[PATCH v3] dix: adds support for none root window background

[Rami Ylimäki]

  Reviewed-by: Rami Ylimäki <rami.ylimaki at vincit.fi>

If there is a need to modify ChangeWindowAttributes, that can be a 
separate commit just like the addition of white/black/retro for 
-background option.

On 11/03/2010 11:17 PM, Tiago Vignatti wrote:
> It lets the driver notify the server whether it can draw a background when
> '-background none' option is used by the system platform. Use cases for that
> could be video drivers performing mode-setting in kernel time, before X is up,
> so a seamless transition would happen until X clients start to show up.
>
> If the driver can copy the framebuffer cleanly then it can set the flag
> (canDoBGNoneRoot), otherwise the server will fallback to the normal behaviour.
> The system must explicit indicates willingness of doing so through
> '-background none'. We could do this option as default; in such case,
> malicious users would be able to steal the framebuffer with a bit of tricks.
>
> For instance, I can see the content of my nVidia Quadro FX 580 framebuffer
> old X session modifying a bit nv driver:
>
> --- a/src/g80_driver.c
> +++ b/src/g80_driver.c
> @@ -850,17 +850,6 @@ G80ScreenInit(int scrnIndex, ScreenPtr pScreen, int argc,
> c
>
>       xf86DPMSInit(pScreen, xf86DPMSSet, 0);
>
> -    /* Clear the screen */
> -    if(pNv->xaa) {
> -        /* Use the acceleration engine */
> -        pNv->xaa->SetupForSolidFill(pScrn, 0, GXcopy, ~0);
> -        pNv->xaa->SubsequentSolidFillRect(pScrn,
> -            0, 0, pScrn->displayWidth, pNv->offscreenHeight);
> -        G80DmaKickoff(pNv);
> -    } else {
> -        /* Use a slow software clear path */
> -        memset(pNv->mem, 0, pitch * pNv->offscreenHeight);
> -    }
> +    pScreen->canDoBGNoneRoot = TRUE;
>
> The commit is originally based on discussions happened on xorg-devel:
> http://lists.freedesktop.org/archives/xorg-devel/2010-June/009755.html
>
> Signed-off-by: Tiago Vignatti<tiago.vignatti at nokia.com>
> ---
> changes on v3:
> - '-nr' converted to '-background none' (Daniel's review). Others may want to
>    add similar usage for -wr and -br, but keeping these for backward
>    compatibility.
>
> changes on v2:
> - clarified the usage and example on commit's message. Clarification was done
>    particularly  in detriment of security issues (Pauli's review).
> - added canDoBGNoneRoot in the end of the struct to minimize effects from ABI
> change (Pauli's review)
> - canDoBGNoneRoot changed to Bool type instead int.
>
>
>   dix/window.c         |    6 ++++++
>   include/opaque.h     |    1 +
>   include/scrnintstr.h |    6 ++++++
>   os/utils.c           |    9 +++++++++
>   4 files changed, 22 insertions(+), 0 deletions(-)
>
> diff --git a/dix/window.c b/dix/window.c
> index 1913030..bfaa6f5 100644
> --- a/dix/window.c
> +++ b/dix/window.c
> @@ -137,6 +137,8 @@ Equipment Corporation.
>    *    ChangeWindowDeviceCursor
>    ******/
>
> +Bool bgNoneRoot = FALSE;
> +
>   static unsigned char _back_lsb[4] = {0x88, 0x22, 0x44, 0x11};
>   static unsigned char _back_msb[4] = {0x11, 0x44, 0x22, 0x88};
>
> @@ -463,6 +465,10 @@ InitRootWindow(WindowPtr pWin)
>       if (party_like_its_1989) {
>           MakeRootTile(pWin);
>           backFlag |= CWBackPixmap;
> +    } else if (pScreen->canDoBGNoneRoot&&  bgNoneRoot) {
> +        pWin->backgroundState = XaceBackgroundNoneState(pWin);
> +        pWin->background.pixel = pScreen->whitePixel;
> +        backFlag |= CWBackPixmap;
>       } else {
>   	if (whiteRoot)
>               pWin->background.pixel = pScreen->whitePixel;
> diff --git a/include/opaque.h b/include/opaque.h
> index dfe440c..b1696ca 100644
> --- a/include/opaque.h
> +++ b/include/opaque.h
> @@ -72,6 +72,7 @@ extern _X_EXPORT Bool defeatAccessControl;
>   extern _X_EXPORT long maxBigRequestSize;
>   extern _X_EXPORT Bool party_like_its_1989;
>   extern _X_EXPORT Bool whiteRoot;
> +extern _X_EXPORT Bool bgNoneRoot;
>
>   extern _X_EXPORT Bool CoreDump;
>
> diff --git a/include/scrnintstr.h b/include/scrnintstr.h
> index e36b15f..cd4fb70 100644
> --- a/include/scrnintstr.h
> +++ b/include/scrnintstr.h
> @@ -601,6 +601,12 @@ typedef struct _Screen {
>       /* Device cursor procedures */
>       DeviceCursorInitializeProcPtr DeviceCursorInitialize;
>       DeviceCursorCleanupProcPtr    DeviceCursorCleanup;
> +
> +    /* set it in driver side if X server can copy the framebuffer content.
> +     * Meant to be used together with '-background none' option, avoiding
> +     * malicious users to steal framebuffer's content if that would be the
> +     * default */
> +    Bool		canDoBGNoneRoot;
>   } ScreenRec;
>
>   static inline RegionPtr BitmapToRegion(ScreenPtr _pScreen, PixmapPtr pPix) {
> diff --git a/os/utils.c b/os/utils.c
> index 8921d7c..9ca9d39 100644
> --- a/os/utils.c
> +++ b/os/utils.c
> @@ -502,6 +502,7 @@ void UseMsg(void)
>   #endif
>       ErrorF("-nolisten string       don't listen on protocol\n");
>       ErrorF("-noreset               don't reset after last client exists\n");
> +    ErrorF("-background [none]     create root window with no background\n");
>       ErrorF("-reset                 reset after last client exists\n");
>       ErrorF("-p #                   screen-saver pattern duration (minutes)\n");
>       ErrorF("-pn                    accept failure to listen on all ports\n");
> @@ -842,6 +843,14 @@ ProcessCommandLine(int argc, char *argv[])
>   	    defaultBackingStore = WhenMapped;
>           else if ( strcmp( argv[i], "-wr") == 0)
>               whiteRoot = TRUE;
> +        else if ( strcmp( argv[i], "-background") == 0) {
> +            if(++i<  argc) {
> +                if (!strcmp ( argv[i], "none"))
> +                    bgNoneRoot = TRUE;
> +                else
> +                    UseMsg();
> +            }
> +        }
>           else if ( strcmp( argv[i], "-maxbigreqsize") == 0) {
>                if(++i<  argc) {
>                    long reqSizeArg = atol(argv[i]);