enricobuehler
e2f004589c
The driver now publishes each acquired swap-chain surface into the host-created shared ring (the IDD-push path) — the full glass-to-glass transport is code-complete. Both sides use the canonical pf_vdisplay_proto::frame layout (lockstep by compile-error, not "must match" comments). Driver compiles + LOADS on-glass (adapter inits, Status=OK; no regression — the publisher is dormant until a frame is acquired); host cargo check green; adversarially reviewed (no blockers — token layout, keyed-mutex key 0, names by target_id, and the format guard all match the host consumer). - new driver frame_transport.rs: FramePublisher OPENS the host ring by target_id (OpenFileMapping header + magic Acquire readiness gate + OpenEvent + OpenSharedResourceByName RING_LEN keyed-mutex textures), writes its render LUID + DRV_STATUS back into the header; publish() is NON-BLOCKING (round-robin 0ms try-acquire -> CopyResource -> ReleaseSync -> FrameToken::pack store Release -> SetEvent; drops the frame if every slot is busy or the surface format != the ring format). Manual handle/view cleanup on every try_open early return; RAII Drop (slots -> unmap -> CloseHandle). Layout/consts/names/token all from pf_vdisplay_proto::frame. - swap_chain_processor.rs run_core: lazy rate-limited attach (every ~30 frames) + is_stale re-attach (mid-session HDR ring recreate); publishes buffer.MetaData.pSurface via IDXGIResource::from_raw_borrowed (preserves IddCx's refcount) BEFORE IddCxSwapChainFinishedProcessingFrame. run/run_core gain the render LUID; callbacks.rs assign_swap_chain passes it. - host idd_push.rs migrated onto pf_vdisplay_proto::frame (deleted the hand-rolled SharedHeader / MAGIC / VERSION / RING_LEN / DRV_STATUS_* / name fns / token packing) — pure refactor, byte-identical, no behavior or gating change. DebugBlock + DXGI_SHARED_RESOURCE_RW kept local (not in the proto). - driver windows crate gains Win32_System_Memory (MapViewOfFile/OpenFileMappingW/...); rustfmt'd the whole driver workspace (incl. wdk-probe — fmt-only). Built via the ultracode flow: STEP-6 map workflow -> agent-implement -> box build (driver + host both green; caught nothing this time) -> adversarial-verify-agent (no blockers) -> FrameToken::pack hardening -> deploy (loads). Glass-to-glass frame validation awaits a composited session (per the parity finding: this headless box yields 0 frames for the proven SudoVDA path too). FOLLOW-UPs: port the optional Global\pfvd-dbg DebugBlock triage channel to the new driver; STEP 7 HDR; STEP 8 drop SudoVDA. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windows host packaging — signed Inno Setup installer
A one-file, signed setup.exe for the punktfunk streaming host on Windows, published to Gitea's
generic package registry (punktfunk-host-windows) by .gitea/workflows/windows-host.yml.
x64 only (no ARM64)
Unlike the client (which ships x64 + ARM64 MSIX), the host is x64-only by design. It is coupled to
an NVIDIA GPU (NVENC, via nvEncodeAPI64.dll from the driver) and the pf-vdisplay virtual-display
driver — neither exists on Windows ARM64 (no ARM64 NVIDIA driver; the driver builds x64-only). An
ARM64 host would install but couldn't encode or create a virtual display, so we don't build one.
Revisit if NVIDIA-ARM Windows PCs ever ship.
Why not MSIX (like the client)
The host installs a LocalSystem SCM service that CreateProcessAsUserW's from Session 0 into the
interactive session for secure-desktop (UAC / lock screen) capture, adds firewall rules, and depends
on the pf-vdisplay UMDF/IDD virtual-display driver. MSIX's sandbox can install neither a SYSTEM
service of this kind nor a driver. So the host ships as a classic elevated installer.
The installer is deliberately thin: the real install logic — SCM registration, firewall rules, the
default host.env, and the SYSTEM→interactive-session supervisor — already lives in
punktfunk-host service install (crates/punktfunk-host/src/service.rs). The installer just lays the
exe into C:\Program Files\punktfunk\ and calls that subcommand, elevated.
What the installer does
- Installs
punktfunk-host.exe(+host.env.example, this README) to{app}(C:\Program Files\punktfunk). - Optional task Install the pf-vdisplay virtual display driver — imports the driver's self-signed
cert (machine
Root+TrustedPublisher), creates theroot\pf_vdisplaydevice node (only if absent, via nefconc — never devgen —install-pf-vdisplay.ps1), and stages the driver withpnputil /add-driver /install. Best-effort: a driver failure warns but never aborts the install (the host degrades to a physical display without it). - Runs
punktfunk-host service install(idempotent; writes a defaulthost.envonly if absent, so user config survives upgrades) and, by the Start service now task,service start. - Web management console (bundled when packed with
-WebDir/-BunExe, which the CI always is): lays down the built self-contained.outputserver (NitronoExternals— deps bundled + tree-shaken, ~75 files, nonode_modules) + a portable bun, prompts for a console login password (pre-filled with a secure random default, shown again on the final page; kept on upgrade), thenweb-setup.ps1writes the ACL'd%ProgramData%\punktfunk\web-password, registers thePunktfunkWebscheduled task (boot, SYSTEM, restart-on-failure →web-run.cmd→bunon:3000), opens TCP 3000, and starts it. It proxies the host's loopback mgmt API with the host's own%ProgramData%\punktfunk\mgmt-token. - Upgrade: stops a running
PunktfunkHostservice and waits forSTOPPEDbefore replacing files (otherwise the locked exe / respawning supervisor would block the copy), then re-points the service; the existing console password is kept (the wizard page is skipped). - Uninstall (Add/Remove Programs): runs
service uninstall(stop + delete service + remove firewall rules) and removes thePunktfunkWebtask + its firewall rule. The pf-vdisplay driver and the%ProgramData%\punktfunkconfig (incl.web-password) are intentionally left in place.
