Register the retained LGIdd authority handle for service device
notifications. Close the exact handle before granting query-remove.
Use cancellable overlapped control requests so the SCM handler never
waits for driver I/O while Plug and Play is removing the device.
Keep authority publication, host liveness, and child activation under
one synchronized state machine to prevent activation after removal.
Retire device notifications on the service thread and keep polling for
the interface so a manual re-enable recovers without a service restart.
Stop LGIddHelper before updating either UMDF stack. Disable LGInput
before LGIdd, update both packages while quiesced, then restore the
provider before its dependent and start the service last.
Use in-use replacement for UMDF binaries and prevent the INF from
restarting the Helper during package installation. Report each
SetupAPI restart result and propagate it through NSIS.
Roll back transaction-owned devices, packages, and service state on
fresh-install failure. Preserve dependency order during removal and
select the package actually installed on each devnode.
WDF forbids WdfIoQueuePurgeSynchronously from an I/O callback.
Keep HID deactivation pending while the report queue is purged
asynchronously, then complete it from the queue-state callback.
Reject activation during the transition. Complete any remaining
deactivation request during queue cleanup.
Add two protocol-sized read-ahead buffers to each active clipboard
file stream. Fetch the next remote block on a worker while the caller
or CopyTo destination consumes the current block.
Serialize stream operations and invalidate queued work on seeks and
failures. Join the worker before releasing the remote dataset lease.
Extend the clipboard target boundary with ordered prefix delivery.
Pass up to four queued LGMP stream records to the Helper ring in one
operation, apply state only to the accepted prefix, and retain the
remaining suffix for exact retries.
The channel holds its write lock across the prefix and emits one pipe
doorbell per stream window instead of one per record.
Keep inbound stream payloads in the bounded stream-target window while
the Helper channel is busy and publish directly from those buffers.
Retain the pending target only for LGMP queue controls. Their credits
remain outstanding across retries.
This removes one full payload copy per client-to-Helper record without
changing delivery order, backpressure, or reset behavior.
Add a reusable copy path for moving data from write-combined mappings
into normal cacheable memory. Dispatch to MOVNTDQA-based SSE4.1 or AVX2
loads when the processor and OS support them, with a fenced fallback.
Use the optimized path when staging inbound clipboard stream records from
the IVSHMEM mapping.
Drive adaptive clipboard stream polling with a high-resolution waitable
timer instead of rounding microsecond delays into coarse wait-function
timeouts.
Preserve the explicit stop and local wake events while avoiding a clock-tick
stall at each file-transfer window.
Use the documented Win32 wait constants throughout the pipe, clipboard,
and input workers instead of local numeric aliases.
Select the WDK NT-status definitions before including Windows headers.
Include wudfwdm.h privately in the affected translation units so UMDF 2
provides NTSTATUS without exposing WDF headers through LGCommon's public
interface to the desktop Helper.
Replace legacy clipboard grant and queued input fixtures with bound SPSC
stream endpoints. Verify stream-only payload delivery, credit recovery,
release completion, and four 256 KiB records for a 1 MiB response.
Keep queue assertions for status, discovery, ownership, and control.
Carry DATA and FILE_DATA only through the duplex SPSC streams. Keep LGMP
queues for control and status. Remove grants, commits, ACKs, and
queue-payload transport negotiation.
Poll adaptively while ownership or release is active. Preserve FIFO
release and graceful draining. Quarantine payloads crossed by a newer
OFFER or CLEAR, and retire data-plane state on detach.
Carry every input activation and report through its client-bound SPSC
stream. Keep the LGMP queue only for status publication and subscriber
discovery, removing transport selection and the queue-report fallback.
Retain graceful endpoint draining when a subscriber disappears and use
bounded adaptive polling while streams are active. The IDD polling setup
remains compatible with the project’s current C++ language mode.
Publish ordered four-record prefixes through the Helper mapping and ring
once per accepted burst. Wake blocked producers when the peer returns
credits while retaining the bounded polling fallback.
Move received payload ownership into manager work items and place remote
file-read data directly into the waiting caller’s bounded output buffer.
This removes avoidable 256 KiB copies without changing record ordering,
timeouts, cancellation, or reset semantics.
