mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-09-13 16:01:00 +03:00
feat(drm): opt-in DRM/KMS screen capture for Linux/Wayland
adds an opt-in `drm` feature for unattended remote access on Wayland: it captures below the compositor via libdrmtap, so there is no xdg-desktop-portal consent dialog and it works at the login screen. off by default. when the feature is off the build is byte-identical. everything is gated behind feature = "drm" or lives only in the separate rustdesk-unattended-wayland deb, whose package name is the informed consent. architecture (agreed with the maintainer): the capture runs inside the root --service, which already holds the privilege it needs, and streams frames to the user --server over a service-scoped _drm ipc channel. libdrmtap is loaded with dlopen at runtime (no link-time dependency, so the base build is unchanged and it still runs on ubuntu 18), and the .so is built in ci from the rustdesk-org/libdrmtap fork and shipped only in the drm deb. no setcap helper. - service: DrmReader reads scanout directly via the dlopen loader; an IpcDrmCapturer serves _drm consumers with a per-connection capture worker; durable availability cache + pre-warm to avoid enumerate/re-probe restarts - capture: multi-display (targets the selected crtc), hardware cursor over _drm, transient-errno retry with a bounded stall, rejects non-32bpp scanouts before the frame copy - robustness: only active, crtc-bound outputs are offered (an unbound crtc_id=0 connector is filtered and a client-selected 0 is refused, both fall back to pipewire); a per-display rapid-rebuild guard demotes a flapping display to pipewire; per-display (not global) zero-frame failure tracking - root-service hardening: bounded frame allocation and a concurrent-connection cap so a malformed scanout or a buggy consumer cannot OOM or thread-exhaust the service; a negative availability verdict expires so displays that appear after startup recover without a --server restart; exactly-one .so selection in the packaging so a stale object is never silently shipped - build: libdrmtap.so cloned at build time from rustdesk-org/libdrmtap main and bundled only for the --drm deb; ci builds a separate rustdesk-unattended-wayland deb (incl. an ubuntu 18.04 container) - DRM_CAPTURE_SECURITY.md: threat model and hardening notes
This commit is contained in:
Mariano Abad
478
src/ipc.rs
478
src/ipc.rs
@@ -481,6 +481,47 @@ pub enum Data {
|
||||
ControlPermissionsRemoteModify(Option<bool>),
|
||||
#[cfg(target_os = "windows")]
|
||||
FileTransferEnabledState(Option<bool>),
|
||||
// --- DRM/KMS capture (opt-in `drm` feature) over the `_drm` service-scoped channel ---
|
||||
// All of the following are `cfg(all(linux, drm))`, so the drm-off IPC wire is byte-identical
|
||||
// to upstream. Protocol on `_drm`: on connect the root service sends `DrmDisplayList`, the
|
||||
// client replies `DrmStart{display}`, then the service streams `DrmFrame` + send_raw(BGRA) and
|
||||
// `DrmCursor` + send_raw(RGBA). A frame/cursor header is ALWAYS immediately followed by exactly
|
||||
// one `send_raw()` payload (the same header-then-raw pairing as `FileBlockFromCM`). This keeps
|
||||
// the header extensible: a future zero-copy `DrmFrameDmabuf { fd, stride, modifier, .. }` slots
|
||||
// in as a sibling variant without changing the transport.
|
||||
/// Client -> service: begin streaming the chosen display.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
DrmStart { display: i32 },
|
||||
/// Service -> client: the enumerated DRM displays (sent once, before frames).
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
DrmDisplayList(Vec<DrmDisplayInfo>),
|
||||
/// Service -> client: a frame header; the packed BGRA pixels follow via `send_raw()`.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
DrmFrame { width: u32, height: u32 },
|
||||
/// Service -> client: a hardware-cursor header; the RGBA pixels follow via `send_raw()`.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
DrmCursor {
|
||||
id: u64,
|
||||
width: u32,
|
||||
height: u32,
|
||||
hotx: i32,
|
||||
hoty: i32,
|
||||
},
|
||||
}
|
||||
|
||||
/// One enumerated DRM display shipped over `_drm` (physical geometry). The serializable IPC
|
||||
/// form of `scrap::drm_reader::DisplaySnapshot`; the server augments it with the Wayland
|
||||
/// logical geometry/scale, which needs the user session.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
#[derive(Debug, Serialize, Deserialize, Clone)]
|
||||
pub struct DrmDisplayInfo {
|
||||
pub name: String,
|
||||
pub crtc_id: u32,
|
||||
pub x: i32,
|
||||
pub y: i32,
|
||||
pub width: u32,
|
||||
pub height: u32,
|
||||
pub active: bool,
|
||||
}
|
||||
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
@@ -1448,6 +1489,443 @@ pub async fn start_pa() {
|
||||
}
|
||||
}
|
||||
|
||||
/// Filesystem path of the `_drm` capture socket. It lives beside the hardened `_service` socket in
|
||||
/// the shared `/tmp/<app>-service` directory (cross-uid, traversable) so the root `--service` and
|
||||
/// the user `--server` share one uid-independent path. Derived from the real `_service` path so we
|
||||
/// inherit hbb_common's directory convention WITHOUT teaching hbb_common about a drm-specific
|
||||
/// postfix (keeps the isolation clean: no shared-lib change). Both ends call this.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
pub(crate) fn drm_ipc_path() -> String {
|
||||
let service_path = Config::ipc_path("_service");
|
||||
let dir = std::path::Path::new(&service_path)
|
||||
.parent()
|
||||
.unwrap_or_else(|| std::path::Path::new("/tmp"));
|
||||
dir.join("ipc_drm").to_string_lossy().into_owned()
|
||||
}
|
||||
|
||||
/// Connect (from the user `--server`) to the root service's `_drm` capture channel. Uses the
|
||||
/// derived `drm_ipc_path()` rather than `Config::ipc_path` since `_drm` is not a hbb_common
|
||||
/// service postfix (Option 2 isolation — no shared-lib change).
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
pub(crate) async fn connect_drm(ms_timeout: u64) -> ResultType<ConnectionTmpl<ConnClient>> {
|
||||
connect_with_path(ms_timeout, &drm_ipc_path()).await
|
||||
}
|
||||
|
||||
/// Bind the `_drm` listener. Unlike `new_listener`, this does not route through hbb_common's
|
||||
/// service-postfix machinery — it places the socket in the shared service dir directly, so the
|
||||
/// drm-off build needs no hbb_common change. The socket is 0666 (world-connectable) so the
|
||||
/// unprivileged `--server` can reach it; every accepted peer is still authorized in
|
||||
/// `handle_drm_conn` (root or the active session uid + exe identity), so connectable != authorized.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
async fn new_drm_listener() -> ResultType<Incoming> {
|
||||
let path = drm_ipc_path();
|
||||
// Ensure the shared service dir exists at its hardened (0711) mode. Passing the `_service`
|
||||
// postfix reuses hbb_common's expected mode for that directory; it only creates/chmods the
|
||||
// directory (no pid/socket side effects) and is idempotent with the real `_service` listener.
|
||||
let _ = ensure_secure_ipc_parent_dir(&path, "_service")?;
|
||||
// Clear any stale socket from a previous run before binding.
|
||||
std::fs::remove_file(&path).ok();
|
||||
let mut endpoint = Endpoint::new(path.clone());
|
||||
endpoint.set_security_attributes(SecurityAttributes::allow_everyone_create()?);
|
||||
let incoming = endpoint.incoming()?;
|
||||
std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o666)).map_err(|err| {
|
||||
std::fs::remove_file(&path).ok();
|
||||
err
|
||||
})?;
|
||||
log::info!("Started drm ipc server at path: {}", &path);
|
||||
Ok(incoming)
|
||||
}
|
||||
|
||||
/// Message from a per-connection DRM worker thread (which owns the `!Send` `DrmReader`) to its
|
||||
/// async socket task. The worker does the blocking device I/O; the task only forwards to the wire.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
enum DrmProducerMsg {
|
||||
/// Enumerated displays, sent once before any frame so the task can answer the handshake.
|
||||
Displays(Vec<DrmDisplayInfo>),
|
||||
/// A captured frame header + its packed BGRA pixels.
|
||||
Frame {
|
||||
width: u32,
|
||||
height: u32,
|
||||
data: Bytes,
|
||||
},
|
||||
/// A changed hardware-cursor shape + its packed RGBA pixels.
|
||||
Cursor {
|
||||
id: u64,
|
||||
width: u32,
|
||||
height: u32,
|
||||
hotx: i32,
|
||||
hoty: i32,
|
||||
colors: Vec<u8>,
|
||||
},
|
||||
}
|
||||
|
||||
/// Sets the shared stop flag when the async task ends (any path), so the blocking worker thread
|
||||
/// terminates promptly even while it is between channel sends (e.g. spinning on WouldBlock).
