FreeCalypso > hg > fc-magnetite
view cdg-hybrid/sap/gmmreg.pdf @ 516:1ed9de6c90bd
src/g23m-gsm/sms/sms_for.c: bogus malloc removed
The new error handling code that was not present in TCS211 blob version
contains a malloc call that is bogus for 3 reasons:
1) The memory allocation in question is not needed in the first place;
2) libc malloc is used instead of one of the firmware's proper ways;
3) The memory allocation is made inside a function and then never freed,
i.e., a memory leak.
This bug was caught in gcc-built FreeCalypso fw projects (Citrine
and Selenite) because our gcc environment does not allow any use of
libc malloc (any reference to malloc produces a link failure),
but this code from TCS3.2 is wrong even for Magnetite: if this code
path is executed repeatedly over a long time, the many small allocations
made by this malloc call without a subsequent free will eventually
exhaust the malloc heap provided by the TMS470 environment, malloc will
start returning NULL, and the bogus code will treat it as an error.
Because the memory allocation in question is not needed at all,
the fix entails simply removing it.
author | Mychaela Falconia <falcon@freecalypso.org> |
---|---|
date | Sun, 22 Jul 2018 06:04:49 +0000 |
parents | e7a67accfad9 |
children |
line wrap: on
line source
;******************************************************************************** ;*** File : gmmreg.pdf ;*** Creation : Wed Mar 11 09:58:04 CST 2009 ;*** XSLT Processor : Apache Software Foundation / http://xml.apache.org/xalan-j / supports XSLT-Ver: 1 ;*** Copyright : (c) Texas Instruments AG, Berlin Germany 2002 ;******************************************************************************** ;*** Document Type : Service Access Point Specification ;*** Document Name : gmmreg ;*** Document No. : 8441.115.99.013 ;*** Document Date : 2002-11-28 ;*** Document Status: BEING_PROCESSED ;*** Document Author: DPI ;******************************************************************************** PRAGMA SRC_FILE_TIME "Thu Nov 29 09:42:12 2007" PRAGMA LAST_MODIFIED "2002-11-28" PRAGMA ID_AND_VERSION "8441.115.99.013" CONST GMMREG_MAX_PLMN_ID 12 ; CONST MMR_MAX_TEXT_LEN 40 ; CONST SIZE_MCC 3 ; CONST SIZE_MNC 3 ; VALTAB VAL_attach_type VAL DEF "Combined GPRS attached" VAL 1 GMMREG_AT_GPRS "GPRS-only attached" VAL 2 GMMREG_AT_IMSI "non-GPRS-only attached" VAL 3 GMMREG_AT_COMB "Combined GPRS/IMSI attached" VALTAB VAL_detach_type VAL DEF "GPRS detach" VAL 1 GMMREG_DT_GPRS "GPRS detach ( IMSI attached, GPRS will be reattached)" VAL 2 GMMREG_DT_IMSI "IMSI detach ( GPRS attached)" VAL 3 GMMREG_DT_COMB "Combined GPRS/IMSI detach ( GPRS will be reattached)" VAL 4 GMMREG_DT_SIM_REMOVED "SIM removed" VAL 5 GMMREG_DT_POWER_OFF "Power off" VAL 6 GMMREG_DT_DISABLE_GPRS "GPRS disabled" VAL 7 GMMREG_DT_LIMITED_SERVICE "Limited Service requested" VAL 8 GMMREG_DT_SOFT_OFF "soft power off. SIM data is not cleaned" VALTAB VAL_v_plmn VAL 1 V_PLMN_PRES "present" VAL 255 GMMREG_PLMN_NOT_PRES "not present" VALTAB VAL_cause VAL 0x0402 MMCS_IMSI_IN_HLR "IMSI unknown in HLR" VAL 0x0403 MMCS_ILLEGAL_MS "Illegal MS" VAL 0x0404 MMCS_IMSI_IN_VLR "IMSI unknown in VLR" VAL 0x0405 MMCS_IMEI_NOT_ACCEPTED "IMEI not accepted" VAL 0x0406 MMCS_ILLEGAL_ME "Illegal ME" VAL 0x040B MMCS_PLMN_NOT_ALLOWED "PLMN not allowed" VAL 0x040C MMCS_LA_NOT_ALLOWED "Location Area not allowed" VAL 0x040D MMCS_ROAMING_NOT_ALLOWED "Roaming not allowed in this location area" VAL 0x040F MMCS_NO_SUITABLE_CELL_IN_LA %REL99% "Find another allowed location area in the same PLMN" VAL 0x0411 MMCS_NETWORK_FAILURE "Network failure" VAL 0x0416 MMCS_CONGESTION "Congestion" VAL 0x0420 MMCS_SERVICE_NOT_SUPPORTED "Service option not supported" VAL 0x0421 MMCS_SERVICE_NOT_SUBSCRIBED "Requested service option not subscribed" VAL 0x0422 MMCS_SERVICE_ORDER "Service option temporarily out of order" VAL 0x0426 MMCS_IDENTIFIY "Call cannot be identified" VAL 0x0430 MMCS_RETRY_IN_NEW_CELL "retry upon entry into a new cell (mapped 0x0430..0x043f -> 0x0430)" VAL 0x045F MMCS_INCORRECT_MESSAGE "Semantically incorrect message" VAL 0x0460 MMCS_INVALID_MAND_MESSAGE "Invalid mandatory information" VAL 0x0461 MMCS_MESSAGE_TYPE_NOT_IMPLEM "Message type non-existent or not implemented" VAL 0x0462 MMCS_MESSAGE_TYPE_INCOMPAT "Message type not compatible with the protocol state" VAL 0x0463 MMCS_IE_NOT_IMPLEM "Information element non-existent or not implemented" VAL 0x0464 MMCS_CONDITIONAL_IE "Conditional IE error" VAL 0x0465 MMCS_MESSAGE_INCOMPAT "Message not compatible with the protocol state" VAL 0x046F MMCS_UNSPECIFIED "Protocol error, unspecified" VAL 0xC400 MMCS_SUCCESS "No error, successful operation (MM)" VAL 0xC480 MMCS_NO_REGISTRATION "MS is not registered or deregistration started" VAL 0xC481 MMCS_TIMER_RECOVERY "time-out in MM during establishment" VAL 0xC482 MMCS_NO_REESTABLISH "Cell does not support call reestablishment" VAL 0xC483 MMCS_INT_PREEM "Preemptive release, e.g. MO-MT clash in MM" VAL 0xC484 MMCS_PLMN_NOT_IDLE_MODE "reject, not in idle mode (MMR_PLMN_IND)" VAL 0xC488 MMCS_AUTHENTICATION_REJECTED "AUTHENTICATION REJECT received" VAL 0xC489 MMCS_SIM_REMOVED "A valid SIM is not present" VAL 0xC4FF MMCS_INT_NOT_PRESENT "No error cause (MM)" VAL 0x0A02 GMMCS_IMSI_UNKNOWN "IMSI unknown in HLR" VAL 0x0A03 GMMCS_ILLEGAL_MS "Illegal MS" VAL 0x0A06 GMMCS_ILLEGAL_ME "Illegal ME" VAL 0x0A07 GMMCS_GPRS_NOT_ALLOWED "GPRS services not allowed" VAL 0x0A08 GMMCS_GSM_GPRS_NOT_ALLOWED "GPRS services and non-GPRS services not allowed" VAL 0x0A09 