SPI slave transaction .rx_buffer issue

kyorochan
Posts: 4
Joined: Wed Aug 12, 2026 8:04 am

SPI slave transaction .rx_buffer issue

Postby kyorochan » Wed Aug 12, 2026 8:42 am

Chipset: ESP32S3
ESP-IDF v6.0.2

Code: Select all

#define SPI_RECV_DMA_BUF_SIZE       (8 * 1024)

esp_err_t _spi_slave_receive()
{
	recv_buf = heap_caps_calloc(SPI_RECV_DMA_BUF_SIZE, 1, MALLOC_CAP_DMA);
	
	uint8_t * rx_ptr = recv_buf;
	int offset = 0;
	
	uint32_t bit_length;
	uint32_t reaminder = 11420;
	uint32_t byte_length = 0;
	uint32_t cnt = 0;
	
	while (remainder > 0) {
		if (remainder > SPI_RECV_DMA_BUF_SIZE) {
            		section_size = SPI_RECV_DMA_BUF_SIZE;
        	} else {
            		section_size = remainder;
       	}
       	
       	bit_length = section_size * 8;
        
		spi_slave_transaction_t t = {
            		.length = bit_length,
            		.rx_buffer = (rx_ptr + offset),
            		.tx_buffer = NULL,
            		.flags = 0,
            		.trans_len = 0,
            		.user = NULL,
        	};
        	
        	ret = spi_slave_bus_transmit(&t, portMAX_DELAY);
        	if (ret != ESP_OK) {
        		break;
        	}
        	
        	byte_length = (t.trans_len / 8);
        	remainder -= byte_length;
        	cnt++;
        	
        	// each time, SPI receiver 420 bytes
        	offset += 512;  // for DMA alignment
        	
        	if ((cnt % 10) == 0) { offset = 0; }  // prevent buffer overflow
        }
        
        free(recv_buf);
}
Above code section, it is testing code section.
First invoked, it works well, but second invoked, I got the exception.
Guru Meditation Error: Core 0 panic'ed (LoadProhibited). Exception was unhandled.

Core 0 register dump:
PC : 0x4037e5fa PS : 0x00060f33 A0 : 0x8037e495 A1 : 0x3fcc83a0
--- 0x4037e5fa: block_set_prev_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:123
--- (inlined by) block_mark_as_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:177
--- (inlined by) tlsf_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf.c:631
A2 : 0x3fc95e04 A3 : 0x3fcc9290 A4 : 0x8037d868 A5 : 0x3fc933e0
A6 : 0x3fc92088 A7 : 0x3fcc9290 A8 : 0xd320e6e0 A9 : 0x93545454
A10 : 0x3fcc9288 A11 : 0xfffffffc A12 : 0x00060f20 A13 : 0x3fc964f4
A14 : 0x00060023 A15 : 0x00060f23 SAR : 0x00000005 EXCCAUSE: 0x0000001c
EXCVADDR: 0xd320e6e4 LBEG : 0x40056f5c LEND : 0x40056f72 LCOUNT : 0x00000000
--- 0x40056f5c: memcpy in ROM
--- 0x40056f72: memcpy in ROM