Silent install: punktfunk-host-setup-<ver>.exe /VERYSILENT (omit the driver with
/MERGETASKS="!installdriver"). A silent fresh install uses the generated random console password —
read it from %ProgramData%\punktfunk\web-password.
Prerequisites on the target box
- A GPU for hardware encode: an NVIDIA GPU + driver (NVENC), or an AMD/Intel GPU (AMF/QSV) — the
exe is built
--features nvenc,amf-qsv. Software H.264 is the GPU-less fallback. - Virtual gamepads need no prerequisite. The DualSense / DualShock 4 / Xbox 360 (XUSB) UMDF drivers
are bundled in the installer (the Install the virtual gamepad drivers task) and
pnputil-installed. ViGEmBus is no longer used.
Files here
| File | Role |
|---|---|
punktfunk-host.iss |
Inno Setup script (the installer definition). |
pack-host-installer.ps1 |
Orchestrator: cert + sign, stage the driver + FFmpeg + web console (.output + bun) bundles, run ISCC, sign setup.exe, emit registry paths. |
stage-pf-vdisplay.ps1 |
Stage the vendored pf-vdisplay driver + fetch/verify the pinned nefcon release into the bundle. |
install-pf-vdisplay.ps1 |
Runs at install time (elevated): trust cert → gated device-node create (nefconc) → pnputil install. |
../../scripts/windows/web-run.cmd |
The PunktfunkWeb task action: loads the mgmt token + login password env, runs the bundled bun on the Nitro server (:3000). |
../../scripts/windows/web-setup.ps1 |
Install-time (elevated): write the ACL'd console password, register the PunktfunkWeb task + firewall rule, start it. |
pf-vdisplay/ |
Vendored signed pf-vdisplay driver: pf_vdisplay.inf / pf_vdisplay.cat / pf_vdisplay.dll / punktfunk-driver.cer. Built from vdisplay-driver/. |
vdisplay-driver/ |
The all-Rust IddCx driver source (pf-vdisplay crate + vendored wdf-umdf* bindings) + deploy-dev.ps1 (build/sign/install for dev). |
nvenc/nvenc.def, nvenc/gen-nvenc-importlib.ps1 |
Synthesise nvencodeapi.lib for the --features nvenc link (llvm-dlltool / lib.exe). |
Vendored driver: pf-vdisplay is our all-Rust IddCx virtual display (UMDF2), built from
packaging/windows/vdisplay-driver/. It replaced the vendored SudoVDA C++ driver — full story indocs/windows-virtual-display-rust-port.md. The signed output (pf_vdisplay.dll/.inf/.cat+punktfunk-driver.cer; signerpunktfunk-ds-test— the same cert the gamepad drivers ship, Class=Display, HWIDroot\pf_vdisplay) is checked in underpf-vdisplay/. To refresh it after a driver-source change, rebuild + re-sign withvdisplay-driver/deploy-dev.ps1and copy the stagedpf_vdisplay.{dll,inf,cat}over the vendored copies. nefcon (the device-node tool — the install creates the node with it, neverdevgen, which leaves persistent phantom devices) is fetched + SHA-256-verified from its pinned release instage-pf-vdisplay.ps1.
Build locally (Windows, MSVC + Windows SDK + Inno Setup)
# 1. import lib for the nvenc link
pwsh -File packaging\windows\nvenc\gen-nvenc-importlib.ps1 -OutDir C:\t\nvenc
$env:PUNKTFUNK_NVENC_LIB_DIR = 'C:\t\nvenc'
# 2. build the host
cargo build --release -p punktfunk-host --features nvenc
# 3. pack (self-signed unless MSIX_CERT_PFX_B64/MSIX_CERT_PASSWORD are set; -NoDriver to skip pf-vdisplay)
pwsh -File packaging\windows\pack-host-installer.ps1 -Version 0.0.0-dev -TargetDir C:\t\release -OutDir C:\t\out
Release
Push a vX.Y.Z tag — one tag releases every platform (see
Release Channels). The workflow builds, signs, and
publishes punktfunk-host-setup-X.Y.Z.exe + the public .cer, refreshes the stable latest/
alias, and attaches the installer to the unified Gitea Release. Main pushes publish rolling
0.3.<run> canary builds to the canary/ alias.