enricobuehler
5a14d2b3f4
`Child::kill` is one `TerminateProcess`: it ends exactly the process we launched. On Unix
that is the whole story here — `kscreen-doctor`, `systemctl`, `pw-dump` are single processes
we exec directly. On Windows there is no direct exec, so every helper is reached through a
shell (`cmd /c …`, `powershell -Command "… | pnputil …"`) and the process that actually
hangs is a GRANDCHILD. Killing the shell left it running, holding the stdio handles and the
working directory it inherited from us, which means the budget bounded nothing.
Not theoretical: it is why a fully green `cargo test -p pf-vdisplay` still failed its CI job
on `33a31427`. The suite's own hung-helper case orphaned a 60-second `ping.exe`; it kept the
build step's stdout pipe open past the runner's 10 s WaitDelay ("exec: WaitDelay expired
before I/O complete") and pinned `crates\pf-vdisplay` so the workspace could not be cleaned
up. The tests reported `55 passed; 0 failed` in the same log.
Spawned children are now enrolled in a Job object. Job membership is inherited across
`CreateProcess`, so one `TerminateJobObject` ends every descendant, and
`JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` makes that hold on paths that never reach the explicit
call — an early `?`, a panic — because closing the last handle is then itself the kill.
Best-effort: a box that cannot make a job object degrades to the single-process kill it did
before rather than failing the query, the same stance as the already-ignored `Child::kill`.
`output_within` ends the tree BEFORE `wait_with_output`. That read runs to EOF, and a
grandchild outliving the helper holds the write end — the one way this "bounded" helper
could still hang forever.
The new test is the permanent lever, and it is not vacuous: it asserts the grandchild
reached its first marker before asserting it never reached its second. Verified on .173
(Win11 26200): 56 pass, `clippy -p punktfunk-host -p pf-vdisplay --all-targets` clean, no
`ping.exe` survivors. A/B with the job disabled: the test fails with "a grandchild outlived
the budget" and one orphan survives. On the CI runner .133 the job APIs were also checked
directly, as Administrator (already inside a job — nesting works) and as SYSTEM: both kill
the tree.
Trap for anyone editing that test: a .cmd file is read in the OEM code page, so an absolute
path baked into it is mangled the moment the temp dir holds a non-ASCII character
(`C:\Users\Enrico Bühler\…` arrives as `B?hler`) and every redirect fails with "path not
found". It uses `%~dp0` instead, so the file stays pure ASCII.
74 lines
3.6 KiB
TOML
74 lines
3.6 KiB
TOML
# Virtual-display orchestration (plan §W6): the on-demand client-sized headless output — per-compositor
|
|
# Linux backends (KWin zkde-screencast, wlroots swaymsg, Mutter RemoteDesktop, Hyprland) and the
|
|
# Windows IddCx/pf-vdisplay driver backend — behind one VirtualDisplay trait, plus the mode-conflict
|
|
# admission registry and the DDC/CI panel control. Extracted into a subsystem crate; depends on the
|
|
# shared leaves (pf-frame's DXGI identity, pf-win-display's CCD helpers, pf-gpu, pf-paths) + pf-encode
|
|
# (the NVENC session-budget admission gate), never on capture/inject or the orchestrator (the display
|
|
# lifecycle events invert to a host-registered sink).
|
|
[package]
|
|
name = "pf-vdisplay"
|
|
version.workspace = true
|
|
edition = "2021"
|
|
rust-version.workspace = true
|
|
license = "MIT OR Apache-2.0"
|
|
description = "punktfunk host virtual-display orchestration: per-compositor Linux backends + the Windows IddCx driver backend behind one VirtualDisplay trait."
|
|
publish = false
|
|
|
|
[dependencies]
|
|
punktfunk-core = { path = "../punktfunk-core", features = ["quic"] }
|
|
pf-frame = { path = "../pf-frame" }
|
|
pf-gpu = { path = "../pf-gpu" }
|
|
pf-host-config = { path = "../pf-host-config" }
|
|
pf-paths = { path = "../pf-paths" }
|
|
pf-win-display = { path = "../pf-win-display" }
|
|
# The Windows admission gate consults NVENC's session budget (can_open_another_session).
|
|
pf-encode = { path = "../pf-encode" }
|
|
anyhow = "1"
|
|
tracing = "0.1"
|
|
# The platform-neutral policy/identity/custom-preset state is serde-serialized (persisted + the mgmt
|
|
# API), and the policy/preset types derive utoipa `ToSchema` for the OpenAPI document.
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
utoipa = { version = "5", features = ["axum_extras"] }
|
|
sha2 = "0.10"
|
|
hex = "0.4"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
libc = "0.2"
|
|
# The Mutter backend drives D-Bus RemoteDesktop + ScreenCast.RecordVirtual via ashpd on a tokio
|
|
# runtime; the gamescope restore worker + portal handshakes use tokio too.
|
|
ashpd = { version = "0.13", features = ["screencast", "remote_desktop"] }
|
|
tokio = { version = "1", features = ["rt", "rt-multi-thread", "macros", "net", "time"] }
|
|
futures-util = "0.3"
|
|
# KWin virtual-output creation via the privileged `zkde_screencast_unstable_v1` protocol (vendored in
|
|
# `protocols/`); the generated interface tables reference `wayland-backend`.
|
|
wayland-client = "0.31"
|
|
wayland-scanner = "0.31"
|
|
wayland-backend = "0.3"
|
|
# wayland-scanner emits `bitflags::bitflags!` for the KDE output-device protocol's bitfield enums
|
|
# (kde-output-device-v2 `capability`/`flags`); needs the crate in scope (kwin_output_mgmt.rs).
|
|
bitflags = "2"
|
|
# The gamescope bare-spawn splash client (gamescope/splash.rs): pure-Rust X11 core protocol (the
|
|
# same no-libxcb-link stance as pf-capture's XFixes cursor source), no extension features needed.
|
|
x11rb = { version = "0.13", default-features = false }
|
|
|
|
[target.'cfg(target_os = "windows")'.dependencies]
|
|
# The host<->driver wire contract for the pf-vdisplay IddCx backend (control IOCTLs + Pod structs).
|
|
pf-driver-proto = { path = "../pf-driver-proto" }
|
|
bytemuck = { version = "1.19", features = ["derive"] }
|
|
windows = { version = "0.62", features = [
|
|
"Win32_Foundation",
|
|
"Win32_Devices_DeviceAndDriverInstallation",
|
|
"Win32_Devices_Display",
|
|
"Win32_Graphics_Gdi",
|
|
"Win32_Storage_FileSystem",
|
|
"Win32_System_IO",
|
|
# `proc`'s budget ends the helper's whole process TREE: every Windows helper is reached through
|
|
# a shell, so the process that hangs is a grandchild `Child::kill` cannot reach.
|
|
"Win32_System_JobObjects",
|
|
"Win32_System_Threading",
|
|
] }
|
|
|
|
[lints]
|
|
workspace = true
|