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
struct DrmStopGuard(std::sync::Arc<std::sync::atomic::AtomicBool>);
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
impl Drop for DrmStopGuard {
|
||||
fn drop(&mut self) {
|
||||
self.0.store(true, std::sync::atomic::Ordering::Relaxed);
|
||||
}
|
||||
}
|
||||
|
||||
/// Cached DRM display enumeration. The pre-warm populates it and each capture open refreshes it, so
|
||||
/// a consumer's handshake can send the display list without first paying a DRM enumeration open.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
static DRM_DISPLAY_CACHE: std::sync::Mutex<Vec<DrmDisplayInfo>> = std::sync::Mutex::new(Vec::new());
|
||||
|
||||
/// Snapshot a reader's enumerated displays as the IPC `DrmDisplayInfo` form. `displays()` lists all
|
||||
/// device outputs regardless of the reader's target CRTC, so a capture reader can refresh the cache.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
fn drm_displays_from_reader(reader: &mut scrap::drm_reader::DrmReader) -> Vec<DrmDisplayInfo> {
|
||||
reader
|
||||
.displays()
|
||||
.into_iter()
|
||||
// Only offer outputs actually bound to a CRTC (i.e. scanning out). A
|
||||
// CONNECTED-but-unbound connector (e.g. a virtual/dummy HDMI plug the
|
||||
// compositor is not driving) enumerates with `crtc_id == 0`. Such an
|
||||
// entry has no scanout to capture, yet was still shipped to the client as
|
||||
// a selectable monitor; picking it made libdrmtap's `open(crtc=0)`
|
||||
// AUTO-SELECT the first active CRTC (the primary) and stream ITS frames at
|
||||
// the wrong geometry (e.g. a 3840x2160 frame into a 1280x1024 encoder ->
|
||||
// `src rect > dst rect`), which failed every frame and drove a ~1/sec
|
||||
// capturer restart loop (the flap that leaked EGL contexts to OOM). Drop
|
||||
// these here so they are never offered; the client keeps its real monitors.
|
||||
.filter(|d| d.active && d.crtc_id != 0)
|
||||
.map(|d| DrmDisplayInfo {
|
||||
name: d.name,
|
||||
crtc_id: d.crtc_id,
|
||||
x: d.x,
|
||||
y: d.y,
|
||||
width: d.width,
|
||||
height: d.height,
|
||||
active: d.active,
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Best-effort warm-up at listener start: loads libdrmtap, initializes EGL, enumerates displays into
|
||||
/// the cache, and maps the first framebuffer once. Moves that one-time cost (which otherwise lands
|
||||
/// on the first consumer and can push the first frame past the client's initial-frame timeout) off
|
||||
/// the critical path. Runs on its own thread since `DrmReader` is `!Send` and `open`/`grab` block.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
fn drm_prewarm() {
|
||||
let t = std::time::Instant::now();
|
||||
match scrap::drm_reader::DrmReader::open(None, 0) {
|
||||
Some(mut r) => {
|
||||
let displays = drm_displays_from_reader(&mut r);
|
||||
let n = displays.len();
|
||||
let _ = r.grab(); // force the first framebuffer map / import
|
||||
*DRM_DISPLAY_CACHE.lock().unwrap() = displays;
|
||||
log::info!("drm: pre-warm ok ({n} displays) in {:?}", t.elapsed());
|
||||
}
|
||||
None => log::info!("drm: pre-warm skipped (reader unavailable)"),
|
||||
}
|
||||
}
|
||||
|
||||
/// DRM/KMS capture producer. Runs in the ROOT `--service` (which holds CAP_SYS_ADMIN, so libdrmtap
|
||||
/// reads the scanout in-process — no helper, no setcap). One dedicated `current_thread` runtime
|
||||
/// owns the `_drm` listener and `tokio::spawn`s a task per accepted consumer, so a multi-monitor
|
||||
/// client (which opens one `_drm` connection per captured display) is served CONCURRENTLY instead
|
||||
/// of serially. The `!Send` `DrmReader` never runs on this runtime: each connection offloads its
|
||||
/// blocking `grab()` loop to a private std worker thread (see `handle_drm_conn`), which keeps the
|
||||
/// connection future `Send` (thus spawnable) and lets the tasks multiplex on the one listener
|
||||
/// thread while the workers capture in parallel.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
pub async fn start_drm() {
|
||||
match new_drm_listener().await {
|
||||
Ok(mut incoming) => {
|
||||
// Warm libdrmtap/EGL + enumeration off-thread so the first consumer does not pay that
|
||||
// one-time cost on its critical path.
|
||||
std::thread::spawn(drm_prewarm);
|
||||
loop {
|
||||
match incoming.next().await {
|
||||
Some(Ok(stream)) => {
|
||||
tokio::spawn(async move {
|
||||
if let Err(err) = handle_drm_conn(Connection::new(stream)).await {
|
||||
log::info!("drm ipc connection ended: {}", err);
|
||||
}
|
||||
});
|
||||
}
|
||||
Some(Err(err)) => log::error!("Couldn't get drm client: {:?}", err),
|
||||
// Stream exhausted: without this the `if let Some` form would re-poll the dead
|
||||
// stream forever and busy-spin the root service. Stop the producer instead.
|
||||
None => {
|
||||
log::error!("drm ipc listener stream ended; stopping drm producer");
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Err(err) => {
|
||||
log::error!("Failed to start drm ipc server: {}", err);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Handle one `_drm` consumer. `DrmReader` is `!Send` and `grab()` is a blocking C call, so it
|
||||
/// cannot live on the shared listener runtime; this task spawns a private std worker thread that
|
||||
/// owns the reader (`drm_capture_worker`) and streams `DrmProducerMsg`s back over a bounded channel
|
||||
/// (capacity 2 = backpressure: a slow consumer throttles capture instead of growing memory). The
|
||||
/// task itself stays fully async — hence `Send`, hence `tokio::spawn`able — and only forwards
|
||||
/// messages to the wire. On any error / disconnect it returns; the `DrmStopGuard` plus dropping the
|
||||
/// channels tears the worker down, and the client falls back to PipeWire/portal.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
async fn handle_drm_conn(mut stream: Connection) -> ResultType<()> {
|
||||
use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
|
||||
use std::sync::Arc;
|
||||
|
||||
// The `_drm` socket is world-connectable (0666) so the unprivileged `--server` can reach it,
|
||||
// so we MUST authorize the peer here — this is a dedicated listener that does not go through
|
||||
// the generic `start()` accept loop where service-scoped channels are checked. Same policy as
|
||||
// `_service`: peer must be root or the active session uid, with a `/proc/pid/exe` identity
|
||||
// match. Without this any local process could connect and receive the screen contents.
|
||||
if !authorize_service_scoped_ipc_connection(&stream, "_drm") {
|
||||
log::warn!("drm: rejected unauthorized connection to _drm");
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Admission bound: each accepted _drm consumer spawns a worker thread that opens a DRM context.
|
||||
// The peer is authorized (root/active-session), but we still cap concurrency so a buggy or
|
||||
// compromised --server cannot exhaust root-service threads/memory by opening an unbounded number
|
||||
// of streams. One connection per served display is plenty; MAX_DRM_CONNS covers multi-monitor
|
||||
// plus a little slack for a reconnect overlapping an old worker still tearing down.
|
||||
const MAX_DRM_CONNS: usize = 8;
|
||||
static DRM_CONN_COUNT: AtomicUsize = AtomicUsize::new(0);
|
||||
struct DrmConnGuard;
|
||||
impl Drop for DrmConnGuard {
|
||||
fn drop(&mut self) {
|
||||
DRM_CONN_COUNT.fetch_sub(1, Ordering::SeqCst);
|
||||
}
|
||||
}
|
||||
if DRM_CONN_COUNT.fetch_add(1, Ordering::SeqCst) >= MAX_DRM_CONNS {
|
||||
DRM_CONN_COUNT.fetch_sub(1, Ordering::SeqCst);
|
||||
log::warn!("drm: too many concurrent _drm connections (>= {MAX_DRM_CONNS}); rejecting");
|
||||
return Ok(());
|
||||
}
|
||||
let _conn_guard = DrmConnGuard;
|
||||
|
||||
// worker -> task: display list, frames, cursor (bounded = backpressure).
|
||||
let (frame_tx, mut frame_rx) = tokio::sync::mpsc::channel::<DrmProducerMsg>(2);
|
||||
// task -> worker: the chosen CRTC, sent once after the client's DrmStart.
|
||||
let (crtc_tx, crtc_rx) = std::sync::mpsc::channel::<u32>();
|
||||
let stop = Arc::new(AtomicBool::new(false));
|
||||
let _stop_guard = DrmStopGuard(stop.clone());
|
||||
let worker_stop = stop.clone();
|
||||
std::thread::spawn(move || drm_capture_worker(frame_tx, crtc_rx, worker_stop));
|
||||
|
||||
// Handshake: the worker sends the display list (from the pre-warmed cache, or a throwaway
|
||||
// enumeration open if the cache is empty). A closed channel (no Displays) means the reader was
|
||||
// unavailable, so let the client fall back.
|
||||
let displays = match frame_rx.recv().await {
|
||||
Some(DrmProducerMsg::Displays(d)) => d,
|
||||
_ => {
|
||||
log::info!("drm: reader unavailable; closing _drm connection (client falls back)");
|
||||
return Ok(());
|
||||
}
|
||||
};
|
||||
stream.send(&Data::DrmDisplayList(displays.clone())).await?;
|
||||
|
||||
// Wait for the client to choose a display before streaming.
|
||||
let display_idx = loop {
|
||||
match stream.next_timeout(10_000).await? {
|
||||
Some(Data::DrmStart { display }) => break display,
|
||||
Some(_) => continue,
|
||||
None => return Ok(()),
|
||||
}
|
||||
};
|
||||
// Resolve the chosen display's CRTC. `displays` here is already filtered to
|
||||
// CRTC-bound outputs (see drm_displays_from_reader), so a valid selection
|
||||
// always yields a non-zero crtc_id. Reject a 0 (out-of-range index, or an
|
||||
// unbound display that somehow slipped through) rather than passing it to
|
||||
// `open(crtc=0)`, whose "auto-select the first/primary CRTC" sentinel would
|
||||
// silently stream the WRONG monitor at a mismatched geometry and flap the
|
||||
// capturer. Closing lets the consumer fall back (PipeWire) for that display.
