icE1usb fw: Fix computation of received E1 frames from USB
Several issues :
- The reported length includes the CRC so it's minus 6 and
not minus 4. (2 for CRC, 4 for header)
- Cast length to int to make it signed so the minus works
- If the packet is empty, this would be negative (no header),
underflow, and then try to submit a giant number of frames
to the E1 hardware
Signed-off-by: Sylvain Munaut <tnt@246tNt.com>
Change-Id: Ib754e460290fe2e1551a0090e30a51846131d07d
diff --git a/firmware/ice40-riscv/icE1usb/usb_e1.c b/firmware/ice40-riscv/icE1usb/usb_e1.c
index 3de6071..ed4826f 100644
--- a/firmware/ice40-riscv/icE1usb/usb_e1.c
+++ b/firmware/ice40-riscv/icE1usb/usb_e1.c
@@ -171,8 +171,9 @@
usb_data_read(&hdr, ptr, 4);
/* Empty data into the FIFO */
- int n = ((csr & USB_BD_LEN_MSK) - 4) / 32;
- n = e1_tx_feed_data((ptr >> 2) + 1, n);
+ int n = ((int)(csr & USB_BD_LEN_MSK) - 6) / 32;
+ if (n > 0)
+ e1_tx_feed_data((ptr >> 2) + 1, n);
refill:
/* Refill it */