On 02/09/2012 09:43 AM, Larry Finger wrote:
> On 02/09/2012 08:41 AM, Tim Gardner wrote:
>>
>> I agree with you about the semantics of rtlpriv->max_fw_size, but I
>> don't agree
>> that the size check is correct. While rtlpriv->max_fw_size has been
>> set to
>> sizeof(struct rt_firmware), that value is _way_ bigger then the size
>> of the
>> target buffer.
>>
>> sizeof(struct rt_firmware) == 64000+64000+164000 plus some change
>>
>> The target buffer size is only 164000 bytes.
>>
>> I've attached v2 of the patch that is simpler and may serve to better
>> illustrate
>> my point. By the way, Ben Hutchings was right about the original patch
>> having an
>> off by one error. This version also clears rtlpriv->max_fw_size if the
>> size
>> check fails. Probably should have mentioned that in the commit log.
>
> I agree that Ben is right.
>
> This thread forced me to go back to square one in analyzing the
> situation. For the other drivers in the rtlwifi family, the firmware
> file contains an image that is directly stuffed into the device. For the
> RTL8192SE devices, it is more complicated. The structure is described in
> struct rt_firmware. At the moment, the arrays there are grossly
> oversized. They could be as follows:
>
> struct rt_firmware {
> struct fw_hdr *pfwheader;
> enum fw_status fwstatus;
> u16 firmwareversion;
> u8 fw_imem[RTL8190_MAX_IMEM_CODE_SIZE];
> u8 fw_emem[RTL8190_MAX_DMEM_CODE_SIZE];
> u32 fw_imem_len;
> u32 fw_emem_len;
> u8 sz_fw_tmpbuffer[RTL8190_MAX_FIRMWARE_SIZE];
> u32 sz_fw_tmpbufferlen;
> u16 cmdpacket_fragthresold;
> };
>
> with
>
> RTL8190_MAX_IMEM_CODE_SIZE = 54000 (current fw is 51,208),
> RTL8190_MAX_DMEM_CODE_SIZE = 40000 (current fw is 37,520), and
> RTL8190_MAX_FIRMWARE_SIZE = 90000 (it holds the raw firmware image,
> which is currently 88,856).
>
> Ultimately, all three arrays should be eliminated. Now that we are using
> asynchronous loading, the kernel should keep its cached data and not
> copy it into the driver's private storage when a pointer will suffice.
> All the drivers need this change, but that can wait for now.
>
> I will ACK the patch if you resumit it with
> #define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE 90000
>
> Larry

v3 expands the commit log a bit. It doesn't apply to stable 3.2.y, but 
could easily be backported. If I remember I'll do it when its merged in 
Linus' tree.

rtg
-- 
Tim Gardner tim.gardner@canonical.com