|
||||
let target_crtc = usize::try_from(display_idx)
|
||||
.ok()
|
||||
.and_then(|i| displays.get(i))
|
||||
.map(|d| d.crtc_id)
|
||||
.unwrap_or(0);
|
||||
if target_crtc == 0 {
|
||||
log::warn!(
|
||||
"drm: client selected display {display_idx} with no bound CRTC; closing _drm (client falls back)"
|
||||
);
|
||||
return Ok(());
|
||||
}
|
||||
// Hand the CRTC to the worker; an error means it already gave up (reader vanished).
|
||||
if crtc_tx.send(target_crtc).is_err() {
|
||||
return Ok(());
|
||||
}
|
||||
|
||||
// Forward frames + cursor updates until the worker ends or the client disconnects (a wire send
|
||||
// error on a dropped client propagates out and tears the worker down via the guard).
|
||||
while let Some(msg) = frame_rx.recv().await {
|
||||
match msg {
|
||||
DrmProducerMsg::Frame {
|
||||
width,
|
||||
height,
|
||||
data,
|
||||
} => {
|
||||
stream.send(&Data::DrmFrame { width, height }).await?;
|
||||
stream.send_raw(data).await?;
|
||||
}
|
||||
DrmProducerMsg::Cursor {
|
||||
id,
|
||||
width,
|
||||
height,
|
||||
hotx,
|
||||
hoty,
|
||||
colors,
|
||||
} => {
|
||||
stream
|
||||
.send(&Data::DrmCursor {
|
||||
id,
|
||||
width,
|
||||
height,
|
||||
hotx,
|
||||
hoty,
|
||||
})
|
||||
.await?;
|
||||
stream.send_raw(Bytes::from(colors)).await?;
|
||||
}
|
||||
DrmProducerMsg::Displays(_) => {}
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The blocking half of a `_drm` connection: owns the `!Send` `DrmReader`(s) on its own thread and
|
||||
/// streams messages to the async task. Ends (thread exits, reader closes) when the device is
|
||||
/// unavailable, errors/stalls, or the task drops the channels / sets the stop flag.
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
fn drm_capture_worker(
|
||||
frame_tx: tokio::sync::mpsc::Sender<DrmProducerMsg>,
|
||||
crtc_rx: std::sync::mpsc::Receiver<u32>,
|
||||
stop: std::sync::Arc<std::sync::atomic::AtomicBool>,
|
||||
) {
|
||||
use std::sync::atomic::Ordering;
|
||||
use std::time::Duration;
|
||||
// ~30 fps producer ceiling; the consumer's encoder/QoS sets the effective rate and the bounded
|
||||
// channel throttles us further if it is slower. Also avoids a busy-spin when `grab()` returns
|
||||
// the same scanout repeatedly.
|
||||
const FRAME_INTERVAL: Duration = Duration::from_millis(33);
|
||||
// Bound continuous no-frame (WouldBlock) time so a wedged device ends the stream (~5s) instead
|
||||
// of freezing forever; the client then falls back.
|
||||
const MAX_STALLED: u32 = 150;
|
||||
|
||||
let t_conn = std::time::Instant::now();
|
||||
|
||||
// Send the display list. Prefer the pre-warmed cache (skips a per-connection enumeration open);
|
||||
// fall back to a throwaway enumeration reader if the pre-warm has not populated it yet.
|
||||
let displays = {
|
||||
let cached = DRM_DISPLAY_CACHE.lock().unwrap().clone();
|
||||
if !cached.is_empty() {
|
||||
cached
|
||||
} else {
|
||||
let mut enum_reader = match scrap::drm_reader::DrmReader::open(None, 0) {
|
||||
Some(r) => r,
|
||||
None => return,
|
||||
};
|
||||
drm_displays_from_reader(&mut enum_reader)
|
||||
}
|
||||
};
|
||||
if frame_tx
|
||||
.blocking_send(DrmProducerMsg::Displays(displays))
|
||||
.is_err()
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
// Wait for the task to relay the client's chosen CRTC (Err => the task gave up / disconnected).
|
||||
let target_crtc = match crtc_rx.recv() {
|
||||
Ok(c) => c,
|
||||
Err(_) => return,
|
||||
};
|
||||
let t_open = std::time::Instant::now();
|
||||
let mut reader = match scrap::drm_reader::DrmReader::open(None, target_crtc) {
|
||||
Some(r) => r,
|
||||
None => {
|
||||
log::warn!("drm: failed to open crtc {target_crtc}; closing _drm connection");
|
||||
// The cached display list handed out a CRTC that no longer opens (a hotplug/modeset
|
||||
// likely invalidated it). Drop the cache so the next connection re-enumerates from the
|
||||
// live device instead of serving the same stale, unopenable CRTC on every reconnect.
|
||||
DRM_DISPLAY_CACHE.lock().unwrap().clear();
|
||||
return;
|
||||
}
|
||||
};
|
||||
// Refresh the cache from the live device so the next consumer's handshake uses fresh geometry.
|
||||
*DRM_DISPLAY_CACHE.lock().unwrap() = drm_displays_from_reader(&mut reader);
|
||||
log::debug!(
|
||||
"drm: capture reader for crtc {target_crtc} opened in {:?}",
|
||||
t_open.elapsed()
|
||||
);
|
||||
|
||||
let mut last_cursor_id: u64 = 0;
|
||||
let mut stalled: u32 = 0;
|
||||
let mut logged_first = false;
|
||||
while !stop.load(Ordering::Relaxed) {
|
||||
match reader.grab() {
|
||||
Ok((buf, w, h)) => {
|
||||
stalled = 0;
|
||||
if !logged_first {
|
||||
logged_first = true;
|
||||
log::debug!(
|
||||
"drm: first frame {w}x{h} for crtc {target_crtc} in {:?}",
|
||||
t_conn.elapsed()
|
||||
);
|
||||
}
|
||||
if frame_tx
|
||||
.blocking_send(DrmProducerMsg::Frame {
|
||||
width: w as u32,
|
||||
height: h as u32,
|
||||
data: Bytes::copy_from_slice(buf),
|
||||
})
|
||||
.is_err()
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
Err(err) if err.kind() == std::io::ErrorKind::WouldBlock => {
|
||||
stalled += 1;
|
||||
if stalled > MAX_STALLED {
|
||||
log::info!("drm: capture stalled (no frame); closing _drm connection");
|
||||
break;
|
||||
}
|
||||
std::thread::sleep(FRAME_INTERVAL);
|
||||
continue;
|
||||
}
|
||||
Err(err) => {
|
||||
log::warn!("drm: capture error: {err}; closing _drm connection");
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
// Ship the cursor shape only when it changes (id is a content hash or the hidden sentinel).
|
||||
if let Some(c) = reader.cursor() {
|
||||
if c.id != last_cursor_id {
|
||||
last_cursor_id = c.id;
|
||||
if frame_tx
|
||||
.blocking_send(DrmProducerMsg::Cursor {
|
||||
id: c.id,
|
||||
width: c.width,
|
||||
height: c.height,
|
||||
hotx: c.hotx,
|
||||
hoty: c.hoty,
|
||||
colors: c.colors,
|
||||
})
|
||||
.is_err()
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
std::thread::sleep(FRAME_INTERVAL);
|
||||
}
|
||||
}
|
||||
|
||||
pub struct ConnectionTmpl<T> {
|
||||
inner: Framed<T, BytesCodec>,
|
||||
}
|
||||
|
||||
@@ -361,6 +361,13 @@ pub fn get_focused_display(displays: Vec<DisplayInfo>) -> Option<usize> {
|
||||
}
|
||||
|
||||
pub fn get_cursor() -> ResultType<Option<u64>> {
|
||||
// DRM/KMS capture: the hardware cursor arrives over the `_drm` stream, not from XFixes.
|
||||
#[cfg(feature = "drm")]
|
||||
if !is_x11() {
|
||||
if let Some(id) = crate::server::drm_capturer::drm_cursor_id() {
|
||||
return Ok(Some(id));
|
||||
}
|
||||
}
|
||||
let mut res = None;
|
||||
DISPLAY.with(|conn| {
|
||||
if let Ok(d) = conn.try_borrow_mut() {
|
||||
@@ -379,6 +386,22 @@ pub fn get_cursor() -> ResultType<Option<u64>> {
|
||||
}
|
||||
|
||||
pub fn get_cursor_data(hcursor: u64) -> ResultType<CursorData> {
|
||||
// DRM/KMS capture: return the latest hardware-cursor snapshot from the `_drm` stream. Its id may
|
||||
// have advanced past `hcursor` between get_cursor() and here, so return the latest rather than
|
||||
// bailing (which would trigger a MouseCursorService backoff).
|
||||
#[cfg(feature = "drm")]
|
||||
if !is_x11() {
|
||||
if let Some(c) = crate::server::drm_capturer::drm_cursor() {
|
||||
let mut cd: CursorData = Default::default();
|
||||
cd.id = c.id;
|
||||
cd.width = c.width;
|
||||
cd.height = c.height;
|
||||
cd.hotx = c.hotx;
|
||||
cd.hoty = c.hoty;
|
||||
cd.colors = c.colors.into();
|
||||
return Ok(cd);
|
||||
}
|
||||
}
|
||||
let mut res = None;
|
||||
DISPLAY.with(|conn| {
|
||||
if let Ok(ref mut d) = conn.try_borrow_mut() {
|
||||
@@ -810,6 +833,15 @@ pub fn start_os_service() {
|
||||
allow_err!(crate::ipc::start(crate::POSTFIX_SERVICE));
|
||||
});
|
||||
|
||||
// DRM/KMS capture producer (opt-in `drm` feature): a dedicated thread + runtime that streams
|
||||
// scanout frames to the user `--server` over the `_drm` service-scoped channel. Runs here
|
||||
// because this process is the root service that already holds CAP_SYS_ADMIN for the in-process
|
||||
// (direct-mode) libdrmtap read.
