diff --git a/client/pool-buffer.c b/client/pool-buffer.c
index 1f54a77c..52438303 100644
--- a/client/pool-buffer.c
+++ b/client/pool-buffer.c
@@ -1,37 +1,56 @@
 #define _XOPEN_SOURCE 500
 #include <assert.h>
 #include <cairo/cairo.h>
+#include <fcntl.h>
+#include <pango/pangocairo.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
-#include <pango/pangocairo.h>
 #include <unistd.h>
 #include <wayland-client.h>
 #include "config.h"
 #include "pool-buffer.h"
 
+static bool set_cloexec(int fd) {
+	long flags = fcntl(fd, F_GETFD);
+	if (flags == -1) {
+		return false;
+	}
+
+	if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) {
+		return false;
+	}
+
+	return true;
+}
+
 static int create_pool_file(size_t size, char **name) {
 	static const char template[] = "sway-client-XXXXXX";
 	const char *path = getenv("XDG_RUNTIME_DIR");
-	if (!path) {
+	if (path == NULL) {
+		fprintf(stderr, "XDG_RUNTIME_DIR is not set\n");
 		return -1;
 	}
 
-	int ts = (path[strlen(path) - 1] == '/');
-
-	*name = malloc(
-		strlen(template) +
-		strlen(path) +
-		(ts ? 0 : 1) + 1);
-	sprintf(*name, "%s%s%s", path, ts ? "" : "/", template);
+	size_t name_size = strlen(template) + 1 + strlen(path) + 1;
+	*name = malloc(name_size);
+	if (*name == NULL) {
+		fprintf(stderr, "allocation failed\n");
+		return -1;
+	}
+	snprintf(*name, name_size, "%s/%s", path, template);
 
 	int fd = mkstemp(*name);
-
 	if (fd < 0) {
 		return -1;
 	}
 
+	if (!set_cloexec(fd)) {
+		close(fd);
+		return -1;
+	}
+
 	if (ftruncate(fd, size) < 0) {
 		close(fd);
 		return -1;
@@ -53,7 +72,7 @@ static struct pool_buffer *create_buffer(struct wl_shm *shm,
 		struct pool_buffer *buf, int32_t width, int32_t height,
 		uint32_t format) {
 	uint32_t stride = width * 4;
-	uint32_t size = stride * height;
+	size_t size = stride * height;
 
 	char *name;
 	int fd = create_pool_file(size, &name);
@@ -68,8 +87,10 @@ static struct pool_buffer *create_buffer(struct wl_shm *shm,
 	free(name);
 	fd = -1;
 
+	buf->size = size;
 	buf->width = width;
 	buf->height = height;
+	buf->data = data;
 	buf->surface = cairo_image_surface_create_for_data(data,
 			CAIRO_FORMAT_ARGB32, width, height, stride);
 	buf->cairo = cairo_create(buf->surface);
@@ -92,6 +113,9 @@ void destroy_buffer(struct pool_buffer *buffer) {
 	if (buffer->pango) {
 		g_object_unref(buffer->pango);
 	}
+	if (buffer->data) {
+		munmap(buffer->data, buffer->size);
+	}
 	memset(buffer, 0, sizeof(struct pool_buffer));
 }
 
diff --git a/include/pool-buffer.h b/include/pool-buffer.h
index 856f7c8c..54f5be06 100644
--- a/include/pool-buffer.h
+++ b/include/pool-buffer.h
@@ -12,6 +12,8 @@ struct pool_buffer {
 	cairo_t *cairo;
 	PangoContext *pango;
 	uint32_t width, height;
+	void *data;
+	size_t size;
 	bool busy;
 };
 
diff --git a/include/sway/criteria.h b/include/sway/criteria.h
index 74da132c..bd3ca0ac 100644
--- a/include/sway/criteria.h
+++ b/include/sway/criteria.h
@@ -18,6 +18,7 @@ struct criteria {
 	char *target; // workspace or output name for `assign` criteria
 
 	pcre *title;
+	pcre *shell;
 	pcre *app_id;
 	pcre *class;
 	pcre *instance;
diff --git a/include/sway/tree/view.h b/include/sway/tree/view.h
index 0fb8f1b3..a8bf4955 100644
--- a/include/sway/tree/view.h
+++ b/include/sway/tree/view.h
@@ -201,7 +201,7 @@ const char *view_get_window_role(struct sway_view *view);
 
 uint32_t view_get_window_type(struct sway_view *view);
 