Backtrace: 0x4037e5f7:0x3fcc83a0 0x4037e492:0x3fcc83c0 0x40375f86:0x3fcc83e0 0x4037b0bd:0x3fcc8400 0x4037728e:0x3fcc8420 0x42015433:0x3fcc8440 0x42015462:0x3fcc8480 0x42014e1e:0x3fcc84b0 0x42012117:0x3fcc84d0
--- 0x4037e5f7: offset_to_block at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:146
--- (inlined by) block_next at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:159
--- (inlined by) block_link_next at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:168
--- (inlined by) block_mark_as_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_block_functions.h:176
--- (inlined by) tlsf_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf.c:631
--- 0x4037e492: multi_heap_free_impl at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/multi_heap.c:240
--- (inlined by) multi_heap_free_impl at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/multi_heap.c:229
--- 0x40375f86: heap_caps_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps_base.c:86
--- 0x4037b0bd: free at /home/keroro/.espressif/v6.0.2/esp-idf/components/esp_libc/src/heap.c:34
--- 0x4037728e: spi_slave_uninstall_priv_trans at /home/keroro/.espressif/v6.0.2/esp-idf/components/esp_driver_spi/src/gpspi/spi_slave.c:409
--- 0x42015433: spi_slave_get_trans_result at /home/keroro/.espressif/v6.0.2/esp-idf/components/esp_driver_spi/src/gpspi/spi_slave.c:553
--- 0x42015462: spi_slave_transmit at /home/keroro/.espressif/v6.0.2/esp-idf/components/esp_driver_spi/src/gpspi/spi_slave.c:567
--- 0x42014e1e: spi_slave_bus_transmit at /home/keroro/TempoVision/Firmware/Espressif/ESP32/esp32-s3-spi_TV001_preTest/components/spi_bus_driver/spi_bus_driver.c:358
--- 0x42012117: _spi_slave_receive at /home/keroro/TempoVision/Firmware/Espressif/ESP32/esp32-s3-spi_TV001_preTest/components/sensor_tv001_task/spi_recev_task.c:117
--- (inlined by) spi_slave_bus_seq_task at /home/keroro/TempoVision/Firmware/Espressif/ESP32/esp32-s3-spi_TV001_preTest/components/sensor_tv001_task/spi_recev_task.c:207
If I fixed transaction.rx_buffer = recv_buf, It has no error occurred.

Code: Select all

spi_slave_transaction_t t = {
	.length = bit_length,
	.rx_buffer = recv_buf,
	.tx_buffer = NULL,
	.flags = 0,
	.trans_len = 0,
	.user = NULL,
};
Why esp_driver_spi::spi_slave::spi_slave_bus_transmit() can't handle it. I have already do precaution about DMA alignment.

Sprite
Espressif staff
Espressif staff
Posts: 10652
Joined: Thu Nov 26, 2015 4:08 am

Re: SPI slave transaction .rx_buffer issue

Postby Sprite » Thu Aug 13, 2026 12:14 am

Looks like you try to receive chunks of a SPI_RECV_DMA_BUF_SIZE buffer, but regardless of how large the amount of data you receive is (420 bytes according to the comments?) you increase the buffer offset by 512. That means the offset at some point will be larger than the size of your buffer; you're likely overwriting TLSF structures and that makes it unhappy.

kyorochan
Posts: 4
Joined: Wed Aug 12, 2026 8:04 am

Re: SPI slave transaction .rx_buffer issue

Postby kyorochan » Thu Aug 13, 2026 11:06 am

Code: Select all

cnt++;

// each time, SPI receiver 420 bytes
offset += 512;  // for DMA alignment
        	
if ((cnt % 10) == 0) { offset = 0; }  // prevent buffer overflow
I have buffers size 8192 bytes, and only used 5632 bytes (above code section), it is ring-buffer.
And I make sure echo time SPI-slave only received 420 bytes. I have an array to record received data size.
It seems like gdma issue.
I want to try it on ESP-IDF-5.5

then report the situation later.

Sprite
Espressif staff
Espressif staff
Posts: 10652
Joined: Thu Nov 26, 2015 4:08 am

Re: SPI slave transaction .rx_buffer issue

Postby Sprite » Fri Aug 14, 2026 12:27 am

Fair enough, I didn't see that. As written, your code shouldn't be able to crash... *IF* the SPI transfer indeed doesn't receive more than 420 bytes as you wrote. I'd suggest making sure that can't happen: `bit_length = 512 * 8;`. If that helps things, you know where the issue is.

kyorochan
Posts: 4
Joined: Wed Aug 12, 2026 8:04 am

Re: SPI slave transaction .rx_buffer issue

Postby kyorochan » Fri Aug 14, 2026 3:11 am

Code: Select all

//bit_length = section_size * 8;
        bit_length = 512 * 8;

        spi_slave_transaction_t t = {
            .length = bit_length,
            .rx_buffer = (rx_ptr + offset), 
            // .rx_buffer = recv_buf,
            .tx_buffer = NULL,
            .flags = 0,
            .trans_len = 0,
            .user = NULL,
        };

It doesn't work. I still get exception at second invoked.