GMMCS_NO_MS_ID "MS identity cannot be derived by the network" VAL 0x0A0A GMMCS_IMPLICIT_DETACHED "Implicitly detached" VAL 0x0A0B GMMCS_PLMN_NOT_ALLOWED "PLMN not allowed" VAL 0x0A0C GMMCS_LA_NOT_ALLOWED "Location Area not allowed" VAL 0x0A0D GMMCS_ROAMING_NOT_ALLOWED "Roaming not allowed in this location area" VAL 0x0A0E GMMCS_GPRS_NOT_ALLOWED_IN_PLMN "GPRS services not allowed in this PLMN" VAL 0xA0F GMMCS_NO_SUITABLE_CELL_IN_LA %REL99% "No Suitable Cell" VAL 0x0A10 GMMCS_MSC_TEMP_NOT_REACHABLE "MSC temporarily not reachable" VAL 0x0A11 GMMCS_NET_FAIL "Network failure" VAL 0x0A16 GMMCS_CONGESTION "Congestion" VAL 0x0A30 GMMCS_RETRY_IN_NEW_CELL "retry upon entry into a new cell (- 0x0A3F)" VAL 0x0A5F GMMCS_SEMANTIC_INCORRECT "Semantically incorrect message" VAL 0x0A60 GMMCS_INVALID_M_INFO "Invalid mandatory information" VAL 0x0A61 GMMCS_TYPE_INVALID "Message type non-existent or not implemented" VAL 0x0A62 GMMCS_TYPE_INCOMPATIBLE "Message type not compatible with the protocol state" VAL 0x0A63 GMMCS_IE_INVALID "Information element non-existent or not implemented" VAL 0x0A64 GMMCS_COND_IE_ERROR "Conditional IE error" VAL 0x0A65 GMMCS_MESSAGE_INVALID "Message not compatible with the protocol state" VAL 0x0A6F GMMCS_PROTOCOL_ERROR "Protocol error, unspecified" VAL 0x4A07 GMMCS_INT_PROTOCOL_ERROR "GPRS services not allowed (MS MM originated)" VAL 0x4A0A GMMCS_INT_IMPLICIT_DETACHED "Implicitely detached (MS MM originated)" VAL 0x4A6F GNMCS_INT_PROTOCOL_ERROR "Protocol error, unspecified (MS MM originated)" VAL 0x8AFF GMMCS_NET_CAUSE_NOT_PRESENT "Network send message without cause information element" VAL 0xCA00 GMMCS_SUCCESS "No error, successful operation (GMM)" VAL 0xCA80 GMMCS_AAC_OVER_5 "attach_attempt counter over or equal 5" VAL 0xCA81 GMMCS_AAC_UNDER_5 "attach_attempt counter under 5" VAL 0xCA88 GMMCS_AUTHENTICATION_REJECTED "AUTHENTICATION REJECT received" VAL 0xCA89 GMMCS_SIM_REMOVED "reserved for GACI" VAL 0xCA8A GMMCS_POWER_OFF "reserved for GACI" VAL 0xCA8B GMMCS_NO_SERVICE "reserved for GACI, no service available" VAL 0xCA8C GMMCS_LIMITED_SERVICE "reserved for GACI" VAL 0xCAFF GMMCS_INT_NOT_PRESENT "No error cause (GMM)" VALTAB VAL_mobile_class VAL DEF "Combined GPRS attach" VAL 1 GMMREG_CLASS_A "Combined GPRS" VAL 2 GMMREG_CLASS_B "GPRS and GSM" VAL 3 GMMREG_CLASS_BC "Combined GPRS if possible, otherwise GSM only" VAL 4 GMMREG_CLASS_BG "Combined GPRS if possible, otherwise GPRS only" VAL 5 GMMREG_CLASS_CC "GSM-only" VAL 6 GMMREG_CLASS_CG "GPRS-only" VALTAB VAL_forb_ind VAL 0 FORB_PLMN_NOT_INCLUDED "Not member of the forbidden PLMN list" VAL 1 FORB_PLMN_INCLUDED "Member of the forbidden PLMN list" VALTAB VAL_gprs_status VAL DEF "PLMN supports GPRS and GSM" VAL 0 GMMREG_GPRS_GSM "PLMN supports GPRS and GSM" VAL 