-const char *view_get_type(struct sway_view *view);
+const char *view_get_shell(struct sway_view *view);
 
 void view_configure(struct sway_view *view, double ox, double oy, int width,
 	int height);
diff --git a/include/swaylock/swaylock.h b/include/swaylock/swaylock.h
index dae823b8..2931fd61 100644
--- a/include/swaylock/swaylock.h
+++ b/include/swaylock/swaylock.h
@@ -56,6 +56,7 @@ struct swaylock_surface {
 	struct zwlr_layer_surface_v1 *layer_surface;
 	struct pool_buffer buffers[2];
 	struct pool_buffer *current_buffer;
+	bool frame_pending, dirty;
 	uint32_t width, height;
 	int32_t scale;
 	char *output_name;
@@ -74,5 +75,7 @@ void swaylock_handle_key(struct swaylock_state *state,
 		xkb_keysym_t keysym, uint32_t codepoint);
 void render_frame(struct swaylock_surface *surface);
 void render_frames(struct swaylock_state *state);
+void damage_surface(struct swaylock_surface *surface);
+void damage_state(struct swaylock_state *state);
 
 #endif
diff --git a/sway/criteria.c b/sway/criteria.c
index 4295cacc..dec5fed7 100644
--- a/sway/criteria.c
+++ b/sway/criteria.c
@@ -13,6 +13,7 @@
 
 bool criteria_is_empty(struct criteria *criteria) {
 	return !criteria->title
+		&& !criteria->shell
 		&& !criteria->app_id
 		&& !criteria->class
 		&& !criteria->instance
@@ -29,6 +30,7 @@ bool criteria_is_empty(struct criteria *criteria) {
 
 void criteria_destroy(struct criteria *criteria) {
 	pcre_free(criteria->title);
+	pcre_free(criteria->shell);
 	pcre_free(criteria->app_id);
 	pcre_free(criteria->class);
 	pcre_free(criteria->instance);
@@ -53,6 +55,13 @@ static bool criteria_matches_view(struct criteria *criteria,
 		}
 	}
 
+	if (criteria->shell) {
+		const char *shell = view_get_shell(view);
+		if (!shell || regex_cmp(shell, criteria->shell) != 0) {
+			return false;
+		}
+	}
+
 	if (criteria->app_id) {
 		const char *app_id = view_get_app_id(view);
 		if (!app_id || regex_cmp(app_id, criteria->app_id) != 0) {
@@ -206,6 +215,7 @@ enum criteria_token {
 	T_FLOATING,
 	T_ID,
 	T_INSTANCE,
+	T_SHELL,
 	T_TILING,
 	T_TITLE,
 	T_URGENT,
@@ -229,6 +239,8 @@ static enum criteria_token token_from_name(char *name) {
 		return T_ID;
 	} else if (strcmp(name, "instance") == 0) {
 		return T_INSTANCE;
+	} else if (strcmp(name, "shell") == 0) {
+		return T_SHELL;
 	} else if (strcmp(name, "title") == 0) {
 		return T_TITLE;
 	} else if (strcmp(name, "urgent") == 0) {
@@ -271,6 +283,9 @@ static char *get_focused_prop(enum criteria_token token) {
 	case T_INSTANCE:
 		value = view_get_instance(view);
 		break;
+	case T_SHELL:
+		value = view_get_shell(view);
+		break;
 	case T_TITLE:
 		value = view_get_class(view);
 		break;
@@ -332,6 +347,9 @@ static bool parse_token(struct criteria *criteria, char *name, char *value) {
 	case T_TITLE:
 		generate_regex(&criteria->title, effective_value);
 		break;
+	case T_SHELL:
+		generate_regex(&criteria->shell, effective_value);
+		break;
 	case T_APP_ID:
 		generate_regex(&criteria->app_id, effective_value);
 		break;
diff --git a/sway/desktop/xdg_shell.c b/sway/desktop/xdg_shell.c
index 9a0d282b..b2b95fa0 100644
--- a/sway/desktop/xdg_shell.c
+++ b/sway/desktop/xdg_shell.c
@@ -3,13 +3,14 @@
 #include <stdlib.h>
 #include <wayland-server.h>
 #include <wlr/types/wlr_xdg_shell.h>
+#include <wlr/util/edges.h>
+#include "log.h"
+#include "sway/input/input-manager.h"
+#include "sway/input/seat.h"
+#include "sway/server.h"
 #include "sway/tree/container.h"
 #include "sway/tree/layout.h"
-#include "sway/server.h"
 #include "sway/tree/view.h"
-#include "sway/input/seat.h"
-#include "sway/input/input-manager.h"
-#include "log.h"
 
