display: runtime mode-setting, EDID, and fenced (vsync) present (v2 V5)

The native backend can now change resolution and presents tear-free.

Mode-setting without churn. The driver sizes its scanout resource + shared surface to the
largest mode it offers and treats a mode change as re-pointing the scanout rectangle within
that surface — so the resource, its backing, and the shared mapping never change, and the
surface's row stride (the max width) is fixed while the active width/height move. The
compositor is handed that stride in the announce and composes at it; a smaller mode just
paints the top-left rectangle. This sidesteps the surface re-share a true resolution change
would otherwise need (the service harness can't reply with a capability).

- scanout-protocol gains get_modes + set_mode; the driver offers {640x480, 800x600} and
  re-points set_scanout on set_mode.
- backend.VirtioGpu carries the surface stride, exposes modes()/setMode(), and reports
  canModeSet = hasVsync = true.
- runtime.display gains modes()/setMode() (display-protocol get_modes/set_mode, forwarded to
  the backend) — the client-facing API.
- EDID: the driver negotiates VIRTIO_GPU_F_EDID when the device offers it, reads the monitor's
  EDID, and logs its preferred mode (parsed from the first detailed timing descriptor).
- vsync: every resource_flush is fenced (VIRTIO_GPU_FLAG_FENCE); the device signals the fence
  when the frame is on screen, which the used-ring ack the synchronous present already waits
  on gates — so a completed present is a tear-free one.

After the native upgrade the compositor runs a one-shot mode-set self-check: query the modes,
switch to a different one, re-composite, and confirm the backend reports the new geometry —
the gate's markers.

Gate: python3 test/qemu_test.py display-modeset (reuses the display-native boot) — "display:
mode set to 800x600, verified" + "display: vsync present ok", passing 3/3. host tests,
display-service, display-demo, shm, virtio-gpu, and display-native still pass.

system/services/display/backend.zig

@@ -126,41 +126,72 @@ pub const Gop = struct {
     }
 };
 
+/// A display mode the native backend can switch to.
+pub const Mode = scanout_protocol.Mode;
+
 /// The native virtio-gpu backend: the compositor composes into a **shared** scanout surface
 /// (an `shm` region the driver created and handed over) and `present` asks the driver to put
 /// a frame on the panel over its `.scanout` endpoint. Unlike GOP there is no local copy — the
 /// surface *is* the device's resource backing, so compositing writes land straight where the
 /// driver transfers-and-flushes from (x86 DMA is cache-coherent, so the cacheable shared pages
-/// need no explicit flush). Built by the display service when a driver announces (V4); mode-set
-/// and vsync stay off until V5.
+/// need no explicit flush). Built by the display service when a driver announces (V4). The
+/// surface is sized to the driver's largest mode, so `stride` (its row width) is fixed while
+/// `width`/`height` — the active mode — change under `setMode` (V5).
 pub const VirtioGpu = struct {
     pixels: [*]u32, // the shared scanout surface, mapped into the compositor
-    width: u32,
+    stride: u32, // the surface's row stride in pixels (the driver's max mode width) — fixed
+    width: u32, // the active mode
     height: u32,
     format: u32,
-    scanout: ipc.Handle, // the driver's present channel (looked up on `.scanout`)
+    scanout: ipc.Handle, // the driver's present + mode channel (looked up on `.scanout`)
 
