading::{GetCurrentProcess, OpenProcessToken};
|
||||
unsafe {
|
||||
let mut token = HANDLE::default();
|
||||
if OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &mut token).is_err() {
|
||||
return false;
|
||||
}
|
||||
let mut len = 0u32;
|
||||
let _ = GetTokenInformation(token, TokenUser, None, 0, &mut len);
|
||||
if len == 0 {
|
||||
let _ = CloseHandle(token);
|
||||
return false;
|
||||
}
|
||||
let mut buf = vec![0u8; len as usize];
|
||||
let ok = GetTokenInformation(
|
||||
token,
|
||||
TokenUser,
|
||||
Some(buf.as_mut_ptr() as *mut _),
|
||||
len,
|
||||
&mut len,
|
||||
)
|
||||
.is_ok();
|
||||
let _ = CloseHandle(token);
|
||||
if !ok {
|
||||
return false;
|
||||
}
|
||||
let tu = &*(buf.as_ptr() as *const TOKEN_USER);
|
||||
// The well-known LocalSystem SID is S-1-5-18.
|
||||
is_local_system_sid(tu.User.Sid)
|
||||
}
|
||||
}
|
||||
|
||||
/// True iff `sid` is S-1-5-18 (LocalSystem).
|
||||
unsafe fn is_local_system_sid(sid: windows::Win32::Security::PSID) -> bool {
|
||||
use windows::Win32::Security::{
|
||||
GetSidIdentifierAuthority, GetSidSubAuthority, GetSidSubAuthorityCount, IsValidSid,
|
||||
};
|
||||
if !IsValidSid(sid).as_bool() {
|
||||
return false;
|
||||
}
|
||||
let auth = GetSidIdentifierAuthority(sid);
|
||||
if auth.is_null() {
|
||||
return false;
|
||||
}
|
||||
// NT Authority = {0,0,0,0,0,5}.
|
||||
let a = (*auth).Value;
|
||||
if a != [0, 0, 0, 0, 0, 5] {
|
||||
return false;
|
||||
}
|
||||
let count = *GetSidSubAuthorityCount(sid);
|
||||
if count != 1 {
|
||||
return false;
|
||||
}
|
||||
*GetSidSubAuthority(sid, 0) == 18 // SECURITY_LOCAL_SYSTEM_RID
|
||||
}
|
||||
Reference in New Issue
Block a user