[PATCH v1 00/16] VS/PE Override support

[PATCH v1 00/16] VS/PE Override support

[Michał Grzelak]

First version the series with RFC tag being removed [1]. No changelog at
commit-level since the series transformed vastly.

Already pointed out issue with the series is that I still haven't came
up yet with better platform-depedent checks than just doing a never-
ending if-ladder. It seems especially unnecessary in case of
intel_ddi_buf_trans.c where it repeats the work that has already been
done.

Thanks for all the feedback regarding the RFC.

Booted & successfully loaded i915/xe on MTL+ and EHL. 

[1] https://lore.kernel.org/intel-gfx/20260308132446.3320848-1-michal.grzelak@intel.com

BR,
Michał


Michał Grzelak (16):
  drm/i915/lt: align xe3plpd with VS/PE Override layout
  drm/i915/buf_trans: switch from u8 to u32
  drm/i915/buf_trans: describe VS/PE Override layout
  drm/i915/bios: prepare for parsing VBT #57
  drm/i915/bios: parse LT's VS/PE Override Block #57
  drm/i915/bios: parse Snps's VS/PE Override Block #57
  drm/i915/bios: parse EHL's VS/PE Override Block #57
  drm/i915/bios: support VS/PE Override per each ddi port
  drm/i915/bios: print VS/PE Override port info
  drm/i915/ddi: cache VS/PE struct pointer into intel_encoder
  drm/i915/buf_trans: override encoder->get_buf_trans when asked
  drm/i915/buf_trans: compute LT's VS/PE Override index
  drm/i915/buf_trans: compute Snps's VS/PE Override index
  drm/i915/buf_trans: compute EHL's VS/PE Override index
  drm/i915/bios: search for VBT #57 by default
  drm/i915/bios: remove VS/PE Override warning

 drivers/gpu/drm/i915/display/intel_bios.c     | 197 ++++++++++++++++-
 drivers/gpu/drm/i915/display/intel_bios.h     |   3 +
 drivers/gpu/drm/i915/display/intel_ddi.c      |   1 +
 .../drm/i915/display/intel_ddi_buf_trans.c    | 201 ++++++++++++++----
 .../drm/i915/display/intel_ddi_buf_trans.h    |  51 ++++-
 .../gpu/drm/i915/display/intel_display_core.h |   9 +
 .../drm/i915/display/intel_display_types.h    |   1 +
 7 files changed, 410 insertions(+), 53 deletions(-)

-- 
2.45.2

[PATCH v1 01/16] drm/i915/lt: align xe3plpd with VS/PE Override layout

[Michał Grzelak]

Align struct xe3plpd_lt_phy_buf_trans to match layout found in
Vswing / Preemphasis Override tables.

Move txswing & txswing_level to the end of the struct. Keep order
between txswing & txswing_level columns in xe3plpd_lt_* tables.

Move post_cursor from third field to second.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../drm/i915/display/intel_ddi_buf_trans.c    | 72 +++++++++----------
 .../drm/i915/display/intel_ddi_buf_trans.h    |  6 +-
 2 files changed, 39 insertions(+), 39 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
index 395dba8c9e4d..de5f6f89374e 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
@@ -1118,50 +1118,50 @@ static const struct intel_ddi_buf_trans mtl_c20_trans_uhbr = {
 
 /* DP1.4 */
 static const union intel_ddi_buf_trans_entry _xe3plpd_lt_trans_dp14[] = {
-	{ .lt = { 1, 0, 0, 21, 0  } },
-	{ .lt = { 1, 1, 0, 24, 3  } },
-	{ .lt = { 1, 2, 0, 28, 7  } },
-	{ .lt = { 0, 3, 0, 35, 13 } },
-	{ .lt = { 1, 1, 0, 27, 0  } },
-	{ .lt = { 1, 2, 0, 31, 4  } },
-	{ .lt = { 0, 3, 0, 39, 9  } },
-	{ .lt = { 1, 2, 0, 35, 0  } },
-	{ .lt = { 0, 3, 0, 41, 7  } },
-	{ .lt = { 0, 3, 0, 48, 0  } },
+	{ .lt = { 21, 0, 0 , 1, 0 } },
+	{ .lt = { 24, 0, 3 , 1, 1 } },
+	{ .lt = { 28, 0, 7 , 1, 2 } },
+	{ .lt = { 35, 0, 13, 0, 3 } },
+	{ .lt = { 27, 0, 0 , 1, 1 } },
+	{ .lt = { 31, 0, 4 , 1, 2 } },
+	{ .lt = { 39, 0, 9 , 0, 3 } },
+	{ .lt = { 35, 0, 0 , 1, 2 } },
+	{ .lt = { 41, 0, 7 , 0, 3 } },
+	{ .lt = { 48, 0, 0 , 0, 3 } },
 };
 
 /* DP2.1 */
 static const union intel_ddi_buf_trans_entry _xe3plpd_lt_trans_uhbr[] = {
-	{ .lt = { 0, 0, 0, 48, 0  } },
-	{ .lt = { 0, 0, 0, 43, 5  } },
-	{ .lt = { 0, 0, 0, 40, 8  } },
-	{ .lt = { 0, 0, 0, 37, 11 } },
-	{ .lt = { 0, 0, 0, 33, 15 } },
-	{ .lt = { 0, 0, 2, 46, 0  } },
-	{ .lt = { 0, 0, 2, 42, 4  } },
-	{ .lt = { 0, 0, 2, 38, 8  } },
-	{ .lt = { 0, 0, 2, 35, 11 } },
-	{ .lt = { 0, 0, 2, 33, 13 } },
-	{ .lt = { 0, 0, 4, 44, 0  } },
-	{ .lt = { 0, 0, 4, 40, 4  } },
-	{ .lt = { 0, 0, 4, 37, 7  } },
-	{ .lt = { 0, 0, 4, 33, 11 } },
-	{ .lt = { 0, 0, 8, 40, 0  } },
-	{ .lt = { 1, 0, 2, 26, 2  } },
+	{ .lt = { 48, 0, 0 , 0, 0 } },
+	{ .lt = { 43, 0, 5 , 0, 0 } },
+	{ .lt = { 40, 0, 8 , 0, 0 } },
+	{ .lt = { 37, 0, 11, 0, 0 } },
+	{ .lt = { 33, 0, 15, 0, 0 } },
+	{ .lt = { 46, 2, 0 , 0, 0 } },
+	{ .lt = { 42, 2, 4 , 0, 0 } },
+	{ .lt = { 38, 2, 8 , 0, 0 } },
+	{ .lt = { 35, 2, 11, 0, 0 } },
+	{ .lt = { 33, 2, 13, 0, 0 } },
+	{ .lt = { 44, 4, 0 , 0, 0 } },
+	{ .lt = { 40, 4, 4 , 0, 0 } },
+	{ .lt = { 37, 4, 7 , 0, 0 } },
+	{ .lt = { 33, 4, 11, 0, 0 } },
+	{ .lt = { 40, 8, 0 , 0, 0 } },
+	{ .lt = { 26, 2, 2 , 1, 0 } },
 };
 
 /* eDp */
 static const union intel_ddi_buf_trans_entry _xe3plpd_lt_trans_edp[] = {
-	{ .lt = { 1, 0, 0, 12, 0 } },
-	{ .lt = { 1, 1, 0, 13, 1 } },
-	{ .lt = { 1, 2, 0, 15, 3 } },
-	{ .lt = { 1, 3, 0, 19, 7 } },
-	{ .lt = { 1, 1, 0, 14, 0 } },
-	{ .lt = { 1, 2, 0, 16, 2 } },
-	{ .lt = { 1, 3, 0, 21, 5 } },
-	{ .lt = { 1, 2, 0, 18, 0 } },
-	{ .lt = { 1, 3, 0, 22, 4 } },
-	{ .lt = { 1, 3, 0, 26, 0 } },
+	{ .lt = { 12, 0, 0, 1, 0 } },
+	{ .lt = { 13, 0, 1, 1, 1 } },
+	{ .lt = { 15, 0, 3, 1, 2 } },
+	{ .lt = { 19, 0, 7, 1, 3 } },
+	{ .lt = { 14, 0, 0, 1, 1 } },
+	{ .lt = { 16, 0, 2, 1, 2 } },
+	{ .lt = { 21, 0, 5, 1, 3 } },
+	{ .lt = { 18, 0, 0, 1, 2 } },
+	{ .lt = { 22, 0, 4, 1, 3 } },
+	{ .lt = { 26, 0, 0, 1, 3 } },
 };
 
 static const struct intel_ddi_buf_trans xe3plpd_lt_trans_dp14 = {
diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
index cec332090a20..7703c6c0a0cb 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
@@ -51,11 +51,11 @@ struct dg2_snps_phy_buf_trans {
 };
 
 struct xe3plpd_lt_phy_buf_trans {
-	u8 txswing;
-	u8 txswing_level;
-	u8 pre_cursor;
 	u8 main_cursor;
+	u8 pre_cursor;
 	u8 post_cursor;
+	u8 txswing;
+	u8 txswing_level;
 };
 
 union intel_ddi_buf_trans_entry {
-- 
2.45.2

[PATCH v1 02/16] drm/i915/buf_trans: switch from u8 to u32

[Michał Grzelak]

Match width of fields of struct xe3plpd_lt_* & struct dg2_snps_*
with Vswing / Preemphasis Override tables layout.

This change affects DG2 and MTL+ cases.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../gpu/drm/i915/display/intel_ddi_buf_trans.h   | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
index 7703c6c0a0cb..bea6fb2ec6f4 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
@@ -45,17 +45,17 @@ struct tgl_dkl_phy_ddi_buf_trans {
 };
 
 struct dg2_snps_phy_buf_trans {
-	u8 vswing;
-	u8 pre_cursor;
-	u8 post_cursor;
+	u32 vswing;
+	u32 pre_cursor;
+	u32 post_cursor;
 };
 
 struct xe3plpd_lt_phy_buf_trans {
-	u8 main_cursor;
-	u8 pre_cursor;
-	u8 post_cursor;
-	u8 txswing;
-	u8 txswing_level;
+	u32 main_cursor;
+	u32 pre_cursor;
+	u32 post_cursor;
+	u32 txswing;
+	u32 txswing_level;
 };
 
 union intel_ddi_buf_trans_entry {
-- 
2.45.2

[PATCH v1 03/16] drm/i915/buf_trans: describe VS/PE Override layout

[Michał Grzelak]

Name indices of each present VS/PE Override table. Reflect tables'
layout by grouping indices into enums. Pack & unify all enums into union
ddi_vswing_preemph_index.

Naming of the data structures is far from perfect and should be a
subject to renaming.

Capture Vswing / Preemphasis Override tables' layout from MTL onward.
Add a placeholder for ICL+.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../drm/i915/display/intel_ddi_buf_trans.h    | 35 +++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
index bea6fb2ec6f4..20bf1d749344 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.h
@@ -74,6 +74,41 @@ struct intel_ddi_buf_trans {
 	u8 hdmi_default_entry;
 };
 
+enum lt_vswing_preemph_index {
+        XE3P_VS_PE_UNSET = -1,
+	XE3P_VS_PE_DEFAULT = 0,
+        XE3P_VS_PE_EDP = 3,
+        XE3P_VS_PE_DP14 = 4,
+        XE3P_VS_PE_DP21 = 5
+};
+
+enum snps_vswing_preemph_index {
+        MTL_C10_VS_PE_UNSET = -1,
+        MTL_C10_VS_PE_DP14_RBR_HBR = 0,
+        MTL_C10_VS_PE_DP14_HBR2_HBR3 = 1,
+        MTL_C10_VS_PE_EDP_NON_HBR3 = 2,
+        MTL_C10_VS_PE_EDP_HBR3 = 3,
+
+        MTL_C20_VS_PE_DP14 = 4,
+        MTL_C20_VS_PE_DP20 = 5
+};
+
+enum icl_vswing_preemph_index {
+        ICL_VS_PE_UNSET = -1,
+        ICL_VS_PE_DEFAULT = 0
+};
+
+union ddi_vswing_preemph_index {
+        enum lt_vswing_preemph_index lt;
+        enum snps_vswing_preemph_index snps;
+        enum icl_vswing_preemph_index icl;
+};
+
+struct ddi_vswing_preemph {
+        struct intel_ddi_buf_trans *buf_trans;
+        union ddi_vswing_preemph_index index;
+};
+
 bool is_hobl_buf_trans(const struct intel_ddi_buf_trans *table);
 
 void intel_ddi_buf_trans_init(struct intel_encoder *encoder);
-- 
2.45.2

[PATCH v1 04/16] drm/i915/bios: prepare for parsing VBT #57

[Michał Grzelak]

Add dead, generic VBT #57 parsing code since searching for VBT #57 at
the moment is switched off by default.

Add a struct storing all VS/PE relevant data into intel_vbt_data.

Add other possible renames into the comment.

Allocate matrix of intel_ddi_buf_trans_entry. This "buffers' table" (or
"buffers' block", or "tables' block") will be used to store all deparsed
values from VBT #57. Store matrix's pointer in intel_vbt_data.

Deallocate whole matrix on driver removal.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c     | 44 +++++++++++++++++++
 .../gpu/drm/i915/display/intel_display_core.h |  9 ++++
 2 files changed, 53 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index b6fe87c29aa7..778584c59fc6 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -34,6 +34,7 @@
 #include <drm/drm_fixed.h>
 #include <drm/drm_print.h>
 
+#include "intel_ddi_buf_trans.h"
 #include "intel_display.h"
 #include "intel_display_core.h"
 #include "intel_display_rpm.h"
@@ -2183,6 +2184,38 @@ parse_compression_parameters(struct intel_display *display)
 	}
 }
 
+static void
+parse_vswing_preemph_override(struct intel_display *display)
+{
+	union intel_ddi_buf_trans_entry **bufs_table;
+	const struct bdb_vswing_preemph *block;
+	u8 num_rows;
+
+	if (display->vbt.version < 218)
+		return;
+
+	block = bdb_find_section(display, BDB_VSWING_PREEMPH);
+
+	/* pre-ICL GOP don't have VBT #57 */
+	if (!block)
+		return;
+
+	num_rows = DISPLAY_VER(display) >= 14 ? 16 : 10;
+
+	bufs_table = kzalloc(block->num_tables * sizeof(*bufs_table), GFP_KERNEL);
+
+	for (int idx = 0; idx < block->num_tables; idx++)
+		bufs_table[idx] = kzalloc(num_rows * sizeof(**bufs_table), GFP_KERNEL);
+
+	drm_dbg_kms(display->drm, "Vswing / Preemph Override not yet supported on the platform\n");
+	bufs_table = NULL;
+
+	display->vbt.vswing_preemph.bufs_table = bufs_table;
+	display->vbt.vswing_preemph.num_tables = block->num_tables;
+	display->vbt.vswing_preemph.num_rows = num_rows;
+	display->vbt.vswing_preemph.num_cols = block->num_columns;
+}
+
 static u8 translate_iboost(struct intel_display *display, u8 val)
 {
 	static const u8 mapping[] = { 1, 3, 7 }; /* See VBT spec */
@@ -2978,6 +3011,9 @@ init_vbt_defaults(struct intel_display *display)
 							      !HAS_PCH_SPLIT(display));
 	drm_dbg_kms(display->drm, "Set default to SSC at %d kHz\n",
 		    display->vbt.lvds_ssc_freq);
+
+	/* Vswing / Preemphasis Override */
+	display->vbt.vswing_preemph.bufs_table = NULL;
 }
 
 /* Common defaults which may be overridden by VBT. */
@@ -3274,6 +3310,7 @@ void intel_bios_init(struct intel_display *display)
 
 	/* Depends on child device list */
 	parse_compression_parameters(display);
+	parse_vswing_preemph_override(display);
 
 out:
 	if (!vbt) {
@@ -3358,6 +3395,13 @@ void intel_bios_driver_remove(struct intel_display *display)
 		list_del(&entry->node);
 		kfree(entry);
 	}
+
+	if (display->vbt.vswing_preemph.bufs_table) {
+		for (int idx = 0; idx < display->vbt.vswing_preemph.num_tables; idx++)
+			kfree(display->vbt.vswing_preemph.bufs_table[idx]);
+
+		kfree(display->vbt.vswing_preemph.bufs_table);
+	}
 }
 
 void intel_bios_fini_panel(struct intel_panel *panel)
diff --git a/drivers/gpu/drm/i915/display/intel_display_core.h b/drivers/gpu/drm/i915/display/intel_display_core.h
index d708d322aa85..c18465b1018b 100644
--- a/drivers/gpu/drm/i915/display/intel_display_core.h
+++ b/drivers/gpu/drm/i915/display/intel_display_core.h
@@ -233,6 +233,15 @@ struct intel_vbt_data {
 	struct list_head display_devices;
 	struct list_head bdb_blocks;
 
+	struct {
+		// union intel_ddi_buf_trans_entry **tables_block;
+		// union intel_ddi_buf_trans_entry **bufs_block;
+		union intel_ddi_buf_trans_entry **bufs_table;
+		int num_tables;
+		int num_cols;
+		int num_rows;
+	} vswing_preemph;
+
 	struct sdvo_device_mapping {
 		u8 initialized;
 		u8 dvo_port;
-- 
2.45.2

[PATCH v1 05/16] drm/i915/bios: parse LT's VS/PE Override Block #57

[Michał Grzelak]

Parse content of VBT #57 into buffers' table. In case of LT we cannot
parse the content by simply casting pointer to the memory location since
VBT #57 contains more fields than it is actually needed.