|
||||
#[cfg(feature = "drm")]
|
||||
std::thread::spawn(|| {
|
||||
crate::ipc::start_drm();
|
||||
});
|
||||
|
||||
let running = Arc::new(AtomicBool::new(true));
|
||||
let r = running.clone();
|
||||
let (mut display, mut xauth): (String, String) = ("".to_owned(), "".to_owned());
|
||||
|
||||
@@ -44,6 +44,8 @@ mod clipboard_service;
|
||||
pub use clipboard_service::is_clipboard_service_ok;
|
||||
#[cfg(target_os = "linux")]
|
||||
pub(crate) mod wayland;
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
pub(crate) mod drm_capturer;
|
||||
#[cfg(target_os = "linux")]
|
||||
pub mod uinput;
|
||||
#[cfg(target_os = "linux")]
|
||||
@@ -599,6 +601,10 @@ pub async fn start_server(is_server: bool, no_server: bool) {
|
||||
std::process::exit(-1);
|
||||
}
|
||||
});
|
||||
// Warm the DRM availability cache before any client connects, so the first connection does
|
||||
// not race a cold `_drm` probe and ship an empty display list ("No displays" + retry).
|
||||
#[cfg(all(target_os = "linux", feature = "drm"))]
|
||||
std::thread::spawn(drm_capturer::warm_availability);
|
||||
input_service::fix_key_down_timeout_loop();
|
||||
#[cfg(target_os = "linux")]
|
||||
if input_service::wayland_use_uinput() {
|
||||
|
||||
@@ -328,6 +328,16 @@ fn check_get_displays_changed_msg() -> Option<Message> {
|
||||
#[cfg(target_os = "linux")]
|
||||
{
|
||||
if !is_x11() {
|
||||
// On the DRM/KMS capture path the PipeWire enumeration (which is what feeds
|
||||
// `SYNC_DISPLAYS` via `check_update_displays`) is bypassed, so populate the sync list
|
||||
// from the DRM display list here. Without this the display service broadcasts an empty
|
||||
// list that overwrites the login peer-info displays and the client shows "No displays".
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
if let Some(displays) = super::drm_capturer::get_display_infos() {
|
||||
SYNC_DISPLAYS.lock().unwrap().check_changed(&displays);
|
||||
}
|
||||
}
|
||||
return get_displays_msg();
|
||||
}
|
||||
}
|
||||
@@ -535,6 +545,7 @@ pub fn get_primary_2(all: &Vec<Display>) -> usize {
|
||||
all.iter().position(|d| d.is_primary()).unwrap_or(0)
|
||||
}
|
||||
|
||||
|
||||
#[inline]
|
||||
#[cfg(windows)]
|
||||
fn no_displays(displays: &Vec<Display>) -> bool {
|
||||
|
||||
680
src/server/drm_capturer.rs
Normal file
680
src/server/drm_capturer.rs
Normal file
@@ -0,0 +1,680 @@
|
||||
// Server-side (`--server`, unprivileged) consumer of the root `--service`'s DRM/KMS capture stream.
|
||||
//
|
||||
// The architecture pivot moved the scanout read into the root service; this process no longer
|
||||
// links or dlopens libdrmtap. It connects to the service's `_drm` channel, learns the display
|
||||
// geometry from the service, and pulls packed-BGRA frames. This mirrors the Windows
|
||||
// `portable_service` CapturerPortable split (a privileged process captures, this process presents),
|
||||
// but over rustdesk's own IPC instead of shared memory.
|
||||
//
|
||||
// `TraitCapturer::frame()` is synchronous (the encoder loop calls it) while the IPC receive is
|
||||
// async, so a dedicated background thread runs the receive loop and keeps only the newest frame
|
||||
// (latest-wins, so a slow encoder never backs the socket up). `frame()` returns that frame as a
|
||||
// borrowed `PixelBuffer`, `WouldBlock` when nothing new arrived within the timeout, and a hard
|
||||
// `Err` once the stream ends (the caller then rebuilds the capturer or falls back to PipeWire).
|
||||
|
||||
use crate::ipc::{connect_drm, Data, DrmDisplayInfo};
|
||||
use hbb_common::{anyhow::anyhow, log, message_proto::DisplayInfo, tokio, ResultType};
|
||||
use scrap::{Frame, Pixfmt, PixelBuffer, TraitCapturer};
|
||||
use std::collections::BTreeMap;
|
||||
use std::io;
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::{Arc, Condvar, Mutex};
|
||||
use std::time::{Duration, Instant};
|
||||
|
||||
// Upper bound on how long `new()` waits for the service to answer with the display list before
|
||||
// giving up and letting the caller fall back.
|
||||
const HANDSHAKE_TIMEOUT_MS: u64 = 3000;
|
||||
|
||||
struct FrameSlot {
|
||||
// (width, height, packed-BGRA) of the newest frame not yet consumed by `frame()`; latest-wins.
|
||||
latest: Option<(usize, usize, Vec<u8>)>,
|
||||
// Set once the stream ends so `frame()` returns a hard error (triggers a capturer rebuild).
|
||||
ended: Option<String>,
|
||||
}
|
||||
|
||||
struct Shared {
|
||||
slot: Mutex<FrameSlot>,
|
||||
cv: Condvar,
|
||||
}
|
||||
|
||||
pub struct IpcDrmCapturer {
|
||||
shared: Arc<Shared>,
|
||||
stop: Arc<AtomicBool>,
|
||||
// The buffer `frame()` hands out a borrow of; kept across calls (grow-once) and only replaced
|
||||
// when a new frame is taken from the slot.
|
||||
// The requested display index this capturer streams, for per-display failure tracking.
|
||||
display: i32,
|
||||
cur: Vec<u8>,
|
||||
cur_w: usize,
|
||||
cur_h: usize,
|
||||
// Whether this capturer ever delivered a frame. Used to distinguish a stream that fails to
|
||||
// produce ANY frame (a permanent grab failure — unsupported scanout on that CRTC) from a normal
|
||||
// teardown, so DRM can fall back to PipeWire for that display instead of rebuilding it forever.
|
||||
got_frame: bool,
|
||||
}
|
||||
|
||||
// Consecutive DRM capture sessions, keyed BY requested display index, that ended without ever
|
||||
// producing a frame. A display whose scanout can never be grabbed (e.g. an unsupported format on its
|
||||
// CRTC) enumerates fine but never streams, so the video service would keep rebuilding it onto DRM.
|
||||
// Tracking this per display — not globally — stops a working monitor from masking a permanently
|
||||
// failing one: after DRM_GRAB_MAX_FAILURES consecutive zero-frame sessions for a given display,
|
||||
// get_capturer_info() refuses it so the video service falls back to PipeWire for THAT display; any
|
||||
// session that produces a frame clears that display's entry.
|
||||
static DRM_DISPLAY_FAILURES: Mutex<BTreeMap<i32, (u32, Instant)>> = Mutex::new(BTreeMap::new());
|
||||
const DRM_GRAB_MAX_FAILURES: u32 = 4;
|
||||
// A demotion is recoverable: after this cooldown the display retries DRM. The map is keyed by display
|
||||
// index (stable within a session); the cooldown also releases a demotion that a hotplug/modeset may
|
||||
// have pinned to an index a different monitor later occupies, so a stale verdict cannot stick forever.
|
||||
const DEMOTE_COOLDOWN: Duration = Duration::from_secs(30);
|
||||
|
||||
// Rapid-rebuild guard (defense-in-depth against a capturer flap). The zero-frame streak above does
|
||||
// not catch a display that keeps delivering a first frame and then failing downstream (e.g. a
|
||||
// frame the encoder rejects), because got_frame clears the streak each session — so such a display
|
||||
// would rebuild ~once per second forever. Track per-display rebuild cadence: after
|
||||
// RAPID_REBUILD_MAX rebuilds all within RAPID_REBUILD_WINDOW of each other, demote it to PipeWire
|
||||
// via the same failure gate. A capturer that streams longer than the window resets the count, so a
|
||||
// healthy display is never demoted.
|
||||
static DRM_DISPLAY_REBUILDS: Mutex<BTreeMap<i32, (Instant, u32)>> = Mutex::new(BTreeMap::new());
|
||||
const RAPID_REBUILD_WINDOW: Duration = Duration::from_secs(3);
|
||||
const RAPID_REBUILD_MAX: u32 = 6;
|
||||
|
||||
impl IpcDrmCapturer {
|
||||
/// Connect to the service `_drm` channel, complete the handshake (receive the display list, then
|
||||
/// request `display`), and start streaming on a background thread. Returns the capturer plus the
|
||||
/// enumerated displays so the caller can populate `display_service`. `Err` if the service has no
|
||||
/// DRM capture available or the handshake fails — the caller then falls back to PipeWire/portal.