tmv> I (12104) spi_recv_task: received = 141120, remainder = 8160, cnt = 336, ret = 0x107
chunk_size[0] = 420 (0x01a4)
chunk_size[1] = 420 (0x01a4)
chunk_size[2] = 420 (0x01a4)
chunk_size[3] = 420 (0x01a4)
chunk_size[4] = 420 (0x01a4)
chunk_size[5] = 420 (0x01a4)
chunk_size[6] = 420 (0x01a4)
chunk_size[7] = 420 (0x01a4)
chunk_size[8] = 420 (0x01a4)
chunk_size[9] = 420 (0x01a4)
chunk_size[10] = 420 (0x01a4)
chunk_size[11] = 420 (0x01a4)
chunk_size[12] = 420 (0x01a4)
chunk_size[13] = 420 (0x01a4)
chunk_size[14] = 420 (0x01a4)
chunk_size[15] = 420 (0x01a4)
chunk_size[16] = 420 (0x01a4)
chunk_size[17] = 420 (0x01a4)
chunk_size[18] = 420 (0x01a4)
chunk_size[19] = 420 (0x01a4)
chunk_size[20] = 420 (0x01a4)
chunk_size[21] = 420 (0x01a4)
chunk_size[22] = 420 (0x01a4)
chunk_size[23] = 420 (0x01a4)
chunk_size[24] = 420 (0x01a4)
chunk_size[25] = 420 (0x01a4)
chunk_size[26] = 420 (0x01a4)
chunk_size[27] = 420 (0x01a4)
chunk_size[28] = 420 (0x01a4)
chunk_size[29] = 420 (0x01a4)
chunk_size[30] = 420 (0x01a4)
chunk_size[31] = 420 (0x01a4)
chunk_size[32] = 420 (0x01a4)
chunk_size[33] = 420 (0x01a4)
chunk_size[34] = 420 (0x01a4)
chunk_size[35] = 420 (0x01a4)
chunk_size[36] = 420 (0x01a4)
chunk_size[37] = 420 (0x01a4)
chunk_size[38] = 420 (0x01a4)
chunk_size[39] = 420 (0x01a4)
chunk_size[40] = 420 (0x01a4)
chunk_size[41] = 420 (0x01a4)
chunk_size[42] = 420 (0x01a4)
chunk_size[43] = 420 (0x01a4)
chunk_size[44] = 420 (0x01a4)
chunk_size[45] = 420 (0x01a4)
chunk_size[46] = 420 (0x01a4)
chunk_size[47] = 420 (0x01a4)
chunk_size[48] = 420 (0x01a4)
chunk_size[49] = 420 (0x01a4)
chunk_size[50] = 420 (0x01a4)
chunk_size[51] = 420 (0x01a4)
chunk_size[52] = 420 (0x01a4)
chunk_size[53] = 420 (0x01a4)
chunk_size[54] = 420 (0x01a4)
chunk_size[55] = 420 (0x01a4)
chunk_size[56] = 420 (0x01a4)
chunk_size[57] = 420 (0x01a4)
chunk_size[58] = 420 (0x01a4)
chunk_size[59] = 420 (0x01a4)
chunk_size[60] = 420 (0x01a4)
chunk_size[61] = 420 (0x01a4)
chunk_size[62] = 420 (0x01a4)
chunk_size[63] = 420 (0x01a4)
chunk_size[64] = 420 (0x01a4)
chunk_size[65] = 420 (0x01a4)
chunk_size[66] = 420 (0x01a4)
chunk_size[67] = 420 (0x01a4)
chunk_size[68] = 420 (0x01a4)
chunk_size[69] = 420 (0x01a4)
chunk_size[70] = 420 (0x01a4)
chunk_size[71] = 420 (0x01a4)
chunk_size[72] = 420 (0x01a4)
chunk_size[73] = 420 (0x01a4)
chunk_size[74] = 420 (0x01a4)
chunk_size[75] = 420 (0x01a4)
chunk_size[76] = 420 (0x01a4)
chunk_size[77] = 420 (0x01a4)
chunk_size[78] = 420 (0x01a4)
chunk_size[79] = 420 (0x01a4)
chunk_size[80] = 420 (0x01a4)
chunk_size[81] = 420 (0x01a4)
chunk_size[82] = 420 (0x01a4)
chunk_size[83] = 420 (0x01a4)
chunk_size[84] = 420 (0x01a4)
chunk_size[85] = 420 (0x01a4)
chunk_size[86] = 420 (0x01a4)
chunk_size[87] = 420 (0x01a4)
chunk_size[88] = 420 (0x01a4)
chunk_size[89] = 420 (0x01a4)
chunk_size[90] = 420 (0x01a4)
chunk_size[91] = 420 (0x01a4)
chunk_size[92] = 420 (0x01a4)
chunk_size[93] = 420 (0x01a4)
chunk_size[94] = 420 (0x01a4)
chunk_size[95] = 420 (0x01a4)
chunk_size[96] = 420 (0x01a4)
chunk_size[97] = 420 (0x01a4)
chunk_size[98] = 420 (0x01a4)
chunk_size[99] = 420 (0x01a4)
chunk_size[100] = 420 (0x01a4)
chunk_size[101] = 420 (0x01a4)
chunk_size[102] = 420 (0x01a4)
chunk_size[103] = 420 (0x01a4)
chunk_size[104] = 420 (0x01a4)
chunk_size[105] = 420 (0x01a4)
chunk_size[106] = 420 (0x01a4)
chunk_size[107] = 420 (0x01a4)
chunk_size[108] = 420 (0x01a4)
chunk_size[109] = 420 (0x01a4)
chunk_size[110] = 420 (0x01a4)
chunk_size[111] = 420 (0x01a4)
