Repository navigation
esp32s3_wifi: stop RX DMA when the driver disables it - #9
Merged
Merged
Conversation
esp_wifi_stop() clears bit 31 of DMA_IN_STATUS and frees the RX descriptor ring. The model kept writing incoming frames through the stale ring, which corrupted the guest heap a few ms after every Wi-Fi stop (seen as random heap asserts in CrossDink after its Wi-Fi remote paused). Drop frames while RX DMA is disabled, and never write a descriptor software owns or past its buffer size. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EeGGE28yr2hgb7r7vGQcFZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Before: after the firmware stopped Wi-Fi (CrossDink's Wi-Fi remote pausing for a MACRO, KOSync hand-offs), the Wi-Fi model kept writing incoming frames through the freed RX descriptor ring. The guest heap got corrupted within a few ms, and CrossDink crashed later in unrelated frees (~CssParser, expat, TLSF asserts).
After: frames are dropped while RX DMA is disabled, and the model never writes a descriptor software owns or past its buffer size.
esp_wifi_stop()clears bit 31 of DMA_IN_STATUS (0x84) and then frees the ring; the model ignored that bit.How: gate
Esp32_sendFrameon DMA_IN_STATUS bit 31; skip descriptors with owner=0 or size < frame length.Evidence: CrossDink x4-pro-debug with comprehensive heap poisoning and a 500 ms integrity checker. Before: "CORRUPT HEAP: Invalid data at 0x3fccdd5c. Expected 0xfefefefe got 0xfe04eefe" 5 ms after the remote went off. That address is the freed descriptor the model wrote back. After: 8 MACRO runs with HTTP traffic and 2800 heap checks were all clean, and the remote rejoined Wi-Fi each time.
🤖 Generated with Claude Code
https://claude.ai/code/session_01EeGGE28yr2hgb7r7vGQcFZ
Generated by Claude Code