Register the retained LGIdd authority handle for service device
notifications. Close the exact handle before granting query-remove.
Use cancellable overlapped control requests so the SCM handler never
waits for driver I/O while Plug and Play is removing the device.
Keep authority publication, host liveness, and child activation under
one synchronized state machine to prevent activation after removal.
Retire device notifications on the service thread and keep polling for
the interface so a manual re-enable recovers without a service restart.
Add two protocol-sized read-ahead buffers to each active clipboard
file stream. Fetch the next remote block on a worker while the caller
or CopyTo destination consumes the current block.
Serialize stream operations and invalidate queued work on seeks and
failures. Join the worker before releasing the remote dataset lease.
Publish ordered four-record prefixes through the Helper mapping and ring
once per accepted burst. Wake blocked producers when the peer returns
credits while retaining the bounded polling fallback.
Move received payload ownership into manager work items and place remote
file-read data directly into the waiting caller’s bounded output buffer.
This removes avoidable 256 KiB copies without changing record ordering,
timeouts, cancellation, or reset semantics.
The interactive Helper now writes its own log under LocalAppData so it
can run with the desktop user token. The tray menu should still take
users to the system-wide IDD and service logs under ProgramData.
Expose the log-directory resolver and have Open log directory request
the ProgramData location explicitly. Keep Helper log storage unchanged.
Explorer can consume FILECONTENTS streams with reads much smaller than
the 1 MiB protocol limit. Previously each IStream::Read became a
synchronous cross-VM request, including client-side path validation and
a fresh file open.
Give each clipboard file stream a lazy 1 MiB absolute-offset read-ahead
window. Serve sequential reads and seeks within that window locally.
Bypass the cache for 1 MiB-or-larger reads and for CopyTo so bulk
callers avoid an extra copy. Preserve EOF, partial-read, failure, seek,
and clone semantics.
Explorer file copies were invisible to the Helper because the service
launched its child with a duplicate of the LocalSystem token and changed
only TokenSessionId. The child therefore remained a System-integrity
process. Windows filtered Explorer's file clipboard formats across that
integrity boundary. Basic text and bitmap formats continued to work.
Keep only the SCM service privileged. Obtain the active session user's
primary token with WTSQueryUserToken. For elevated accounts, prefer the
linked limited token. Validate its session and security properties.
Build the user environment and launch the interactive Helper on
WinSta0\Default. Gate Helper activation until the service has rechecked
the active session and registered the clipboard authority.
Use random lifetime, stop, and activation objects owned by the service.
Give the target logon SID synchronization access only. Recheck the
active console session and service state before activation. Make the
lifetime mutex terminate the Helper if the service exits unexpectedly.
Restart it when the active session, IDD host, or authority changes.
Replace the old process-handle mapping transfer with a device-bound
authority protocol on the LGIdd device interface. The service verifies
the exact driver host instance, duplicates only section map rights into
that process, and registers the session, mapping identifier, and handle.
Bind authority lifetime to its WDF file object, revoke it synchronously
on cleanup, and poll the driver host identity while the child is active.
Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF
device group. Restrict the shared section to SYSTEM and the target logon
SID. Apply a medium mandatory label that prevents low-integrity readers
and writers. Map it with read/write rights instead of all access.
Give each clipboard mapping a second random authority identifier. Store
it only inside the logon-SID-protected mapping and send it in the
mandatory HELLO. LGIdd matches it against the service-injected mapping.
This authenticates the user Helper without the unsupported UMDF call to
GetNamedPipeClientSessionId. Have the Helper verify that its pipe server
is in session zero.
Extend the pipe endpoint with bounded authentication reads, cancellable
overlapped I/O, periodic authorization checks, and explicit disconnects.
Serialize authority changes with clipboard attach and detach. Prevent
stale cleanup from tearing down a replacement mapping. Disconnect the
user pipe immediately when its owning authority is revoked.
Run clipboard, OLE, display, configuration, and file access in the
user's interactive process. Retain its process token for worker-thread
file operations instead of querying and impersonating the desktop user
from a System process. Store Helper logs in LocalAppData and grant only
the registry rights needed by interactive configuration and UMDF.
Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout
clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and
enumerate the OLE object's advertised file formats. Validate returned
storage and fall back to Shell item paths when direct retrieval fails.
Validate clipboard sequence changes and defer retries during contention
without publishing incomplete clipboard state.
Complete the 1 MiB transfer work with full-sized Windows copy buffers.
Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit.
Validate the user-writable mapping with CClipboardRing before attaching.
The pipe, mapping, and authority protocols change together. LGIdd.dll,
the INF, and LGIddHelper.exe must be rebuilt and installed as one
matching set.
Add a protocol-independent recovery channel outside LGMP so clients can
request a usable guest display even when transport versions differ.
Synchronize recovery state with the helper across driver restarts and
restore the configured topology without persisting temporary changes.
Make CSRWLock own the native lock and provide scoped guards for shared,
exclusive, early-unlock, and non-blocking use.
Replace direct SRW lock management throughout the IDD, input driver,
and helper while preserving the existing lock scopes.
Move the reusable named-pipe endpoint and shared support code into
the LGCommon static library.
Run a dedicated server in LGIdd and a reconnecting client in
LGInput, with device-lifecycle handling and report framing.
Refactor the helper pipe to use the same endpoint implementation.
Store refresh rates in millihertz and preserve three decimal places.
Advertise exact rational rates while accepting legacy integer values.
Accept rates from 23.900 through 1000.000 Hz.
No GPU notifications are not possible before the notification icon is
created. Since the helper could start before explorer.exe (and often does
on reboot), the notification would fail.
This commit adds logic to refer the notification and we send it immediately
when successfully creating the notification icon.
After 882d531792, the existing code in the
helper reads past the end of the array for refresh rate, which is broken.
This PR also refactors the default modes into a getDefaultModes method so
that it can be used for a reset feature later.