chunk_size[112] = 420 (0x01a4)
chunk_size[113] = 420 (0x01a4)
chunk_size[114] = 420 (0x01a4)
chunk_size[115] = 420 (0x01a4)
chunk_size[116] = 420 (0x01a4)
chunk_size[117] = 420 (0x01a4)
chunk_size[118] = 420 (0x01a4)
chunk_size[119] = 420 (0x01a4)
chunk_size[120] = 420 (0x01a4)
chunk_size[121] = 420 (0x01a4)
chunk_size[122] = 420 (0x01a4)
chunk_size[123] = 420 (0x01a4)
chunk_size[124] = 420 (0x01a4)
chunk_size[125] = 420 (0x01a4)
chunk_size[126] = 420 (0x01a4)
chunk_size[127] = 420 (0x01a4)
chunk_size[128] = 420 (0x01a4)
chunk_size[129] = 420 (0x01a4)
chunk_size[130] = 420 (0x01a4)
chunk_size[131] = 420 (0x01a4)
chunk_size[132] = 420 (0x01a4)
chunk_size[133] = 420 (0x01a4)
chunk_size[134] = 420 (0x01a4)
chunk_size[135] = 420 (0x01a4)
chunk_size[136] = 420 (0x01a4)
chunk_size[137] = 420 (0x01a4)
chunk_size[138] = 420 (0x01a4)
chunk_size[139] = 420 (0x01a4)
chunk_size[140] = 420 (0x01a4)
chunk_size[141] = 420 (0x01a4)
chunk_size[142] = 420 (0x01a4)
chunk_size[143] = 420 (0x01a4)
chunk_size[144] = 420 (0x01a4)
chunk_size[145] = 420 (0x01a4)
chunk_size[146] = 420 (0x01a4)
chunk_size[147] = 420 (0x01a4)
chunk_size[148] = 420 (0x01a4)
chunk_size[149] = 420 (0x01a4)
chunk_size[150] = 420 (0x01a4)
chunk_size[151] = 420 (0x01a4)
chunk_size[152] = 420 (0x01a4)
chunk_size[153] = 420 (0x01a4)
chunk_size[154] = 420 (0x01a4)
chunk_size[155] = 420 (0x01a4)
chunk_size[156] = 420 (0x01a4)
chunk_size[157] = 420 (0x01a4)
chunk_size[158] = 420 (0x01a4)
chunk_size[159] = 420 (0x01a4)
chunk_size[160] = 420 (0x01a4)
chunk_size[161] = 420 (0x01a4)
chunk_size[162] = 420 (0x01a4)
chunk_size[163] = 420 (0x01a4)
chunk_size[164] = 420 (0x01a4)
chunk_size[165] = 420 (0x01a4)
chunk_size[166] = 420 (0x01a4)
chunk_size[167] = 420 (0x01a4)
chunk_size[168] = 420 (0x01a4)
chunk_size[169] = 420 (0x01a4)
chunk_size[170] = 420 (0x01a4)
chunk_size[171] = 420 (0x01a4)
chunk_size[172] = 420 (0x01a4)
chunk_size[173] = 420 (0x01a4)
chunk_size[174] = 420 (0x01a4)
chunk_size[175] = 420 (0x01a4)
chunk_size[176] = 420 (0x01a4)
chunk_size[177] = 420 (0x01a4)
chunk_size[178] = 420 (0x01a4)
chunk_size[179] = 420 (0x01a4)
chunk_size[180] = 420 (0x01a4)
chunk_size[181] = 420 (0x01a4)
chunk_size[182] = 420 (0x01a4)
chunk_size[183] = 420 (0x01a4)
chunk_size[184] = 420 (0x01a4)
chunk_size[185] = 420 (0x01a4)
chunk_size[186] = 420 (0x01a4)
chunk_size[187] = 420 (0x01a4)
chunk_size[188] = 420 (0x01a4)
chunk_size[189] = 420 (0x01a4)
chunk_size[190] = 420 (0x01a4)
chunk_size[191] = 420 (0x01a4)
chunk_size[192] = 420 (0x01a4)
chunk_size[193] = 420 (0x01a4)
chunk_size[194] = 420 (0x01a4)
chunk_size[195] = 420 (0x01a4)
chunk_size[196] = 420 (0x01a4)
chunk_size[197] = 420 (0x01a4)
chunk_size[198] = 420 (0x01a4)
chunk_size[199] = 420 (0x01a4)
chunk_size[200] = 420 (0x01a4)
chunk_size[201] = 420 (0x01a4)
chunk_size[202] = 420 (0x01a4)
chunk_size[203] = 420 (0x01a4)
chunk_size[204] = 420 (0x01a4)
chunk_size[205] = 420 (0x01a4)
chunk_size[206] = 420 (0x01a4)
chunk_size[207] = 420 (0x01a4)
chunk_size[208] = 420 (0x01a4)
chunk_size[209] = 420 (0x01a4)
chunk_size[210] = 420 (0x01a4)
chunk_size[211] = 420 (0x01a4)
chunk_size[212] = 420 (0x01a4)
chunk_size[213] = 420 (0x01a4)
chunk_size[214] = 420 (0x01a4)
chunk_size[215] = 420 (0x01a4)
chunk_size[216] = 420 (0x01a4)
chunk_size[217] = 420 (0x01a4)
chunk_size[218] = 420 (0x01a4)
chunk_size[219] = 420 (0x01a4)
chunk_size[220] = 420 (0x01a4)
chunk_size[221] = 420 (0x01a4)
chunk_size[222] = 420 (0x01a4)
chunk_size[223] = 420 (0x01a4)
