drm/amd/display: Clamp dc_cursor_position x_hotspot to prevent integer overflow

why:
Workaround for duplicate cursor. Cursor offsetting via x_hotspot attempts
to write a 32 bit unsigned integer to the 8 bit field CURSOR_HOT_SPOT_X.
This wraps cursor position back into focus if x_hotspot exceeds 8 bits,
making duplicate cursors visible

how:
Clamp x_hotspot before writing to hardware

Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Reviewed-by: Nevenko Stupar <nevenko.stupar@amd.com>
Signed-off-by: Benjamin Nwankwo <Benjamin.Nwankwo@amd.com>
Signed-off-by: Chuanyu Tseng <chuanyu.tseng@amd.com>
Tested-by: Dan Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

diff --git a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
index 4985e885952d9593aa1258315fba3f5031a17e5f..263e0c4d34f668653dad6204372d936872f51f9d 100644 (file)
--- a/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/hubp/dcn401/dcn401_hubp.c
@@ -812,9 +812,8 @@ void hubp401_cursor_set_position(
        int x_pos_viewport = 0;
        int x_hot_viewport = 0;
        uint32_t cur_en = pos->enable ? 1 : 0;
-
+       uint32_t x_hotspot_clamped = pos->x_hotspot;
        hubp->curs_pos = *pos;
-
        /* Recout is zero for pipes if the entire dst_rect is contained
         * within preceeding ODM slices.
         */
@@ -845,6 +844,8 @@ void hubp401_cursor_set_position(
 
        ASSERT(param->h_scale_ratio.value);
 
+       if (x_hotspot_clamped > 0xFF)
+               x_hotspot_clamped = 0xFF;
        if (param->h_scale_ratio.value)
                dst_x_offset = dc_fixpt_floor(dc_fixpt_div(
                        dc_fixpt_from_int(dst_x_offset),
@@ -865,7 +866,7 @@ void hubp401_cursor_set_position(
                        CURSOR_Y_POSITION, pos->y);
 
                REG_SET_2(CURSOR_HOT_SPOT, 0,
-                       CURSOR_HOT_SPOT_X, pos->x_hotspot,
+                       CURSOR_HOT_SPOT_X, x_hotspot_clamped,
                        CURSOR_HOT_SPOT_Y, pos->y_hotspot);
 
                REG_SET(CURSOR_DST_OFFSET, 0,