[PATCH] drm/nouveau/bios/vmap: only read max2 if the header contains it

[PATCH] drm/nouveau/bios/vmap: only read max2 if the header contains it

[Yazdan Ghalavand]

nvbios_vmap_parse() reads the id of the third "max voltage" entry
(max2) from offset 0xc of a version 0x20 voltage map table whenever
the table's *entry* length is at least 0xc. The entry length says
nothing about the size of the header, though. On a GeForce 710M
(GF117) the header is only 0xa bytes long while the entries are 0x26
bytes, so "max2" is actually read from byte 2 of the first voltage map
entry:

  header:  20 0a 26 12 01 c8 00 ff ff ff
  entry 0: 01 10 50 f8 0c 00 ...
                 ^^ read as max2 = 0x50

There is no vmap entry 0x50 (the table has 0x12 entries), so
nvkm_volt_map() falls back to interpreting the id as a voltage in
10 mV units, and nvkm_cstate_find_best() caps every cstate at 800 mV.
That is below the boot voltage (850 mV) and below what every cstate of
the board needs (900-950 mV), so no cstate is ever valid and setting
any pstate fails with -EINVAL.

Check the header length instead of the entry length before reading
max2.

Fermi reclocking is disabled upstream, so on this board the bug is
only visible with reclocking force-enabled, but the parser runs for
every GPU with a version 0x20 vmap table, including those where
reclocking is enabled.

Tested on the GeForce 710M with Fermi reclocking force-enabled locally:
without this patch, writing pstate 0f fails with -EINVAL; with it, the
pstate is accepted and the core clock goes to 774 MHz.

Fixes: 4a4555a7f1dd ("drm/nouveau/volt: Parse the max voltage map entries")
Signed-off-by: Yazdan Ghalavand <yazdanghalavand@gmail.com>
---
 drivers/gpu/drm/nouveau/nvkm/subdev/bios/vmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/vmap.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/vmap.c
index c228ca1..07b3b47 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/vmap.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/vmap.c
@@ -68,7 +68,7 @@ nvbios_vmap_parse(struct nvkm_bios *bios, u8 *ver, u8 *hdr, u8 *cnt, u8 *len,
 	case 0x20:
 		info->max0 = nvbios_rd08(bios, vmap + 0x7);
 		info->max1 = nvbios_rd08(bios, vmap + 0x8);
-		if (*len >= 0xc)
+		if (*hdr > 0xc)
 			info->max2 = nvbios_rd08(bios, vmap + 0xc);
 		else
 			info->max2 = 0xff;
-- 
2.56.0