Advance LGMP to the stream polling fallback implementation.
The new API combines short spins with bounded exponential backoff and
resets on observed progress. Notification callbacks remain advisory, so
plain shared-memory transports keep making progress without doorbells.
Select the endpoint bound to this LGMP client and send each complete
input activation through its reliable fixed-slot stream.
Track the transport with every pending and published record so CLAIM,
reports, KEEPALIVE, RESET, and RELEASE cannot cross data planes.
Latch queue fallback for the connection after it is selected, avoiding
cross-generation reordering if a stream appears later. Preserve motion
coalescing and the existing queue retry behavior.
Create and advertise one reliable input stream for each possible LGMP
client, then bind endpoints to active input subscribers.
Drain endpoints fairly while prioritizing the current owner's lane so
its RELEASE remains the ordering barrier. Reject transport changes
within an activation generation.
Gracefully retire missing or stalled subscribers without reusing an
active reservation. Keep excess clients on the queue and release HID
ownership from the input worker when its stream retires.
Extend input status with eight exported client-to-host stream
endpoints, matching the maximum number of LGMP clients.
Publish each endpoint descriptor, client binding, epoch, and lifecycle
flags. Require every input activation to keep its ordered records on a
single transport.
Retain the queue transport as a fallback and bump the input and
KVMFR protocol versions for the expanded status layout.
Attach the advertised clipboard lanes before claiming ownership, prefer
the stream transport, and activate only the acknowledged client and
epoch binding.
Move representation and file payloads through fixed-slot reservations
while status and lifecycle control remain on the LGMP queue. Retain a
legacy v4 fallback for other hosts.
Hold each host-to-client reservation until the consumer accepts its
record, return credits in order, and drain queued traffic in bounded
bursts before sleeping.
Create one reliable four-slot lane in each direction and advertise the
stream data plane for clipboard protocol v4.
Bind both lanes to the accepted owner generation, stage incoming data
within a fixed window, and apply backpressure when Helper delivery is
full.
Drain reliable records before releasing an owner. Force stale or
unresponsive bindings after a bounded deadline while preserving the
existing cancellation and clipboard-clear cleanup.
Replace the single 1 MiB clipboard slot with a four-record 256 KiB
window while retaining a 1 MiB logical file-read limit.
Advertise transport capabilities and duplex stream descriptors in the
clipboard status. Make each claim select one data plane for its entire
owner generation so control and payload ordering cannot be mixed.
Bump the clipboard, KVMFR, and Helper mapping versions for the new
wire layouts and shared-memory geometry.
Expose LGMP stream creation through the existing IDD host wrapper so
subsystem transports do not reach through its ownership boundary.
Keep stream lifetime and binding under each transport while the host
continues to own the underlying shared-memory allocator.
Add a transport-neutral wire copy of the LGMP stream descriptor for
embedding in KVMFR subsystem status records.
Keep the common protocol independent of LGMP headers and assert the
field offsets and total size at both C and C++ integration points.
Advance LGMP to the new separately versioned stream transport. This
provides fixed-slot, epoch-bound SPSC lanes without changing the
existing broadcast queue ABI.
Use reliable draining for clipboard and input payloads, and retain
transport-neutral notification hooks for a later doorbell backend.
Yet again we have to implement a fix for another Gnome-ism. Why they
dont just implement standard such as rfc2483 is beyond me. Instead they
have decided to implement the undocumented format
`x-special/gnome-copied-files`. You would think that they could at least
remain compatible by trimming `\r` from the lines.
I am so glad KDE is good these days
The X11 clipboard test directly checks the protocol representation chunk
limit. Include the header that defines the constant instead of relying on
a transitive include from the implementation translation unit.
The interactive Helper now writes its own log under LocalAppData so it
can run with the desktop user token. The tray menu should still take
users to the system-wide IDD and service logs under ProgramData.
Expose the log-directory resolver and have Open log directory request
the ProgramData location explicitly. Keep Helper log storage unchanged.
Explorer can consume FILECONTENTS streams with reads much smaller than
the 1 MiB protocol limit. Previously each IStream::Read became a
synchronous cross-VM request, including client-side path validation and
a fresh file open.