chunk_size[224] = 420 (0x01a4)
chunk_size[225] = 420 (0x01a4)
chunk_size[226] = 420 (0x01a4)
chunk_size[227] = 420 (0x01a4)
chunk_size[228] = 420 (0x01a4)
chunk_size[229] = 420 (0x01a4)
chunk_size[230] = 420 (0x01a4)
chunk_size[231] = 420 (0x01a4)
chunk_size[232] = 420 (0x01a4)
chunk_size[233] = 420 (0x01a4)
chunk_size[234] = 420 (0x01a4)
chunk_size[235] = 420 (0x01a4)
chunk_size[236] = 420 (0x01a4)
chunk_size[237] = 420 (0x01a4)
chunk_size[238] = 420 (0x01a4)
chunk_size[239] = 420 (0x01a4)
chunk_size[240] = 420 (0x01a4)
chunk_size[241] = 420 (0x01a4)
chunk_size[242] = 420 (0x01a4)
chunk_size[243] = 420 (0x01a4)
chunk_size[244] = 420 (0x01a4)
chunk_size[245] = 420 (0x01a4)
chunk_size[246] = 420 (0x01a4)
chunk_size[247] = 420 (0x01a4)
chunk_size[248] = 420 (0x01a4)
chunk_size[249] = 420 (0x01a4)
chunk_size[250] = 420 (0x01a4)
chunk_size[251] = 420 (0x01a4)
chunk_size[252] = 420 (0x01a4)
chunk_size[253] = 420 (0x01a4)
chunk_size[254] = 420 (0x01a4)
chunk_size[255] = 420 (0x01a4)
chunk_size[256] = 420 (0x01a4)
chunk_size[257] = 420 (0x01a4)
chunk_size[258] = 420 (0x01a4)
chunk_size[259] = 420 (0x01a4)
chunk_size[260] = 420 (0x01a4)
chunk_size[261] = 420 (0x01a4)
chunk_size[262] = 420 (0x01a4)
chunk_size[263] = 420 (0x01a4)
chunk_size[264] = 420 (0x01a4)
chunk_size[265] = 420 (0x01a4)
chunk_size[266] = 420 (0x01a4)
chunk_size[267] = 420 (0x01a4)
chunk_size[268] = 420 (0x01a4)
chunk_size[269] = 420 (0x01a4)
chunk_size[270] = 420 (0x01a4)
chunk_size[271] = 420 (0x01a4)
chunk_size[272] = 420 (0x01a4)
chunk_size[273] = 420 (0x01a4)
chunk_size[274] = 420 (0x01a4)
chunk_size[275] = 420 (0x01a4)
chunk_size[276] = 420 (0x01a4)
chunk_size[277] = 420 (0x01a4)
chunk_size[278] = 420 (0x01a4)
chunk_size[279] = 420 (0x01a4)
chunk_size[280] = 420 (0x01a4)
chunk_size[281] = 420 (0x01a4)
chunk_size[282] = 420 (0x01a4)
chunk_size[283] = 420 (0x01a4)
chunk_size[284] = 420 (0x01a4)
chunk_size[285] = 420 (0x01a4)
chunk_size[286] = 420 (0x01a4)
chunk_size[287] = 420 (0x01a4)
chunk_size[288] = 420 (0x01a4)
chunk_size[289] = 420 (0x01a4)
chunk_size[290] = 420 (0x01a4)
chunk_size[291] = 420 (0x01a4)
chunk_size[292] = 420 (0x01a4)
chunk_size[293] = 420 (0x01a4)
chunk_size[294] = 420 (0x01a4)
chunk_size[295] = 420 (0x01a4)
chunk_size[296] = 420 (0x01a4)
chunk_size[297] = 420 (0x01a4)
chunk_size[298] = 420 (0x01a4)
chunk_size[299] = 420 (0x01a4)
chunk_size[300] = 420 (0x01a4)
chunk_size[301] = 420 (0x01a4)
chunk_size[302] = 420 (0x01a4)
chunk_size[303] = 420 (0x01a4)
chunk_size[304] = 420 (0x01a4)
chunk_size[305] = 420 (0x01a4)
chunk_size[306] = 420 (0x01a4)
chunk_size[307] = 420 (0x01a4)
chunk_size[308] = 420 (0x01a4)
chunk_size[309] = 420 (0x01a4)
chunk_size[310] = 420 (0x01a4)
chunk_size[311] = 420 (0x01a4)
chunk_size[312] = 420 (0x01a4)
chunk_size[313] = 420 (0x01a4)
chunk_size[314] = 420 (0x01a4)
chunk_size[315] = 420 (0x01a4)
chunk_size[316] = 420 (0x01a4)
chunk_size[317] = 420 (0x01a4)
chunk_size[318] = 420 (0x01a4)
chunk_size[319] = 420 (0x01a4)
chunk_size[320] = 420 (0x01a4)
chunk_size[321] = 420 (0x01a4)
chunk_size[322] = 420 (0x01a4)
chunk_size[323] = 420 (0x01a4)
chunk_size[324] = 420 (0x01a4)
chunk_size[325] = 420 (0x01a4)
chunk_size[326] = 420 (0x01a4)
chunk_size[327] = 420 (0x01a4)
chunk_size[328] = 420 (0x01a4)
chunk_size[329] = 420 (0x01a4)
chunk_size[330] = 420 (0x01a4)
chunk_size[331] = 420 (0x01a4)
chunk_size[332] = 420 (0x01a4)
chunk_size[333] = 420 (0x01a4)
chunk_size[334] = 420 (0x01a4)
chunk_size[335] = 420 (0x01a4)

