Re: [PATCH 4/4] drm/i915/panel: Attempt VRR based refresh rate change for !allow_modeset

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] `_intel_panel_fixed_mode` can select a fixed mode with a lower native refresh rate than requested, causing `vtotal` to be incorrectly shrunk below `vdisplay` and programmed into hardware.
- [High] VRR-based seamless refresh rate fastsets fail because `is_vrr_compatible` incorrectly rejects stretched modes due to a mismatched `vtotal - vsync_start` offset.
--

commit 41ed53116263d4e38c4aa61dc4fe28e6a92d7c3c
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>

drm/i915/panel: Attempt VRR based refresh rate change for !allow_modeset

Adjusts the panel fixed mode selection to consider VRR-compatible modes 
when userspace denies full modesets. This allows refresh rate changes via 
the fastset path by adjusting the vblank length.

> diff --git a/drivers/gpu/drm/i915/display/intel_panel.c b/drivers/gpu/drm/i915/display/intel_panel.c
> index 6c539987f0a3f..a8af6a4d35bc5 100644
> --- a/drivers/gpu/drm/i915/display/intel_panel.c
> +++ b/drivers/gpu/drm/i915/display/intel_panel.c
> @@ -82,16 +82,37 @@ static bool is_best_fixed_mode(struct intel_connector *connector,
>  		abs(drm_mode_vrefresh(best_mode) - vrefresh);
>  }
>  
> +static bool is_vrr_compatible(const struct drm_display_mode *mode1,
> +			      const struct drm_display_mode *mode2)
> +{
> +	return drm_mode_match(mode1, mode2,
> +			      DRM_MODE_MATCH_CLOCK |
> +			      DRM_MODE_MATCH_TIMINGS_VRR |

[Severity: High]
Will this check reject valid stretched modes and prevent the fastset?

drm_mode_match() with DRM_MODE_MATCH_TIMINGS_VRR requires the offset
between vtotal and vsync_start to be identical between both modes.

However, the VRR logic in intel_panel_compute_config() stretches vtotal
without altering vsync_start or vsync_end. This means a stretched
vrr_ref_mode will have a larger vtotal - vsync_start offset than its base
fixed mode, causing is_vrr_compatible() to return false.

If is_vrr_compatible() returns false, _intel_panel_fixed_mode() fails to
find a matching mode and falls back to intel_panel_fixed_mode(). Since
allow_modeset is false, this fallback causes the core DRM modeset checks
to reject the commit, breaking the intended seamless switch.

> +			      DRM_MODE_MATCH_FLAGS |
> +			      DRM_MODE_MATCH_3D_FLAGS);
> +}
> +
> +static const struct drm_display_mode *
> +_intel_panel_fixed_mode(struct intel_connector *connector,
> +			const struct drm_display_mode *mode,
> +			const struct drm_display_mode *vrr_ref_mode)
> +{
> +	const struct drm_display_mode *fixed_mode, *best_mode = NULL;
> +	int vrefresh = drm_mode_vrefresh(mode);
> +
> +	if (vrr_ref_mode &&
> +	    (!intel_vrr_is_in_range(connector, vrefresh) ||
> +	     !intel_vrr_is_in_range(connector, drm_mode_vrefresh(vrr_ref_mode))))
> +		return NULL;
> +
>  	list_for_each_entry(fixed_mode, &connector->panel.fixed_modes, head) {
>  		int fixed_mode_vrefresh = drm_mode_vrefresh(fixed_mode);
>  
> +		if (vrr_ref_mode &&
> +		    (!intel_vrr_is_in_range(connector, fixed_mode_vrefresh) ||
> +		     !is_vrr_compatible(fixed_mode, vrr_ref_mode)))
> +			continue;
> +
>  		if (is_best_fixed_mode(connector, vrefresh,
>  				       fixed_mode_vrefresh, best_mode))
>  			best_mode = fixed_mode;
>  	}

[Severity: Critical]
Does this loop inadvertently select a lower refresh rate mode that
later causes vtotal to shrink below vdisplay?

If userspace requests a transition from a lower to a higher refresh rate
without a full modeset, is_vrr_compatible() filters out the high refresh
rate fixed mode due to a dotclock mismatch.

The loop then evaluates the lower refresh rate fixed mode. Because this
is the first iteration where best_mode is NULL, is_best_fixed_mode()
unconditionally returns true and accepts the mode, bypassing the
requirement that fixed_mode_vrefresh >= vrefresh:

intel_panel.c:is_best_fixed_mode() {
        if (!best_mode)
                return true;
        ...
}

Later in intel_panel_compute_config(), the driver shrinks vtotal to match
the higher requested refresh rate using the lower dotclock:

intel_panel.c:intel_panel_compute_config() {
        ...
        if (is_vrr && fixed_mode_vrefresh != vrefresh)
                adjusted_mode->vtotal =
                        DIV_ROUND_CLOSEST(adjusted_mode->clock * 1000,
                                          adjusted_mode->htotal * vrefresh);
        ...
}

Since both refresh rates fall within the VRR range, update_lrr is set
to true, which bypasses crtc_vtotal validation during the atomic check.

Could this regression result in programming a vtotal that is smaller than
vdisplay, leading to hardware hangs or pipeline underflows?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612144203.31715-1-ville.syrjala@linux.intel.com?part=4