Parse VBT #57 going row-wise since VBT #57 is a contiguous block.

Add FIXME to confirm LT's tables' layout.

Add LOW() macro for extracting lower byte out of u32 value read from
Block 57.

Equivalently, extraction of lower byte could be done by cast to (u8).
This approach would have the advantage of dropping "drm/i915/buf_trans:
switch from u8 to u32" patch.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 44 +++++++++++++++++++++--
 1 file changed, 42 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 778584c59fc6..4b2d86bac2de 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -47,6 +47,10 @@
 #define _INTEL_BIOS_PRIVATE
 #include "intel_vbt_defs.h"
 
+#define VS_PE_MASK 0x000000ff
+
+#define LOW(x) ((x) & (VS_PE_MASK))
+
 /**
  * DOC: Video BIOS Table (VBT)
  *
@@ -2184,6 +2188,38 @@ parse_compression_parameters(struct intel_display *display)
 	}
 }
 
+static void
+parse_vswing_preemph_lt(union intel_ddi_buf_trans_entry **bufs_table,
+			const struct bdb_vswing_preemph *block)
+{
+	union intel_ddi_buf_trans_entry *entry;
+	const u32 *tables = block->tables;
+	u32 num_rows = 16;
+	size_t offset = 0;
+	size_t row_width;
+	const u32 *vals;
+
+	row_width = block->num_columns * sizeof(*tables);
+
+	for (int idx = 0; idx < block->num_tables; idx++) {
+		for (int row = 0; row < num_rows; row++) {
+			vals = &tables[offset];
+
+			entry = &bufs_table[idx][row];
+			entry->lt.main_cursor = LOW(vals[0]);
+			entry->lt.pre_cursor = LOW(vals[1]);
+			entry->lt.post_cursor = LOW(vals[2]);
+			/* FIXME confirm LT's tables' layout
+			 * should this ever trigger.
+			 * entry->lt.txswing = LOW(vals[3]);
+			 * entry->lt.txswing_level = LOW(vals[4]);
+			 */
+
+			offset += row_width;
+		}
+	}
+}
+
 static void
 parse_vswing_preemph_override(struct intel_display *display)
 {
@@ -2207,8 +2243,12 @@ parse_vswing_preemph_override(struct intel_display *display)
 	for (int idx = 0; idx < block->num_tables; idx++)
 		bufs_table[idx] = kzalloc(num_rows * sizeof(**bufs_table), GFP_KERNEL);
 
-	drm_dbg_kms(display->drm, "Vswing / Preemph Override not yet supported on the platform\n");
-	bufs_table = NULL;
+	if (HAS_LT_PHY(display)) {
+		parse_vswing_preemph_lt(bufs_table, block);
+	} else {
+		drm_dbg_kms(display->drm, "Vswing / Preemph Override not yet supported on the platform\n");
+		bufs_table = NULL;
+	}
 
 	display->vbt.vswing_preemph.bufs_table = bufs_table;
 	display->vbt.vswing_preemph.num_tables = block->num_tables;
-- 
2.45.2

[PATCH v1 06/16] drm/i915/bios: parse Snps's VS/PE Override Block #57

[Michał Grzelak]

Parse content of VBT #57 into buffers' table. In case of Snps we can
also parse the content by casting pointer to the memory location.

Parse VBT #57 going row-wise since VBT #57 is a contiguous block.

Reuse LOW() macro for extracting lower byte out of u32 value read from
Block 57.

Equivalently, extraction of lower byte could be done by cast to (u8).
This approach would have the advantage of dropping "drm/i915/buf_trans:
switch from u8 to u32" patch.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 4b2d86bac2de..c09af91ab55f 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -2188,6 +2188,33 @@ parse_compression_parameters(struct intel_display *display)
 	}
 }
 
+static void
+parse_vswing_preemph_snps(union intel_ddi_buf_trans_entry **bufs_table,
+			  const struct bdb_vswing_preemph *block)
+{
+	union intel_ddi_buf_trans_entry *entry;
+	const u32 *tables = block->tables;
+	u32 num_rows = 16;
+	size_t offset = 0;
+	size_t row_width;
+	const u32 *vals;
+
+	row_width = block->num_columns * sizeof(*tables);
+
+	for (int idx = 0; idx < block->num_tables; idx++) {
+		for (int row = 0; row < num_rows; row++) {
+			vals = &tables[offset];
+
+			entry = &bufs_table[idx][row];
+			entry->snps.vswing = LOW(vals[0]);
+			entry->snps.pre_cursor = LOW(vals[1]);
+			entry->snps.post_cursor = LOW(vals[2]);
+
+			offset += row_width;
+		}
+	}
+}
+
 static void
 parse_vswing_preemph_lt(union intel_ddi_buf_trans_entry **bufs_table,
 			const struct bdb_vswing_preemph *block)
@@ -2245,6 +2272,10 @@ parse_vswing_preemph_override(struct intel_display *display)
 
 	if (HAS_LT_PHY(display)) {
 		parse_vswing_preemph_lt(bufs_table, block);
+	} else if (DISPLAY_VER(display) >= 14) {
+		parse_vswing_preemph_snps(bufs_table, block);
+	} else if (display->platform.battlemage) {
+		parse_vswing_preemph_snps(bufs_table, block);
 	} else {
 		drm_dbg_kms(display->drm, "Vswing / Preemph Override not yet supported on the platform\n");
 		bufs_table = NULL;
-- 
2.45.2

[PATCH v1 07/16] drm/i915/bios: parse EHL's VS/PE Override Block #57

[Michał Grzelak]

Parse content of VBT #57 into buffers' table. In case of EHL we cannot
parse the content by simply casting pointer to the memory location since
VBT #57 contains more fields than it is actually needed.

Parse VBT #57 going row-wise since VBT #57 is a contiguous block.

Reuse LOW() macro for extracting lower byte out of u32 value read from
Block 57.

Equivalently, extraction of lower byte could be done by cast to (u8).
This approach would have the advantage of dropping "drm/i915/buf_trans:
switch from u8 to u32" patch.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 31 +++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index c09af91ab55f..f2f1a57dbdbc 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -2188,6 +2188,35 @@ parse_compression_parameters(struct intel_display *display)
 	}
 }
 
+static void
+parse_vswing_preemph_icl(union intel_ddi_buf_trans_entry **bufs_table,
+			     const struct bdb_vswing_preemph *block)
+{
+	union intel_ddi_buf_trans_entry *entry;
+	const u32 *tables = block->tables;
+	u32 num_rows = 10;
+	size_t offset = 0;
+	size_t row_width;
+	const u32 *vals;
+
+	row_width = block->num_columns * sizeof(*tables);
+
+	for (int idx = 0; idx < block->num_tables; idx++) {
+		for (int row = 0; row < num_rows; row++) {
+			vals = &tables[offset];
+
+			entry = &bufs_table[idx][row];
+			entry->icl.dw2_swing_sel = LOW(vals[0]);
+			entry->icl.dw7_n_scalar = LOW(vals[1]);
+			entry->icl.dw4_cursor_coeff = LOW(vals[2]);
+			entry->icl.dw4_post_cursor_2 = LOW(vals[3]);
+			entry->icl.dw4_post_cursor_1 = LOW(vals[4]);
+
+			offset += row_width;
+		}
+	}
+}
+
 static void
 parse_vswing_preemph_snps(union intel_ddi_buf_trans_entry **bufs_table,
 			  const struct bdb_vswing_preemph *block)
@@ -2276,6 +2305,8 @@ parse_vswing_preemph_override(struct intel_display *display)
 		parse_vswing_preemph_snps(bufs_table, block);
 	} else if (display->platform.battlemage) {
 		parse_vswing_preemph_snps(bufs_table, block);
+	} else if (display->platform.elkhartlake) {
+		parse_vswing_preemph_icl(bufs_table, block);
 	} else {
 		drm_dbg_kms(display->drm, "Vswing / Preemph Override not yet supported on the platform\n");
 		bufs_table = NULL;
-- 
2.45.2

[PATCH v1 08/16] drm/i915/bios: support VS/PE Override per each ddi port

[Michał Grzelak]

Add helper function to check if port asks for overriding default VS/PE
tables.

Add ddi_vswing_preemph into bios_encoder_data. This is required because
every devdata needs a separate intel_ddi_buf_trans since each port can
request an override. Store buffer's pointer in ddi_vswing_preemph. Treat
setting .buf_trans to NULL as if the request was invalid.

Initialize port's buffer pointer to NULL when no VBT was provided.

Allocate intel_ddi_buf_trans buffer per port if the request is valid.
Defer index computing to occur later during override_buf_trans(). Set
the index to being not yet computed.

Deallocate buffer on driver removal when port asked for an allocation.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 29 +++++++++++++++++++++++
 drivers/gpu/drm/i915/display/intel_bios.h |  1 +
 2 files changed, 30 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index f2f1a57dbdbc..016696de2870 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -77,6 +77,7 @@
 struct intel_bios_encoder_data {
 	struct intel_display *display;
 
+	struct ddi_vswing_preemph vswing_preemph;
 	struct child_device_config child;
 	struct dsc_compression_parameters_entry *dsc;
 	struct list_head node;
@@ -2758,6 +2759,20 @@ static void sanitize_hdmi_level_shift(struct intel_bios_encoder_data *devdata,
 	}
 }
 
+static void override_vswing_preemph(struct intel_bios_encoder_data *devdata)
+{
+	struct intel_ddi_buf_trans *buf_trans;
+
+	devdata->vswing_preemph.buf_trans = NULL;
+	devdata->vswing_preemph.index = (union ddi_vswing_preemph_index) -1;
+
+	if (!intel_bios_encoder_overrides_vswing(devdata))
+		return;
+
+	buf_trans = kzalloc(sizeof(*buf_trans), GFP_KERNEL);
+	devdata->vswing_preemph.buf_trans = buf_trans;
+}
+
 static bool
 intel_bios_encoder_supports_crt(const struct intel_bios_encoder_data *devdata)
 {
@@ -2949,6 +2964,7 @@ static void parse_ddi_port(struct intel_bios_encoder_data *devdata)
 	sanitize_dedicated_external(devdata, port);
 	sanitize_device_type(devdata, port);
 	sanitize_hdmi_level_shift(devdata, port);
+	override_vswing_preemph(devdata);
 }
 
 static bool has_ddi_port_info(struct intel_display *display)
@@ -3157,6 +3173,9 @@ init_vbt_missing_defaults(struct intel_display *display)
 			break;
 
 		devdata->display = display;
+		devdata->vswing_preemph.buf_trans = NULL;
+		devdata->vswing_preemph.index =
+			(union ddi_vswing_preemph_index) -1;
 		child = &devdata->child;
 
 		if (port == PORT_F)
@@ -3490,6 +3509,10 @@ void intel_bios_driver_remove(struct intel_display *display)
 				 node) {
 		list_del(&devdata->node);
 		kfree(devdata->dsc);
+
+		if (devdata->vswing_preemph.buf_trans)
+			kfree(devdata->vswing_preemph.buf_trans);
+
 		kfree(devdata);
 	}
 
@@ -3937,6 +3960,12 @@ bool intel_bios_encoder_supports_tbt(const struct intel_bios_encoder_data *devda
 	return devdata->display->vbt.version >= 209 && devdata->child.tbt;
 }
 
+bool intel_bios_encoder_overrides_vswing(const struct intel_bios_encoder_data *devdata)
+{
+	return devdata->display->vbt.version >= 218 &&
+		devdata->child.use_vbt_vswing;
+}
+
 bool intel_bios_encoder_is_dedicated_external(const struct intel_bios_encoder_data *devdata)
 {
 	return devdata->display->vbt.version >= 264 &&
diff --git a/drivers/gpu/drm/i915/display/intel_bios.h b/drivers/gpu/drm/i915/display/intel_bios.h
index 75dff27b4228..50c8fc91fbe8 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.h
+++ b/drivers/gpu/drm/i915/display/intel_bios.h
@@ -73,6 +73,7 @@ bool intel_bios_get_dsc_params(struct intel_encoder *encoder,
 const struct intel_bios_encoder_data *
 intel_bios_encoder_data_lookup(struct intel_display *display, enum port port);
 
+bool intel_bios_encoder_overrides_vswing(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_supports_dvi(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_supports_hdmi(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_supports_dp(const struct intel_bios_encoder_data *devdata);
-- 
2.45.2

[PATCH v1 09/16] drm/i915/bios: print VS/PE Override port info

[Michał Grzelak]

Issue a debug message when port asks to override default Vswing /
Preemphasis tables.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 016696de2870..f94093379df0 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -2904,6 +2904,11 @@ static void print_ddi_port(const struct intel_bios_encoder_data *devdata)
 			    "Port %c supports dynamic DDI allocation in TCSS\n",
 			    port_name(port));
 
+	if (intel_bios_encoder_overrides_vswing(devdata))
+		drm_dbg_kms(display->drm,
+			    "Port %c overrides VBT vswing/preemphasis tables\n",
+			    port_name(port));
+
 	hdmi_level_shift = intel_bios_hdmi_level_shift(devdata);
 	if (hdmi_level_shift >= 0) {
 		drm_dbg_kms(display->drm,
-- 
2.45.2

[PATCH v1 10/16] drm/i915/ddi: cache VS/PE struct pointer into intel_encoder

[Michał Grzelak]

Add ddi_vswing_preemph's pointer into struct intel_encoder. Track with
it struct ddi_vswing_preemph from each encoder.