|
||||
pub fn new(display: i32) -> ResultType<(IpcDrmCapturer, Vec<DrmDisplayInfo>)> {
|
||||
let shared = Arc::new(Shared {
|
||||
slot: Mutex::new(FrameSlot {
|
||||
latest: None,
|
||||
ended: None,
|
||||
}),
|
||||
cv: Condvar::new(),
|
||||
});
|
||||
let stop = Arc::new(AtomicBool::new(false));
|
||||
let (tx, rx) = std::sync::mpsc::channel::<ResultType<Vec<DrmDisplayInfo>>>();
|
||||
{
|
||||
let shared = shared.clone();
|
||||
let stop = stop.clone();
|
||||
std::thread::spawn(move || recv_thread(display, shared, stop, tx));
|
||||
}
|
||||
let displays = match rx.recv_timeout(Duration::from_millis(HANDSHAKE_TIMEOUT_MS + 500)) {
|
||||
Ok(res) => res?,
|
||||
Err(_) => {
|
||||
// The recv thread still has its own connect/handshake budget. If we just returned,
|
||||
// a handshake that completes after our timeout would leave that thread streaming
|
||||
// with no owning capturer (our Drop never runs — the capturer was never built), so
|
||||
// signal it to stop before giving up.
|
||||
stop.store(true, Ordering::SeqCst);
|
||||
return Err(anyhow!("drm capture handshake timed out"));
|
||||
}
|
||||
};
|
||||
Ok((
|
||||
IpcDrmCapturer {
|
||||
shared,
|
||||
stop,
|
||||
display,
|
||||
cur: Vec::new(),
|
||||
cur_w: 0,
|
||||
cur_h: 0,
|
||||
got_frame: false,
|
||||
},
|
||||
displays,
|
||||
))
|
||||
}
|
||||
}
|
||||
|
||||
impl Drop for IpcDrmCapturer {
|
||||
fn drop(&mut self) {
|
||||
// Signal the receive thread to exit; it also exits on its own when the connection drops.
|
||||
self.stop.store(true, Ordering::SeqCst);
|
||||
}
|
||||
}
|
||||
|
||||
impl TraitCapturer for IpcDrmCapturer {
|
||||
fn frame<'a>(&'a mut self, timeout: Duration) -> io::Result<Frame<'a>> {
|
||||
let deadline = Instant::now() + timeout;
|
||||
{
|
||||
let mut slot = self.shared.slot.lock().unwrap();
|
||||
loop {
|
||||
if slot.latest.is_some() || slot.ended.is_some() {
|
||||
break;
|
||||
}
|
||||
let now = Instant::now();
|
||||
if now >= deadline {
|
||||
return Err(io::ErrorKind::WouldBlock.into());
|
||||
}
|
||||
let (guard, _timed_out) =
|
||||
self.shared.cv.wait_timeout(slot, deadline - now).unwrap();
|
||||
slot = guard;
|
||||
}
|
||||
// Deliver a pending frame before surfacing an end, so the last frame is not dropped.
|
||||
if let Some((w, h, buf)) = slot.latest.take() {
|
||||
drop(slot);
|
||||
self.cur = buf;
|
||||
self.cur_w = w;
|
||||
self.cur_h = h;
|
||||
if !self.got_frame {
|
||||
// First frame of this session: DRM capture works for this display, clear its
|
||||
// failure streak.
|
||||
self.got_frame = true;
|
||||
DRM_DISPLAY_FAILURES.lock().unwrap().remove(&self.display);
|
||||
}
|
||||
} else {
|
||||
let err = slot
|
||||
.ended
|
||||
.clone()
|
||||
.unwrap_or_else(|| "drm stream ended".to_owned());
|
||||
if !self.got_frame {
|
||||
// This session never produced a frame for THIS display. If enough sessions in a
|
||||
// row fail this way for the same display, its scanout is effectively ungrababble;
|
||||
// count it so get_capturer_info() will refuse that display and the video service
|
||||
// falls back to PipeWire for it (other displays are unaffected).
|
||||
let mut map = DRM_DISPLAY_FAILURES.lock().unwrap();
|
||||
let e = map.entry(self.display).or_insert((0, Instant::now()));
|
||||
e.0 += 1;
|
||||
e.1 = Instant::now();
|
||||
if e.0 >= DRM_GRAB_MAX_FAILURES {
|
||||
log::warn!(
|
||||
"drm: display {} produced no frame in {} sessions; falling back to PipeWire for it",
|
||||
self.display,
|
||||
e.0
|
||||
);
|
||||
}
|
||||
}
|
||||
return Err(io::Error::new(io::ErrorKind::Other, err));
|
||||
}
|
||||
}
|
||||
Ok(Frame::PixelBuffer(PixelBuffer::new(
|
||||
&self.cur,
|
||||
Pixfmt::BGRA,
|
||||
self.cur_w,
|
||||
self.cur_h,
|
||||
)))
|
||||
}
|
||||
}
|
||||
|
||||
// Background receive loop. Owns the `_drm` connection and the async runtime; keeps the newest frame
|
||||
// in `shared.slot`. Runs on its own thread because `frame()` is sync and one blocking consumer is
|
||||
// enough for DRM.
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
async fn recv_thread(
|
||||
display: i32,
|
||||
shared: Arc<Shared>,
|
||||
stop: Arc<AtomicBool>,
|
||||
tx: std::sync::mpsc::Sender<ResultType<Vec<DrmDisplayInfo>>>,
|
||||
) {
|
||||
// Handshake: connect, receive the display list, request the display.
|
||||
let mut conn = match connect_drm(1000).await {
|
||||
Ok(c) => c,
|
||||
Err(err) => {
|
||||
let _ = tx.send(Err(err));
|
||||
return;
|
||||
}
|
||||
};
|
||||
let displays = match conn.next_timeout(HANDSHAKE_TIMEOUT_MS).await {
|
||||
Ok(Some(Data::DrmDisplayList(v))) => v,
|
||||
Ok(other) => {
|
||||
let _ = tx.send(Err(anyhow!("expected DrmDisplayList, got {:?}", other)));
|
||||
return;
|
||||
}
|
||||
Err(err) => {
|
||||
let _ = tx.send(Err(err));
|
||||
return;
|
||||
}
|
||||
};
|
||||
if let Err(err) = conn.send(&Data::DrmStart { display }).await {
|
||||
let _ = tx.send(Err(err));
|
||||
return;
|
||||
}
|
||||
let _ = tx.send(Ok(displays));
|
||||
|
||||
// Stream until stopped or the connection ends. Poll the header read with a short timeout (rather
|
||||
// than blocking indefinitely on `next()`) so a dropped capturer re-checks `stop` and tears down
|
||||
// promptly even when the producer has stalled (no frames arriving). A header is always followed
|
||||
// immediately by its `next_raw()` body, so only the header read needs the poll.
|
||||
let end_reason = loop {
|
||||
if stop.load(Ordering::SeqCst) {
|
||||
break "stopped".to_owned();
|
||||
}
|
||||
let msg = match conn.next_timeout2(200).await {
|
||||
None => continue, // timeout: re-check stop at the loop top
|
||||
Some(Ok(Some(d))) => d,
|
||||
Some(Ok(None)) => break "desynchronized frame".to_owned(),
|
||||
Some(Err(err)) => break format!("recv: {err}"),
|
||||
};
|
||||
match msg {
|
||||
Data::DrmFrame { width, height } => match conn.next_raw().await {
|
||||
Ok(raw) => {
|
||||
let mut slot = shared.slot.lock().unwrap();
|
||||
slot.latest = Some((width as usize, height as usize, raw.to_vec()));
|
||||
shared.cv.notify_one();
|
||||
}
|
||||
Err(err) => break format!("frame body: {err}"),
|
||||
},
|
||||
Data::DrmCursor {
|
||||
id,
|
||||
width,
|
||||
height,
|
||||
hotx,
|
||||
hoty,
|
||||
} => match conn.next_raw().await {
|
||||
Ok(raw) => set_drm_cursor(
|
||||
display,
|
||||
DrmCursorData {
|
||||
id,
|
||||
width: width as i32,
|
||||
height: height as i32,
|
||||
hotx,
|
||||
hoty,
|
||||
colors: raw.to_vec(),
|
||||
},
|
||||
),
|
||||
Err(err) => break format!("cursor body: {err}"),
|
||||
},
|
||||
_ => {} // ignore any unexpected control message
|
||||
}
|
||||
};
|
||||
log::info!("drm capture stream ended: {end_reason}");
|
||||
// Drop only THIS stream's cursor entry so a torn-down monitor does not erase the cursor state of
|
||||
// other still-active streams.
|
||||
remove_drm_cursor(display);
|
||||
let mut slot = shared.slot.lock().unwrap();
|
||||
slot.ended = Some(format!("drm stream ended ({end_reason})"));
|
||||
shared.cv.notify_one();
|
||||
}
|
||||
|
||||
// The latest DRM hardware-cursor snapshots, published by recv_thread and read by the cursor service
|
||||
// (platform::linux::get_cursor / get_cursor_data). Keyed by display index because a multi-monitor
|
||||
// client runs one recv_thread per display and the hardware cursor lives on whichever CRTC the
|
||||
// pointer is over (the others report the hidden sentinel). Keying per stream — instead of a single
|
||||
// last-writer-wins global — stops one stream's hidden sentinel from clobbering another stream's
|
||||
// visible cursor, and lets a torn-down stream drop only its own entry.
