[PATCH] drm/ssd130x: Set the address window in ssd132x_clear_screen()

[PATCH] drm/ssd130x: Set the address window in ssd132x_clear_screen()

[Fabio Piparo]

ssd132x_clear_screen() sends its zeroes without setting the column and
row ranges first, so they land in whatever window the last
ssd132x_update_rect() left programmed. A partial final update then
leaves the rest of the screen uncleared, with fbcon the last damage is
typically the cursor cell, so blanking keeps the console content on
the panel.

Set the full-screen window first, as ssd130x_clear_screen() already
does.

Fixes: fdd591e00a9c ("drm/ssd130x: Add support for the SSD132x OLED controller family")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Fabio Piparo <holofermes@gmail.com>
---
Exercised on an SPI SSD1322 under local enablement patches for that
chip; compile-tested only on the SSD1325/1327. ssd133x_clear_screen()
has the same problem, left alone here for lack of hardware.

 drivers/gpu/drm/solomon/ssd130x.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/gpu/drm/solomon/ssd130x.c b/drivers/gpu/drm/solomon/ssd130x.c
index 0b0fc6fe3df..256d370e240 100644
--- a/drivers/gpu/drm/solomon/ssd130x.c
+++ b/drivers/gpu/drm/solomon/ssd130x.c
@@ -900,9 +900,20 @@ static void ssd132x_clear_screen(struct ssd130x_device *ssd130x, u8 *data_array)
 {
 	unsigned int columns = DIV_ROUND_UP(ssd130x->width, SSD132X_SEGMENT_WIDTH);
 	unsigned int height = ssd130x->height;
+	int ret;
 
 	memset(data_array, 0, columns * height);
 
+	/* Set column start and end */
+	ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_COL_RANGE, 0, columns - 1);
+	if (ret < 0)
+		return;
+
+	/* Set row start and end */
+	ret = ssd130x_write_cmd(ssd130x, 3, SSD132X_SET_ROW_RANGE, 0, height - 1);
+	if (ret < 0)
+		return;
+
 	/* Write out update in one go since horizontal addressing mode is used */
 	ssd130x_write_data(ssd130x, data_array, columns * height);
 }
-- 
2.43.0

Re: [PATCH] drm/ssd130x: Set the address window in ssd132x_clear_screen()

[Fabio Piparo]

I can confirm that one of Sashiko's findings is correct, and it's not
limited to my use case: with the early return on !plane_state->crtc,
the clear in this path never runs at all.

I also have to retract the testing note. I did more testing, and the
blackout I had attributed to clear_screen during bring-up was
something else entirely, not the clear writing RAM. So "Exercised on
an SPI SSD1322" is wrong. The asymmetry itself is still valid I think
(the sibling ssd130x_clear_screen() sets the window, this one
doesn't), and the patch stands on inspection and compile testing
only. Happy to reword the commit message in a v2 if the cleanup is
still wanted, or drop it.

The other finding, the out-of-bounds read in ssd132x_update_rect(),
looks real too, but it's pre-existing and separate from this patch.

Thanks,
Fabio