1 GMMREG_GPRS_ONLY "PLMN supports only GPRS" VAL 2 GMMREG_GSM_ONLY "PLMN supports only GSM" VALTAB VAL_cell_state VAL DEF "full service" VAL 0 GMMREG_FULL_SERVICE "full service" VAL 1 GMMREG_LIMITED_SERVICE "limited service" VAL 2 GMMREG_CS_CALL "limited service because of switching to dedicated mode" VAL 3 GMMREG_GPRS_NOT_SUPPORTED "no GPRS cell available" VAL 4 GMMREG_TRY_TO_UPDATE "next attempt to update MS" VALTAB VAL_net_selection_mode VAL 0 GMMREG_NET_SEL_MODE_AUTO "automatic mode" VAL 1 GMMREG_NET_SEL_MODE_MAN "manual mode" VALTAB VAL_time_zone VAL 0 TIMEZONE_GMT "GMT" VAL 0x40 TIMEZONE_GMT_PLS_1HR "GMT + 1 hour" VAL 0x80 TIMEZONE_GMT_PLS_2HR "GMT + 2 hours" VAL 0x48 TIMEZONE_GMT_MIN_1HR "GMT - 1 hour" VAL 0x88 TIMEZONE_GMT_MIN_2HR "GMT - 2 hours" VALTAB VAL_month VAL 1 - 12 "month" VALTAB VAL_second VAL 0 - 59 "second" VALTAB VAL_minute VAL 0 - 59 "minute" VALTAB VAL_hour VAL 0 - 23 "hour" VALTAB VAL_day VAL 1 - 31 "day" VALTAB VAL_year VAL 0 - 99 "year" VALTAB VAL_service_mode VAL 0 SERVICE_MODE_LIMITED "Search for limited service required" VAL 1 SERVICE_MODE_FULL "Search for full service required" VALTAB VAL_search_running VAL 0 GMMREG_SEARCH_NOT_RUNNING "Network search not running anymore" VAL 1 GMMREG_SEARCH_RUNNING "Network search still running" VALTAB VAL_cipher_on VAL 0 GMMREG_CIPHER_OFF "ciphering switch off" VAL 1 GMMREG_CIPHER_ON "ciphering switch on" VALTAB VAL_tlli_handling VAL DEF "normal TLLI handling" VAL 0 GMMREG_TLLI_STANDARD "normal TLLI handling" VAL 1 GMMREG_TLLI_TWICE "attach complete will be sent with old and with new TLLI" VALTAB VAL_gsm_ciph VAL 0 CIPH_OFF "ciphering off" VAL 1 CIPH_ON "ciphering on" VAL 2 CIPH_NA "ciphering not applicable / no change in ciphering" VALTAB VAL_lac VAL DEF "location area code" VAL 0xFFFE GMMREG_LA_INVALID "location area code is not known" VALTAB VAL_rac VAL DEF "routing area code" VAL 0xFF GMMREG_RA_INVALID "routing area code is not known" VALTAB VAL_gprs_indicator VAL 0 GMM_GPRS_SUPP_NO "GPRS is not supported within the cell" VAL 1 GMM_GPRS_SUPP_LIMITED "GPRS is supported in limited service" VAL 2 GMM_GPRS_SUPP_YES "GPRS is supported within the cell" VAL 3 GMM_GPRS_SUPP_UNKNOWN "GPRS support is unknown within the cell" VALTAB VAL_service VAL 0 NREG_NO_SERVICE "no service available" VAL 1 NREG_LIMITED_SERVICE "limited service available" VALTAB VAL_net_daylight_save_time %REL99% VAL 0 GMMREG_ADJ_NO %REL99% "GMMREG_ADJ_NO" VAL 1 GMMREG_TIME_ADJ_1 %REL99% "+1 hour adjustment for Daylight Saving Time" VAL 2 GMMREG_TIME_ADJ_2 %REL99% "+2 hours adjustment for Daylight Saving Time" VALTAB VAL_rt VAL 0 RT_GSM "GSM" VAL 1 RT_GPRS "GSM/GPRS" VAL 2 RT_EDGE "GSM/GPRS/EDGE" VAL 3 RT_UMTS_FDD "UMTS FDD" VALTAB VAL_bootup_act VAL 0 NORMAL_REG "Normal Registration" VAL 