 static const struct sway_view_child_impl popup_impl;
 
@@ -248,7 +249,8 @@ void handle_xdg_shell_surface(struct wl_listener *listener, void *data) {
 	wlr_log(L_DEBUG, "New xdg_shell toplevel title='%s' app_id='%s'",
 		xdg_surface->toplevel->title, xdg_surface->toplevel->app_id);
 	wlr_xdg_surface_ping(xdg_surface);
-	wlr_xdg_toplevel_set_maximized(xdg_surface, true);
+	wlr_xdg_toplevel_set_tiled(xdg_surface, WLR_EDGE_LEFT | WLR_EDGE_RIGHT |
+		WLR_EDGE_TOP | WLR_EDGE_BOTTOM);
 
 	struct sway_xdg_shell_view *xdg_shell_view =
 		calloc(1, sizeof(struct sway_xdg_shell_view));
diff --git a/sway/sway.5.scd b/sway/sway.5.scd
index 25a5eef5..e6bc5a1e 100644
--- a/sway/sway.5.scd
+++ b/sway/sway.5.scd
@@ -560,6 +560,11 @@ The following attributes may be matched with:
 	value is \_\_focused\_\_, then the window instance must be the same as that
 	of the currently focused window.
 
+*shell*
+	Compare value against the window shell, such as "xdg\_shell" or "xwayland".
+	Can be a regular expression. If value is \_\_focused\_\_, then the shell
+	must be the same as that of the currently focused window.
+
 *tiling*
 	Matches tiling windows.
 
diff --git a/sway/tree/view.c b/sway/tree/view.c
index 812d7740..d91182ed 100644
--- a/sway/tree/view.c
+++ b/sway/tree/view.c
@@ -107,7 +107,7 @@ uint32_t view_get_window_type(struct sway_view *view) {
 	return 0;
 }
 
-const char *view_get_type(struct sway_view *view) {
+const char *view_get_shell(struct sway_view *view) {
 	switch(view->type) {
 	case SWAY_VIEW_XDG_SHELL_V6:
 		return "xdg_shell_v6";
@@ -654,10 +654,12 @@ static size_t parse_title_format(struct sway_view *view, char *buffer) {
 		return title ? strlen(title) : 0;
 	}
 	const char *title = view_get_title(view);
+	const char *app_id = view_get_app_id(view);
 	const char *class = view_get_class(view);
 	const char *instance = view_get_instance(view);
-	const char *shell = view_get_type(view);
+	const char *shell = view_get_shell(view);
 	size_t title_len = title ? strlen(title) : 0;
+	size_t app_id_len = app_id ? strlen(app_id) : 0;
 	size_t class_len = class ? strlen(class) : 0;
 	size_t instance_len = instance ? strlen(instance) : 0;
 	size_t shell_len = shell ? strlen(shell) : 0;
@@ -675,6 +677,10 @@ static size_t parse_title_format(struct sway_view *view, char *buffer) {
 			lenient_strcat(buffer, title);
 			len += title_len;
 			format += 6;
+		} else if (strncmp(next, "%app_id", 7) == 0) {
+			lenient_strcat(buffer, app_id);
+			len += app_id_len;
+			format += 7;
 		} else if (strncmp(next, "%class", 6) == 0) {
 			lenient_strcat(buffer, class);
 			len += class_len;
diff --git a/swaylock/main.c b/swaylock/main.c
index f89f2849..591df7b4 100644
--- a/swaylock/main.c
+++ b/swaylock/main.c
@@ -131,14 +131,58 @@ static const struct zwlr_layer_surface_v1_listener layer_surface_listener = {
 	.closed = layer_surface_closed,
 };
 