Give each clipboard file stream a lazy 1 MiB absolute-offset read-ahead
window. Serve sequential reads and seeks within that window locally.
Bypass the cache for 1 MiB-or-larger reads and for CopyTo so bulk
callers avoid an extra copy. Preserve EOF, partial-read, failure, seek,
and clone semantics.
Mark the last non-empty FILE_DATA payload with BEGIN and END when the
producer knows it is terminal. Complete producer bookkeeping in the
following fileDataEnd call without consuming another LGMP grant. Keep
the standalone terminal record for empty and legacy unknown streams.
Drain up to 64 queued clipboard records per worker pass instead of
sleeping after every message. Poll at 1 ms while transfers, blocked
writes, held input, or pending output are active, and retain the 10 ms
interval while idle.
This removes a serialized grant round trip from every non-empty file
response and reduces scheduling delay while a large transfer is active.
Keep the 1 MiB payload size because the bottleneck was stop-and-wait
latency, not the chunk capacity.
Exercise a full 1 MiB response in a single BEGIN|END grant and retain
coverage for empty unknown-size responses.
Explorer file copies were invisible to the Helper because the service
launched its child with a duplicate of the LocalSystem token and changed
only TokenSessionId. The child therefore remained a System-integrity
process. Windows filtered Explorer's file clipboard formats across that
integrity boundary. Basic text and bitmap formats continued to work.
Keep only the SCM service privileged. Obtain the active session user's
primary token with WTSQueryUserToken. For elevated accounts, prefer the
linked limited token. Validate its session and security properties.
Build the user environment and launch the interactive Helper on
WinSta0\Default. Gate Helper activation until the service has rechecked
the active session and registered the clipboard authority.
Use random lifetime, stop, and activation objects owned by the service.
Give the target logon SID synchronization access only. Recheck the
active console session and service state before activation. Make the
lifetime mutex terminate the Helper if the service exits unexpectedly.
Restart it when the active session, IDD host, or authority changes.
Replace the old process-handle mapping transfer with a device-bound
authority protocol on the LGIdd device interface. The service verifies
the exact driver host instance, duplicates only section map rights into
that process, and registers the session, mapping identifier, and handle.
Bind authority lifetime to its WDF file object, revoke it synchronously
on cleanup, and poll the driver host identity while the child is active.
Restrict the device stack to SYSTEM and isolate LGIdd in a unique UMDF
device group. Restrict the shared section to SYSTEM and the target logon
SID. Apply a medium mandatory label that prevents low-integrity readers
and writers. Map it with read/write rights instead of all access.
Give each clipboard mapping a second random authority identifier. Store
it only inside the logon-SID-protected mapping and send it in the
mandatory HELLO. LGIdd matches it against the service-injected mapping.
This authenticates the user Helper without the unsupported UMDF call to
GetNamedPipeClientSessionId. Have the Helper verify that its pipe server
is in session zero.
Extend the pipe endpoint with bounded authentication reads, cancellable
overlapped I/O, periodic authorization checks, and explicit disconnects.
Serialize authority changes with clipboard attach and detach. Prevent
stale cleanup from tearing down a replacement mapping. Disconnect the
user pipe immediately when its owning authority is revoked.
Run clipboard, OLE, display, configuration, and file access in the
user's interactive process. Retain its process token for worker-thread
file operations instead of querying and impersonating the desktop user
from a System process. Store Helper logs in LocalAppData and grant only
the registry rights needed by interactive configuration and UMDF.
Keep immediate, stage-specific Win32 and HRESULT diagnostics throughout
clipboard capture. Probe CF_HDROP while holding the Win32 clipboard and
enumerate the OLE object's advertised file formats. Validate returned
storage and fall back to Shell item paths when direct retrieval fails.
Validate clipboard sequence changes and defer retries during contention
without publishing incomplete clipboard state.
Complete the 1 MiB transfer work with full-sized Windows copy buffers.
Use full-sized FUSE reads and retain the named 64 KiB X11 chunk limit.
Validate the user-writable mapping with CClipboardRing before attaching.
The pipe, mapping, and authority protocols change together. LGIdd.dll,
the INF, and LGIddHelper.exe must be rebuilt and installed as one
matching set.
