Retain non-file clipboard representations while asynchronous file MIME
imports are validated. If an offered URI list is invalid or cannot be
read, publish the retained image and text formats instead of clearing
the clipboard.
Classify configured devices by keyboard and pointer capability so
automatic keyboard capture leaves relative pointer devices with the
display server.
Run descriptor, grab, physical-state, and LED operations on one worker.
Marshal normalized events through each display server's event loop and
serialize ownership changes with per-lane barriers.
Fall back whole lanes to native input when an evdev cohort cannot be
owned, and retry missing or removed devices without disabling the rest.
Handle report framing, SYN_DROPPED, high-resolution wheels, queue
overflow, held-state cleanup, and guest-driven keyboard LEDs. Restore
host LEDs and kernel grabs during teardown.
Re-evaluate capture when the active input transport changes.
Allow display servers to dispatch a caller-owned event source on their
native event thread. This lets background input readers marshal events
to the thread that owns application and display-server state.
Poll X11 fairly when native events remain continuously available, and
use bounded polling if the external descriptor cannot be registered.
Report guest HID keyboard LED state from LGInput to LGIdd and
publish it with the LGMP input endpoint status.
Forward SPICE modifier updates through the same provider state so evdev
can synchronize physical keyboard LEDs across transport changes and
reconnects.
Bump the versioned pipe and KVMFR input status contracts for the new
feedback state.
Accept earlier LGMP input status versions without LED feedback so the
client retains input while the guest driver is being upgraded.
Capture-on-focus could consume the initial focus event before an input
provider became available. The focused state then suppressed any later
attempt to establish capture.
Treat explicit capture as local window state, refresh keyboard ownership
on focus and input-policy changes, and preserve pre-ungrab availability
for key release. Fall back to the window center when guest cursor
geometry is not ready.
Add a configured escape key plus Shift+R command that requests display
recovery from the LGMP transport and switches video to SPICE.
Track the request on the main thread, report its asynchronous result,
and return its producer instance with the request serial for exact
correlation.
Preserve normal escape+R rotation behavior, including custom Shift
escape keys.
Heartbeat expiry does not change the LGMP session ID. Queue operations
can therefore accept ownership releases into stale shared memory after
a guest reboot, where no host remains to advance the acknowledgement
serial.
Skip graceful clipboard and input ownership release when the session is
already invalid. Keep the existing timeout and warning for a live host
that fails to process the release.
The splash state machine reset its fade whenever a transport handoff
restored the logo. Each replacement source therefore started another
one-second fade when it became ready.
Retain one startup fade allowance and consume it on the first hide.
Later source changes can still show the unavailable-video splash, but
hide it immediately when video returns.
Primary frame and pointer workers can still be unwinding an abandoned
payload when another thread detects that the primary transport has
disconnected. Their fatal paths previously stored SHUTDOWN
unconditionally, allowing a stale renderer or transport failure to
overwrite RESTART and terminate the client instead of activating the
SPICE fallback.
Publish RESTART at the beginning of primary-loss handling, before
transport bookkeeping, and make worker-local fatal paths transition to
SHUTDOWN only while the application is still RUNNING. Global failures
and the case where both primary and fallback sessions are lost remain
terminal.
Teach the X11 fixture about the MATE atom and verify import
preference, source target advertisement, and copied-files delivery.
Cover the same Wayland offer and source behavior. Assert that MATE
reuses the single GNOME-style payload instead of fetching a duplicate
representation.
Exercise the core parser and generator with the MATE copied-files MIME,
including invalid operation handling and byte-identical remote output.
Treat either GNOME or MATE copied-files data as preferred over the URI
list fallback. The previous pair of strcmp conditions could never both
be false, so a MATE offer could not replace an earlier URI list.
GNOME and MATE use the same copied-files representation. Generate that
payload once and serve it under both advertised MIME names instead of
overwriting and leaking the first allocation.
Replace legacy clipboard grant and queued input fixtures with bound SPSC
stream endpoints. Verify stream-only payload delivery, credit recovery,
release completion, and four 256 KiB records for a 1 MiB response.
Keep queue assertions for status, discovery, ownership, and control.
Carry DATA and FILE_DATA only through the duplex SPSC streams. Keep LGMP
queues for control and status. Remove grants, commits, ACKs, and
queue-payload transport negotiation.
Poll adaptively while ownership or release is active. Preserve FIFO
release and graceful draining. Quarantine payloads crossed by a newer
OFFER or CLEAR, and retire data-plane state on detach.
Carry every input activation and report through its client-bound SPSC
stream. Keep the LGMP queue only for status publication and subscriber
discovery, removing transport selection and the queue-report fallback.
Retain graceful endpoint draining when a subscriber disappears and use
bounded adaptive polling while streams are active. The IDD polling setup
remains compatible with the project’s current C++ language mode.
Select the endpoint bound to this LGMP client and send each complete
input activation through its reliable fixed-slot stream.
Track the transport with every pending and published record so CLAIM,
reports, KEEPALIVE, RESET, and RELEASE cannot cross data planes.
Latch queue fallback for the connection after it is selected, avoiding
cross-generation reordering if a stream appears later. Preserve motion
coalescing and the existing queue retry behavior.