Guru Meditation Error: Core 0 panic'ed (StoreProhibited). Exception was unhandled.

Core 0 register dump:
PC : 0x4037ea26 PS : 0x00060d33 A0 : 0x8037e4fb A1 : 0x3fc98530
--- 0x4037ea26: remove_free_block at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_control_functions.h:374
--- (inlined by) block_locate_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_control_functions.h:619
--- (inlined by) tlsf_malloc at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf.c:444
A2 : 0x3c0419a0 A3 : 0x00000040 A4 : 0x00000004 A5 : 0x3fc99608
A6 : 0x3fc98544 A7 : 0x3fc98540 A8 : 0x00000040 A9 : 0x0000000e
A10 : 0x0000001f A11 : 0x3c040014 A12 : 0x01a401a4 A13 : 0x3c040038
A14 : 0x3c040074 A15 : 0x01a401a4 SAR : 0x0000001f EXCCAUSE: 0x0000001d
EXCVADDR: 0x01a401b0 LBEG : 0x40056f5c LEND : 0x40056f72 LCOUNT : 0x00000000
--- 0x40056f5c: memcpy in ROM
--- 0x40056f72: memcpy in ROM


Backtrace: 0x4037ea23:0x3fc98530 0x4037e4f8:0x3fc98550 0x40375ffc:0x3fc98570 0x4037601c:0x3fc985a0 0x4037614e:0x3fc985c0 0x40375ed7:0x3fc985e0 0x42012507:0x3fc98600 0x4200e199:0x3fc98620 0x420075c3:0x3fc98660
--- 0x4037ea23: remove_free_block at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_control_functions.h:373
--- (inlined by) block_locate_free at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf_control_functions.h:619
--- (inlined by) tlsf_malloc at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/tlsf/tlsf.c:444
--- 0x4037e4f8: multi_heap_malloc_impl at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/multi_heap.c:216
--- 0x40375ffc: aligned_or_unaligned_alloc at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps_base.c:93
--- (inlined by) heap_caps_aligned_alloc_base at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps_base.c:180
--- 0x4037601c: heap_caps_malloc_base at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps_base.c:207
--- 0x4037614e: heap_caps_calloc_base at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps_base.c:337
--- 0x40375ed7: heap_caps_calloc at /home/keroro/.espressif/v6.0.2/esp-idf/components/heap/heap_caps.c:272

