[PATCH 14/19] present: Add window flip mode

[Keith Packard]

Michel Dänzer <michel at daenzer.net> writes:

> Taking a step back, do we even need to keep around the original pixmap
> and unflip to it at all? I had a chat on IRC about this with Keith a
> while ago, see the attached log excerpt.

I guess the question is whether the special access granted by the kernel
to the window pixmap is at all problematic.

> Keith's main concern is that the presenting client could be able to
> read/write the window pixmap's contents behind the X server's back.

And that was largely in the context of the root window. We preserve the
screen pixmap so that we have something to show when a full-screen
window goes away after page flipping.

> I understand this concern at least somewhat in the case of per-screen
> flips, because the screen pixmap can be used for completely different
> windows after flipping.

Exactly.

> But this seems irrelevant for per-window flips. In this case, the window
> pixmap isn't used for anything else after flipping, so having direct
> access to the pixmap doesn't allow the client to do anything it couldn't
> do anyway using the X11 protocol. (There might be exceptions to this if
> the window wasn't created by the presenting client, and the Security
> extension comes into play. But that would be a rather exotic scenario,
> so I don't think we need to consider it here.)

Agreed. Discarding the window pixmap during per-window flips seems like
it should be fine. Of course, you need to replace the window pixmap for
all windows sharing the original redirection, and that might include the
parent. That's mildly concerning as now the client has control over the
contents of another application's window outside of the X protocol.

> To avoid this, the flip pixmap must be set as the window pixmap, as is
> done for per-screen flips.

Yup, and for all windows sharing the same window pixmap.

> Assuming the original window pixmap doesn't need to be saved and
> restored, this should result in even less complexity than in this
> patch.

I would think so; we can free the original window pixmap.

I'll go back to writing up some more complicated thoughts now :-)

-- 
-keith
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: <https://lists.x.org/archives/xorg-devel/attachments/20180202/3281d489/attachment.sig>