     pub fn info(self: *const VirtioGpu) Info {
-        return .{ .width = self.width, .height = self.height, .pitch = self.width * 4, .format = self.format };
+        return .{ .width = self.width, .height = self.height, .pitch = self.stride * 4, .format = self.format };
     }
     pub fn surface(self: *const VirtioGpu) Surface {
-        return .{ .pixels = self.pixels, .stride = self.width, .width = self.width, .height = self.height };
+        return .{ .pixels = self.pixels, .stride = self.stride, .width = self.width, .height = self.height };
     }
     /// Ask the driver to present. The composited pixels are already in the shared surface, so
-    /// this is a single request over `.scanout`; the driver transfers + flushes. V4 presents
-    /// the whole surface (the damage-rect fast path is a later refinement).
+    /// this is a single request over `.scanout`; the driver transfers + fenced-flushes.
     pub fn present(self: *const VirtioGpu, damage: Rect) void {
         _ = damage;
         var request = scanout_protocol.Request{
             .operation = @intFromEnum(scanout_protocol.Operation.present),
-            .x = 0,
-            .y = 0,
             .width = self.width,
             .height = self.height,
         };
         var reply: [scanout_protocol.reply_size]u8 = undefined;
         _ = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch {};
     }
+    /// Fill `out` with the driver's offered modes; returns how many were written.
+    pub fn modes(self: *const VirtioGpu, out: []Mode) usize {
+        var request = scanout_protocol.Request{ .operation = @intFromEnum(scanout_protocol.Operation.get_modes) };
+        var reply: [scanout_protocol.modes_reply_size]u8 = undefined;
+        const n = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch return 0;
+        if (n < scanout_protocol.modes_reply_size) return 0;
+        const answer = std.mem.bytesToValue(scanout_protocol.ModesReply, reply[0..scanout_protocol.modes_reply_size]);
+        if (answer.status != 0) return 0;
+        const count = @min(@min(answer.count, scanout_protocol.max_modes), out.len);
+        for (0..count) |i| out[i] = answer.modes[i];
+        return count;
+    }
+    /// Change the scanout resolution. On success the active `width`/`height` update (the shared
+    /// surface — sized to the max mode — is unchanged, so `stride` stays put).
+    pub fn setMode(self: *VirtioGpu, w: u32, h: u32) bool {
+        if (w == 0 or h == 0 or w > self.stride) return false;
+        var request = scanout_protocol.Request{
+            .operation = @intFromEnum(scanout_protocol.Operation.set_mode),
+            .width = w,
+            .height = h,
+        };
+        var reply: [scanout_protocol.reply_size]u8 = undefined;
+        const n = ipc.call(self.scanout, std.mem.asBytes(&request), &reply) catch return false;
+        if (n < scanout_protocol.reply_size) return false;
+        if (std.mem.bytesToValue(scanout_protocol.Reply, reply[0..scanout_protocol.reply_size]).status != 0) return false;
+        self.width = w;
+        self.height = h;
+        return true;
+    }
 };
 
 /// The pluggable scanout backend. A tagged union so the compositor holds one value and
@@ -184,18 +215,33 @@ pub const Backend = union(enum) {
             inline else => |*b| b.present(damage),
         }
     }
-    /// Whether this backend supports runtime mode-setting (GOP: no; virtio-gpu: not until V5).
+    /// The modes this backend can switch to (none for GOP); returns how many were written.
+    pub fn modes(self: *const Backend, out: []Mode) usize {
+        return switch (self.*) {
+            .virtio => |*v| v.modes(out),
+            .gop => 0,
+        };
+    }
+    /// Change the resolution; false if this backend can't mode-set or the mode was refused.
+    pub fn setMode(self: *Backend, w: u32, h: u32) bool {
+        return switch (self.*) {
+            .virtio => |*v| v.setMode(w, h),
+            .gop => false,
+        };
+    }
+    /// Whether this backend supports runtime mode-setting (GOP: no; virtio-gpu: yes, V5).
     pub fn canModeSet(self: *const Backend) bool {
         return switch (self.*) {
             .gop => false,
-            .virtio => false,
+            .virtio => true,
         };
     }
-    /// Whether this backend has a vblank/fence for tear-free present (not until V5).
+    /// Whether this backend has a vblank/fence for tear-free present (virtio-gpu: yes, V5 — every
+    /// flush is fenced, so the device signals completion when the frame is actually on screen).
     pub fn hasVsync(self: *const Backend) bool {
         return switch (self.*) {
             .gop => false,
-            .virtio => false,
+            .virtio => true,
         };
     }
 };

system/services/display/display.zig

@@ -39,6 +39,11 @@ var service_endpoint: ipc.Handle = 0;
 /// whole screen into the shared surface and reads a pixel back to confirm the frame landed.
 var pending_native_verify: bool = false;
 
+/// Set alongside it: after the native present is verified, run the mode-set self-check once
+/// (query the driver's modes, switch to a different one, confirm the geometry changed) — the
+/// serial proof the runtime-resolution-change + fenced-present paths work (V5).
+var pending_modeset_check: bool = false;
+
 /// The wallpaper the compositor clears damaged regions to before painting layers.
 var background: u32 = 0;
 
