QWT-NG 4.3.12 (agent 2adbd57)
The black window is fixed — it was Windows' UAC prompt
The recurring "unclosable black window" (forum 42717 — thank you GWeck for the logs) is
Windows' UAC secure desktop being mapped into dom0. When something asks to elevate,
Windows switches the guest to a separate desktop and draws the consent dialog over a
full-screen dimming backdrop; the agent followed that switch and mapped those surfaces. You
got a large dark window that could not be closed and ignored input — because the guest's
input was parked on a desktop dom0 never sees. If the agent died during the switch (a bug it
also hits), you got the backdrop without the dialog: a black rectangle and an invisible
prompt waiting for an answer.
It never reproduced in testing because every test machine ran with UAC off. One registry flip
reproduced the entire report on the first try.
Fixed in two layers:
- Elevation prompts are ordinary windows now. Consent is drawn on the normal desktop, so
it behaves like any other guest window: a standalone window in dom0 in seamless mode, or a
window inside the desktop window in non-seamless mode. You can read it and click it. - The secure desktop is never mapped. If Windows switches desktops anyway — lock screen,
Ctrl+Alt+Del, a site policy — the agent suppresses output for the duration instead of
mapping those surfaces, and resumes cleanly. Your open windows are left as they were.
A guest can no longer put a screen-sized window on your display
Non-seamless mode (the whole guest desktop in one window) used to inherit the guest's
host-sized desktop, so switching to it produced a window covering the entire display. Now the
agent shrinks the desktop first (1280×800 by default, remembered separately from the seamless
size) and completes the switch only once the smaller mode is live — and it refuses outright
any guest-initiated switch that would still cover the screen. Sizing driven by dom0 — you
resizing or maximizing the qube's window — is untouched: that is the one legitimate way for a
qube to fill the screen.
UAC can be turned off per qube, with one caveat
qvm-features <qube> service.uac-disable 1 turns UAC off (reboot required). Only an explicit
1 acts, and clearing the feature undoes it. It must be set on the TEMPLATE: an AppVM's
system drive is reset from its template at every boot, and Windows reads this setting at boot,
so a value written inside an AppVM can never take effect. The agent now warns when the feature
is set somewhere it cannot work. Turning UAC off is not recommended — without it any code in
the qube reaches admin/kernel.
Also
- Reinstalling an older release now really downgrades the display driver (Windows' driver
ranking only rebinds upward, which silently left a newer driver bound to an older agent). - Capture-engine telemetry (
WCBLACK/WCDEAD) has a fault-injection test behind it, so those
warnings are proven to fire rather than assumed to.
Known, not fixed here
Resizing the qube's window is slow and plays the Windows device-connect sound: each new size
makes the display driver reload its mode list, which Windows treats as a monitor change. Being
worked on.
Install
RPM in dom0, or the ISO/tarball inside the template; let the template shut down at the
end. In-place upgrade from any 4.3.x. Hand-created qube? qvm-features <qube> vmexec 1 and
qvm-prefs <qube> qrexec_timeout 1800 in dom0 (on the template; AppVMs inherit).