tnt has uploaded this change for review. ( https://gerrit.osmocom.org/c/osmo-e1-hardware/+/26836 )
Change subject: icE1usb fw: Fix computation of received E1 frames from USB ......................................................................
icE1usb fw: Fix computation of received E1 frames from USB
Several issues :
- The reported length includes the CRC so it's minus 6 and not minus 4. (2 for CRC, 4 for header)
- Cast length to int to make it signed so the minus works
- If the packet is empty, this would be negative (no header), underflow, and then try to submit a giant number of frames to the E1 hardware
Signed-off-by: Sylvain Munaut tnt@246tNt.com Change-Id: Ib754e460290fe2e1551a0090e30a51846131d07d --- M firmware/ice40-riscv/icE1usb/usb_e1.c 1 file changed, 3 insertions(+), 2 deletions(-)
git pull ssh://gerrit.osmocom.org:29418/osmo-e1-hardware refs/changes/36/26836/1
diff --git a/firmware/ice40-riscv/icE1usb/usb_e1.c b/firmware/ice40-riscv/icE1usb/usb_e1.c index 3de6071..ed4826f 100644 --- a/firmware/ice40-riscv/icE1usb/usb_e1.c +++ b/firmware/ice40-riscv/icE1usb/usb_e1.c @@ -171,8 +171,9 @@ usb_data_read(&hdr, ptr, 4);
/* Empty data into the FIFO */ - int n = ((csr & USB_BD_LEN_MSK) - 4) / 32; - n = e1_tx_feed_data((ptr >> 2) + 1, n); + int n = ((int)(csr & USB_BD_LEN_MSK) - 6) / 32; + if (n > 0) + e1_tx_feed_data((ptr >> 2) + 1, n);
refill: /* Refill it */