Add into intel_bios.[ch] a helper function to extract the pointer. Cache
the pointer by default into each encoder in intel_ddi.c.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c          | 6 ++++++
 drivers/gpu/drm/i915/display/intel_bios.h          | 2 ++
 drivers/gpu/drm/i915/display/intel_ddi.c           | 1 +
 drivers/gpu/drm/i915/display/intel_display_types.h | 1 +
 4 files changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index f94093379df0..a0a5399711d6 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -3965,6 +3965,12 @@ bool intel_bios_encoder_supports_tbt(const struct intel_bios_encoder_data *devda
 	return devdata->display->vbt.version >= 209 && devdata->child.tbt;
 }
 
+const struct ddi_vswing_preemph *
+intel_bios_encoder_extract_vswing(const struct intel_bios_encoder_data *devdata)
+{
+	return &devdata->vswing_preemph;
+}
+
 bool intel_bios_encoder_overrides_vswing(const struct intel_bios_encoder_data *devdata)
 {
 	return devdata->display->vbt.version >= 218 &&
diff --git a/drivers/gpu/drm/i915/display/intel_bios.h b/drivers/gpu/drm/i915/display/intel_bios.h
index 50c8fc91fbe8..2cf32ee58ed0 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.h
+++ b/drivers/gpu/drm/i915/display/intel_bios.h
@@ -73,6 +73,8 @@ bool intel_bios_get_dsc_params(struct intel_encoder *encoder,
 const struct intel_bios_encoder_data *
 intel_bios_encoder_data_lookup(struct intel_display *display, enum port port);
 
+const struct ddi_vswing_preemph *
+intel_bios_encoder_extract_vswing(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_overrides_vswing(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_supports_dvi(const struct intel_bios_encoder_data *devdata);
 bool intel_bios_encoder_supports_hdmi(const struct intel_bios_encoder_data *devdata);
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index ebefa889bc8c..f2497d20e6bd 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -5249,6 +5249,7 @@ void intel_ddi_init(struct intel_display *display,
 
 	encoder = &dig_port->base;
 	encoder->devdata = devdata;
+	encoder->vswing_preemph = intel_bios_encoder_extract_vswing(devdata);
 
 	drm_encoder_init(display->drm, &encoder->base, &intel_ddi_funcs,
 			 DRM_MODE_ENCODER_TMDS, "%s",
diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h
index e2496db1642a..e879c2c9b394 100644
--- a/drivers/gpu/drm/i915/display/intel_display_types.h
+++ b/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -297,6 +297,7 @@ struct intel_encoder {
 
 	/* VBT information for this encoder (may be NULL for older platforms) */
 	const struct intel_bios_encoder_data *devdata;
+	const struct ddi_vswing_preemph *vswing_preemph;
 };
 
 struct intel_panel_bl_funcs {
-- 
2.45.2

[PATCH v1 11/16] drm/i915/buf_trans: override encoder->get_buf_trans when asked

[Michał Grzelak]

Overwrite encoder->get_buf_trans with override_buf_trans() hook when
port asks to override default Vswing / Preemphasis tables.

Overriding proper consists of:
1) getting buffers' table via cached pointer in intel_encoder;
2) checking if the index to the table has already been computed;
3) computing & storing the most appropriate index;
4) accessing desired buf_trans with the index;
5) pointing allocated buf_trans_entry to the accessed buf_trans.

Assume 0 as the default index when finding the most specific index
failed.

There are no changes to intel_ddi_dp_level() since selection of correct
row of intel_ddi_buf_trans_entry is same as when no override request has
been done.

vswing_preemph_compute_index() feels like should be done in
override_vswing_preemph() during parse_ddi_ports() from intel_bios.c
instead of override_buf_trans(). Points 2) & 3) then could be omitted
from override_buf_trans(). In reality it is not trivial because index
computation depends on port_clock properties from crtc_state. Checking
those in intel_bios.c is out of my idea as of now.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../drm/i915/display/intel_ddi_buf_trans.c    | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
index de5f6f89374e..06c2869d3e7a 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
@@ -3,6 +3,8 @@
  * Copyright © 2020 Intel Corporation
  */
 
+#include <drm/drm_print.h>
+
 #include "intel_cx0_phy.h"
 #include "intel_ddi.h"
 #include "intel_ddi_buf_trans.h"
@@ -1784,6 +1786,56 @@ xe3plpd_get_lt_buf_trans(struct intel_encoder *encoder,
 		return intel_get_buf_trans(&xe3plpd_lt_trans_dp14, n_entries);
 }
 
+static union ddi_vswing_preemph_index
+vswing_preemph_compute_index(struct intel_encoder *encoder,
+			     const struct intel_crtc_state *crtc_state)
+{
+	struct intel_display *display = to_intel_display(encoder);
+	union ddi_vswing_preemph_index index;
+
+	drm_dbg_kms(display->drm, "using default VS/PE Override index");
+	index = (union ddi_vswing_preemph_index) 0;
+
+	return index;
+}
+
+static int
+vswing_preemph_cast_index(struct intel_display *display,
+			   union ddi_vswing_preemph_index index)
+{
+	return 0;
+}
+
+static const struct intel_ddi_buf_trans *
+override_buf_trans(struct intel_encoder *encoder,
+		   const struct intel_crtc_state *crtc_state,
+		   int *n_entries)
+{
+	struct intel_display *display = to_intel_display(encoder);
+
+	struct intel_ddi_buf_trans *buf_trans;
+	struct ddi_vswing_preemph *vswing_preemph;
+	union ddi_vswing_preemph_index index;
+	u32 idx;
+
+	index = encoder->vswing_preemph->index;
+	idx = vswing_preemph_cast_index(display, index);
+
+	if (idx < 0) {
+		index = vswing_preemph_compute_index(encoder, crtc_state);
+		vswing_preemph = (void *) encoder->vswing_preemph;
+		vswing_preemph->index = index;
+		idx = vswing_preemph_cast_index(display, index);
+	}
+
+	buf_trans = (void *) encoder->vswing_preemph->buf_trans;
+
+	buf_trans->entries = display->vbt.vswing_preemph.bufs_table[idx];
+	buf_trans->num_entries = display->vbt.vswing_preemph.num_rows;
+
+	return intel_get_buf_trans(buf_trans, n_entries);
+}
+
 void intel_ddi_buf_trans_init(struct intel_encoder *encoder)
 {
 	struct intel_display *display = to_intel_display(encoder);
@@ -1851,4 +1903,7 @@ void intel_ddi_buf_trans_init(struct intel_encoder *encoder)
 
 		MISSING_CASE(pdev->device);
 	}
+
+	if (encoder->vswing_preemph->buf_trans)
+		encoder->get_buf_trans = override_buf_trans;
 }
-- 
2.45.2

[PATCH v1 12/16] drm/i915/buf_trans: compute LT's VS/PE Override index

[Michał Grzelak]

Add support for VS/PE Override on LT. Basing on the mode & CRTC type
found, compute the most appropriate index. Assume default index as 0.

Add FIXME & warning when EDP is requested to be overridden.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../drm/i915/display/intel_ddi_buf_trans.c    | 31 +++++++++++++++++--
 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
index 06c2869d3e7a..e94b1eb84e58 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
@@ -1786,6 +1786,25 @@ xe3plpd_get_lt_buf_trans(struct intel_encoder *encoder,
 		return intel_get_buf_trans(&xe3plpd_lt_trans_dp14, n_entries);
 }
 
+static enum lt_vswing_preemph_index
+_compute_index_lt(const struct intel_crtc_state *crtc_state)
+{
+        if (intel_crtc_has_dp_encoder(crtc_state) && intel_dp_is_uhbr(crtc_state)) {
+                return XE3P_VS_PE_DP21;
+        } else if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)) {
+                 /* FIXME need to check correct parsing & table index should
+                 * this ever trigger.
+                 */
+                drm_WARN(to_intel_display(crtc_state)->drm, 1,
+                         "Ask to override EDP's vswing/preemph tables\n");
+                return XE3P_VS_PE_EDP;
+        } else {
+                return XE3P_VS_PE_DP14;
+        }
+
+        return (enum lt_vswing_preemph_index) 0;
+}
+
 static union ddi_vswing_preemph_index
 vswing_preemph_compute_index(struct intel_encoder *encoder,
 			     const struct intel_crtc_state *crtc_state)
@@ -1793,8 +1812,12 @@ vswing_preemph_compute_index(struct intel_encoder *encoder,
 	struct intel_display *display = to_intel_display(encoder);
 	union ddi_vswing_preemph_index index;
 
-	drm_dbg_kms(display->drm, "using default VS/PE Override index");
-	index = (union ddi_vswing_preemph_index) 0;
+	if (HAS_LT_PHY(display)) {
+		index.lt = _compute_index_lt(crtc_state);
+	} else {
+		drm_dbg_kms(display->drm, "using default VS/PE Override index");
+		index = (union ddi_vswing_preemph_index) 0;
+	}
 
 	return index;
 }
@@ -1803,6 +1826,10 @@ static int
 vswing_preemph_cast_index(struct intel_display *display,
 			   union ddi_vswing_preemph_index index)
 {
+	if (HAS_LT_PHY(display)) {
+		return index.lt;
+	}
+
 	return 0;
 }
 
-- 
2.45.2

[PATCH v1 13/16] drm/i915/buf_trans: compute Snps's VS/PE Override index

[Michał Grzelak]

Add support for VS/PE Override on Snps platforms. Basing on the mode &
CRTC type found, compute the most appropriate index. Assume default
index as 0.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 .../drm/i915/display/intel_ddi_buf_trans.c    | 37 +++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
index e94b1eb84e58..6978ad32ef2a 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
@@ -1786,6 +1786,36 @@ xe3plpd_get_lt_buf_trans(struct intel_encoder *encoder,
 		return intel_get_buf_trans(&xe3plpd_lt_trans_dp14, n_entries);
 }
 
+static enum snps_vswing_preemph_index
+_compute_index_snps_c10(const struct intel_crtc_state *crtc_state)
+{
+        if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_DP)) {
+		if (crtc_state->port_clock > 270000)
+                        return MTL_C10_VS_PE_DP14_HBR2_HBR3;
+                else
+                        return MTL_C10_VS_PE_DP14_RBR_HBR;
+        } else if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)){
+		if (crtc_state->port_clock > 540000)
+                        return MTL_C10_VS_PE_EDP_HBR3;
+                else
+                        return MTL_C10_VS_PE_EDP_NON_HBR3;
+        }
+
+        return (enum snps_vswing_preemph_index) 0;
+}
+
+static enum snps_vswing_preemph_index
+_compute_index_snps_c20(const struct intel_crtc_state *crtc_state)
+{
+        if (intel_crtc_has_dp_encoder(crtc_state) && intel_dp_is_uhbr(crtc_state)) {
+                return MTL_C20_VS_PE_DP20;
+        } else if (!intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) {
+                return MTL_C20_VS_PE_DP14;
+        }
+
+        return (enum snps_vswing_preemph_index) 0;
+}
+
 static enum lt_vswing_preemph_index
 _compute_index_lt(const struct intel_crtc_state *crtc_state)
 {
@@ -1814,6 +1844,11 @@ vswing_preemph_compute_index(struct intel_encoder *encoder,
 
 	if (HAS_LT_PHY(display)) {
 		index.lt = _compute_index_lt(crtc_state);
+	} else if (DISPLAY_VER(display) >= 14) {
+		if (intel_encoder_is_c10phy(encoder))
+			index.snps = _compute_index_snps_c10(crtc_state);
+		else
+			index.snps = _compute_index_snps_c20(crtc_state);
 	} else {
 		drm_dbg_kms(display->drm, "using default VS/PE Override index");
 		index = (union ddi_vswing_preemph_index) 0;
@@ -1828,6 +1863,8 @@ vswing_preemph_cast_index(struct intel_display *display,
 {
 	if (HAS_LT_PHY(display)) {
 		return index.lt;
+	} else if (DISPLAY_VER(display) >= 14) {
+		return index.snps;
 	}
 
 	return 0;
-- 
2.45.2

[PATCH v1 14/16] drm/i915/buf_trans: compute EHL's VS/PE Override index

[Michał Grzelak]

Add a placeholder for VS/PE Override index computation on EHL. Assume
default index as 0.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
index 6978ad32ef2a..7ebc1480c4b4 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c
@@ -1786,6 +1786,12 @@ xe3plpd_get_lt_buf_trans(struct intel_encoder *encoder,
 		return intel_get_buf_trans(&xe3plpd_lt_trans_dp14, n_entries);
 }
 
+static enum icl_vswing_preemph_index
+_compute_index_icl(const struct intel_crtc_state *crtc_state)
+{
+        return (enum icl_vswing_preemph_index) 0;
+}
+
 static enum snps_vswing_preemph_index
 _compute_index_snps_c10(const struct intel_crtc_state *crtc_state)
 {
@@ -1849,6 +1855,8 @@ vswing_preemph_compute_index(struct intel_encoder *encoder,
 			index.snps = _compute_index_snps_c10(crtc_state);
 		else
 			index.snps = _compute_index_snps_c20(crtc_state);
+	} else if (display->platform.elkhartlake) {
+		index.icl = _compute_index_icl(crtc_state);
 	} else {
 		drm_dbg_kms(display->drm, "using default VS/PE Override index");
 		index = (union ddi_vswing_preemph_index) 0;
@@ -1865,6 +1873,8 @@ vswing_preemph_cast_index(struct intel_display *display,
 		return index.lt;
 	} else if (DISPLAY_VER(display) >= 14) {
 		return index.snps;
+	} else if (display->platform.elkhartlake) {
+		return index.icl;
 	}
 
 	return 0;
-- 
2.45.2

[PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

[Michał Grzelak]

Start searching for Vswing / Preemphasis Override Block on VBT parsing.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index a0a5399711d6..89c479925f6d 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -206,6 +206,8 @@ static const struct {
 	  .min_size = sizeof(struct bdb_mipi_sequence) },
 	{ .section_id = BDB_COMPRESSION_PARAMETERS,
 	  .min_size = sizeof(struct bdb_compression_parameters), },
+	{ .section_id = BDB_VSWING_PREEMPH,
+	  .min_size = sizeof(struct bdb_vswing_preemph), },
 	{ .section_id = BDB_GENERIC_DTD,
 	  .min_size = sizeof(struct bdb_generic_dtd), },
 };
-- 
2.45.2

[PATCH v1 16/16] drm/i915/bios: remove VS/PE Override warning

[Michał Grzelak]

There is not much use of drm_WARN() from print_ddi_port() since
searching for VBT #57 is switched on by default. Remove it and
child_device from print_ddi_port() since drm_WARN() was the only user of
it.

Signed-off-by: Michał Grzelak <michal.grzelak@intel.com>
---
 drivers/gpu/drm/i915/display/intel_bios.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c
index 89c479925f6d..78ae953e040a 100644
--- a/drivers/gpu/drm/i915/display/intel_bios.c
+++ b/drivers/gpu/drm/i915/display/intel_bios.c
@@ -2869,7 +2869,6 @@ static bool is_port_valid(struct intel_display *display, enum port port)
 static void print_ddi_port(const struct intel_bios_encoder_data *devdata)
 {
 	struct intel_display *display = devdata->display;
-	const struct child_device_config *child = &devdata->child;
 	bool is_dvi, is_hdmi, is_dp, is_edp, is_dsi, is_crt, supports_typec_usb, supports_tbt;
 	int dp_boost_level, dp_max_link_rate, hdmi_boost_level, hdmi_level_shift, max_tmds_clock;
 	enum port port;
@@ -2942,14 +2941,6 @@ static void print_ddi_port(const struct intel_bios_encoder_data *devdata)
 		drm_dbg_kms(display->drm,
 			    "Port %c VBT DP max link rate: %d\n",
 			    port_name(port), dp_max_link_rate);
-
-	/*
-	 * FIXME need to implement support for VBT
-	 * vswing/preemph tables should this ever trigger.
-	 */
-	drm_WARN(display->drm, child->use_vbt_vswing,
-		 "Port %c asks to use VBT vswing/preemph tables\n",
-		 port_name(port));
 }
 
 static void parse_ddi_port(struct intel_bios_encoder_data *devdata)
-- 
2.45.2

✗ i915.CI.BAT: failure for VS/PE Override support

[Patchwork]

[-- Attachment #1: Type: text/plain, Size: 7236 bytes --]

== Series Details ==

Series: VS/PE Override support
URL   : https://patchwork.freedesktop.org/series/164196/
State : failure

== Summary ==

CI Bug Log - changes from CI_DRM_18256 -> Patchwork_164196v1
====================================================

Summary
-------

  **FAILURE**

  Serious unknown changes coming with Patchwork_164196v1 absolutely need to be
  verified manually.
  
