enricobuehler
d01a8fd17a
NVIDIA/AMD Vulkan ICDs refuse to *advertise* an HDR color space for a surface on an
IddCx indirect/virtual display, so Vulkan games (Doom: The Dark Ages, id Tech, Indiana
Jones, …) report "device does not support HDR" — even though Windows HDR, DWM compose,
and the client PQ stream all work, and the ICD happily *accepts + presents* a forced HDR
swapchain there. The whole gap is enumeration; the community (Apollo/Sunshine/VDD) wrote
this off as kernel-side / unfixable.
Add VK_LAYER_PUNKTFUNK_hdr_inject (packaging/windows/pf-vkhdr-layer/): a standalone
cdylib Vulkan implicit layer that appends {A2B10G10R10, HDR10_ST2084} + {RGBA16F, scRGB}
to vkGetPhysicalDeviceSurfaceFormats[2]KHR (no need to hook vkCreateSwapchainKHR — the
ICD doesn't validate the color space there). Self-gated on the surface monitor's actual
advanced-color state (DisplayConfig GET_ADVANCED_COLOR_INFO), so it is a complete no-op
on SDR sessions and real monitors (dedup). Always-on (registry-discovered) so it works
regardless of how a game is launched — env-scoping silently fails for already-running
Steam. Escape hatches: DISABLE_PF_VKHDR, PF_VKHDR_EXCLUDE, and a built-in kernel-anti-
cheat denylist.
The installer builds/signs/stages it and registers it under
HKLM64\SOFTWARE\Khronos\Vulkan\ImplicitLayers (opt-out "Install the HDR Vulkan layer"
task); windows-host CI fmt+clippy-gates it (msvc-only FFI).
Live-validated on the RTX box: Doom: The Dark Ages enables HDR over the pf-vdisplay
virtual display.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
5.0 KiB
Windows service (deployment)
The PunktfunkHost Windows service is the end-user way to run the host on Windows. It replaces the
manual bring-up chain (a scheduled task → PsExec64 -s -i 1 → wscript launch.vbs → host-run.cmd)
with one command, auto-start on boot, and supervision.
Install (installer — recommended)
Download the signed installer from the package registry
(punktfunk-host-windows, https://git.unom.io/unom/-/packages) and run it (it elevates itself):
punktfunk-host-setup-<ver>.exe # wizard
punktfunk-host-setup-<ver>.exe /VERYSILENT # unattended
It lays the host into C:\Program Files\punktfunk, optionally installs the bundled SudoVDA
virtual-display driver, then runs service install + service start for you. Upgrades stop the
service first and re-point it; uninstall (Add/Remove Programs) runs service uninstall. Packaging
details: packaging/windows/README.md. A self-signed CI build also
publishes a .cer — import it once (Import-Certificate -FilePath punktfunk-host-windows.cer -CertStoreLocation Cert:\LocalMachine\TrustedPublisher) so Windows trusts the signed setup.
Install (manual / CLI)
From an elevated (Administrator) prompt:
punktfunk-host service install # register auto-start LocalSystem service + firewall rules + default host.env
punktfunk-host service start # start it now (also starts automatically on every boot)
service install is idempotent — run it again after upgrading the exe to re-point the service at the
new binary. Register whatever location you keep the exe in (e.g. C:\Program Files\punktfunk\); the
service records the current exe path.
Other subcommands:
punktfunk-host service stop
punktfunk-host service status
punktfunk-host service uninstall # stop + delete the service + remove its firewall rules
How it works
The host must run as SYSTEM in the interactive session (Session 1+): Desktop Duplication of the
secure desktop (UAC / lock / login) and SendInput need SYSTEM, and capture/injection need the
interactive session, which a plain Session-0 service is not in.
So the service (itself in Session 0) never captures. On start, and whenever the active console session changes, it:
- resolves the active console session (
WTSGetActiveConsoleSessionId), - duplicates its own LocalSystem token and retargets it to that session (
SetTokenInformationTokenSessionId), - launches the host there with
CreateProcessAsUserW(lpDesktop = winsta0\default), - supervises it: relaunches on exit/crash (with backoff) and on a console connect/disconnect.
A kill-on-close job object ensures a service crash never orphans the SYSTEM host. The host in turn
spawns the WGC helper into the user session (see windows-secure-desktop.md)
— two nested launches. Lock/unlock are handled inside the host (the DesktopWatcher DDA↔WGC mux), so
the service deliberately does not relaunch on lock/unlock — only on a real session switch.
This is the same model Sunshine/Apollo use.
Configuration
Config lives in %ProgramData%\punktfunk\host.env (KEY=VALUE lines, # comments). service install writes a default if none exists. Template: scripts/windows/host.env.example.
PUNKTFUNK_ENCODER=nvenc
PUNKTFUNK_VIDEO_SOURCE=virtual
PUNKTFUNK_SECURE_DDA=1
RUST_LOG=info
# PUNKTFUNK_HOST_CMD=serve --gamestream # the host subcommand the service launches (default: native + Moonlight)
The service loads these into its environment and carries PUNKTFUNK_* + RUST_LOG to the host child
(the same env-merge the WGC helper uses). Restart the service after editing:
punktfunk-host service stop; punktfunk-host service start
The host's identity (cert/pairing/mgmt token/library) also lives under %ProgramData%\punktfunk — a
machine-wide dir the SYSTEM service and the interactive user share, surviving user logout.
PUNKTFUNK_CONFIG_DIR overrides the location (both platforms; handy for tests).
Logs
%ProgramData%\punktfunk\logs\service.log— the service's own supervision log (spawn/exit/session switches).%ProgramData%\punktfunk\logs\host.log— the host child's stdout/stderr.
Prerequisites
- The host built with
--features nvencfor NVENC (the driver shipsnvEncodeAPI64.dll; no SDK needed at runtime). Software encode otherwise. - The SudoVDA indirect display driver installed (for
PUNKTFUNK_VIDEO_SOURCE=virtual). - ViGEmBus for virtual gamepads (optional).
Gotchas
service install/uninstallneed an elevated prompt (the SCM rejects non-admin).service runis the SCM entry point — don't run it by hand (it errors with a hint).- A graceful stop currently
TerminateProcesses the host, so its RAII teardown (SudoVDA monitor REMOVE) doesn't run; a stale virtual monitor can linger until the next start. A cooperative-stop signal is a follow-up.