This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMS320F28388D: mem_free_count is greater than mem_alloc_count in LWIP(TMS320F28388D)

Part Number: TMS320F28388D
Other Parts Discussed in Thread: C2000WARE, TMS320F28388S

Tool/software:

hello, 

my application's cm core keeps crashing giving FaultISR 

and sometimes raises mem_malloc error like I previously asked

which part should I check to see if mem is freed more times than it was allcoated?

  • Hi, 

    You can view the memory allocation for your application by selecting View -> memory allocation in CCS. Can you confirm if you are using the latest version of C2000Ware. There should be a fix that address this issue.

    There's a similar forum post that you can reference here:

    https://e2e.ti.com/support/microcontrollers/c2000-microcontrollers-group/c2000/f/c2000-microcontrollers-forum/1100471/tms320f28388d-fault-lwip-f2838x---full-memory-without-reasons 

    Regards,

    Ozino

  • I'm using c2000ware version 5.03.00.00.

    I've already applied the solution provided from the post you referenced but still crashes.

    What I've noticed is that it only crashes when I'm debugging.

  • Hi Mark,

     I am having this post forwarded to the LWIP experts to comment further.

    Regards,

    Ozino

  • I am experiencing the same problem with double freeing of LWIP buffers. I've been trying to power through it, but I think there is some fundamental error with the LwIP examples even with the 5.4.0.0 C2000ware. I am using the TMS320F28388S processor.

    Turning on the LWIP_STATS and MEM_STATS defines show the illegal count being incremented for double free operations.

    I have traced part of the problem to the loop in f2838xif_process_transmit from f2838xif.c that is freeing a chain of packet descriptors.

        do
        {
            pktDescPtrShadow = pktDescPtr->nextPacketDesc;
            mem_free(pktDescPtr);
            pktDescPtr = pktDescPtrShadow;
        }
        while(pktDescPtr != 0);

    This code can be traced back to being called from Ethernet_removePacketsFromTxQueue [driverlib_cm/ethernet.c] which is popping packets one at a time off of the descQueue using Ethernet_performPopOnPacketQueue and calling the pfcbFreePacket function on them.

    static Ethernet_Pkt_Desc *Ethernet_performPopOnPacketQueue(
                Ethernet_PKT_Queue_T *pktQueuePtr)
    {
        Ethernet_Pkt_Desc *pktDescHdrPtr;
    
        pktDescHdrPtr = pktQueuePtr->head;
    
        if(0U != pktDescHdrPtr)
        {
            pktQueuePtr->head = pktDescHdrPtr->nextPacketDesc;
            pktQueuePtr->count--;
        }
    
        return(pktDescHdrPtr);
    }

    pktQueuePtr->head keeps a pointer to pktDescHdrPtr->nextPacketDesc which is getting freed in f2838xif_process_transmit. The problem can get particularly tough if there are more packets getting processed that reuse these buffers and cause circular references in the descriptor nextPacketDesc links.

    One of my attempts to work through this was to only free one item at a time in f2838xif_process_transmit, but that led to memory leaks and ultimately running out of available memory.

    Please let me know if there are any further tests or fixes that I can try.