1 QUICK_REG "Fast Registration" VALTAB VAL_bootup_cause VAL 0 REG_END "end of registration" VAL 1 PWR_SCAN_START "power scanning started" VAR attach_type "Attach type" B VAL @p_gmmreg - VAL_attach_type@ VAR detach_type "Detach type" B VAL @p_gmmreg - VAL_detach_type@ VAR v_plmn "valid flag" B VAL @p_gmmreg - VAL_v_plmn@ VAR mcc "mobile country code" B VAR mnc "mobile network code" B VAR cause "error cause" S VAL @p_gmmreg - VAL_cause@ VAR mobile_class "Mobile Class" B VAL @p_gmmreg - VAL_mobile_class@ VAR forb_ind "Forbidden PLMN indicator" B VAL @p_gmmreg - VAL_forb_ind@ VAR rxlevel "Fieldstrength" B VAR gprs_status "GPRS Status" B VAL @p_gmmreg - VAL_gprs_status@ VAR cell_state "Cell State" B VAL @p_gmmreg - VAL_cell_state@ VAR net_selection_mode "network selction mode" B VAL @p_gmmreg - VAL_net_selection_mode@ VAR v_name "valid flag" B VAR dcs "coding scheme" B VAR add_ci "add ci indicator" B VAR num_spare "num spare bits" B VAR text "name" B VAR v_time_zone "timezone valid" B VAR time_zone "timezone" B VAL @p_gmmreg - VAL_time_zone@ VAR v_time "time valid" B VAR year "year" B VAL @p_gmmreg - VAL_year@ VAR month "month" B VAL @p_gmmreg - VAL_month@ VAR day "day" B VAL @p_gmmreg - VAL_day@ VAR hour "hour" B VAL @p_gmmreg - VAL_hour@ VAR minute "minute" B VAL @p_gmmreg - VAL_minute@ VAR second "second" B VAL @p_gmmreg - VAL_second@ VAR service_mode "Required service mode" B VAL @p_gmmreg - VAL_service_mode@ VAR search_running "Search is still running" B VAL @p_gmmreg - VAL_search_running@ VAR cipher_on "ciphering on or off" B VAL @p_gmmreg - VAL_cipher_on@ VAR tlli_handling "tlli handling in attach proc" B VAL @p_gmmreg - VAL_tlli_handling@ VAR gsm_ciph "GSM Ciphering Indicator" B VAL @p_gmmreg - VAL_gsm_ciph@ VAR gprs_ciph "GPRS Ciphering Indicator" B VAL @p_gmmreg - VAL_gsm_ciph@ VAR lac "location area code" S VAL @p_gmmreg - VAL_lac@ VAR rac "routing area code" B VAL @p_gmmreg - VAL_rac@ VAR cid "cell id" S VAR gprs_indicator "GPRS indicator" B VAL @p_gmmreg - VAL_gprs_indicator@ VAR lac_list "LACs of found PLMNs" S VAR service "service (either no or limited service)" S VAL @p_gmmreg - VAL_service@ VAR net_daylight_save_time %REL99% "Network daylight saving time" B VAL @p_gmmreg - VAL_net_daylight_save_time@ VAR rt "This parameter indicates the radio access technology available in the cell. " B VAL @p_gmmreg - VAL_rt@ VAR bootup_act "bootup action" B VAL @p_gmmreg - VAL_bootup_act@ VAR bootup_cause "bootup cause" B VAL @p_gmmreg - VAL_bootup_cause@ COMP plmn "PLMN identification" { v_plmn ; valid flag mcc [SIZE_MCC] ; mobile country code mnc [SIZE_MNC] ; mobile network code } TYPEDEF COMP plmn ahplmn "AHPLMN identification" COMP full_net_name_gmm "Network name, long format" { v_name ; valid flag dcs ; coding scheme add_ci ; add ci indicator num_spare ; num spare bits text [0..MMR_MAX_TEXT_LEN] ; name } TYPEDEF COMP full_net_name_gmm short_net_name_gmm "Network name, short format" COMP net_time_zone "Network time zone" { v_time_zone ; timezone valid time_zone ; timezone } COMP net_time "Network time" { v_time ; time valid year ; year month ; month day ; day hour ; hour minute ; minute second ; second } ; GMMREG_ATTACH_REQ 0x3300 ; GMMREG_ATTACH_CNF 0x7300 ; GMMREG_ATTACH_REJ 0x7301 ; GMMREG_DETACH_REQ 0x3301 ; GMMREG_DETACH_CNF 0x7302 ; GMMREG_DETACH_IND 0x7303 ; GMMREG_NET_REQ 0x3302 ; GMMREG_PLMN_IND 0x7304 ; GMMREG_PLMN_RES 0x3303 ; GMMREG_SUSPEND_IND 0x7305 ; GMMREG_RESUME_IND 0x7306 ; GMMREG_PLMN_MODE_REQ 0x3304 ; GMMREG_INFO_IND 0x7307 ; GMMREG_CONFIG_REQ 0x3305 ; GMMREG_CIPHERING_IND 0x7308 ; GMMREG_AHPLMN_IND 0x7309 PRIM GMMREG_ATTACH_REQ 0x3300 { mobile_class ; Mobile Class attach_type ; Attach type service_mode ; registration mode bootup_act ; bootup action } PRIM GMMREG_ATTACH_CNF 0x7300 { attach_type ; Attach type plmn ; PLMN lac ; Location area code rac ; Routing area code cid ; Cell id gprs_indicator ; GPRS indicator search_running ; Search running rt ; Radi Access Technology bootup_cause ; bootup cause } PRIM GMMREG_ATTACH_REJ 0x7301 { detach_type ; Detach type cause ; Error cause search_running ; Search running service ; Primitive Item } PRIM GMMREG_DETACH_REQ 0x3301 { detach_type ; Detach type } PRIM GMMREG_DETACH_CNF 0x7302 { detach_type ; Detach type } PRIM GMMREG_DETACH_IND 0x7303 { detach_type ; Detach type cause ; Error cause search_running ; Search running service ; Primitive Item } PRIM GMMREG_NET_REQ 0x3302 { } PRIM GMMREG_PLMN_IND 0x7304 { cause ; network search result plmn [GMMREG_MAX_PLMN_ID] ; found plmns forb_ind [GMMREG_MAX_PLMN_ID] ; Forbidden PLMN lac_list [GMMREG_MAX_PLMN_ID] ; List of LACs rxlevel [GMMREG_MAX_PLMN_ID] ; Fieldstrength gprs_status [GMMREG_MAX_PLMN_ID] ; GPRS valid } PRIM GMMREG_PLMN_RES 0x3303 { plmn ; selected plmn mobile_class ; Mobile Class attach_type ; Attach type } PRIM GMMREG_SUSPEND_IND 0x7305 { cell_state ; Cell State } PRIM GMMREG_RESUME_IND 0x7306 { } PRIM GMMREG_PLMN_MODE_REQ 0x3304 { net_selection_mode ; network selected mode } PRIM GMMREG_INFO_IND 0x7307 { plmn ; Public Land Mobile Network full_net_name_gmm ; full network name short_net_name_gmm ; short network name net_time_zone ; network time zone net_time ; network time net_daylight_save_time %REL99% ; network daylight saving time } PRIM GMMREG_CONFIG_REQ 0x3305 { cipher_on ; ciphering on or off tlli_handling ; tlli handling in attach proc } PRIM GMMREG_CIPHERING_IND 0x7308 { gsm_ciph ; GSM Ciphering Indicator gprs_ciph ; GPRS Ciphering Indicator } PRIM GMMREG_AHPLMN_IND 0x7309 { ahplmn ; AHPLMN }