  If you think the reported changes have nothing to do with the changes
  introduced in Patchwork_164196v1, please notify your bug team (I915-ci-infra@lists.freedesktop.org) to allow them
  to document this new failure mode, which will reduce false positives in CI.

  External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/index.html

Participating hosts (41 -> 40)
------------------------------

  Additional (1): bat-adls-6 
  Missing    (2): bat-dg2-13 fi-snb-2520m 

Possible new issues
-------------------

  Here are the unknown changes that may have been introduced in Patchwork_164196v1:

### IGT changes ###

#### Possible regressions ####

  * igt@i915_module_load@load:
    - fi-hsw-4770:        [PASS][1] -> [ABORT][2]
   [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-hsw-4770/igt@i915_module_load@load.html
   [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-hsw-4770/igt@i915_module_load@load.html

  
Known issues
------------

  Here are the changes found in Patchwork_164196v1 that come from known issues:

### IGT changes ###

#### Issues hit ####

  * igt@dmabuf@all-tests@dma_fence_chain:
    - fi-skl-6600u:       NOTRUN -> [SKIP][3]
   [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-skl-6600u/igt@dmabuf@all-tests@dma_fence_chain.html

  * igt@gem_lmem_swapping@parallel-random-engines:
    - bat-adls-6:         NOTRUN -> [SKIP][4] ([i915#4613]) +3 other tests skip
   [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@gem_lmem_swapping@parallel-random-engines.html

  * igt@gem_tiled_pread_basic@basic:
    - bat-adls-6:         NOTRUN -> [SKIP][5] ([i915#15656])
   [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@gem_tiled_pread_basic@basic.html

  * igt@i915_selftest@live:
    - fi-bsw-n3050:       [PASS][6] -> [DMESG-FAIL][7] ([i915#14808]) +1 other test dmesg-fail
   [6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-bsw-n3050/igt@i915_selftest@live.html
   [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-bsw-n3050/igt@i915_selftest@live.html
    - fi-cfl-8109u:       [PASS][8] -> [DMESG-FAIL][9] ([i915#14808]) +1 other test dmesg-fail
   [8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-cfl-8109u/igt@i915_selftest@live.html
   [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-cfl-8109u/igt@i915_selftest@live.html

  * igt@intel_hwmon@hwmon-read:
    - bat-adls-6:         NOTRUN -> [SKIP][10] ([i915#7707]) +1 other test skip
   [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@intel_hwmon@hwmon-read.html

  * igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy:
    - bat-adls-6:         NOTRUN -> [SKIP][11] ([i915#4103]) +1 other test skip
   [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html

  * igt@kms_dsc@dsc-basic:
    - bat-adls-6:         NOTRUN -> [SKIP][12] ([i915#3555] / [i915#3840])
   [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_dsc@dsc-basic.html

  * igt@kms_force_connector_basic@force-load-detect:
    - bat-adls-6:         NOTRUN -> [SKIP][13]
   [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_force_connector_basic@force-load-detect.html

  * igt@kms_pm_backlight@basic-brightness:
    - bat-adls-6:         NOTRUN -> [SKIP][14] ([i915#5354])
   [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_pm_backlight@basic-brightness.html

  * igt@kms_psr@psr-primary-mmap-gtt:
    - bat-adls-6:         NOTRUN -> [SKIP][15] ([i915#1072] / [i915#9732]) +3 other tests skip
   [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_psr@psr-primary-mmap-gtt.html

  * igt@kms_setmode@basic-clone-single-crtc:
    - bat-adls-6:         NOTRUN -> [SKIP][16] ([i915#3555])
   [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@kms_setmode@basic-clone-single-crtc.html

  * igt@prime_vgem@basic-fence-read:
    - bat-adls-6:         NOTRUN -> [SKIP][17] ([i915#3291]) +2 other tests skip
   [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-adls-6/igt@prime_vgem@basic-fence-read.html

  
#### Possible fixes ####

  * igt@i915_selftest@live:
    - fi-skl-6600u:       [INCOMPLETE][18] ([i915#15859]) -> [PASS][19]
   [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-skl-6600u/igt@i915_selftest@live.html
   [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-skl-6600u/igt@i915_selftest@live.html

  * igt@i915_selftest@live@gem_contexts:
    - fi-skl-6600u:       [INCOMPLETE][20] -> [PASS][21]
   [20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/fi-skl-6600u/igt@i915_selftest@live@gem_contexts.html
   [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-skl-6600u/igt@i915_selftest@live@gem_contexts.html

  * igt@i915_selftest@live@workarounds:
    - bat-dg2-14:         [DMESG-FAIL][22] ([i915#12061]) -> [PASS][23] +1 other test pass
   [22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_18256/bat-dg2-14/igt@i915_selftest@live@workarounds.html
   [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/bat-dg2-14/igt@i915_selftest@live@workarounds.html

  
  [i915#1072]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/1072
  [i915#12061]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12061
  [i915#14808]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14808
  [i915#15656]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15656
  [i915#15859]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15859
  [i915#3291]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3291
  [i915#3555]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3555
  [i915#3840]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/3840
  [i915#4103]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/4103
  [i915#4613]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/4613
  [i915#5354]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/5354
  [i915#7707]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/7707
  [i915#9732]: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/9732


Build changes
-------------

  * Linux: CI_DRM_18256 -> Patchwork_164196v1

  CI-20190529: 20190529
  CI_DRM_18256: 779129c7868f4c7205901d6e57b25de52b411d1c @ git://anongit.freedesktop.org/gfx-ci/linux
  IGT_8839: 8839
  Patchwork_164196v1: 779129c7868f4c7205901d6e57b25de52b411d1c @ git://anongit.freedesktop.org/gfx-ci/linux

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/index.html

[-- Attachment #2: Type: text/html, Size: 8408 bytes --]

Re: [PATCH v1 12/16] drm/i915/buf_trans: compute LT's VS/PE Override index

[kernel test robot]

Hi Michał,

kernel test robot noticed the following build warnings:

[auto build test WARNING on drm-i915/for-linux-next]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
base:   https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
patch link:    https://lore.kernel.org/r/20260331183332.1773886-13-michal.grzelak%40intel.com
patch subject: [PATCH v1 12/16] drm/i915/buf_trans: compute LT's VS/PE Override index
reproduce: (https://download.01.org/0day-ci/archive/20260401/202604010401.ywwXdvN6-lkp@intel.com/reproduce)

# many are suggestions rather than must-fix

WARNING:BLOCK_COMMENT_STYLE: Block comments should align the * on each line
#34: FILE: drivers/gpu/drm/i915/display/intel_ddi_buf_trans.c:1796:
+                 /* FIXME need to check correct parsing & table index should
+                 * this ever trigger.

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v1 08/16] drm/i915/bios: support VS/PE Override per each ddi port

[kernel test robot]

Hi Michał,

kernel test robot noticed the following build errors:

[auto build test ERROR on drm-i915/for-linux-next]
[also build test ERROR on drm-i915/for-linux-next-fixes drm-tip/drm-tip linus/master v7.0-rc6 next-20260331]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
base:   https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
patch link:    https://lore.kernel.org/r/20260331183332.1773886-9-michal.grzelak%40intel.com
patch subject: [PATCH v1 08/16] drm/i915/bios: support VS/PE Override per each ddi port
config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20260402/202604021026.aZi3LxDW-lkp@intel.com/config)
compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260402/202604021026.aZi3LxDW-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604021026.aZi3LxDW-lkp@intel.com/

All errors (new ones prefixed by >>):

>> drivers/gpu/drm/i915/display/intel_bios.c:2767:34: error: cast to union type from type 'int' not present in union
    2767 |         devdata->vswing_preemph.index = (union ddi_vswing_preemph_index) -1;
         |                                         ^                                ~~
   drivers/gpu/drm/i915/display/intel_bios.c:3178:4: error: cast to union type from type 'int' not present in union
    3178 |                         (union ddi_vswing_preemph_index) -1;
         |                         ^                                ~~
   2 errors generated.


vim +/int +2767 drivers/gpu/drm/i915/display/intel_bios.c

  2761	
  2762	static void override_vswing_preemph(struct intel_bios_encoder_data *devdata)
  2763	{
  2764		struct intel_ddi_buf_trans *buf_trans;
  2765	
  2766		devdata->vswing_preemph.buf_trans = NULL;
> 2767		devdata->vswing_preemph.index = (union ddi_vswing_preemph_index) -1;
  2768	
  2769		if (!intel_bios_encoder_overrides_vswing(devdata))
  2770			return;
  2771	
  2772		buf_trans = kzalloc(sizeof(*buf_trans), GFP_KERNEL);
  2773		devdata->vswing_preemph.buf_trans = buf_trans;
  2774	}
  2775	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

[kernel test robot]

Hello,

kernel test robot noticed "BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps" on:

commit: 07d1ee54da4966c1457602dc088a8a43b29254cb ("[PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default")
url: https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
base: https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
patch link: https://lore.kernel.org/all/20260331183332.1773886-16-michal.grzelak@intel.com/
patch subject: [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

in testcase: ltp
version: 
with following parameters:

	test: ima



config: x86_64-rhel-9.4-ltp
compiler: gcc-14
test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory

(please refer to attached dmesg/kmsg for entire log/backtrace)



If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202604150702.d409a2b6-lkp@intel.com


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com


kern  :err   : [   27.966990] [    T399] ==================================================================
kern  :err   : [   27.968126] [    T399] BUG: KASAN: slab-out-of-bounds in parse_vswing_preemph_snps+0x2dd/0x430 [i915]
kern  :err   : [   27.969712] [    T399] Read of size 4 at addr ffff8881eba2c49d by task (udev-worker)/399

kern  :err   : [   27.971135] [    T399] CPU: 4 UID: 0 PID: 399 Comm: (udev-worker) Tainted: G S                  7.0.0-rc4-01496-g07d1ee54da49 #1 PREEMPT(lazy) 
kern  :err   : [   27.971139] [    T399] Tainted: [S]=CPU_OUT_OF_SPEC
kern  :err   : [   27.971140] [    T399] Hardware name: ASUSTeK COMPUTER INC. NUC14RVS-B/NUC14RVSU9, BIOS RVMTL357.0047.2025.0108.1408 01/08/2025
kern  :err   : [   27.971142] [    T399] Call Trace:
kern  :err   : [   27.971144] [    T399]  <TASK>
kern  :err   : [   27.971145] [    T399]  dump_stack_lvl+0x47/0x70
kern  :err   : [   27.971152] [    T399]  print_address_description+0x88/0x320
kern  :err   : [   27.971156] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
kern  :err   : [   27.971355] [    T399]  print_report+0x106/0x1f4
kern  :err   : [   27.971357] [    T399]  ? __virt_addr_valid+0xc4/0x230
kern  :err   : [   27.971360] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
kern  :err   : [   27.971533] [    T399]  kasan_report+0xb5/0xf0
kern  :err   : [   27.971537] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
kern  :err   : [   27.971704] [    T399]  parse_vswing_preemph_snps+0x2dd/0x430 [i915]
kern  :err   : [   27.971868] [    T399]  intel_bios_init+0xcc1/0x14b0 [i915]
kern  :err   : [   27.972042] [    T399]  ? drm_vblank_init+0x147/0x330 [drm]
kern  :err   : [   27.972105] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
kern  :err   : [   27.972295] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
kern  :err   : [   27.972445] [    T399]  ? __pfx_mutex_lock+0x10/0x10
kern  :err   : [   27.972450] [    T399]  ? mutex_lock+0x91/0xf0
kern  :err   : [   27.972451] [    T399]  ? __pfx_i915_driver_probe+0x10/0x10 [i915]
kern  :err   : [   27.972597] [    T399]  ? drm_privacy_screen_get+0x2bf/0x370 [drm]
kern  :err   : [   27.972628] [    T399]  ? intel_display_driver_probe_defer+0x41/0x70 [i915]
kern  :err   : [   27.972814] [    T399]  ? i915_pci_probe+0x2ab/0x3b0 [i915]
kern  :err   : [   27.972963] [    T399]  ? __pfx_i915_pci_probe+0x10/0x10 [i915]
kern  :err   : [   27.973110] [    T399]  local_pci_probe+0xdb/0x1b0
kern  :err   : [   27.973114] [    T399]  pci_call_probe+0x153/0x4f0
kern  :err   : [   27.973116] [    T399]  ? __pfx_pci_call_probe+0x10/0x10
kern  :err   : [   27.973117] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
kern  :err   : [   27.973119] [    T399]  ? pci_assign_irq+0x80/0x2f0
kern  :err   : [   27.973121] [    T399]  ? pci_match_device+0x38d/0x6b0
kern  :err   : [   27.973123] [    T399]  ? kernfs_create_link+0x164/0x230
kern  :err   : [   27.973127] [    T399]  pci_device_probe+0x173/0x2f0
kern  :err   : [   27.973128] [    T399]  call_driver_probe+0x62/0x1f0
kern  :err   : [   27.973132] [    T399]  really_probe+0x197/0x770
kern  :err   : [   27.973134] [    T399]  __driver_probe_device+0x18c/0x3b0
kern  :err   : [   27.973137] [    T399]  driver_probe_device+0x4a/0x130
kern  :err   : [   27.973139] [    T399]  __driver_attach+0x18c/0x4f0
kern  :err   : [   27.973141] [    T399]  ? __pfx___driver_attach+0x10/0x10
kern  :err   : [   27.973143] [    T399]  bus_for_each_dev+0xef/0x170
kern  :err   : [   27.973145] [    T399]  ? kasan_unpoison+0x40/0x70
kern  :err   : [   27.973147] [    T399]  ? __pfx_bus_for_each_dev+0x10/0x10
kern  :err   : [   27.973149] [    T399]  ? __kasan_slab_alloc+0x2f/0x70
kern  :err   : [   27.973152] [    T399]  ? klist_add_tail+0x132/0x270
kern  :err   : [   27.973154] [    T399]  bus_add_driver+0x2a7/0x4f0
kern  :err   : [   27.973156] [    T399]  driver_register+0x1a1/0x370
kern  :err   : [   27.973158] [    T399]  i915_init+0x57/0x160 [i915]
kern  :err   : [   27.973307] [    T399]  ? __pfx_i915_init+0x10/0x10 [i915]
kern  :err   : [   27.973453] [    T399]  do_one_initcall+0x8d/0x3f0
kern  :err   : [   27.973455] [    T399]  ? __pfx_do_one_initcall+0x10/0x10
kern  :err   : [   27.973457] [    T399]  ? kasan_unpoison+0x3b/0x70
kern  :err   : [   27.973458] [    T399]  ? kasan_unpoison+0x40/0x70
kern  :err   : [   27.973460] [    T399]  do_init_module+0x281/0x830
kern  :err   : [   27.973463] [    T399]  ? __pfx_do_init_module+0x10/0x10
kern  :err   : [   27.973464] [    T399]  ? kfree+0x195/0x430
kern  :err   : [   27.973467] [    T399]  load_module+0x173d/0x2070
kern  :err   : [   27.973469] [    T399]  ? ima_post_read_file+0x18f/0x230
kern  :err   : [   27.973474] [    T399]  ? __pfx_load_module+0x10/0x10
kern  :err   : [   27.973476] [    T399]  ? security_kernel_post_read_file+0x35/0xf0
kern  :err   : [   27.973479] [    T399]  ? __pfx_kernel_read_file+0x10/0x10
kern  :err   : [   27.973483] [    T399]  ? __pfx_current_time+0x10/0x10
kern  :err   : [   27.973486] [    T399]  ? init_module_from_file+0x157/0x1b0
kern  :err   : [   27.973487] [    T399]  init_module_from_file+0x157/0x1b0
kern  :err   : [   27.973489] [    T399]  ? __pfx_init_module_from_file+0x10/0x10
kern  :err   : [   27.973491] [    T399]  ? touch_atime+0x1bc/0x4f0
kern  :err   : [   27.973493] [    T399]  ? _raw_spin_lock+0x80/0xf0
kern  :err   : [   27.973494] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
kern  :err   : [   27.973496] [    T399]  ? __pfx_filemap_read+0x10/0x10
kern  :err   : [   27.973498] [    T399]  ? do_sys_openat2+0xeb/0x170
kern  :err   : [   27.973501] [    T399]  idempotent_init_module+0x21c/0x770
kern  :err   : [   27.973503] [    T399]  ? __pfx_idempotent_init_module+0x10/0x10
kern  :err   : [   27.973505] [    T399]  ? fdget+0x54/0x3b0
kern  :err   : [   27.973506] [    T399]  ? security_capable+0x35/0xf0
kern  :err   : [   27.973509] [    T399]  __x64_sys_finit_module+0xca/0x170
kern  :err   : [   27.973511] [    T399]  do_syscall_64+0x108/0x5b0
kern  :err   : [   27.973513] [    T399]  ? vfs_read+0x3be/0x9b0
kern  :err   : [   27.973514] [    T399]  ? vfs_read+0x3be/0x9b0
kern  :err   : [   27.973516] [    T399]  ? __pfx_vfs_read+0x10/0x10
kern  :err   : [   27.973517] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
kern  :err   : [   27.973519] [    T399]  ? fdget+0x54/0x3b0
kern  :err   : [   27.973520] [    T399]  ? __pfx___seccomp_filter+0x10/0x10
kern  :err   : [   27.973523] [    T399]  ? __x64_sys_pread64+0x18d/0x1f0
kern  :err   : [   27.973525] [    T399]  ? __pfx___x64_sys_pread64+0x10/0x10
kern  :err   : [   27.973526] [    T399]  ? fdget+0x54/0x3b0
kern  :err   : [   27.973528] [    T399]  ? security_capable+0x35/0xf0
kern  :err   : [   27.973530] [    T399]  ? do_syscall_64+0x140/0x5b0
kern  :err   : [   27.973531] [    T399]  ? arch_exit_to_user_mode_prepare+0x9e/0xf0
kern  :err   : [   27.973533] [    T399]  ? do_syscall_64+0x140/0x5b0
kern  :err   : [   27.973534] [    T399]  ? __x64_sys_openat+0x104/0x1f0
kern  :err   : [   27.973536] [    T399]  ? __pfx___x64_sys_openat+0x10/0x10
kern  :err   : [   27.973538] [    T399]  ? do_syscall_64+0x140/0x5b0
kern  :err   : [   27.973540] [    T399]  ? do_syscall_64+0x140/0x5b0
kern  :err   : [   27.973541] [    T399]  ? irqentry_exit+0x76/0x4f0
kern  :err   : [   27.973544] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
kern  :err   : [   27.973546] [    T399] RIP: 0033:0x7f3689aa8779
kern  :err   : [   27.973549] [    T399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 67 76 0d 00 f7 d8 64 89 01 48
kern  :err   : [   27.973551] [    T399] RSP: 002b:00007ffca3326338 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
kern  :err   : [   27.973555] [    T399] RAX: ffffffffffffffda RBX: 000055c94afdd3e0 RCX: 00007f3689aa8779
kern  :err   : [   27.973556] [    T399] RDX: 0000000000000000 RSI: 00007f36882ae44d RDI: 0000000000000053
kern  :err   : [   27.973557] [    T399] RBP: 0000000000000000 R08: 0000000000000000 R09: 000055c94af65b30
kern  :err   : [   27.973558] [    T399] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36882ae44d
kern  :err   : [   27.973559] [    T399] R13: 0000000000020000 R14: 000055c94afb65f0 R15: 0000000000000000
kern  :err   : [   27.973561] [    T399]  </TASK>

