mipi_dbi_fb_dirty() takes the damage rectangle from drm_atomic_helper_damage_merged(), which is expressed in framebuffer coordinates and already clipped to the plane's source rectangle. It then passed that rectangle straight to mipi_dbi_set_window_address(), which is correct only while the source rectangle starts at (0,0) - i.e. while the framebuffer is exactly panel-sized.
If a driver allows a framebuffer larger than the panel and the plane selects a sub-region with a non-zero src_x/src_y, the controller was still addressed in framebuffer coordinates, so the wrong part of the panel was written and an out-of-range window could be programmed. Pass the integer plane source origin down to mipi_dbi_fb_dirty() and subtract it when programming the column/page address. The copy into the transfer buffer still uses the framebuffer-coordinate rectangle, so it keeps reading the correct pixels from an oversized source. With a panel-sized framebuffer src_x/src_y are zero and behaviour is unchanged. The rectangle from drm_atomic_helper_damage_merged() is clipped against the src rectangle's exact 16.16 fixed-point bounds, while src_x/src_y above are that same origin truncated to whole pixels. When the origin has a fractional part, the truncation can leave the rectangle's far edge up to a pixel past where a whole-pixel origin would place the panel's own width/height - and tx_buf is sized for exactly the panel, with no slack for that overshoot. Clamp the rectangle to the panel's fixed mode before using it for the window address or the transfer length. Cc: Dave Stevenson <[email protected]> Signed-off-by: Jonathan Frazin <[email protected]> --- Changes since v1: - Clamp the damage rectangle to the panel's fixed mode before using it. src_x/src_y are the plane source origin truncated to whole pixels, but the rectangle from drm_atomic_helper_damage_merged() is clipped against that origin's exact 16.16 fixed-point value - when the origin has a fractional part, the rectangle's far edge could land up to a pixel past where the truncated origin would place the panel's own width/height, overflowing the panel-sized tx_buf. Thanks to the automated review for catching this. drivers/gpu/drm/drm_mipi_dbi.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/drm_mipi_dbi.c b/drivers/gpu/drm/drm_mipi_dbi.c index 25cf04d02..1263dce91 100644 --- a/drivers/gpu/drm/drm_mipi_dbi.c +++ b/drivers/gpu/drm/drm_mipi_dbi.c @@ -271,19 +271,35 @@ static void mipi_dbi_set_window_address(struct mipi_dbi_dev *dbidev, } static void mipi_dbi_fb_dirty(struct iosys_map *src, struct drm_framebuffer *fb, - struct drm_rect *rect, struct drm_format_conv_state *fmtcnv_state) + struct drm_rect *rect, unsigned int src_x, unsigned int src_y, + struct drm_format_conv_state *fmtcnv_state) { struct mipi_dbi_dev *dbidev = drm_to_mipi_dbi_dev(fb->dev); - unsigned int height = rect->y2 - rect->y1; - unsigned int width = rect->x2 - rect->x1; const struct drm_format_info *dst_format; struct mipi_dbi *dbi = &dbidev->dbi; bool swap = dbi->swap_bytes; + unsigned int height, width; int ret = 0; size_t len; bool full; void *tr; + /* + * @rect is in framebuffer coordinates, clipped to the plane's src + * rectangle by the damage iterator against that rectangle's exact + * 16.16 fixed-point bounds. @src_x/@src_y are that same origin + * truncated to whole pixels. When the origin has a fractional part, + * that truncation can leave @rect's far edge up to a pixel past + * where a whole-pixel @src_x/@src_y would place the panel's own + * width/height -- and tx_buf is sized for exactly the panel, with no + * slack for that overshoot. Clamp before using @rect for anything. + */ + rect->x2 = min_t(int, rect->x2, src_x + dbidev->mode.hdisplay); + rect->y2 = min_t(int, rect->y2, src_y + dbidev->mode.vdisplay); + + height = rect->y2 - rect->y1; + width = rect->x2 - rect->x1; + full = width == fb->width && height == fb->height; DRM_DEBUG_KMS("Flushing [FB:%d] " DRM_RECT_FMT "\n", fb->base.id, DRM_RECT_ARG(rect)); @@ -298,8 +314,13 @@ static void mipi_dbi_fb_dirty(struct iosys_map *src, struct drm_framebuffer *fb, tr = src->vaddr; /* TODO: Use mapping abstraction properly */ } - mipi_dbi_set_window_address(dbidev, rect->x1, rect->x2 - 1, rect->y1, - rect->y2 - 1); + /* + * @rect is in framebuffer coordinates and has been clipped to the plane + * src rectangle by the damage iterator. The panel is addressed relative + * to the src origin, so subtract it here. + */ + mipi_dbi_set_window_address(dbidev, rect->x1 - src_x, rect->x2 - 1 - src_x, + rect->y1 - src_y, rect->y2 - 1 - src_y); if (fb->format->format == DRM_FORMAT_XRGB8888) dst_format = drm_format_info(dbidev->pixel_format); @@ -390,6 +411,8 @@ void drm_mipi_dbi_plane_helper_atomic_update(struct drm_plane *plane, if (drm_dev_enter(plane->dev, &idx)) { if (drm_atomic_helper_damage_merged(old_plane_state, plane_state, &rect)) mipi_dbi_fb_dirty(&shadow_plane_state->data[0], fb, &rect, + plane_state->src_x >> 16, + plane_state->src_y >> 16, &shadow_plane_state->fmtcnv_state); drm_dev_exit(idx); } -- 2.53.0