@@ -214,14 +219,15 @@ fn verifyNativePresent() void {
 /// present channel, switch the backend to virtio-gpu, and queue a full-screen repaint. The
 /// present is deferred to a timer (see `service_endpoint`) so it happens after this reply
 /// unblocks the driver and it starts serving `.scanout`.
-fn attachScanout(width: u32, height: u32, format: u32, capability: ?ipc.Handle, reply: []u8) usize {
+fn attachScanout(stride: u32, width: u32, height: u32, format: u32, capability: ?ipc.Handle, reply: []u8) usize {
     const cap = capability orelse return fail(reply);
-    if (width == 0 or height == 0) return fail(reply);
+    if (width == 0 or height == 0 or stride < width) return fail(reply);
     const mapped = runtime.shm.map(cap) orelse return fail(reply);
     const scanout = ipc.lookup(.scanout) orelse return fail(reply);
 
     backend = .{ .virtio = .{
         .pixels = @ptrCast(@alignCast(mapped)),
+        .stride = stride,
         .width = width,
         .height = height,
         .format = format,
@@ -230,11 +236,53 @@ fn attachScanout(width: u32, height: u32, format: u32, capability: ?ipc.Handle,
     background = protocol.pack(format, 0x20, 0x30, 0x48); // re-pack the wallpaper for the mode
     addDamage(screenRect()); // the whole new surface must be painted
     pending_native_verify = true;
+    pending_modeset_check = true;
     _ = system.timerOnce(service_endpoint, 50); // present once the driver is serving .scanout
     _ = system.write("display: scanout upgraded to virtio-gpu\n");
     return ok(reply);
 }
 
+/// After the native upgrade is verified, prove the runtime-resolution-change and fenced-present
+/// paths: query the driver's modes, switch to one that differs from the current, re-composite
+/// the whole screen at the new size, and confirm the backend now reports that geometry. The
+/// present goes through the driver's fenced flush, so a clean present is a vsync present.
+fn modesetSelfCheck() void {
+    if (!backend.canModeSet()) return;
+    var mode_list: [4]backend_mod.Mode = undefined;
+    const count = backend.modes(&mode_list);
+    if (count == 0) {
+        _ = system.write("display: mode-set self-check: no modes reported\n");
+        return;
+    }
+    const current = backend.info();
+    var target: ?backend_mod.Mode = null;
+    for (mode_list[0..count]) |m| {
+        if (m.width != current.width or m.height != current.height) {
+            target = m;
+            break;
+        }
+    }
+    const wanted = target orelse {
+        _ = system.write("display: mode-set self-check: no alternate mode offered\n");
+        return;
+    };
+    if (!backend.setMode(wanted.width, wanted.height)) {
+        _ = system.write("display: mode set FAILED\n");
+        return;
+    }
+    addDamage(screenRect()); // repaint the whole screen at the new resolution, then present it
+    present();
+
+    const now = backend.info();
+    if (now.width == wanted.width and now.height == wanted.height) {
+        var line: [80]u8 = undefined;
+        _ = system.write(std.fmt.bufPrint(&line, "display: mode set to {d}x{d}, verified\n", .{ now.width, now.height }) catch "display: mode set, verified\n");
+        if (backend.hasVsync()) _ = system.write("display: vsync present ok\n");
+    } else {
+        _ = system.write("display: mode set FAILED (geometry unchanged)\n");
+    }
+}
+
 // --- startup self-check -----------------------------------------------------
 
 /// Prove the compositor wiring on the real backend: two overlapping opaque layers,
@@ -351,17 +399,42 @@ fn onMessage(message: []const u8, reply: []u8, sender: u32, capability: ?ipc.Han
             return ok(reply);
         },
         @intFromEnum(protocol.Operation.attach_scanout) => {
-            return attachScanout(request.width, request.height, request.colour, capability, reply);
+            return attachScanout(request.x, request.width, request.height, request.colour, capability, reply);
+        },
+        @intFromEnum(protocol.Operation.set_mode) => {
+            if (!backend.setMode(request.width, request.height)) return fail(reply);
+            addDamage(screenRect()); // repaint the whole screen at the new resolution
+            present();
+            return ok(reply);
+        },
+        @intFromEnum(protocol.Operation.get_modes) => {
+            var list: [4]backend_mod.Mode = undefined;
+            const count = backend.modes(&list);
+            var response = protocol.ModesReply{ .status = 0, .count = @intCast(count), .modes = undefined };
+            for (0..protocol.max_modes) |i| {
+                response.modes[i] = if (i < count)
+                    .{ .width = list[i].width, .height = list[i].height }
+                else
+                    .{ .width = 0, .height = 0 };
+            }
+            const bytes = std.mem.asBytes(&response);
+            @memcpy(reply[0..bytes.len], bytes);
+            return bytes.len;
         },
         else => return fail(reply),
     }
 }
 