kern  :err   : [   28.051757] [    T399] Allocated by task 399:
kern  :warn  : [   28.052350] [    T399]  kasan_save_stack+0x1e/0x70
kern  :warn  : [   28.053001] [    T399]  kasan_save_track+0x10/0x30
kern  :warn  : [   28.053646] [    T399]  __kasan_kmalloc+0x8b/0xb0
kern  :warn  : [   28.054278] [    T399]  __kmalloc_noprof+0x1d8/0x5f0
kern  :warn  : [   28.054944] [    T399]  init_bdb_block+0x128/0xc30 [i915]
kern  :warn  : [   28.055915] [    T399]  intel_bios_init+0x4de/0x14b0 [i915]
kern  :warn  : [   28.056854] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
kern  :warn  : [   28.057984] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
kern  :warn  : [   28.058917] [    T399]  local_pci_probe+0xdb/0x1b0
kern  :warn  : [   28.059565] [    T399]  pci_call_probe+0x153/0x4f0
kern  :warn  : [   28.060210] [    T399]  pci_device_probe+0x173/0x2f0
kern  :warn  : [   28.060878] [    T399]  call_driver_probe+0x62/0x1f0
kern  :warn  : [   28.061547] [    T399]  really_probe+0x197/0x770
kern  :warn  : [   28.062168] [    T399]  __driver_probe_device+0x18c/0x3b0
kern  :warn  : [   28.062894] [    T399]  driver_probe_device+0x4a/0x130
kern  :warn  : [   28.063587] [    T399]  __driver_attach+0x18c/0x4f0
kern  :warn  : [   28.064243] [    T399]  bus_for_each_dev+0xef/0x170
kern  :warn  : [   28.064898] [    T399]  bus_add_driver+0x2a7/0x4f0
kern  :warn  : [   28.065543] [    T399]  driver_register+0x1a1/0x370
kern  :warn  : [   28.066202] [    T399]  i915_init+0x57/0x160 [i915]
kern  :warn  : [   28.067030] [    T399]  do_one_initcall+0x8d/0x3f0
kern  :warn  : [   28.067677] [    T399]  do_init_module+0x281/0x830
kern  :warn  : [   28.068320] [    T399]  load_module+0x173d/0x2070
kern  :warn  : [   28.068951] [    T399]  init_module_from_file+0x157/0x1b0
kern  :warn  : [   28.069678] [    T399]  idempotent_init_module+0x21c/0x770
kern  :warn  : [   28.070417] [    T399]  __x64_sys_finit_module+0xca/0x170
kern  :warn  : [   28.071143] [    T399]  do_syscall_64+0x108/0x5b0
kern  :warn  : [   28.071777] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

kern  :err   : [   28.072915] [    T399] The buggy address belongs to the object at ffff8881eba2c000
                                          which belongs to the cache kmalloc-2k of size 2048
kern  :err   : [   28.074832] [    T399] The buggy address is located 0 bytes to the right of
                                          allocated 1181-byte region [ffff8881eba2c000, ffff8881eba2c49d)

kern  :err   : [   28.077135] [    T399] The buggy address belongs to the physical page:
kern  :warn  : [   28.078017] [    T399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eba28
kern  :warn  : [   28.079226] [    T399] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
kern  :warn  : [   28.080389] [    T399] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
kern  :warn  : [   28.081460] [    T399] page_type: f5(slab)
kern  :warn  : [   28.082008] [    T399] raw: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
kern  :warn  : [   28.083180] [    T399] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
kern  :warn  : [   28.084355] [    T399] head: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
kern  :warn  : [   28.085541] [    T399] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
kern  :warn  : [   28.086725] [    T399] head: 0017ffffc0000003 ffffea0007ae8a01 00000000ffffffff 00000000ffffffff
kern  :warn  : [   28.087909] [    T399] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
kern  :warn  : [   28.089093] [    T399] page dumped because: kasan: bad access detected

kern  :err   : [   28.090297] [    T399] Memory state around the buggy address:
kern  :err   : [   28.091073] [    T399]  ffff8881eba2c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern  :err   : [   28.092175] [    T399]  ffff8881eba2c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
kern  :err   : [   28.093276] [    T399] >ffff8881eba2c480: 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc
kern  :err   : [   28.094376] [    T399]                             ^
kern  :err   : [   28.095041] [    T399]  ffff8881eba2c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
kern  :err   : [   28.096145] [    T399]  ffff8881eba2c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
kern  :err   : [   28.097247] [    T399] ==================================================================
kern  :warn  : [   28.098668] [    T399] Disabling lock debugging due to kernel taint



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [LTP] [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

[Petr Vorel]

Hi all,

[ Cc Mimi and linux-integrity ]
> Hello,

> kernel test robot noticed "BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps" on:

> commit: 07d1ee54da4966c1457602dc088a8a43b29254cb ("[PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default")
> url: https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
> base: https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
> patch link: https://lore.kernel.org/all/20260331183332.1773886-16-michal.grzelak@intel.com/
> patch subject: [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

> in testcase: ltp
> version: 
> with following parameters:

> 	test: ima



> config: x86_64-rhel-9.4-ltp
> compiler: gcc-14
> test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory

> (please refer to attached dmesg/kmsg for entire log/backtrace)



> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202604150702.d409a2b6-lkp@intel.com


> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com


> kern  :err   : [   27.966990] [    T399] ==================================================================
> kern  :err   : [   27.968126] [    T399] BUG: KASAN: slab-out-of-bounds in parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> kern  :err   : [   27.969712] [    T399] Read of size 4 at addr ffff8881eba2c49d by task (udev-worker)/399

> kern  :err   : [   27.971135] [    T399] CPU: 4 UID: 0 PID: 399 Comm: (udev-worker) Tainted: G S                  7.0.0-rc4-01496-g07d1ee54da49 #1 PREEMPT(lazy) 
> kern  :err   : [   27.971139] [    T399] Tainted: [S]=CPU_OUT_OF_SPEC
> kern  :err   : [   27.971140] [    T399] Hardware name: ASUSTeK COMPUTER INC. NUC14RVS-B/NUC14RVSU9, BIOS RVMTL357.0047.2025.0108.1408 01/08/2025
> kern  :err   : [   27.971142] [    T399] Call Trace:
> kern  :err   : [   27.971144] [    T399]  <TASK>
> kern  :err   : [   27.971145] [    T399]  dump_stack_lvl+0x47/0x70
> kern  :err   : [   27.971152] [    T399]  print_address_description+0x88/0x320
> kern  :err   : [   27.971156] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> kern  :err   : [   27.971355] [    T399]  print_report+0x106/0x1f4
> kern  :err   : [   27.971357] [    T399]  ? __virt_addr_valid+0xc4/0x230
> kern  :err   : [   27.971360] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> kern  :err   : [   27.971533] [    T399]  kasan_report+0xb5/0xf0
> kern  :err   : [   27.971537] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> kern  :err   : [   27.971704] [    T399]  parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> kern  :err   : [   27.971868] [    T399]  intel_bios_init+0xcc1/0x14b0 [i915]
> kern  :err   : [   27.972042] [    T399]  ? drm_vblank_init+0x147/0x330 [drm]
> kern  :err   : [   27.972105] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
> kern  :err   : [   27.972295] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
> kern  :err   : [   27.972445] [    T399]  ? __pfx_mutex_lock+0x10/0x10
> kern  :err   : [   27.972450] [    T399]  ? mutex_lock+0x91/0xf0
> kern  :err   : [   27.972451] [    T399]  ? __pfx_i915_driver_probe+0x10/0x10 [i915]
> kern  :err   : [   27.972597] [    T399]  ? drm_privacy_screen_get+0x2bf/0x370 [drm]
> kern  :err   : [   27.972628] [    T399]  ? intel_display_driver_probe_defer+0x41/0x70 [i915]
> kern  :err   : [   27.972814] [    T399]  ? i915_pci_probe+0x2ab/0x3b0 [i915]
> kern  :err   : [   27.972963] [    T399]  ? __pfx_i915_pci_probe+0x10/0x10 [i915]
> kern  :err   : [   27.973110] [    T399]  local_pci_probe+0xdb/0x1b0
> kern  :err   : [   27.973114] [    T399]  pci_call_probe+0x153/0x4f0
> kern  :err   : [   27.973116] [    T399]  ? __pfx_pci_call_probe+0x10/0x10
> kern  :err   : [   27.973117] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> kern  :err   : [   27.973119] [    T399]  ? pci_assign_irq+0x80/0x2f0
> kern  :err   : [   27.973121] [    T399]  ? pci_match_device+0x38d/0x6b0
> kern  :err   : [   27.973123] [    T399]  ? kernfs_create_link+0x164/0x230
> kern  :err   : [   27.973127] [    T399]  pci_device_probe+0x173/0x2f0
> kern  :err   : [   27.973128] [    T399]  call_driver_probe+0x62/0x1f0
> kern  :err   : [   27.973132] [    T399]  really_probe+0x197/0x770
> kern  :err   : [   27.973134] [    T399]  __driver_probe_device+0x18c/0x3b0
> kern  :err   : [   27.973137] [    T399]  driver_probe_device+0x4a/0x130
> kern  :err   : [   27.973139] [    T399]  __driver_attach+0x18c/0x4f0
> kern  :err   : [   27.973141] [    T399]  ? __pfx___driver_attach+0x10/0x10
> kern  :err   : [   27.973143] [    T399]  bus_for_each_dev+0xef/0x170
> kern  :err   : [   27.973145] [    T399]  ? kasan_unpoison+0x40/0x70
> kern  :err   : [   27.973147] [    T399]  ? __pfx_bus_for_each_dev+0x10/0x10
> kern  :err   : [   27.973149] [    T399]  ? __kasan_slab_alloc+0x2f/0x70
> kern  :err   : [   27.973152] [    T399]  ? klist_add_tail+0x132/0x270
> kern  :err   : [   27.973154] [    T399]  bus_add_driver+0x2a7/0x4f0
> kern  :err   : [   27.973156] [    T399]  driver_register+0x1a1/0x370
> kern  :err   : [   27.973158] [    T399]  i915_init+0x57/0x160 [i915]
> kern  :err   : [   27.973307] [    T399]  ? __pfx_i915_init+0x10/0x10 [i915]
> kern  :err   : [   27.973453] [    T399]  do_one_initcall+0x8d/0x3f0
> kern  :err   : [   27.973455] [    T399]  ? __pfx_do_one_initcall+0x10/0x10
> kern  :err   : [   27.973457] [    T399]  ? kasan_unpoison+0x3b/0x70
> kern  :err   : [   27.973458] [    T399]  ? kasan_unpoison+0x40/0x70
> kern  :err   : [   27.973460] [    T399]  do_init_module+0x281/0x830
> kern  :err   : [   27.973463] [    T399]  ? __pfx_do_init_module+0x10/0x10
> kern  :err   : [   27.973464] [    T399]  ? kfree+0x195/0x430
> kern  :err   : [   27.973467] [    T399]  load_module+0x173d/0x2070
> kern  :err   : [   27.973469] [    T399]  ? ima_post_read_file+0x18f/0x230

I'm surprised, but indeed it's could be triggered by IMA.

Looking at full dmesg [1] I'm surprised that this is triggered before tests are
actually run and there is no IMA specific kernel command line parameter. That
means that error is not related to any LTP test.

Is it always reproducible or just a random glitch?

ima_post_read_file() is a part of IMA core therefore issue might be not related
to any config, but just FYI kernel config [2].

