daniel-p-carvalho opened a new pull request, #20574:
URL: https://github.com/apache/nuttx/pull/20574
## Summary
`pic32mz_txdone()` asserted that a TX descriptor is available right after
reclaiming the transmitted descriptors, and then polled the network
unconditionally. A TX done event can belong to a packet that an earlier
`pic32mz_txdone()` already reclaimed, and the TX ring may have been filled
again since. In that case no descriptor is available and
`pic32mz_transmit()` ran without one: the assertion fails with
`CONFIG_DEBUG_ASSERTIONS`, and with assertions disabled it is a NULL
pointer dereference.
When no descriptor is available after the reclaim, re-arm the TX
interrupts and the TX timeout and leave the poll to the next TX done
event.
This was seen with a bridge (`net/bridge`) on `eth0`, which keeps the TX
ring full when it forwards continuously: TCP from the board to a host
crashed in the first seconds.
## Impact
* PIC32MZ Ethernet driver only (`arch/mips/src/pic32mz/pic32mz_ethernet.c`).
No Kconfig, API or documentation change.
* Removes a crash when the TX ring is full at a TX done event.
## Testing
Host: Ubuntu Linux x86_64. Board derived from the Microchip EV49N51A
(PIC32MZ-W1, LAN8720A), XC32 v6.00.
* **Hardware:** the same change, on top of the previous Ethernet fixes,
with `net/bridge` on `eth0`: TCP board to host went from a crash within
seconds to a steady 40 Mbit/s (`iperf`, 100 Mbit/s full duplex link).
* **This branch** (rebased on current master, where the assertion sits
before the reclaim and is removed here): builds with `ev49n51a:netnsh`;
`checkpatch.sh -g` passes. It was not re-run on hardware in this exact
form.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
