firmware: double-buffer the panel + zero-copy decode → ~22 fps ceiling

Per-frame paint cost drops from ~24 ms to ~45 µs (≈500× faster) by
enabling num_fbs=2 on the DPI panel and decoding straight into the
back framebuffer. Measured on the bench:

  before: lock=7us ttfb=370us body=40ms dec=6ms paint=24ms post=35us = ~70ms / ~14fps
  after : lock=7us ttfb=330us body=38ms dec=6ms paint=42us  post=25us = ~45ms / ~22fps

How the win actually lands:
- num_fbs=2 in the esp_lcd_dpi_panel_config_t makes the IDF driver
  allocate two framebuffers and stream from one while we fill the
  other.
- display_back_buffer() returns the inactive fb pointer + its size.
- jpeg_decoder_decode() now accepts a caller-provided destination
  buffer instead of owning its own scratch. http_api passes the panel
  back-fb so the hardware JPEG decoder writes BGR888 pixels straight
  into where the DSI will eventually scan from. Zero memcpy in the
  hot path.
- display_flip_back_buffer() calls esp_lcd_panel_draw_bitmap with the
  fb pointer. Because the buffer is inside the panel's own fb range,
  the IDF driver skips its memcpy and just does a cache writeback +
  swaps cur_fb_index. The actual flip happens on the next vsync,
  asynchronously — the call returns in microseconds.

The remaining ceiling is network body time (~38 ms for ~210 KB JPEGs)
and the hardware decoder (~6 ms). Per-viewport JPEG quality (smaller
files = shorter body) is the next lever; everything firmware-side is
already at or near floor.

Also drop the old static jpeg output scratch + JPEG_DECODER_MAX_OUTPUT_BYTES
constant — nothing references them anymore.

1 files changed, 16 insertions, 23 deletions

diff --git a/main/jpeg_decoder.c b/main/jpeg_decoder.c
index 2538f69..cbb98d8 100644
--- a/main/jpeg_decoder.c
+++ b/main/jpeg_decoder.c
@@ -14,8 +14,6 @@ static jpeg_decoder_handle_t s_engine;
 static SemaphoreHandle_t     s_mutex;
 static void   *s_in_buf;
 static size_t  s_in_cap;
-static void   *s_out_buf;
-static size_t  s_out_cap;
 
 esp_err_t jpeg_decoder_init(void)
 {
@@ -29,23 +27,18 @@ esp_err_t jpeg_decoder_init(void)
     ESP_RETURN_ON_ERROR(jpeg_new_decoder_engine(&cfg, &s_engine),
                        TAG, "jpeg_new_decoder_engine");
 
-    // DMA-aligned PSRAM scratch buffers. Allocate once, reuse.
+    // DMA-aligned PSRAM scratch buffer for the inbound JPEG body. The
+    // OUTPUT buffer is no longer owned here — callers pass in a target
+    // (the display back-buffer) so the decoder writes the BGR888 pixels
+    // straight into the panel framebuffer with no intermediate copy.
     jpeg_decode_memory_alloc_cfg_t in_cfg  = { .buffer_direction = JPEG_DEC_ALLOC_INPUT_BUFFER };
-    jpeg_decode_memory_alloc_cfg_t out_cfg = { .buffer_direction = JPEG_DEC_ALLOC_OUTPUT_BUFFER };
-
     s_in_buf = jpeg_alloc_decoder_mem(JPEG_DECODER_MAX_INPUT_BYTES,  &in_cfg,  &s_in_cap);
     if (!s_in_buf) {
         ESP_LOGE(TAG, "jpeg input buf alloc failed");
         return ESP_ERR_NO_MEM;
     }
-    s_out_buf = jpeg_alloc_decoder_mem(JPEG_DECODER_MAX_OUTPUT_BYTES, &out_cfg, &s_out_cap);
-    if (!s_out_buf) {
-        ESP_LOGE(TAG, "jpeg output buf alloc failed");
-        return ESP_ERR_NO_MEM;
-    }
 
-    ESP_LOGI(TAG, "decoder ready (in=%u bytes, out=%u bytes)",
-             (unsigned)s_in_cap, (unsigned)s_out_cap);
+    ESP_LOGI(TAG, "decoder ready (in=%u bytes)", (unsigned)s_in_cap);
     return ESP_OK;
 }
 
@@ -61,19 +54,20 @@ void jpeg_decoder_unlock(void)
 
 void *jpeg_decoder_input_buffer(void) { return s_in_buf; }
 
-esp_err_t jpeg_decoder_decode(size_t   jpeg_len,
-                              void   **out_bgr888,
+esp_err_t jpeg_decoder_decode(size_t    jpeg_len,
+                              void     *out_buf,
+                              size_t    out_cap,
                               uint16_t *out_width,
                               uint16_t *out_height)
 {
     if (jpeg_len == 0 || jpeg_len > s_in_cap) return ESP_ERR_INVALID_SIZE;
+    if (!out_buf || out_cap == 0)             return ESP_ERR_INVALID_ARG;
 
-    // Hardware decode directly into a panel-native BGR888 buffer.
-    // _BGR rgb_order swaps the channel layout so memory ends up as
-    // [B, G, R] per pixel — exactly what the ESP32-P4 DSI engine +
-    // TC358762 + Pi panel pipeline wants. Total firmware-side cost in
-    // the hot /frame path: this hardware decode + one DMA hand-off to
-    // the panel. No CPU pixel work.
+    // Hardware decode directly into the caller's BGR888 buffer (the
+    // panel back-framebuffer in the /frame path). _BGR rgb_order swaps
+    // the channel layout so memory ends up as [B, G, R] per pixel —
+    // exactly what the ESP32-P4 DSI engine + TC358762 + Pi panel
+    // pipeline wants. Zero firmware-side pixel work.
     jpeg_decode_cfg_t dec_cfg = {
         .output_format = JPEG_DECODE_OUT_FORMAT_RGB888,
         .rgb_order     = JPEG_DEC_RGB_ELEMENT_ORDER_BGR,
@@ -89,14 +83,13 @@ esp_err_t jpeg_decoder_decode(size_t   jpeg_len,
 
     uint32_t out_size = 0;
     err = jpeg_decoder_process(s_engine, &dec_cfg,
-                               s_in_buf,  jpeg_len,
-                               s_out_buf, s_out_cap, &out_size);
+                               s_in_buf, jpeg_len,
+                               out_buf,  out_cap, &out_size);
     if (err != ESP_OK) {
         ESP_LOGW(TAG, "jpeg_decoder_process: %s", esp_err_to_name(err));
         return err;
     }
 
-    *out_bgr888 = s_out_buf;
     *out_width  = info.width;
     *out_height = info.height;
     return ESP_OK;