-static void handle_wl_output_geometry(void *data, struct wl_output *output, int32_t x,
-		int32_t y, int32_t width_mm, int32_t height_mm, int32_t subpixel,
-		const char *make, const char *model, int32_t transform) {
+static const struct wl_callback_listener surface_frame_listener;
+
+static void surface_frame_handle_done(void *data, struct wl_callback *callback,
+		uint32_t time) {
+	struct swaylock_surface *surface = data;
+
+	wl_callback_destroy(callback);
+	surface->frame_pending = false;
+
+	if (surface->dirty) {
+		// Schedule a frame in case the surface is damaged again
+		struct wl_callback *callback = wl_surface_frame(surface->surface);
+		wl_callback_add_listener(callback, &surface_frame_listener, surface);
+		surface->frame_pending = true;
+
+		render_frame(surface);
+		surface->dirty = false;
+	}
+}
+
+static const struct wl_callback_listener surface_frame_listener = {
+	.done = surface_frame_handle_done,
+};
+
+void damage_surface(struct swaylock_surface *surface) {
+	surface->dirty = true;
+	if (surface->frame_pending) {
+		return;
+	}
+
+	struct wl_callback *callback = wl_surface_frame(surface->surface);
+	wl_callback_add_listener(callback, &surface_frame_listener, surface);
+	surface->frame_pending = true;
+	wl_surface_commit(surface->surface);
+}
+
+void damage_state(struct swaylock_state *state) {
+	struct swaylock_surface *surface;
+	wl_list_for_each(surface, &state->surfaces, link) {
+		damage_surface(surface);
+	}
+}
+
+static void handle_wl_output_geometry(void *data, struct wl_output *output,
+		int32_t x, int32_t y, int32_t width_mm, int32_t height_mm,
+		int32_t subpixel, const char *make, const char *model,
+		int32_t transform) {
 	// Who cares
 }
 
-static void handle_wl_output_mode(void *data, struct wl_output *output, uint32_t flags,
-		int32_t width, int32_t height, int32_t refresh) {
+static void handle_wl_output_mode(void *data, struct wl_output *output,
+		uint32_t flags, int32_t width, int32_t height, int32_t refresh) {
 	// Who cares
 }
 
@@ -151,7 +195,7 @@ static void handle_wl_output_scale(void *data, struct wl_output *output,
 	struct swaylock_surface *surface = data;
 	surface->scale = factor;
 	if (surface->state->run_display) {
-		render_frames(surface->state);
+		damage_surface(surface);
 	}
 }
 