|
||||
#[derive(Clone)]
|
||||
pub struct DrmCursorData {
|
||||
pub id: u64,
|
||||
pub width: i32,
|
||||
pub height: i32,
|
||||
pub hotx: i32,
|
||||
pub hoty: i32,
|
||||
pub colors: Vec<u8>,
|
||||
}
|
||||
|
||||
static DRM_CURSOR: Mutex<BTreeMap<i32, DrmCursorData>> = Mutex::new(BTreeMap::new());
|
||||
|
||||
fn set_drm_cursor(display: i32, c: DrmCursorData) {
|
||||
DRM_CURSOR.lock().unwrap().insert(display, c);
|
||||
}
|
||||
|
||||
fn remove_drm_cursor(display: i32) {
|
||||
DRM_CURSOR.lock().unwrap().remove(&display);
|
||||
}
|
||||
|
||||
// Pick the cursor to present: prefer the visible one (the pointer is over exactly one captured CRTC
|
||||
// at a time), else fall back to any (hidden) entry so the client still gets the hidden sentinel when
|
||||
// the pointer is off every captured monitor. `None` only when no stream is active.
|
||||
fn pick_drm_cursor() -> Option<DrmCursorData> {
|
||||
let map = DRM_CURSOR.lock().unwrap();
|
||||
map.values()
|
||||
.find(|c| c.id != scrap::drm_reader::HIDDEN_CURSOR_ID)
|
||||
.or_else(|| map.values().next())
|
||||
.cloned()
|
||||
}
|
||||
|
||||
/// The id of the current DRM hardware cursor (None if no stream). The cursor service polls this to
|
||||
/// detect shape changes (a change triggers a `get_cursor_data` fetch).
|
||||
pub fn drm_cursor_id() -> Option<u64> {
|
||||
pick_drm_cursor().map(|c| c.id)
|
||||
}
|
||||
|
||||
/// The current DRM hardware-cursor snapshot (RGBA), or None.
|
||||
pub fn drm_cursor() -> Option<DrmCursorData> {
|
||||
pick_drm_cursor()
|
||||
}
|
||||
|
||||
// ---------------------------------------------------------------------------
|
||||
// Server capture-path integration (the parallel, gated DRM path)
|
||||
//
|
||||
// The `--server` selects DRM/KMS capture over PipeWire when the root service offers the `_drm`
|
||||
// channel. Availability + the display list are probed once and cached: the `_drm` listener now
|
||||
// serves consumers concurrently (one connection per captured display), but re-probing on every
|
||||
// enumeration still churns connections needlessly and briefly tripped a restart loop in testing, so
|
||||
// the result is cached durably. The cache is seeded before capture starts (display enumeration) and
|
||||
// by the capturer handshake, and only reset by `clear()` on teardown.
|
||||
// ---------------------------------------------------------------------------
|
||||
|
||||
enum ProbeState {
|
||||
Unknown,
|
||||
// Timestamped so a negative verdict expires instead of permanently disabling DRM (see
|
||||
// is_available): displays that appear after startup (a headless boot settling, a monitor
|
||||
// hotplug, or a --service restart) can then re-enable it without restarting the --server.
|
||||
Unavailable(Instant),
|
||||
Available(Vec<DrmDisplayInfo>),
|
||||
}
|
||||
|
||||
static DRM_STATE: Mutex<ProbeState> = Mutex::new(ProbeState::Unknown);
|
||||
// How long a negative availability verdict is trusted before is_available re-probes.
|
||||
const NEGATIVE_TTL: Duration = Duration::from_secs(30);
|
||||
|
||||
/// Query the service for the current DRM display list without starting a stream: connect, read the
|
||||
/// list the service sends on connect, then drop the connection (the service closes it when we do
|
||||
/// not send `DrmStart`). Runs the async work on a throwaway thread so it is safe to call from any
|
||||
/// context (a nested `#[tokio::main]` would panic when called from inside a runtime).
|
||||
fn query_displays() -> ResultType<Vec<DrmDisplayInfo>> {
|
||||
let (tx, rx) = std::sync::mpsc::channel();
|
||||
std::thread::spawn(move || {
|
||||
let _ = tx.send(query_displays_async());
|
||||
});
|
||||
rx.recv_timeout(Duration::from_millis(HANDSHAKE_TIMEOUT_MS + 1000))
|
||||
.map_err(|_| anyhow!("drm display query timed out"))?
|
||||
}
|
||||
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
async fn query_displays_async() -> ResultType<Vec<DrmDisplayInfo>> {
|
||||
let mut conn = connect_drm(1000).await?;
|
||||
match conn.next_timeout(HANDSHAKE_TIMEOUT_MS).await? {
|
||||
Some(Data::DrmDisplayList(v)) => Ok(v),
|
||||
other => Err(anyhow!("expected DrmDisplayList, got {:?}", other)),
|
||||
}
|
||||
}
|
||||
|
||||
// Transient-failure budget for the cold probe: a `_drm` probe can fail transiently (the producer
|
||||
// is not up yet, a connection race), so we retry across a few connections before durably giving up.
|
||||
// This keeps one cold-start hiccup from permanently disabling DRM capture for the session, while
|
||||
// still settling to `Unavailable` on a genuinely DRM-less host.
|
||||
static DRM_PROBE_FAILURES: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
|
||||
const DRM_PROBE_MAX_FAILURES: u32 = 5;
|
||||
// Single-flight guard: exactly one caller runs the blocking availability probe at a time, so
|
||||
// is_available() never calls query_displays() (up to ~4s of IPC) while holding DRM_STATE.
|
||||
static DRM_PROBE_IN_FLIGHT: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
|
||||
|
||||
/// Whether the root service offers DRM/KMS capture. The positive result and a definitive negative
|
||||
/// (connected, but no displays) are cached; a transient probe error stays `Unknown` for a few
|
||||
/// retries. Normally the cache is warmed at `--server` startup (`warm_availability`), so the first
|
||||
/// client connection hits the fast `Available` path.
|
||||
pub(super) fn is_available() -> bool {
|
||||
// Fast path under the lock: read the cached verdict, expiring a stale negative so a host that had
|
||||
// no displays at probe time can still enable DRM once displays appear (without a --server
|
||||
// restart). NEVER call the blocking probe while holding DRM_STATE: a cold or expired probe would
|
||||
// otherwise serialize every async caller for the whole query_displays() timeout (~4s).
|
||||
{
|
||||
let mut st = DRM_STATE.lock().unwrap();
|
||||
if let ProbeState::Unavailable(since) = &*st {
|
||||
if since.elapsed() >= NEGATIVE_TTL {
|
||||
*st = ProbeState::Unknown;
|
||||
DRM_PROBE_FAILURES.store(0, Ordering::Relaxed);
|
||||
}
|
||||
}
|
||||
match &*st {
|
||||
ProbeState::Available(_) => return true,
|
||||
ProbeState::Unavailable(_) => return false,
|
||||
ProbeState::Unknown => {} // fall through and probe with the lock released
|
||||
}
|
||||
}
|
||||
// Single-flight: exactly one caller probes at a time. While a probe is in flight, others return
|
||||
// the current cache-only verdict instead of stacking redundant `_drm` probes or blocking on the
|
||||
// mutex across the I/O. warm_availability normally seeds `Available` before clients connect, so
|
||||
// this cold path is rare.
|
||||
if DRM_PROBE_IN_FLIGHT.swap(true, Ordering::AcqRel) {
|
||||
return matches!(&*DRM_STATE.lock().unwrap(), ProbeState::Available(_));
|
||||
}
|
||||
let t = Instant::now();
|
||||
let result = query_displays();
|
||||
let mut st = DRM_STATE.lock().unwrap();
|
||||
let available = match result {
|
||||
Ok(list) if !list.is_empty() => {
|
||||
log::debug!(
|
||||
"drm: availability probe -> available ({} displays) in {:?}",
|
||||
list.len(),
|
||||
t.elapsed()
|
||||
);
|
||||
*st = ProbeState::Available(list);
|
||||
true
|
||||
}
|
||||
Ok(_) => {
|
||||
log::info!("drm: availability probe -> no displays in {:?}", t.elapsed());
|
||||
*st = ProbeState::Unavailable(Instant::now());
|
||||
false
|
||||
}
|
||||
Err(err) => {
|
||||
let n = DRM_PROBE_FAILURES.fetch_add(1, Ordering::Relaxed) + 1;
|
||||
if n >= DRM_PROBE_MAX_FAILURES {
|
||||
log::info!("drm: availability probe failed {n}x ({err}); disabling DRM");
|
||||
*st = ProbeState::Unavailable(Instant::now());
|
||||
} else {
|
||||
// Stay Unknown so the next connection re-probes (cold-start race).
|
||||
log::info!(
|
||||
"drm: availability probe failed ({err}), attempt {n}/{DRM_PROBE_MAX_FAILURES}; will retry"
|
||||
);
|
||||
}
|
||||
false
|
||||
}
|
||||
};
|
||||
drop(st);
|
||||
DRM_PROBE_IN_FLIGHT.store(false, Ordering::Release);
|
||||
available
|
||||
}
|
||||
|
||||
/// Warm the availability cache at `--server` startup so the first client connection does not race a
|
||||
/// cold `_drm` probe. A cold probe blocks display enumeration, and if it has not settled when the
|
||||
/// peer info is built the display list goes out empty and the client shows "No displays" and
|
||||
/// retries (the "connects on the Nth try" symptom). Probes with a short retry budget and only caches
|
||||
/// the positive result; a genuinely DRM-less host just falls through to the lazy `is_available()`.
