Hi all,
   I added some printf message into malloc.c, and find that the function setup() which used to init the memory seems not executed very well.
I put my own malloc.c and the log attached to this mail. Hope some one can help me to find out the problems.

static void setup(void)
{
    int size = (unsigned int)(&_eheap - &_heap) - HDRSIZE;

    *((hdrtype_t *) hstart) = FREE_BLOCK(size);
    printf("%s the memory size:0x%x,begin:0x%x end:0x%x, hstart:0x%x\n",__func__,size,(unsigned int)&_heap,(unsigned int)&_eheap,(unsigned int )*((hdrtype_t *) hstart));


}

static void *alloc(int len)
{
    hdrtype_t header;
    void *ptr = hstart;
    printf("%s length=0x%x, the ptr=0x%x\n",__func__,len,(unsigned int )*((hdrtype_t*)ptr));
    printf("%s the memory begin:0x%x end:0x%x, hstart:0x%x\n",__func__,(unsigned int)&_heap,(unsigned int)&_eheap,(unsigned int )*((hdrtype_t *) hstart));
    /* Align the size. */
    len = (len + 3) & ~3;

    if (!len || len > 0xffffff)
        return (void *)NULL;

    /* Make sure the region is setup correctly. */
    if (!HAS_MAGIC(*((hdrtype_t *) ptr)))
        setup();
    if (!HAS_MAGIC(*((hdrtype_t *) ptr))){
        printf("set up failed,ptr=0x%x\n",(unsigned int)*((hdrtype_t *) ptr));
    }
    /* Find some free space. */
    do {
        header = *((hdrtype_t *) ptr);
        int size = SIZE(header);

        if (!HAS_MAGIC(header) || size == 0) {
            printf("memory allocator panic!!! the size=0x%x. header=0x%x\n",size,(unsigned int)header);
            halt();
        }

        if (header & FLAG_FREE) {
            if (len <= size) {
                void *nptr = ptr + (HDRSIZE + len);
                int nsize = size - (HDRSIZE + len);

                /* If there is still room in this block,
                 * then mark it as such otherwise account
                 * the whole space for that block.
                 */

                if (nsize > 0) {
                    /* Mark the block as used. */
                    *((hdrtype_t *) ptr) = USED_BLOCK(len);

                    /* Create a new free block. */
                    *((hdrtype_t *) nptr) =
                        FREE_BLOCK(nsize);
                } else {
                    /* Mark the block as used. */
                    *((hdrtype_t *) ptr) = USED_BLOCK(size);
                }

                return (void *)(ptr + HDRSIZE);
            }
        }

        ptr += HDRSIZE + size;

    } while (ptr < hend);

    /* Nothing available. */
    return (void *)NULL;
}
log:
Attempting to init PCI bdf 06:05.0 (dev/ven 30381106)
Copying option rom (size 130560) from 0xfff00000 to ce000
Checking rom 0x000ce000 (sig aa55 size 255)
Running option rom at ce00:0003
hello, initialize_usb
00:13.0 4387:1002.0 OHCI controller
Not supported.
00:13.1 4388:1002.1 OHCI controller
Not supported.
00:13.2 4389:1002.2 OHCI controller
Not supported.
00:13.3 438a:1002.3 OHCI controller
Not supported.
00:13.4 438b:1002.4 OHCI controller
Not supported.
00:13.5 4386:1002.5 EHCI controller
Not supported.
00:05.0 3038:1106.0 UHCI controller
alloc length=0x238, the ptr=0x0
alloc the memory begin:0x7860 end:0x57860, hstart:0x0
setup the memory size:0x4fffc,begin:0x7860 end:0x57860, hstart:0xaa04fffc
set up failed,ptr=0x0
memory allocator panic!!! the size=0x0. header=0x0

--
Jason Wang
Peking University