Kind regards,
Petr

[1] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/kmsg.xz
[2] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/config-7.0.0-rc4-01496-g07d1ee54da49

> kern  :err   : [   27.973474] [    T399]  ? __pfx_load_module+0x10/0x10
> kern  :err   : [   27.973476] [    T399]  ? security_kernel_post_read_file+0x35/0xf0
> kern  :err   : [   27.973479] [    T399]  ? __pfx_kernel_read_file+0x10/0x10
> kern  :err   : [   27.973483] [    T399]  ? __pfx_current_time+0x10/0x10
> kern  :err   : [   27.973486] [    T399]  ? init_module_from_file+0x157/0x1b0
> kern  :err   : [   27.973487] [    T399]  init_module_from_file+0x157/0x1b0
> kern  :err   : [   27.973489] [    T399]  ? __pfx_init_module_from_file+0x10/0x10
> kern  :err   : [   27.973491] [    T399]  ? touch_atime+0x1bc/0x4f0
> kern  :err   : [   27.973493] [    T399]  ? _raw_spin_lock+0x80/0xf0
> kern  :err   : [   27.973494] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> kern  :err   : [   27.973496] [    T399]  ? __pfx_filemap_read+0x10/0x10
> kern  :err   : [   27.973498] [    T399]  ? do_sys_openat2+0xeb/0x170
> kern  :err   : [   27.973501] [    T399]  idempotent_init_module+0x21c/0x770
> kern  :err   : [   27.973503] [    T399]  ? __pfx_idempotent_init_module+0x10/0x10
> kern  :err   : [   27.973505] [    T399]  ? fdget+0x54/0x3b0
> kern  :err   : [   27.973506] [    T399]  ? security_capable+0x35/0xf0
> kern  :err   : [   27.973509] [    T399]  __x64_sys_finit_module+0xca/0x170
> kern  :err   : [   27.973511] [    T399]  do_syscall_64+0x108/0x5b0
> kern  :err   : [   27.973513] [    T399]  ? vfs_read+0x3be/0x9b0
> kern  :err   : [   27.973514] [    T399]  ? vfs_read+0x3be/0x9b0
> kern  :err   : [   27.973516] [    T399]  ? __pfx_vfs_read+0x10/0x10
> kern  :err   : [   27.973517] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> kern  :err   : [   27.973519] [    T399]  ? fdget+0x54/0x3b0
> kern  :err   : [   27.973520] [    T399]  ? __pfx___seccomp_filter+0x10/0x10
> kern  :err   : [   27.973523] [    T399]  ? __x64_sys_pread64+0x18d/0x1f0
> kern  :err   : [   27.973525] [    T399]  ? __pfx___x64_sys_pread64+0x10/0x10
> kern  :err   : [   27.973526] [    T399]  ? fdget+0x54/0x3b0
> kern  :err   : [   27.973528] [    T399]  ? security_capable+0x35/0xf0
> kern  :err   : [   27.973530] [    T399]  ? do_syscall_64+0x140/0x5b0
> kern  :err   : [   27.973531] [    T399]  ? arch_exit_to_user_mode_prepare+0x9e/0xf0
> kern  :err   : [   27.973533] [    T399]  ? do_syscall_64+0x140/0x5b0
> kern  :err   : [   27.973534] [    T399]  ? __x64_sys_openat+0x104/0x1f0
> kern  :err   : [   27.973536] [    T399]  ? __pfx___x64_sys_openat+0x10/0x10
> kern  :err   : [   27.973538] [    T399]  ? do_syscall_64+0x140/0x5b0
> kern  :err   : [   27.973540] [    T399]  ? do_syscall_64+0x140/0x5b0
> kern  :err   : [   27.973541] [    T399]  ? irqentry_exit+0x76/0x4f0
> kern  :err   : [   27.973544] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> kern  :err   : [   27.973546] [    T399] RIP: 0033:0x7f3689aa8779
> kern  :err   : [   27.973549] [    T399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 67 76 0d 00 f7 d8 64 89 01 48
> kern  :err   : [   27.973551] [    T399] RSP: 002b:00007ffca3326338 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> kern  :err   : [   27.973555] [    T399] RAX: ffffffffffffffda RBX: 000055c94afdd3e0 RCX: 00007f3689aa8779
> kern  :err   : [   27.973556] [    T399] RDX: 0000000000000000 RSI: 00007f36882ae44d RDI: 0000000000000053
> kern  :err   : [   27.973557] [    T399] RBP: 0000000000000000 R08: 0000000000000000 R09: 000055c94af65b30
> kern  :err   : [   27.973558] [    T399] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36882ae44d
> kern  :err   : [   27.973559] [    T399] R13: 0000000000020000 R14: 000055c94afb65f0 R15: 0000000000000000
> kern  :err   : [   27.973561] [    T399]  </TASK>

> kern  :err   : [   28.051757] [    T399] Allocated by task 399:
> kern  :warn  : [   28.052350] [    T399]  kasan_save_stack+0x1e/0x70
> kern  :warn  : [   28.053001] [    T399]  kasan_save_track+0x10/0x30
> kern  :warn  : [   28.053646] [    T399]  __kasan_kmalloc+0x8b/0xb0
> kern  :warn  : [   28.054278] [    T399]  __kmalloc_noprof+0x1d8/0x5f0
> kern  :warn  : [   28.054944] [    T399]  init_bdb_block+0x128/0xc30 [i915]
> kern  :warn  : [   28.055915] [    T399]  intel_bios_init+0x4de/0x14b0 [i915]
> kern  :warn  : [   28.056854] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
> kern  :warn  : [   28.057984] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
> kern  :warn  : [   28.058917] [    T399]  local_pci_probe+0xdb/0x1b0
> kern  :warn  : [   28.059565] [    T399]  pci_call_probe+0x153/0x4f0
> kern  :warn  : [   28.060210] [    T399]  pci_device_probe+0x173/0x2f0
> kern  :warn  : [   28.060878] [    T399]  call_driver_probe+0x62/0x1f0
> kern  :warn  : [   28.061547] [    T399]  really_probe+0x197/0x770
> kern  :warn  : [   28.062168] [    T399]  __driver_probe_device+0x18c/0x3b0
> kern  :warn  : [   28.062894] [    T399]  driver_probe_device+0x4a/0x130
> kern  :warn  : [   28.063587] [    T399]  __driver_attach+0x18c/0x4f0
> kern  :warn  : [   28.064243] [    T399]  bus_for_each_dev+0xef/0x170
> kern  :warn  : [   28.064898] [    T399]  bus_add_driver+0x2a7/0x4f0
> kern  :warn  : [   28.065543] [    T399]  driver_register+0x1a1/0x370
> kern  :warn  : [   28.066202] [    T399]  i915_init+0x57/0x160 [i915]
> kern  :warn  : [   28.067030] [    T399]  do_one_initcall+0x8d/0x3f0
> kern  :warn  : [   28.067677] [    T399]  do_init_module+0x281/0x830
> kern  :warn  : [   28.068320] [    T399]  load_module+0x173d/0x2070
> kern  :warn  : [   28.068951] [    T399]  init_module_from_file+0x157/0x1b0
> kern  :warn  : [   28.069678] [    T399]  idempotent_init_module+0x21c/0x770
> kern  :warn  : [   28.070417] [    T399]  __x64_sys_finit_module+0xca/0x170
> kern  :warn  : [   28.071143] [    T399]  do_syscall_64+0x108/0x5b0
> kern  :warn  : [   28.071777] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

> kern  :err   : [   28.072915] [    T399] The buggy address belongs to the object at ffff8881eba2c000
>                                           which belongs to the cache kmalloc-2k of size 2048
> kern  :err   : [   28.074832] [    T399] The buggy address is located 0 bytes to the right of
>                                           allocated 1181-byte region [ffff8881eba2c000, ffff8881eba2c49d)

> kern  :err   : [   28.077135] [    T399] The buggy address belongs to the physical page:
> kern  :warn  : [   28.078017] [    T399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eba28
> kern  :warn  : [   28.079226] [    T399] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> kern  :warn  : [   28.080389] [    T399] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
> kern  :warn  : [   28.081460] [    T399] page_type: f5(slab)
> kern  :warn  : [   28.082008] [    T399] raw: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
> kern  :warn  : [   28.083180] [    T399] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
> kern  :warn  : [   28.084355] [    T399] head: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
> kern  :warn  : [   28.085541] [    T399] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
> kern  :warn  : [   28.086725] [    T399] head: 0017ffffc0000003 ffffea0007ae8a01 00000000ffffffff 00000000ffffffff
> kern  :warn  : [   28.087909] [    T399] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> kern  :warn  : [   28.089093] [    T399] page dumped because: kasan: bad access detected

> kern  :err   : [   28.090297] [    T399] Memory state around the buggy address:
> kern  :err   : [   28.091073] [    T399]  ffff8881eba2c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> kern  :err   : [   28.092175] [    T399]  ffff8881eba2c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> kern  :err   : [   28.093276] [    T399] >ffff8881eba2c480: 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc
> kern  :err   : [   28.094376] [    T399]                             ^
> kern  :err   : [   28.095041] [    T399]  ffff8881eba2c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> kern  :err   : [   28.096145] [    T399]  ffff8881eba2c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> kern  :err   : [   28.097247] [    T399] ==================================================================
> kern  :warn  : [   28.098668] [    T399] Disabling lock debugging due to kernel taint

Re: [LTP] [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

[Oliver Sang]

hi, Petr,

On Thu, Apr 16, 2026 at 08:40:51AM +0200, Petr Vorel wrote:
> Hi all,
> 
> [ Cc Mimi and linux-integrity ]
> > Hello,
> 
> > kernel test robot noticed "BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps" on:
> 
> > commit: 07d1ee54da4966c1457602dc088a8a43b29254cb ("[PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default")
> > url: https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
> > base: https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
> > patch link: https://lore.kernel.org/all/20260331183332.1773886-16-michal.grzelak@intel.com/
> > patch subject: [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default
> 
> > in testcase: ltp
> > version: 
> > with following parameters:
> 
> > 	test: ima
> 
> 
> 
> > config: x86_64-rhel-9.4-ltp
> > compiler: gcc-14
> > test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory
> 
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <oliver.sang@intel.com>
> > | Closes: https://lore.kernel.org/oe-lkp/202604150702.d409a2b6-lkp@intel.com
> 
> 
> > The kernel config and materials to reproduce are available at:
> > https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com
> 
> 
> > kern  :err   : [   27.966990] [    T399] ==================================================================
> > kern  :err   : [   27.968126] [    T399] BUG: KASAN: slab-out-of-bounds in parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> > kern  :err   : [   27.969712] [    T399] Read of size 4 at addr ffff8881eba2c49d by task (udev-worker)/399
> 
> > kern  :err   : [   27.971135] [    T399] CPU: 4 UID: 0 PID: 399 Comm: (udev-worker) Tainted: G S                  7.0.0-rc4-01496-g07d1ee54da49 #1 PREEMPT(lazy) 
> > kern  :err   : [   27.971139] [    T399] Tainted: [S]=CPU_OUT_OF_SPEC
> > kern  :err   : [   27.971140] [    T399] Hardware name: ASUSTeK COMPUTER INC. NUC14RVS-B/NUC14RVSU9, BIOS RVMTL357.0047.2025.0108.1408 01/08/2025
> > kern  :err   : [   27.971142] [    T399] Call Trace:
> > kern  :err   : [   27.971144] [    T399]  <TASK>
> > kern  :err   : [   27.971145] [    T399]  dump_stack_lvl+0x47/0x70
> > kern  :err   : [   27.971152] [    T399]  print_address_description+0x88/0x320
> > kern  :err   : [   27.971156] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> > kern  :err   : [   27.971355] [    T399]  print_report+0x106/0x1f4
> > kern  :err   : [   27.971357] [    T399]  ? __virt_addr_valid+0xc4/0x230
> > kern  :err   : [   27.971360] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> > kern  :err   : [   27.971533] [    T399]  kasan_report+0xb5/0xf0
> > kern  :err   : [   27.971537] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> > kern  :err   : [   27.971704] [    T399]  parse_vswing_preemph_snps+0x2dd/0x430 [i915]
> > kern  :err   : [   27.971868] [    T399]  intel_bios_init+0xcc1/0x14b0 [i915]
> > kern  :err   : [   27.972042] [    T399]  ? drm_vblank_init+0x147/0x330 [drm]
> > kern  :err   : [   27.972105] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
> > kern  :err   : [   27.972295] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
> > kern  :err   : [   27.972445] [    T399]  ? __pfx_mutex_lock+0x10/0x10
> > kern  :err   : [   27.972450] [    T399]  ? mutex_lock+0x91/0xf0
> > kern  :err   : [   27.972451] [    T399]  ? __pfx_i915_driver_probe+0x10/0x10 [i915]
> > kern  :err   : [   27.972597] [    T399]  ? drm_privacy_screen_get+0x2bf/0x370 [drm]
> > kern  :err   : [   27.972628] [    T399]  ? intel_display_driver_probe_defer+0x41/0x70 [i915]
> > kern  :err   : [   27.972814] [    T399]  ? i915_pci_probe+0x2ab/0x3b0 [i915]
> > kern  :err   : [   27.972963] [    T399]  ? __pfx_i915_pci_probe+0x10/0x10 [i915]
> > kern  :err   : [   27.973110] [    T399]  local_pci_probe+0xdb/0x1b0
> > kern  :err   : [   27.973114] [    T399]  pci_call_probe+0x153/0x4f0
> > kern  :err   : [   27.973116] [    T399]  ? __pfx_pci_call_probe+0x10/0x10
> > kern  :err   : [   27.973117] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> > kern  :err   : [   27.973119] [    T399]  ? pci_assign_irq+0x80/0x2f0
> > kern  :err   : [   27.973121] [    T399]  ? pci_match_device+0x38d/0x6b0
> > kern  :err   : [   27.973123] [    T399]  ? kernfs_create_link+0x164/0x230
> > kern  :err   : [   27.973127] [    T399]  pci_device_probe+0x173/0x2f0
> > kern  :err   : [   27.973128] [    T399]  call_driver_probe+0x62/0x1f0
> > kern  :err   : [   27.973132] [    T399]  really_probe+0x197/0x770
> > kern  :err   : [   27.973134] [    T399]  __driver_probe_device+0x18c/0x3b0
> > kern  :err   : [   27.973137] [    T399]  driver_probe_device+0x4a/0x130
> > kern  :err   : [   27.973139] [    T399]  __driver_attach+0x18c/0x4f0
> > kern  :err   : [   27.973141] [    T399]  ? __pfx___driver_attach+0x10/0x10
> > kern  :err   : [   27.973143] [    T399]  bus_for_each_dev+0xef/0x170
> > kern  :err   : [   27.973145] [    T399]  ? kasan_unpoison+0x40/0x70
> > kern  :err   : [   27.973147] [    T399]  ? __pfx_bus_for_each_dev+0x10/0x10
> > kern  :err   : [   27.973149] [    T399]  ? __kasan_slab_alloc+0x2f/0x70
> > kern  :err   : [   27.973152] [    T399]  ? klist_add_tail+0x132/0x270
> > kern  :err   : [   27.973154] [    T399]  bus_add_driver+0x2a7/0x4f0
> > kern  :err   : [   27.973156] [    T399]  driver_register+0x1a1/0x370
> > kern  :err   : [   27.973158] [    T399]  i915_init+0x57/0x160 [i915]
> > kern  :err   : [   27.973307] [    T399]  ? __pfx_i915_init+0x10/0x10 [i915]
> > kern  :err   : [   27.973453] [    T399]  do_one_initcall+0x8d/0x3f0
> > kern  :err   : [   27.973455] [    T399]  ? __pfx_do_one_initcall+0x10/0x10
> > kern  :err   : [   27.973457] [    T399]  ? kasan_unpoison+0x3b/0x70
> > kern  :err   : [   27.973458] [    T399]  ? kasan_unpoison+0x40/0x70
> > kern  :err   : [   27.973460] [    T399]  do_init_module+0x281/0x830
> > kern  :err   : [   27.973463] [    T399]  ? __pfx_do_init_module+0x10/0x10
> > kern  :err   : [   27.973464] [    T399]  ? kfree+0x195/0x430
> > kern  :err   : [   27.973467] [    T399]  load_module+0x173d/0x2070
> > kern  :err   : [   27.973469] [    T399]  ? ima_post_read_file+0x18f/0x230
> 
> I'm surprised, but indeed it's could be triggered by IMA.
> 
> Looking at full dmesg [1] I'm surprised that this is triggered before tests are
> actually run and there is no IMA specific kernel command line parameter. That
> means that error is not related to any LTP test.
> 
> Is it always reproducible or just a random glitch?