|
||||
pub(super) fn warm_availability() {
|
||||
for _ in 0..10 {
|
||||
if matches!(&*DRM_STATE.lock().unwrap(), ProbeState::Available(_)) {
|
||||
return;
|
||||
}
|
||||
match query_displays() {
|
||||
Ok(list) if !list.is_empty() => {
|
||||
log::info!("drm: consumer cache warmed ({} displays) at startup", list.len());
|
||||
*DRM_STATE.lock().unwrap() = ProbeState::Available(list);
|
||||
return;
|
||||
}
|
||||
// Producer not ready yet (or no DRM): back off and retry; never cache a negative here.
|
||||
_ => std::thread::sleep(Duration::from_millis(300)),
|
||||
}
|
||||
}
|
||||
log::info!("drm: consumer cache warm found no producer at startup (will probe lazily)");
|
||||
}
|
||||
|
||||
/// The cached DRM displays as protobuf `DisplayInfo`, augmented with the compositor's logical layout
|
||||
/// (per-monitor position + scale). `None` until probed/available.
|
||||
pub(super) fn get_display_infos() -> Option<Vec<DisplayInfo>> {
|
||||
let list = match &*DRM_STATE.lock().unwrap() {
|
||||
ProbeState::Available(list) => list.clone(),
|
||||
_ => return None,
|
||||
};
|
||||
Some(augment_with_wayland_geometry(&list))
|
||||
}
|
||||
|
||||
/// Index (into the cached DRM display list) of the compositor's PRIMARY output. DRM connector order
|
||||
/// is not the compositor's primary, so match the compositor's primary (from the same Wayland source
|
||||
/// the geometry augmentation uses) to the DRM list by normalized connector name; fall back to 0 when
|
||||
/// unknown. Without this the first DRM connector is always streamed, which is the wrong initial
|
||||
/// display whenever the primary is not connector 0.
|
||||
pub(super) fn get_primary_index() -> usize {
|
||||
let list = match &*DRM_STATE.lock().unwrap() {
|
||||
ProbeState::Available(list) => list.clone(),
|
||||
_ => return 0,
|
||||
};
|
||||
let wl = scrap::wayland::display::get_displays();
|
||||
if let Some(pw) = wl.displays.get(wl.primary) {
|
||||
let pn = normalize_connector(&pw.name);
|
||||
if let Some(idx) = list.iter().position(|d| normalize_connector(&d.name) == pn) {
|
||||
return idx;
|
||||
}
|
||||
}
|
||||
0
|
||||
}
|
||||
|
||||
/// The DRM enumeration reports every monitor at physical size and origin (0,0) — it deliberately
|
||||
/// does not know the compositor's logical desktop layout. On a multi-monitor host that leaves the
|
||||
/// client stacking all displays at (0,0), and input/cursor coordinates (mapped through each
|
||||
/// display's logical origin + scale) land on the wrong output. So we augment here from the Wayland
|
||||
/// outputs — the same source the uinput desktop-rect uses — matching by connector name (normalized:
|
||||
/// DRM "HDMI-A-1" vs compositor "HDMI-1") and falling back to a unique physical resolution. This is
|
||||
/// the "server augments the DRM geometry with the Wayland logical geometry" step. A single display
|
||||
/// (already at 0,0, scale 1.0) needs no augmentation, matching the PipeWire path's logical-scale gate.
|
||||
fn augment_with_wayland_geometry(drm: &[DrmDisplayInfo]) -> Vec<DisplayInfo> {
|
||||
let wl = scrap::wayland::display::get_displays();
|
||||
let multi = drm.len() > 1 && wl.displays.len() > 1;
|
||||
drm.iter()
|
||||
.map(|d| {
|
||||
let mut info = display_info_from_drm(d);
|
||||
if multi {
|
||||
if let Some(w) = match_wayland_display(d, &wl.displays) {
|
||||
info.x = w.x;
|
||||
info.y = w.y;
|
||||
if let Some((lw, lh)) = w.logical_size {
|
||||
if lw > 0 && lh > 0 {
|
||||
info.scale = d.width as f64 / lw as f64;
|
||||
// original_resolution is the logical size (physical / scale).
|
||||
info.original_resolution = super::display_service::get_original_resolution(
|
||||
&d.name,
|
||||
lw as usize,
|
||||
lh as usize,
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
info
|
||||
})
|
||||
.collect()
|
||||
}
|
||||
|
||||
/// Match a DRM display to its compositor output: by normalized connector name first, then by a
|
||||
/// uniquely-matching physical resolution.
|
||||
fn match_wayland_display<'a>(
|
||||
d: &DrmDisplayInfo,
|
||||
wl: &'a [hbb_common::platform::linux::WaylandDisplayInfo],
|
||||
) -> Option<&'a hbb_common::platform::linux::WaylandDisplayInfo> {
|
||||
let dn = normalize_connector(&d.name);
|
||||
if let Some(w) = wl.iter().find(|w| normalize_connector(&w.name) == dn) {
|
||||
return Some(w);
|
||||
}
|
||||
let same_res: Vec<_> = wl
|
||||
.iter()
|
||||
.filter(|w| w.width == d.width as i32 && w.height == d.height as i32)
|
||||
.collect();
|
||||
if same_res.len() == 1 {
|
||||
return Some(same_res[0]);
|
||||
}
|
||||
None
|
||||
}
|
||||
|
||||
/// Normalize a connector name for cross-source matching: DRM inserts a single-letter type
|
||||
/// discriminator that the compositor drops ("HDMI-A-1" -> "HDMI-1", "DVI-D-1" -> "DVI-1"); names
|
||||
/// like "DP-1" / "eDP-1" pass through unchanged.
|
||||
fn normalize_connector(name: &str) -> String {
|
||||
let parts: Vec<&str> = name.split('-').collect();
|
||||
if parts.len() == 3 && parts[1].len() == 1 {
|
||||
format!("{}-{}", parts[0], parts[2])
|
||||
} else {
|
||||
name.to_string()
|
||||
}
|
||||
}
|
||||
|
||||
/// Reset the probe cache so the next session re-probes (called on capture teardown).
|
||||
pub(super) fn clear() {
|
||||
*DRM_STATE.lock().unwrap() = ProbeState::Unknown;
|
||||
}
|
||||
|
||||
fn display_info_from_drm(d: &DrmDisplayInfo) -> DisplayInfo {
|
||||
let original_resolution =
|
||||
super::display_service::get_original_resolution(&d.name, d.width as usize, d.height as usize);
|
||||
DisplayInfo {
|
||||
x: d.x,
|
||||
y: d.y,
|
||||
width: d.width as i32,
|
||||
height: d.height as i32,
|
||||
name: d.name.clone(),
|
||||
online: d.active,
|
||||
cursor_embedded: false,
|
||||
original_resolution,
|
||||
scale: 1.0,
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
|
||||
/// Build a `CapturerInfo` backed by a DRM-IPC capturer for `display_idx`, refreshing the cached
|
||||
/// display list from the capturer's handshake so mid-capture enumeration uses fresh geometry.
|
||||
pub(super) fn get_capturer_info(
|
||||
display_idx: usize,
|
||||
) -> ResultType<super::video_service::CapturerInfo> {
|
||||
// Refuse a display already demoted (repeated zero-frame sessions, or a detected flap below), so
|
||||
// the video service uses PipeWire for it instead of rebuilding onto DRM forever. Per-display, not
|
||||
// a global DRM disable.
|
||||
{
|
||||
// Refuse a demoted display UNLESS its demotion has aged past DEMOTE_COOLDOWN, in which case
|
||||
// drop it so the display retries DRM (recoverable, and releases a stale index-pinned verdict).
|
||||
let mut map = DRM_DISPLAY_FAILURES.lock().unwrap();
|
||||
if let Some((count, since)) = map.get(&(display_idx as i32)).copied() {
|
||||
if count >= DRM_GRAB_MAX_FAILURES {
|
||||
if since.elapsed() >= DEMOTE_COOLDOWN {
|
||||
map.remove(&(display_idx as i32));
|
||||
} else {
|
||||
return Err(anyhow!(
|
||||
"drm capture for display {display_idx} repeatedly produced no frame; using PipeWire"
|
||||
));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
// Build the capturer FIRST. A transient `_drm` outage (e.g. the root --service restarting) makes
|
||||
// this fail, and such a failure must NOT count toward the flap threshold — it self-heals once the
|
||||
// service returns. Only a SUCCESSFUL (re)build reaches the rapid-rebuild guard below.
|
||||
let (capturer, displays) = IpcDrmCapturer::new(display_idx as i32)?;
|
||||
// Rapid-rebuild guard (defense-in-depth): a display whose capturer is successfully rebuilt many
|
||||
// times in a short window is flapping (delivering a first frame then failing downstream every
|
||||
// cycle, which the got_frame streak alone cannot catch). Count the cadence of successful builds
|
||||
// and, past the threshold, demote it to PipeWire. A build spaced further apart than the window
|
||||
// resets the count, so a healthy display (built once, streams long) never accumulates. The
|
||||
// initial build counts 0, so demotion fires on the RAPID_REBUILD_MAX-th rapid rebuild — i.e.
|
||||
// the (RAPID_REBUILD_MAX + 1)-th build inside the window.