 /// The only notification the compositor arms is the post-attach present timer: repaint the
-/// screen into the freshly attached native surface and verify the frame landed.
+/// screen into the freshly attached native surface, verify the frame landed, then run the
+/// one-shot mode-set self-check (V5).
 fn onNotification(badge: u64) void {
     _ = badge;
-    present();
+    present(); // native present + verify (first timer fire after the upgrade)
+    if (pending_modeset_check) {
+        pending_modeset_check = false;
+        modesetSelfCheck();
+    }
 }
 
 pub fn main() void {

system/services/display/protocol.zig

@@ -24,11 +24,17 @@ pub const Operation = enum(u32) {
     damage = 6,
     /// present(): composite the dirty layers and flush to the screen.
     present = 7,
-    /// attach_scanout(width, height, colour=format) + <surface capability>: a native scanout
-    /// driver announces itself, handing over the shared scanout surface as an `ipc_call`
+    /// attach_scanout(x=stride, width, height, colour=format) + <surface capability>: a native
+    /// scanout driver announces itself, handing over the shared scanout surface as an `ipc_call`
     /// send_cap. The compositor maps it, looks up the driver's `.scanout` present channel, and
-    /// upgrades off the GOP floor (docs/display-v2.md V4). `colour` carries the DisplayFormat.
+    /// upgrades off the GOP floor (docs/display-v2.md V4). `x` is the surface's row stride in
+    /// pixels, `colour` the DisplayFormat.
     attach_scanout = 8,
+    /// set_mode(width, height): change the display resolution — only a native backend that
+    /// reports `canModeSet` honours it; on the GOP floor it fails (docs/display-v2.md V5).
+    set_mode = 9,
+    /// get_modes() -> ModesReply: the resolutions the display can switch to (empty on GOP).
+    get_modes = 10,
 };
 
 /// The fixed request header. A `blit_tile`'s pixel payload (width*height 32-bit pixels)
@@ -59,6 +65,18 @@ pub const Reply = extern struct {
     reserved2: u32 = 0,
 };
 
+/// One selectable display mode.
+pub const Mode = extern struct { width: u32, height: u32 };
+pub const max_modes = 4;
+
+/// The reply to `get_modes`: a small fixed list of resolutions the display can switch to.
+pub const ModesReply = extern struct {
+    status: i32,
+    count: u32,
+    modes: [max_modes]Mode,
+};
+pub const modes_reply_size: usize = @sizeOf(ModesReply);
+
 /// The IPC message size — the kernel caps every message at `MESSAGE_MAXIMUM` (256 bytes,
 /// system/kernel/ipc-synchronous.zig), so this matches it (a larger receive/reply buffer
 /// is rejected with -E2BIG). A `blit_tile` therefore carries only a *small* tile inline —

system/services/display/scanout-protocol.zig

@@ -10,8 +10,13 @@ const std = @import("std");
 
 pub const Operation = enum(u32) {
     /// present(x, y, width, height): put the given rectangle of the shared scanout surface on
-    /// the panel (on virtio-gpu: transfer-to-host of the region, then a resource flush).
+    /// the panel (on virtio-gpu: transfer-to-host of the region, then a fenced resource flush).
     present = 0,
+    /// get_modes() -> ModesReply: the display modes this scanout can switch to (V5).
+    get_modes = 1,
+    /// set_mode(width, height): change the scanout resolution — the shared surface is sized to
+    /// the largest mode, so this just re-points the scanout rectangle; the surface is unchanged.
+    set_mode = 2,
 };
 
 pub const Request = extern struct {
@@ -27,6 +32,18 @@ pub const Reply = extern struct {
     reserved: u32 = 0,
 };
 
+/// One offered display mode.
+pub const Mode = extern struct { width: u32, height: u32 };
+pub const max_modes = 4;
+
+/// The reply to `get_modes`: a small fixed list of modes.
+pub const ModesReply = extern struct {
+    status: i32,
+    count: u32,
+    modes: [max_modes]Mode,
+};
+
 pub const message_maximum: usize = 64;
 pub const request_size: usize = @sizeOf(Request);
 pub const reply_size: usize = @sizeOf(Reply);
+pub const modes_reply_size: usize = @sizeOf(ModesReply);