in our tests, it's quite persistent and clean on parent:

=========================================================================================
tbox_group/testcase/rootfs/kconfig/compiler/test:
  igk-mtl-nuc02/ltp/debian-13-x86_64-20250902.cgz/x86_64-rhel-9.4-ltp/gcc-14/ima

e3d53a63657f3213 07d1ee54da4966c1457602dc088
---------------- ---------------------------
       fail:runs  %reproduction    fail:runs
           |             |             |
           :6          100%           6:6     dmesg.BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps


> 
> ima_post_read_file() is a part of IMA core therefore issue might be not related
> to any config, but just FYI kernel config [2].
> 
> Kind regards,
> Petr
> 
> [1] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/kmsg.xz
> [2] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/config-7.0.0-rc4-01496-g07d1ee54da49
> 
> > kern  :err   : [   27.973474] [    T399]  ? __pfx_load_module+0x10/0x10
> > kern  :err   : [   27.973476] [    T399]  ? security_kernel_post_read_file+0x35/0xf0
> > kern  :err   : [   27.973479] [    T399]  ? __pfx_kernel_read_file+0x10/0x10
> > kern  :err   : [   27.973483] [    T399]  ? __pfx_current_time+0x10/0x10
> > kern  :err   : [   27.973486] [    T399]  ? init_module_from_file+0x157/0x1b0
> > kern  :err   : [   27.973487] [    T399]  init_module_from_file+0x157/0x1b0
> > kern  :err   : [   27.973489] [    T399]  ? __pfx_init_module_from_file+0x10/0x10
> > kern  :err   : [   27.973491] [    T399]  ? touch_atime+0x1bc/0x4f0
> > kern  :err   : [   27.973493] [    T399]  ? _raw_spin_lock+0x80/0xf0
> > kern  :err   : [   27.973494] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> > kern  :err   : [   27.973496] [    T399]  ? __pfx_filemap_read+0x10/0x10
> > kern  :err   : [   27.973498] [    T399]  ? do_sys_openat2+0xeb/0x170
> > kern  :err   : [   27.973501] [    T399]  idempotent_init_module+0x21c/0x770
> > kern  :err   : [   27.973503] [    T399]  ? __pfx_idempotent_init_module+0x10/0x10
> > kern  :err   : [   27.973505] [    T399]  ? fdget+0x54/0x3b0
> > kern  :err   : [   27.973506] [    T399]  ? security_capable+0x35/0xf0
> > kern  :err   : [   27.973509] [    T399]  __x64_sys_finit_module+0xca/0x170
> > kern  :err   : [   27.973511] [    T399]  do_syscall_64+0x108/0x5b0
> > kern  :err   : [   27.973513] [    T399]  ? vfs_read+0x3be/0x9b0
> > kern  :err   : [   27.973514] [    T399]  ? vfs_read+0x3be/0x9b0
> > kern  :err   : [   27.973516] [    T399]  ? __pfx_vfs_read+0x10/0x10
> > kern  :err   : [   27.973517] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
> > kern  :err   : [   27.973519] [    T399]  ? fdget+0x54/0x3b0
> > kern  :err   : [   27.973520] [    T399]  ? __pfx___seccomp_filter+0x10/0x10
> > kern  :err   : [   27.973523] [    T399]  ? __x64_sys_pread64+0x18d/0x1f0
> > kern  :err   : [   27.973525] [    T399]  ? __pfx___x64_sys_pread64+0x10/0x10
> > kern  :err   : [   27.973526] [    T399]  ? fdget+0x54/0x3b0
> > kern  :err   : [   27.973528] [    T399]  ? security_capable+0x35/0xf0
> > kern  :err   : [   27.973530] [    T399]  ? do_syscall_64+0x140/0x5b0
> > kern  :err   : [   27.973531] [    T399]  ? arch_exit_to_user_mode_prepare+0x9e/0xf0
> > kern  :err   : [   27.973533] [    T399]  ? do_syscall_64+0x140/0x5b0
> > kern  :err   : [   27.973534] [    T399]  ? __x64_sys_openat+0x104/0x1f0
> > kern  :err   : [   27.973536] [    T399]  ? __pfx___x64_sys_openat+0x10/0x10
> > kern  :err   : [   27.973538] [    T399]  ? do_syscall_64+0x140/0x5b0
> > kern  :err   : [   27.973540] [    T399]  ? do_syscall_64+0x140/0x5b0
> > kern  :err   : [   27.973541] [    T399]  ? irqentry_exit+0x76/0x4f0
> > kern  :err   : [   27.973544] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > kern  :err   : [   27.973546] [    T399] RIP: 0033:0x7f3689aa8779
> > kern  :err   : [   27.973549] [    T399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 67 76 0d 00 f7 d8 64 89 01 48
> > kern  :err   : [   27.973551] [    T399] RSP: 002b:00007ffca3326338 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
> > kern  :err   : [   27.973555] [    T399] RAX: ffffffffffffffda RBX: 000055c94afdd3e0 RCX: 00007f3689aa8779
> > kern  :err   : [   27.973556] [    T399] RDX: 0000000000000000 RSI: 00007f36882ae44d RDI: 0000000000000053
> > kern  :err   : [   27.973557] [    T399] RBP: 0000000000000000 R08: 0000000000000000 R09: 000055c94af65b30
> > kern  :err   : [   27.973558] [    T399] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36882ae44d
> > kern  :err   : [   27.973559] [    T399] R13: 0000000000020000 R14: 000055c94afb65f0 R15: 0000000000000000
> > kern  :err   : [   27.973561] [    T399]  </TASK>
> 
> > kern  :err   : [   28.051757] [    T399] Allocated by task 399:
> > kern  :warn  : [   28.052350] [    T399]  kasan_save_stack+0x1e/0x70
> > kern  :warn  : [   28.053001] [    T399]  kasan_save_track+0x10/0x30
> > kern  :warn  : [   28.053646] [    T399]  __kasan_kmalloc+0x8b/0xb0
> > kern  :warn  : [   28.054278] [    T399]  __kmalloc_noprof+0x1d8/0x5f0
> > kern  :warn  : [   28.054944] [    T399]  init_bdb_block+0x128/0xc30 [i915]
> > kern  :warn  : [   28.055915] [    T399]  intel_bios_init+0x4de/0x14b0 [i915]
> > kern  :warn  : [   28.056854] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
> > kern  :warn  : [   28.057984] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
> > kern  :warn  : [   28.058917] [    T399]  local_pci_probe+0xdb/0x1b0
> > kern  :warn  : [   28.059565] [    T399]  pci_call_probe+0x153/0x4f0
> > kern  :warn  : [   28.060210] [    T399]  pci_device_probe+0x173/0x2f0
> > kern  :warn  : [   28.060878] [    T399]  call_driver_probe+0x62/0x1f0
> > kern  :warn  : [   28.061547] [    T399]  really_probe+0x197/0x770
> > kern  :warn  : [   28.062168] [    T399]  __driver_probe_device+0x18c/0x3b0
> > kern  :warn  : [   28.062894] [    T399]  driver_probe_device+0x4a/0x130
> > kern  :warn  : [   28.063587] [    T399]  __driver_attach+0x18c/0x4f0
> > kern  :warn  : [   28.064243] [    T399]  bus_for_each_dev+0xef/0x170
> > kern  :warn  : [   28.064898] [    T399]  bus_add_driver+0x2a7/0x4f0
> > kern  :warn  : [   28.065543] [    T399]  driver_register+0x1a1/0x370
> > kern  :warn  : [   28.066202] [    T399]  i915_init+0x57/0x160 [i915]
> > kern  :warn  : [   28.067030] [    T399]  do_one_initcall+0x8d/0x3f0
> > kern  :warn  : [   28.067677] [    T399]  do_init_module+0x281/0x830
> > kern  :warn  : [   28.068320] [    T399]  load_module+0x173d/0x2070
> > kern  :warn  : [   28.068951] [    T399]  init_module_from_file+0x157/0x1b0
> > kern  :warn  : [   28.069678] [    T399]  idempotent_init_module+0x21c/0x770
> > kern  :warn  : [   28.070417] [    T399]  __x64_sys_finit_module+0xca/0x170
> > kern  :warn  : [   28.071143] [    T399]  do_syscall_64+0x108/0x5b0
> > kern  :warn  : [   28.071777] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> > kern  :err   : [   28.072915] [    T399] The buggy address belongs to the object at ffff8881eba2c000
> >                                           which belongs to the cache kmalloc-2k of size 2048
> > kern  :err   : [   28.074832] [    T399] The buggy address is located 0 bytes to the right of
> >                                           allocated 1181-byte region [ffff8881eba2c000, ffff8881eba2c49d)
> 
> > kern  :err   : [   28.077135] [    T399] The buggy address belongs to the physical page:
> > kern  :warn  : [   28.078017] [    T399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eba28
> > kern  :warn  : [   28.079226] [    T399] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> > kern  :warn  : [   28.080389] [    T399] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
> > kern  :warn  : [   28.081460] [    T399] page_type: f5(slab)
> > kern  :warn  : [   28.082008] [    T399] raw: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
> > kern  :warn  : [   28.083180] [    T399] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
> > kern  :warn  : [   28.084355] [    T399] head: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
> > kern  :warn  : [   28.085541] [    T399] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
> > kern  :warn  : [   28.086725] [    T399] head: 0017ffffc0000003 ffffea0007ae8a01 00000000ffffffff 00000000ffffffff
> > kern  :warn  : [   28.087909] [    T399] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> > kern  :warn  : [   28.089093] [    T399] page dumped because: kasan: bad access detected
> 
> > kern  :err   : [   28.090297] [    T399] Memory state around the buggy address:
> > kern  :err   : [   28.091073] [    T399]  ffff8881eba2c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> > kern  :err   : [   28.092175] [    T399]  ffff8881eba2c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> > kern  :err   : [   28.093276] [    T399] >ffff8881eba2c480: 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc
> > kern  :err   : [   28.094376] [    T399]                             ^
> > kern  :err   : [   28.095041] [    T399]  ffff8881eba2c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > kern  :err   : [   28.096145] [    T399]  ffff8881eba2c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> > kern  :err   : [   28.097247] [    T399] ==================================================================
> > kern  :warn  : [   28.098668] [    T399] Disabling lock debugging due to kernel taint

Re: [LTP] [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default

[Michał Grzelak]

[-- Attachment #1: Type: text/plain, Size: 18161 bytes --]

Hi Petr & Oliver,

On Thu, 16 Apr 2026, Oliver Sang wrote:
> hi, Petr,
>
> On Thu, Apr 16, 2026 at 08:40:51AM +0200, Petr Vorel wrote:
>> Hi all,
>>
>> [ Cc Mimi and linux-integrity ]
>>> Hello,
>>
>>> kernel test robot noticed "BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps" on:
>>
>>> commit: 07d1ee54da4966c1457602dc088a8a43b29254cb ("[PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default")
>>> url: https://github.com/intel-lab-lkp/linux/commits/Micha-Grzelak/drm-i915-lt-align-xe3plpd-with-VS-PE-Override-layout/20260401-092928
>>> base: https://gitlab.freedesktop.org/drm/i915/kernel.git for-linux-next
>>> patch link: https://lore.kernel.org/all/20260331183332.1773886-16-michal.grzelak@intel.com/
>>> patch subject: [PATCH v1 15/16] drm/i915/bios: search for VBT #57 by default
>>
>>> in testcase: ltp
>>> version:
>>> with following parameters:
>>
>>> 	test: ima
>>
>>
>>
>>> config: x86_64-rhel-9.4-ltp
>>> compiler: gcc-14
>>> test machine: 22 threads 1 sockets Intel(R) Core(TM) Ultra 9 185H @ 4.5GHz (Meteor Lake) with 32G memory
>>
>>> (please refer to attached dmesg/kmsg for entire log/backtrace)
>>
>>
>>
>>> If you fix the issue in a separate patch/commit (i.e. not just a new version of
>>> the same patch/commit), kindly add following tags
>>> | Reported-by: kernel test robot <oliver.sang@intel.com>
>>> | Closes: https://lore.kernel.org/oe-lkp/202604150702.d409a2b6-lkp@intel.com
>>
>>
>>> The kernel config and materials to reproduce are available at:
>>> https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com
>>
>>
>>> kern  :err   : [   27.966990] [    T399] ==================================================================
>>> kern  :err   : [   27.968126] [    T399] BUG: KASAN: slab-out-of-bounds in parse_vswing_preemph_snps+0x2dd/0x430 [i915]
>>> kern  :err   : [   27.969712] [    T399] Read of size 4 at addr ffff8881eba2c49d by task (udev-worker)/399
>>
>>> kern  :err   : [   27.971135] [    T399] CPU: 4 UID: 0 PID: 399 Comm: (udev-worker) Tainted: G S                  7.0.0-rc4-01496-g07d1ee54da49 #1 PREEMPT(lazy)
>>> kern  :err   : [   27.971139] [    T399] Tainted: [S]=CPU_OUT_OF_SPEC
>>> kern  :err   : [   27.971140] [    T399] Hardware name: ASUSTeK COMPUTER INC. NUC14RVS-B/NUC14RVSU9, BIOS RVMTL357.0047.2025.0108.1408 01/08/2025
>>> kern  :err   : [   27.971142] [    T399] Call Trace:
>>> kern  :err   : [   27.971144] [    T399]  <TASK>
>>> kern  :err   : [   27.971145] [    T399]  dump_stack_lvl+0x47/0x70
>>> kern  :err   : [   27.971152] [    T399]  print_address_description+0x88/0x320
>>> kern  :err   : [   27.971156] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
>>> kern  :err   : [   27.971355] [    T399]  print_report+0x106/0x1f4
>>> kern  :err   : [   27.971357] [    T399]  ? __virt_addr_valid+0xc4/0x230
>>> kern  :err   : [   27.971360] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
>>> kern  :err   : [   27.971533] [    T399]  kasan_report+0xb5/0xf0
>>> kern  :err   : [   27.971537] [    T399]  ? parse_vswing_preemph_snps+0x2dd/0x430 [i915]
>>> kern  :err   : [   27.971704] [    T399]  parse_vswing_preemph_snps+0x2dd/0x430 [i915]
>>> kern  :err   : [   27.971868] [    T399]  intel_bios_init+0xcc1/0x14b0 [i915]
>>> kern  :err   : [   27.972042] [    T399]  ? drm_vblank_init+0x147/0x330 [drm]
>>> kern  :err   : [   27.972105] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
>>> kern  :err   : [   27.972295] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
>>> kern  :err   : [   27.972445] [    T399]  ? __pfx_mutex_lock+0x10/0x10
>>> kern  :err   : [   27.972450] [    T399]  ? mutex_lock+0x91/0xf0
>>> kern  :err   : [   27.972451] [    T399]  ? __pfx_i915_driver_probe+0x10/0x10 [i915]
>>> kern  :err   : [   27.972597] [    T399]  ? drm_privacy_screen_get+0x2bf/0x370 [drm]
>>> kern  :err   : [   27.972628] [    T399]  ? intel_display_driver_probe_defer+0x41/0x70 [i915]
>>> kern  :err   : [   27.972814] [    T399]  ? i915_pci_probe+0x2ab/0x3b0 [i915]
>>> kern  :err   : [   27.972963] [    T399]  ? __pfx_i915_pci_probe+0x10/0x10 [i915]
>>> kern  :err   : [   27.973110] [    T399]  local_pci_probe+0xdb/0x1b0
>>> kern  :err   : [   27.973114] [    T399]  pci_call_probe+0x153/0x4f0
>>> kern  :err   : [   27.973116] [    T399]  ? __pfx_pci_call_probe+0x10/0x10
>>> kern  :err   : [   27.973117] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
>>> kern  :err   : [   27.973119] [    T399]  ? pci_assign_irq+0x80/0x2f0
>>> kern  :err   : [   27.973121] [    T399]  ? pci_match_device+0x38d/0x6b0
>>> kern  :err   : [   27.973123] [    T399]  ? kernfs_create_link+0x164/0x230
>>> kern  :err   : [   27.973127] [    T399]  pci_device_probe+0x173/0x2f0
>>> kern  :err   : [   27.973128] [    T399]  call_driver_probe+0x62/0x1f0
>>> kern  :err   : [   27.973132] [    T399]  really_probe+0x197/0x770
>>> kern  :err   : [   27.973134] [    T399]  __driver_probe_device+0x18c/0x3b0
>>> kern  :err   : [   27.973137] [    T399]  driver_probe_device+0x4a/0x130
>>> kern  :err   : [   27.973139] [    T399]  __driver_attach+0x18c/0x4f0
>>> kern  :err   : [   27.973141] [    T399]  ? __pfx___driver_attach+0x10/0x10
>>> kern  :err   : [   27.973143] [    T399]  bus_for_each_dev+0xef/0x170
>>> kern  :err   : [   27.973145] [    T399]  ? kasan_unpoison+0x40/0x70
>>> kern  :err   : [   27.973147] [    T399]  ? __pfx_bus_for_each_dev+0x10/0x10
>>> kern  :err   : [   27.973149] [    T399]  ? __kasan_slab_alloc+0x2f/0x70
>>> kern  :err   : [   27.973152] [    T399]  ? klist_add_tail+0x132/0x270
>>> kern  :err   : [   27.973154] [    T399]  bus_add_driver+0x2a7/0x4f0
>>> kern  :err   : [   27.973156] [    T399]  driver_register+0x1a1/0x370
>>> kern  :err   : [   27.973158] [    T399]  i915_init+0x57/0x160 [i915]
>>> kern  :err   : [   27.973307] [    T399]  ? __pfx_i915_init+0x10/0x10 [i915]
>>> kern  :err   : [   27.973453] [    T399]  do_one_initcall+0x8d/0x3f0
>>> kern  :err   : [   27.973455] [    T399]  ? __pfx_do_one_initcall+0x10/0x10
>>> kern  :err   : [   27.973457] [    T399]  ? kasan_unpoison+0x3b/0x70
>>> kern  :err   : [   27.973458] [    T399]  ? kasan_unpoison+0x40/0x70
>>> kern  :err   : [   27.973460] [    T399]  do_init_module+0x281/0x830
>>> kern  :err   : [   27.973463] [    T399]  ? __pfx_do_init_module+0x10/0x10
>>> kern  :err   : [   27.973464] [    T399]  ? kfree+0x195/0x430
>>> kern  :err   : [   27.973467] [    T399]  load_module+0x173d/0x2070
>>> kern  :err   : [   27.973469] [    T399]  ? ima_post_read_file+0x18f/0x230
>>
>> I'm surprised, but indeed it's could be triggered by IMA.
>>
>> Looking at full dmesg [1] I'm surprised that this is triggered before tests are
>> actually run and there is no IMA specific kernel command line parameter. That
>> means that error is not related to any LTP test.
>>
>> Is it always reproducible or just a random glitch?
>
> in our tests, it's quite persistent and clean on parent:

I haven't reproduced it myself, but this issue seems somewhat related
with issue observed earlier by CI [1]. I would expect it to not be a
random glitch but a true bug related to the series.

In previous versions of the series, during parsing there was a
unfortunate snippet of:

+	const u32 *tables = block->tables;
+	size_t offset = 0;
+	size_t row_width;
+	const u32 *vals;
+
+	row_width = block->num_columns * sizeof(*tables);
+
+	for (int idx = 0; idx < block->num_tables; idx++) {
+		for (int row = 0; row < num_rows; row++) {
+			vals = &tables[offset];
[...]
+			offset += row_width;
+		}
+	}

Which caused hopping by 4 times more bytes than it should, because the
sizeof() wasn't meant to be there. Since parsing takes place at module
load, looks like it could be the issue. This seems especially convincing
given that report is from parse_vswing_preemph_snps(). I have to also
admit that it would be consistent with review comment from Sashiko [2].

Lastly, sadly due to poorly split commits, 15th patch from v1 turned on
whole VBT #57 searching. This probably caused bisect to point at 15th
patch instead of pointing at patch adding parsing code, which would
clearly show that patch/es introduce/s the bug.

Anyways, now the bug should be fixed in v2 [3].

[1] https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_164196v1/fi-hsw-4770/dmesg0.txt 
[2] https://sashiko.dev/#/patchset/20260331183332.1773886-1-michal.grzelak%40intel.com?part=5 
[3] https://lore.kernel.org/intel-gfx/20260415234639.3577774-21-michal.grzelak@intel.com/

BR,
Michał

> =========================================================================================
> tbox_group/testcase/rootfs/kconfig/compiler/test:
>  igk-mtl-nuc02/ltp/debian-13-x86_64-20250902.cgz/x86_64-rhel-9.4-ltp/gcc-14/ima
>
> e3d53a63657f3213 07d1ee54da4966c1457602dc088
> ---------------- ---------------------------
>       fail:runs  %reproduction    fail:runs
>           |             |             |
>           :6          100%           6:6     dmesg.BUG:KASAN:slab-out-of-bounds_in_parse_vswing_preemph_snps
>
>
>>
>> ima_post_read_file() is a part of IMA core therefore issue might be not related
>> to any config, but just FYI kernel config [2].
>>
>> Kind regards,
>> Petr
>>
>> [1] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/kmsg.xz
>> [2] https://download.01.org/0day-ci/archive/20260415/202604150702.d409a2b6-lkp@intel.com/config-7.0.0-rc4-01496-g07d1ee54da49
>>
>>> kern  :err   : [   27.973474] [    T399]  ? __pfx_load_module+0x10/0x10
>>> kern  :err   : [   27.973476] [    T399]  ? security_kernel_post_read_file+0x35/0xf0
>>> kern  :err   : [   27.973479] [    T399]  ? __pfx_kernel_read_file+0x10/0x10
>>> kern  :err   : [   27.973483] [    T399]  ? __pfx_current_time+0x10/0x10
>>> kern  :err   : [   27.973486] [    T399]  ? init_module_from_file+0x157/0x1b0
>>> kern  :err   : [   27.973487] [    T399]  init_module_from_file+0x157/0x1b0
>>> kern  :err   : [   27.973489] [    T399]  ? __pfx_init_module_from_file+0x10/0x10
>>> kern  :err   : [   27.973491] [    T399]  ? touch_atime+0x1bc/0x4f0
>>> kern  :err   : [   27.973493] [    T399]  ? _raw_spin_lock+0x80/0xf0
>>> kern  :err   : [   27.973494] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
>>> kern  :err   : [   27.973496] [    T399]  ? __pfx_filemap_read+0x10/0x10
>>> kern  :err   : [   27.973498] [    T399]  ? do_sys_openat2+0xeb/0x170
>>> kern  :err   : [   27.973501] [    T399]  idempotent_init_module+0x21c/0x770
>>> kern  :err   : [   27.973503] [    T399]  ? __pfx_idempotent_init_module+0x10/0x10
>>> kern  :err   : [   27.973505] [    T399]  ? fdget+0x54/0x3b0
>>> kern  :err   : [   27.973506] [    T399]  ? security_capable+0x35/0xf0
>>> kern  :err   : [   27.973509] [    T399]  __x64_sys_finit_module+0xca/0x170
>>> kern  :err   : [   27.973511] [    T399]  do_syscall_64+0x108/0x5b0
>>> kern  :err   : [   27.973513] [    T399]  ? vfs_read+0x3be/0x9b0
>>> kern  :err   : [   27.973514] [    T399]  ? vfs_read+0x3be/0x9b0
>>> kern  :err   : [   27.973516] [    T399]  ? __pfx_vfs_read+0x10/0x10
>>> kern  :err   : [   27.973517] [    T399]  ? __pfx__raw_spin_lock+0x10/0x10
>>> kern  :err   : [   27.973519] [    T399]  ? fdget+0x54/0x3b0
>>> kern  :err   : [   27.973520] [    T399]  ? __pfx___seccomp_filter+0x10/0x10
>>> kern  :err   : [   27.973523] [    T399]  ? __x64_sys_pread64+0x18d/0x1f0
>>> kern  :err   : [   27.973525] [    T399]  ? __pfx___x64_sys_pread64+0x10/0x10
>>> kern  :err   : [   27.973526] [    T399]  ? fdget+0x54/0x3b0
>>> kern  :err   : [   27.973528] [    T399]  ? security_capable+0x35/0xf0
>>> kern  :err   : [   27.973530] [    T399]  ? do_syscall_64+0x140/0x5b0
>>> kern  :err   : [   27.973531] [    T399]  ? arch_exit_to_user_mode_prepare+0x9e/0xf0
>>> kern  :err   : [   27.973533] [    T399]  ? do_syscall_64+0x140/0x5b0
>>> kern  :err   : [   27.973534] [    T399]  ? __x64_sys_openat+0x104/0x1f0
>>> kern  :err   : [   27.973536] [    T399]  ? __pfx___x64_sys_openat+0x10/0x10
>>> kern  :err   : [   27.973538] [    T399]  ? do_syscall_64+0x140/0x5b0
>>> kern  :err   : [   27.973540] [    T399]  ? do_syscall_64+0x140/0x5b0
>>> kern  :err   : [   27.973541] [    T399]  ? irqentry_exit+0x76/0x4f0
>>> kern  :err   : [   27.973544] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>> kern  :err   : [   27.973546] [    T399] RIP: 0033:0x7f3689aa8779
>>> kern  :err   : [   27.973549] [    T399] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 67 76 0d 00 f7 d8 64 89 01 48
>>> kern  :err   : [   27.973551] [    T399] RSP: 002b:00007ffca3326338 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
>>> kern  :err   : [   27.973555] [    T399] RAX: ffffffffffffffda RBX: 000055c94afdd3e0 RCX: 00007f3689aa8779
>>> kern  :err   : [   27.973556] [    T399] RDX: 0000000000000000 RSI: 00007f36882ae44d RDI: 0000000000000053
>>> kern  :err   : [   27.973557] [    T399] RBP: 0000000000000000 R08: 0000000000000000 R09: 000055c94af65b30
>>> kern  :err   : [   27.973558] [    T399] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f36882ae44d
>>> kern  :err   : [   27.973559] [    T399] R13: 0000000000020000 R14: 000055c94afb65f0 R15: 0000000000000000
>>> kern  :err   : [   27.973561] [    T399]  </TASK>
>>
>>> kern  :err   : [   28.051757] [    T399] Allocated by task 399:
>>> kern  :warn  : [   28.052350] [    T399]  kasan_save_stack+0x1e/0x70
>>> kern  :warn  : [   28.053001] [    T399]  kasan_save_track+0x10/0x30
>>> kern  :warn  : [   28.053646] [    T399]  __kasan_kmalloc+0x8b/0xb0
>>> kern  :warn  : [   28.054278] [    T399]  __kmalloc_noprof+0x1d8/0x5f0
>>> kern  :warn  : [   28.054944] [    T399]  init_bdb_block+0x128/0xc30 [i915]
>>> kern  :warn  : [   28.055915] [    T399]  intel_bios_init+0x4de/0x14b0 [i915]
>>> kern  :warn  : [   28.056854] [    T399]  intel_display_driver_probe_noirq+0x8d/0x870 [i915]
>>> kern  :warn  : [   28.057984] [    T399]  i915_driver_probe+0x209/0x9f0 [i915]
>>> kern  :warn  : [   28.058917] [    T399]  local_pci_probe+0xdb/0x1b0
>>> kern  :warn  : [   28.059565] [    T399]  pci_call_probe+0x153/0x4f0
>>> kern  :warn  : [   28.060210] [    T399]  pci_device_probe+0x173/0x2f0
>>> kern  :warn  : [   28.060878] [    T399]  call_driver_probe+0x62/0x1f0
>>> kern  :warn  : [   28.061547] [    T399]  really_probe+0x197/0x770
>>> kern  :warn  : [   28.062168] [    T399]  __driver_probe_device+0x18c/0x3b0
>>> kern  :warn  : [   28.062894] [    T399]  driver_probe_device+0x4a/0x130
>>> kern  :warn  : [   28.063587] [    T399]  __driver_attach+0x18c/0x4f0
>>> kern  :warn  : [   28.064243] [    T399]  bus_for_each_dev+0xef/0x170
>>> kern  :warn  : [   28.064898] [    T399]  bus_add_driver+0x2a7/0x4f0
>>> kern  :warn  : [   28.065543] [    T399]  driver_register+0x1a1/0x370
>>> kern  :warn  : [   28.066202] [    T399]  i915_init+0x57/0x160 [i915]
>>> kern  :warn  : [   28.067030] [    T399]  do_one_initcall+0x8d/0x3f0
>>> kern  :warn  : [   28.067677] [    T399]  do_init_module+0x281/0x830
>>> kern  :warn  : [   28.068320] [    T399]  load_module+0x173d/0x2070
>>> kern  :warn  : [   28.068951] [    T399]  init_module_from_file+0x157/0x1b0
>>> kern  :warn  : [   28.069678] [    T399]  idempotent_init_module+0x21c/0x770
>>> kern  :warn  : [   28.070417] [    T399]  __x64_sys_finit_module+0xca/0x170
>>> kern  :warn  : [   28.071143] [    T399]  do_syscall_64+0x108/0x5b0
>>> kern  :warn  : [   28.071777] [    T399]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
>>
>>> kern  :err   : [   28.072915] [    T399] The buggy address belongs to the object at ffff8881eba2c000
>>>                                           which belongs to the cache kmalloc-2k of size 2048
>>> kern  :err   : [   28.074832] [    T399] The buggy address is located 0 bytes to the right of
>>>                                           allocated 1181-byte region [ffff8881eba2c000, ffff8881eba2c49d)
>>
>>> kern  :err   : [   28.077135] [    T399] The buggy address belongs to the physical page:
>>> kern  :warn  : [   28.078017] [    T399] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eba28
>>> kern  :warn  : [   28.079226] [    T399] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
>>> kern  :warn  : [   28.080389] [    T399] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff)
>>> kern  :warn  : [   28.081460] [    T399] page_type: f5(slab)
>>> kern  :warn  : [   28.082008] [    T399] raw: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
>>> kern  :warn  : [   28.083180] [    T399] raw: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
>>> kern  :warn  : [   28.084355] [    T399] head: 0017ffffc0000040 ffff888100042f00 dead000000000100 dead000000000122
>>> kern  :warn  : [   28.085541] [    T399] head: 0000000000000000 0000000800080008 00000000f5000000 0000000000000000
>>> kern  :warn  : [   28.086725] [    T399] head: 0017ffffc0000003 ffffea0007ae8a01 00000000ffffffff 00000000ffffffff
>>> kern  :warn  : [   28.087909] [    T399] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
>>> kern  :warn  : [   28.089093] [    T399] page dumped because: kasan: bad access detected
>>
>>> kern  :err   : [   28.090297] [    T399] Memory state around the buggy address:
>>> kern  :err   : [   28.091073] [    T399]  ffff8881eba2c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>> kern  :err   : [   28.092175] [    T399]  ffff8881eba2c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>> kern  :err   : [   28.093276] [    T399] >ffff8881eba2c480: 00 00 00 05 fc fc fc fc fc fc fc fc fc fc fc fc
>>> kern  :err   : [   28.094376] [    T399]                             ^
>>> kern  :err   : [   28.095041] [    T399]  ffff8881eba2c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>> kern  :err   : [   28.096145] [    T399]  ffff8881eba2c580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>>> kern  :err   : [   28.097247] [    T399] ==================================================================
>>> kern  :warn  : [   28.098668] [    T399] Disabling lock debugging due to kernel taint
>