Attach the advertised clipboard lanes before claiming ownership, prefer
the stream transport, and activate only the acknowledged client and
epoch binding.
Move representation and file payloads through fixed-slot reservations
while status and lifecycle control remain on the LGMP queue. Retain a
legacy v4 fallback for other hosts.
Hold each host-to-client reservation until the consumer accepts its
record, return credits in order, and drain queued traffic in bounded
bursts before sleeping.
Yet again we have to implement a fix for another Gnome-ism. Why they
dont just implement standard such as rfc2483 is beyond me. Instead they
have decided to implement the undocumented format
`x-special/gnome-copied-files`. You would think that they could at least
remain compatible by trimming `\r` from the lines.
I am so glad KDE is good these days
The X11 clipboard test directly checks the protocol representation chunk
limit. Include the header that defines the constant instead of relying on
a transitive include from the implementation translation unit.
Mark the last non-empty FILE_DATA payload with BEGIN and END when the
producer knows it is terminal. Complete producer bookkeeping in the
following fileDataEnd call without consuming another LGMP grant. Keep
the standalone terminal record for empty and legacy unknown streams.
Drain up to 64 queued clipboard records per worker pass instead of
sleeping after every message. Poll at 1 ms while transfers, blocked
writes, held input, or pending output are active, and retain the 10 ms
interval while idle.
This removes a serialized grant round trip from every non-empty file
response and reduces scheduling delay while a large transfer is active.
Keep the 1 MiB payload size because the bottleneck was stop-and-wait
latency, not the chunk capacity.
Exercise a full 1 MiB response in a single BEGIN|END grant and retain
coverage for empty unknown-size responses.
Explorer file copies were invisible to the Helper because the service
launched its child with a duplicate of the LocalSystem token and changed
only TokenSessionId. The child therefore remained a System-integrity
process. Windows filtered Explorer's file clipboard formats across that
integrity boundary. Basic text and bitmap formats continued to work.
Keep only the SCM service privileged. Obtain the active session user's
primary token with WTSQueryUserToken. For elevated accounts, prefer the
linked limited token. Validate its session and security properties.
Build the user environment and launch the interactive Helper on
WinSta0\Default. Gate Helper activation until the service has rechecked
the active session and registered the clipboard authority.
Use random lifetime, stop, and activation objects owned by the service.
Give the target logon SID synchronization access only. Recheck the
active console session and service state before activation. Make the
lifetime mutex terminate the Helper if the service exits unexpectedly.
Restart it when the active session, IDD host, or authority changes.
Replace the old process-handle mapping transfer with a device-bound
authority protocol on the LGIdd device interface. The service verifies
the exact driver host instance, duplicates only section map rights into
that process, and registers the session, mapping identifier, and handle.
Bind authority lifetime to its WDF file object, revoke it synchronously
on cleanup, and poll the driver host identity while the child is active.
Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF
device group. Restrict the shared section to SYSTEM and the target logon
SID. Apply a medium mandatory label that prevents low-integrity readers
and writers. Map it with read/write rights instead of all access.
Give each clipboard mapping a second random authority identifier. Store
it only inside the logon-SID-protected mapping and send it in the
mandatory HELLO. LGIdd matches it against the service-injected mapping.
This authenticates the user Helper without the unsupported UMDF call to
GetNamedPipeClientSessionId. Have the Helper verify that its pipe server
is in session zero.
Extend the pipe endpoint with bounded authentication reads, cancellable
overlapped I/O, periodic authorization checks, and explicit disconnects.
Serialize authority changes with clipboard attach and detach. Prevent
stale cleanup from tearing down a replacement mapping. Disconnect the
user pipe immediately when its owning authority is revoked.
Run clipboard, OLE, display, configuration, and file access in the
user's interactive process. Retain its process token for worker-thread
file operations instead of querying and impersonating the desktop user
from a System process. Store Helper logs in LocalAppData and grant only
the registry rights needed by interactive configuration and UMDF.
Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout
clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and
enumerate the OLE object's advertised file formats. Validate returned
storage and fall back to Shell item paths when direct retrieval fails.
Validate clipboard sequence changes and defer retries during contention
without publishing incomplete clipboard state.
Complete the 1 MiB transfer work with full-sized Windows copy buffers.
Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit.
Validate the user-writable mapping with CClipboardRing before attaching.
The pipe, mapping, and authority protocols change together. LGIdd.dll,
the INF, and LGIddHelper.exe must be rebuilt and installed as one
matching set.
The buffer scale and viewport were only set from the resize handling in
the swap path, which runs after the buffer has been committed. The first
commit therefore carried a buffer of scale x the window size with no
scale declared, so the compositor sized the window from the raw buffer.
On a scaled output that is larger than the work area GNOME maximizes it,
after which libdecor drops every resize as the frame is no longer
floating, leaving the window stuck at the size of the display.
Split the scaling out of the swap path and apply it when the EGL window
is created, so it is in place for the first commit.
Track unexpected loss of an admitted fallback independently from normal
stop and UUID revocation. Terminate once both primary and fallback
sessions have disappeared, regardless of notification order.
Make shutdown terminal so concurrent disconnect handling cannot replace
it with restart or running state.
