I am porting PPCBoot 2.0.0 to the Xilinx ML300. I know PPCBoot is deprecated in favor of U-Boot, but the nearest port for our board was a PPCBoot port that I got from someone who never submitted their changes.

Everything works fine until the call from board_init_r() in lib_ppc/board.c to devices_init(). Then somewhere in devices_init() there is a call to malloc() which never returns and overwrites much of system memory.

I put some printf's in the dlmalloc.c code to try to figure out what is going on. I am seeing some really large values for victim->size: 0x22fc0, 0x22cb0, 0x7ff2cd0, 0x3d747478, 0x626f6f74

these are strange values for victim->size because TOTAL_MALLOC_LEN is only 0x20000. How can the remaining size for an allocation victim be larger than the total amount of heap space?

When I go and look at memory it looks like it has been overwritten by the runaway malloc routine. Memory is overwritten by a sequence of incrementing values.

Has anyone else had problems like this? I compared the malloc code from U-Boot 1.0.0 to PPCBoot 2.0.0 and except for spacing they look the same. I then built PPCBoot with the dlmalloc.c from U-Boot and the problem is still there.

---- mike wellington be_a_fanatic@yahoo.com mike@lo-ex.com wellington@lucent.com 720.434.7559