|
||||
{
|
||||
let now = Instant::now();
|
||||
let mut rebuilds = DRM_DISPLAY_REBUILDS.lock().unwrap();
|
||||
let count = match rebuilds.get(&(display_idx as i32)) {
|
||||
Some((last, c)) if now.duration_since(*last) < RAPID_REBUILD_WINDOW => c + 1,
|
||||
_ => 0,
|
||||
};
|
||||
rebuilds.insert(display_idx as i32, (now, count));
|
||||
if count >= RAPID_REBUILD_MAX {
|
||||
log::warn!(
|
||||
"drm: display {display_idx} rebuilt {count} times within {RAPID_REBUILD_WINDOW:?}; flapping, falling back to PipeWire"
|
||||
);
|
||||
DRM_DISPLAY_FAILURES
|
||||
.lock()
|
||||
.unwrap()
|
||||
.insert(display_idx as i32, (DRM_GRAB_MAX_FAILURES, Instant::now()));
|
||||
return Err(anyhow!(
|
||||
"drm capture for display {display_idx} is flapping; using PipeWire"
|
||||
));
|
||||
}
|
||||
}
|
||||
let ndisplay = displays.len();
|
||||
let d = displays
|
||||
.get(display_idx)
|
||||
.ok_or_else(|| anyhow!("drm display index {display_idx} out of range ({ndisplay})"))?
|
||||
.clone();
|
||||
// Publish the compositor's LOGICAL origin (the same augmentation get_display_infos advertises)
|
||||
// so the video service's origin matches the reported display geometry on multi-monitor / scaled
|
||||
// layouts; keep the raw physical dimensions for the capture buffer.
|
||||
let origin = augment_with_wayland_geometry(&displays)
|
||||
.get(display_idx)
|
||||
.map(|di| (di.x, di.y))
|
||||
.unwrap_or((d.x, d.y));
|
||||
*DRM_STATE.lock().unwrap() = ProbeState::Available(displays);
|
||||
Ok(super::video_service::CapturerInfo {
|
||||
origin,
|
||||
width: d.width as usize,
|
||||
height: d.height as usize,
|
||||
ndisplay,
|
||||
current: display_idx,
|
||||
privacy_mode_id: 0,
|
||||
_capturer_privacy_mode_id: 0,
|
||||
capturer: Box::new(capturer),
|
||||
})
|
||||
}
|
||||
@@ -396,11 +396,24 @@ fn run_cursor(sp: MouseCursorService, state: &mut StateCursor) -> ResultType<()>
|
||||
if let Some(hcursor) = crate::get_cursor()? {
|
||||
if hcursor != state.hcursor {
|
||||
let msg;
|
||||
// On the DRM path get_cursor_data() may return a snapshot whose id has advanced past the
|
||||
// requested `hcursor` (it returns the latest hardware cursor); file it in the cache AND
|
||||
// record state.hcursor under the id ACTUALLY served, so a later reappearance of that exact
|
||||
// shape dedupes correctly instead of being suppressed. Everything below is fully
|
||||
// `#[cfg(feature = "drm")]`-gated so the drm-off build stays byte-identical to upstream.
|
||||
#[cfg(feature = "drm")]
|
||||
let mut drm_served_id = hcursor;
|
||||
if let Some(cached) = state.cached_cursor_data.get(&hcursor) {
|
||||
super::log::trace!("Cursor data cached, hcursor: {}", hcursor);
|
||||
msg = cached.clone();
|
||||
} else {
|
||||
let mut data = crate::get_cursor_data(hcursor)?;
|
||||
#[cfg(feature = "drm")]
|
||||
let hcursor = data.id;
|
||||
#[cfg(feature = "drm")]
|
||||
{
|
||||
drm_served_id = hcursor;
|
||||
}
|
||||
data.colors = hbb_common::compress::compress(&data.colors[..]).into();
|
||||
let mut tmp = Message::new();
|
||||
tmp.set_cursor_data(data);
|
||||
@@ -408,7 +421,14 @@ fn run_cursor(sp: MouseCursorService, state: &mut StateCursor) -> ResultType<()>
|
||||
state.cached_cursor_data.insert(hcursor, msg.clone());
|
||||
super::log::trace!("Cursor data updated, hcursor: {}", hcursor);
|
||||
}
|
||||
state.hcursor = hcursor;
|
||||
#[cfg(not(feature = "drm"))]
|
||||
{
|
||||
state.hcursor = hcursor;
|
||||
}
|
||||
#[cfg(feature = "drm")]
|
||||
{
|
||||
state.hcursor = drm_served_id;
|
||||
}
|
||||
sp.send_shared(msg.clone());
|
||||
state.cursor_data = msg;
|
||||
}
|
||||
|
||||
@@ -107,8 +107,38 @@ struct CapDisplayInfo {
|
||||
capturer: CapturerPtr,
|
||||
}
|
||||
|
||||
/// Set the uinput absolute-pointer range to the whole logical desktop so the compositor maps
|
||||
/// injected coordinates 1:1 instead of stretching a single-monitor range across all outputs. The
|
||||
/// PipeWire path does this inline in `check_init`; the DRM path bypasses check_init so it must do it
|
||||
/// too, otherwise on a multi-monitor host the injected pointer lands on the wrong output — and the
|
||||
/// hardware cursor, which lives on whichever CRTC the pointer is over, never appears on the captured
|
||||
/// CRTC (the "cursor not visible" symptom). Reads the layout from the Wayland outputs, so it is
|
||||
/// independent of the capture backend. DRM-only: check_init keeps its own inline copy so the
|
||||
/// drm-off build stays byte-identical to upstream.
|
||||
#[cfg(feature = "drm")]
|
||||
async fn update_uinput_resolution() {
|
||||
if crate::input_service::wayland_use_uinput() {
|
||||
if let Some((minx, maxx, miny, maxy)) =
|
||||
scrap::wayland::display::get_desktop_rect_for_uinput()
|
||||
{
|
||||
log::info!("update mouse resolution: ({minx}, {maxx}), ({miny}, {maxy})");
|
||||
allow_err!(input_service::update_mouse_resolution(minx, maxx, miny, maxy).await);
|
||||
} else {
|
||||
log::warn!("Failed to get desktop rect for uinput");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::main(flavor = "current_thread")]
|
||||
pub(super) async fn ensure_inited() -> ResultType<()> {
|
||||
// DRM/KMS capture (opt-in): the root service owns the reader and the capturer self-inits over
|
||||
// IPC, so there is no PipeWire recorder to initialize here. But we still must set the uinput
|
||||
// desktop rect (check_init does this on the PipeWire path, and the DRM path skips check_init).
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
update_uinput_resolution().await;
|
||||
return Ok(());
|
||||
}
|
||||
check_init().await
|
||||
}
|
||||
|
||||
@@ -116,6 +146,10 @@ pub(super) fn is_inited() -> Option<Message> {
|
||||
if is_x11() {
|
||||
None
|
||||
} else {
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
return None;
|
||||
}
|
||||
if CAP_DISPLAY_INFO.read().unwrap().is_empty() {
|
||||
let mut msg_out = Message::new();
|
||||
let res = MessageBox {
|
||||
@@ -242,6 +276,14 @@ pub(super) async fn check_init() -> ResultType<()> {
|
||||
}
|
||||
|
||||
pub(super) async fn get_displays_and_primary() -> ResultType<(Vec<DisplayInfo>, usize)> {
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
if let Some(displays) = super::drm_capturer::get_display_infos() {
|
||||
// DRM connector order is not the compositor's primary; resolve the real primary from
|
||||
// the compositor layout (matched by normalized connector name), not a hardcoded index 0.
|
||||
return Ok((displays, super::drm_capturer::get_primary_index()));
|
||||
}
|
||||
}
|
||||
check_init().await?;
|
||||
// Keep one read guard so clear/reinitialization cannot split these across cache snapshots.
|
||||
let cap_map = CAP_DISPLAY_INFO.read().unwrap();
|
||||
@@ -260,6 +302,19 @@ pub fn clear() {
|
||||
if is_x11() {
|
||||
return;
|
||||
}
|
||||
// The DRM path augments its geometry from the compositor's Wayland outputs (logical origin +
|
||||
// scale), which scrap caches process-wide. The PipeWire path clears that cache on session close,
|
||||
// but the DRM path opens no PipeWire session, so without this it would keep matching DRM outputs
|
||||
// against STALE geometry after a monitor hotplug/rotation/scale change. Invalidate it on teardown
|
||||
// so the next session re-reads fresh geometry (lazily, on the next enumeration) and self-heals.
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
scrap::wayland::display::clear_wayland_displays_cache();
|
||||
}
|
||||
// NOTE: intentionally do NOT reset the DRM probe cache here. `clear()` runs on every capturer
|
||||
// teardown (which happens on each video-service restart), and re-probing `_drm` from the async
|
||||
// enumeration path blocks the executor long enough to trip "deadline has elapsed" and spiral
|
||||
// into a restart loop. DRM availability is fixed at service start, so the cache stays valid.
|
||||
let mut write_lock = CAP_DISPLAY_INFO.write().unwrap();
|
||||
for (_, addr) in write_lock.iter() {
|
||||
let cap_display_info: *mut CapDisplayInfo = *addr as _;
|
||||
@@ -280,6 +335,12 @@ pub(super) fn get_capturer_for_display(
|
||||
if is_x11() {
|
||||
bail!("Do not call this function if not wayland");
|
||||
}
|
||||
// DRM/KMS capture path: build the capturer straight from the service `_drm` stream, bypassing
|
||||
// the PipeWire CAP_DISPLAY_INFO machinery entirely.
|
||||
#[cfg(feature = "drm")]
|
||||
if super::drm_capturer::is_available() {
|
||||
return super::drm_capturer::get_capturer_info(display_idx);
|
||||
}
|
||||
let cap_map = CAP_DISPLAY_INFO.read().unwrap();
|
||||
if let Some(addr) = cap_map.get(&display_idx) {
|
||||
let cap_display_info: *const CapDisplayInfo = *addr as _;
|
||||
|
||||
Reference in New Issue
Block a user