diff --git a/swaylock/password.c b/swaylock/password.c
index 1ad5cd81..6d493309 100644
--- a/swaylock/password.c
+++ b/swaylock/password.c
@@ -93,58 +93,58 @@ static void append_ch(struct swaylock_password *pw, uint32_t codepoint) {
 void swaylock_handle_key(struct swaylock_state *state,
 		xkb_keysym_t keysym, uint32_t codepoint) {
 	switch (keysym) {
-		case XKB_KEY_KP_Enter: /* fallthrough */
-		case XKB_KEY_Return:
-			state->auth_state = AUTH_STATE_VALIDATING;
-			render_frames(state);
-			wl_display_roundtrip(state->display);
-			if (attempt_password(&state->password)) {
-				state->run_display = false;
-				break;
-			}
-			state->auth_state = AUTH_STATE_INVALID;
-			render_frames(state);
+	case XKB_KEY_KP_Enter: /* fallthrough */
+	case XKB_KEY_Return:
+		state->auth_state = AUTH_STATE_VALIDATING;
+		damage_state(state);
+		wl_display_roundtrip(state->display);
+		if (attempt_password(&state->password)) {
+			state->run_display = false;
 			break;
-		case XKB_KEY_Delete:
-		case XKB_KEY_BackSpace:
-			if (backspace(&state->password)) {
-				state->auth_state = AUTH_STATE_BACKSPACE;
-			} else {
-				state->auth_state = AUTH_STATE_CLEAR;
-			}
-			render_frames(state);
-			break;
-		case XKB_KEY_Escape: 
-			clear_password_buffer(&state->password);
+		}
+		state->auth_state = AUTH_STATE_INVALID;
+		damage_state(state);
+		break;
+	case XKB_KEY_Delete:
+	case XKB_KEY_BackSpace:
+		if (backspace(&state->password)) {
+			state->auth_state = AUTH_STATE_BACKSPACE;
+		} else {
 			state->auth_state = AUTH_STATE_CLEAR;
-			render_frames(state);
-			break;
-		case XKB_KEY_Caps_Lock:
-			/* The state is getting active after this
-			 * so we need to manually toggle it */
-			state->xkb.caps_lock = !state->xkb.caps_lock;
-			state->auth_state = AUTH_STATE_INPUT_NOP;
-			render_frames(state);
-			break;
-		case XKB_KEY_Shift_L:
-		case XKB_KEY_Shift_R:
-		case XKB_KEY_Control_L:
-		case XKB_KEY_Control_R:
-		case XKB_KEY_Meta_L:
-		case XKB_KEY_Meta_R:
-		case XKB_KEY_Alt_L:
-		case XKB_KEY_Alt_R:
-		case XKB_KEY_Super_L:
-		case XKB_KEY_Super_R:
-			state->auth_state = AUTH_STATE_INPUT_NOP;
-			render_frames(state);
-			break;
-		default:
-			if (codepoint) {
-				append_ch(&state->password, codepoint);
-				state->auth_state = AUTH_STATE_INPUT;
-				render_frames(state);
-			}
-			break;
+		}
+		damage_state(state);
+		break;
+	case XKB_KEY_Escape:
+		clear_password_buffer(&state->password);
+		state->auth_state = AUTH_STATE_CLEAR;
+		damage_state(state);
+		break;
+	case XKB_KEY_Caps_Lock:
+		/* The state is getting active after this
+		 * so we need to manually toggle it */
+		state->xkb.caps_lock = !state->xkb.caps_lock;
+		state->auth_state = AUTH_STATE_INPUT_NOP;
+		damage_state(state);
+		break;
+	case XKB_KEY_Shift_L:
+	case XKB_KEY_Shift_R:
+	case XKB_KEY_Control_L:
+	case XKB_KEY_Control_R:
+	case XKB_KEY_Meta_L:
+	case XKB_KEY_Meta_R:
+	case XKB_KEY_Alt_L:
+	case XKB_KEY_Alt_R:
+	case XKB_KEY_Super_L:
+	case XKB_KEY_Super_R:
+		state->auth_state = AUTH_STATE_INPUT_NOP;
+		damage_state(state);
+		break;
+	default:
+		if (codepoint) {
+			append_ch(&state->password, codepoint);
+			state->auth_state = AUTH_STATE_INPUT;
+			damage_state(state);
+		}
+		break;
 	}
 }
diff --git a/swaylock/render.c b/swaylock/render.c
index 05236dea..2032ddcf 100644
--- a/swaylock/render.c
+++ b/swaylock/render.c
@@ -23,6 +23,10 @@ void render_frame(struct swaylock_surface *surface) {
 
 	surface->current_buffer = get_next_buffer(state->shm,
 			surface->buffers, buffer_width, buffer_height);
+	if (surface->current_buffer == NULL) {
+		return;
+	}
+
 	cairo_t *cairo = surface->current_buffer->cairo;
 	cairo_identity_matrix(cairo);