kyorochan
Posts: 4
Joined: Wed Aug 12, 2026 8:04 am

Re: SPI slave transaction .rx_buffer issue

Postby kyorochan » Fri Aug 14, 2026 3:56 am

InternalHeapSize: 186263
LargsetFreeBlock: 118784

Heap summary for capabilities 0x0000080C:
At 0x3fc9b280 len 32767 free 32031 allocated 0 min_free 32031
largest_free_block 31744 alloc_blocks 0 free_blocks 1 total_blocks 1
At 0x3fce9710 len 22308 free 2248 allocated 18844 min_free 2220
largest_free_block 2176 alloc_blocks 120 free_blocks 1 total_blocks 121
At 0x3fcf0000 len 32768 free 32032 allocated 0 min_free 32032
largest_free_block 31744 alloc_blocks 0 free_blocks 1 total_blocks 1
At 0x3fc979f0 len 335136 free 119952 allocated 213268 min_free 119952
largest_free_block 118784 alloc_blocks 36 free_blocks 2 total_blocks 38
Totals:
free 186263 allocated 232112 min_free 186235 largest_free_block 118784
Here is the current memory status

Sprite
Espressif staff
Espressif staff
Posts: 10652
Joined: Thu Nov 26, 2015 4:08 am

Re: SPI slave transaction .rx_buffer issue

Postby Sprite » Fri Aug 14, 2026 5:32 am

Odd. I think one of the confounding factors is that you only find out something went wrong on the 2nd run. Can you maybe put a heap_caps_check_integrity_all() in the loop, and panic or something when that returns false? Should bring you closer to when the out-of-bounds write actually happens.

Who is online

Users browsing this forum: ChatGPT-User and 0 guests