Yet again we have to implement a fix for another Gnome-ism. Why they
dont just implement standard such as rfc2483 is beyond me. Instead they
have decided to implement the undocumented format
`x-special/gnome-copied-files`. You would think that they could at least
remain compatible by trimming `\r` from the lines.
I am so glad KDE is good these days
Mark the last non-empty FILE_DATA payload with BEGIN and END when the
producer knows it is terminal. Complete producer bookkeeping in the
following fileDataEnd call without consuming another LGMP grant. Keep
the standalone terminal record for empty and legacy unknown streams.
Drain up to 64 queued clipboard records per worker pass instead of
sleeping after every message. Poll at 1 ms while transfers, blocked
writes, held input, or pending output are active, and retain the 10 ms
interval while idle.
This removes a serialized grant round trip from every non-empty file
response and reduces scheduling delay while a large transfer is active.
Keep the 1 MiB payload size because the bottleneck was stop-and-wait
latency, not the chunk capacity.
Exercise a full 1 MiB response in a single BEGIN|END grant and retain
coverage for empty unknown-size responses.
Explorer file copies were invisible to the Helper because the service
launched its child with a duplicate of the LocalSystem token and changed
only TokenSessionId. The child therefore remained a System-integrity
process. Windows filtered Explorer's file clipboard formats across that
integrity boundary. Basic text and bitmap formats continued to work.
Keep only the SCM service privileged. Obtain the active session user's
primary token with WTSQueryUserToken. For elevated accounts, prefer the
linked limited token. Validate its session and security properties.
Build the user environment and launch the interactive Helper on
WinSta0\Default. Gate Helper activation until the service has rechecked
the active session and registered the clipboard authority.
Use random lifetime, stop, and activation objects owned by the service.
Give the target logon SID synchronization access only. Recheck the
active console session and service state before activation. Make the
lifetime mutex terminate the Helper if the service exits unexpectedly.
Restart it when the active session, IDD host, or authority changes.
Replace the old process-handle mapping transfer with a device-bound
authority protocol on the LGIdd device interface. The service verifies
the exact driver host instance, duplicates only section map rights into
that process, and registers the session, mapping identifier, and handle.
Bind authority lifetime to its WDF file object, revoke it synchronously
on cleanup, and poll the driver host identity while the child is active.
Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF
device group. Restrict the shared section to SYSTEM and the target logon
SID. Apply a medium mandatory label that prevents low-integrity readers
and writers. Map it with read/write rights instead of all access.
Give each clipboard mapping a second random authority identifier. Store
it only inside the logon-SID-protected mapping and send it in the
mandatory HELLO. LGIdd matches it against the service-injected mapping.
This authenticates the user Helper without the unsupported UMDF call to
GetNamedPipeClientSessionId. Have the Helper verify that its pipe server
is in session zero.
Extend the pipe endpoint with bounded authentication reads, cancellable
overlapped I/O, periodic authorization checks, and explicit disconnects.
Serialize authority changes with clipboard attach and detach. Prevent
stale cleanup from tearing down a replacement mapping. Disconnect the
user pipe immediately when its owning authority is revoked.
Run clipboard, OLE, display, configuration, and file access in the
user's interactive process. Retain its process token for worker-thread
file operations instead of querying and impersonating the desktop user
from a System process. Store Helper logs in LocalAppData and grant only
the registry rights needed by interactive configuration and UMDF.
Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout
clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and
enumerate the OLE object's advertised file formats. Validate returned
storage and fall back to Shell item paths when direct retrieval fails.
Validate clipboard sequence changes and defer retries during contention
without publishing incomplete clipboard state.
Complete the 1 MiB transfer work with full-sized Windows copy buffers.
Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit.
Validate the user-writable mapping with CClipboardRing before attaching.
The pipe, mapping, and authority protocols change together. LGIdd.dll,
the INF, and LGIddHelper.exe must be rebuilt and installed as one
matching set.
Track unexpected loss of an admitted fallback independently from normal
stop and UUID revocation. Terminate once both primary and fallback
sessions have disappeared, regardless of notification order.
Make shutdown terminal so concurrent disconnect handling cannot replace
it with restart or running state.
Display server and overlay teardown can still call app_invalidateWindow,
which signals the frame event; the Wayland presentation module does so
when it unregisters its graph. Freeing the event beforehand asserted in
lgSignalEvent while closing the client.
The render thread freed the overlays as soon as it exited, while the
main thread could still be dispatching display server input callbacks
that iterate them. Free the overlays in lg_shutdown instead, once the
render thread has been joined and the display server has shut down.
The overlays now outlive the renderer, so overlayFreeImage must not
call into it; renderer deinitialization has already destroyed all
textures along with the context.
evdev_stop was never called, and calling it revealed unsafe teardown:
the device list was freed before the thread was joined, a zero epoll
descriptor was mistaken for a valid one, and the device loops walked
past the end of the array through a sentinel that does not exist.
Join the thread in evdev_stop and defer the rest to the new evdev_free.
The display server grab hooks route into evdev until its event thread
is joined, so the device state must stay valid until the display
server has been freed; evdev_free then restores the hooks and releases
the state.
Report expected and current protocol versions through the transport
interface and expose session-independent recovery operations.
Offer recovery from the version mismatch popup, publish requests through
the reserved IVSHMEM channel, and select the validated SPICE fallback.
Register SPICE connection and component options in the SPICE transport.
Move generic input and clipboard settings out of the SPICE namespace,
while retaining migration aliases for existing configurations.
Keep PureSpice and usbredir build requirements private to the transport,
and remove obsolete SPICE configuration state from the client core.
Track primary and fallback video with source-specific generations, and
publish a source only after its first frame or software surface is
ready.
Route SPICE surfaces and cursors through the generic render queue. Keep
the current image across handoffs, and switch input only after the new
source has been presented.
Move fallback activation to its worker so display callbacks cannot
block or deadlock the render path.
Treat autoCapture as keyboard ownership while the pointer is inside the
guest viewport. Predict the next local position for both absolute and
relative motion, then release the keyboard before the pointer crosses
an edge.
Keep capture, focus, and deferred evdev transitions consistent while
retaining the latest local position as the prediction baseline.
X11's legacy guest-position synchronization warps the host cursor to
delayed guest updates. With absolute input this feeds old positions back
through cooked motion and pulls the cursor away from window edges.
Skip display-server guest synchronization when the active input is
absolute. Relative input and explicit uncapture alignment are unchanged.
Rework audio provider and backend lifecycles so playback and capture
callbacks quiesce without blocking real-time threads. Move activation,
teardown, controls, retries, and diagnostics onto bounded workers.
Harden USB audio cadence, feedback, and capture recovery.
Preserve source clocks through recording and pace packets from the
device clock. Bound queues, waits, conversion buffers, and packet sizes.
Make PipeWire and PulseAudio stream control thread-safe and recoverable.
Correct latency clock domains, coalesce rate updates, preserve recent
capture under overload, and keep logging outside real-time callbacks.
Add a composite UAC2 microphone function with its own clock so
recording and playback can use independent sample rates.
Packetize asynchronous capture through usbredir, follow the host
capture clock, and preserve the newest frames across stalls.
Reconfigure active recording without another permission prompt and
fix lost PipeWire capture wakeups.
Treat a negative provider-controlled playback ring as a timeline
discontinuity rather than carrying its underrun debt.
Rebase to the normal low-water target and reset feedback correction so
guest stalls resume at low latency instead of discarding audio for
seconds.
