- baseband-devel - lists.osmocom.org

Patch: use-before-free in config_write_file
by Christian Vogel 24 Mar '12

24 Mar '12

Hi Everyone, while discussing config_file_write, I noticed that there's a use-after-free bug in libosmocore config_write_file. Chris

1 1

[PATCH] Fix use-after-free in config_write_file
by Christian Vogel 24 Mar '12

24 Mar '12

--- src/vty/command.c | 13 ++++++------- 1 files changed, 6 insertions(+), 7 deletions(-) diff --git a/src/vty/command.c b/src/vty/command.c index ab1eaca..b3595e5 100644 --- a/src/vty/command.c +++ b/src/vty/command.c @@ -2337,40 +2337,39 @@ DEFUN(config_write_file, vty_out(vty, "Can't unlink backup configuration file %s.%s", config_file_sav, VTY_NEWLINE); + unlink(config_file_tmp); talloc_free(config_file_sav); talloc_free(config_file_tmp); - unlink(config_file_tmp); return CMD_WARNING; } if (link(config_file, config_file_sav) != 0) { vty_out(vty, "Can't backup old configuration file %s.%s", config_file_sav, VTY_NEWLINE); + unlink(config_file_tmp); talloc_free(config_file_sav); talloc_free(config_file_tmp); - unlink(config_file_tmp); return CMD_WARNING; } + talloc_free(config_file_sav); /* we are done with config_file_sav by now */ sync(); + if (unlink(config_file) != 0) { vty_out(vty, "Can't unlink configuration file %s.%s", config_file, VTY_NEWLINE); - talloc_free(config_file_sav); - talloc_free(config_file_tmp); unlink(config_file_tmp); + talloc_free(config_file_tmp); return CMD_WARNING; } if (link(config_file_tmp, config_file) != 0) { vty_out(vty, "Can't save configuration file %s.%s", config_file, VTY_NEWLINE); - talloc_free(config_file_sav); - talloc_free(config_file_tmp); unlink(config_file_tmp); + talloc_free(config_file_tmp); return CMD_WARNING; } unlink(config_file_tmp); sync(); - talloc_free(config_file_sav); talloc_free(config_file_tmp); if (chmod(config_file, 0666 & ~CONFIGFILE_MASK) != 0) { -- 1.7.5.4 --n8g4imXOkfNTN/H1--

1 0

Frame Number--Paging
by R M 24 Mar '12

24 Mar '12

Hi, Lately I have been looking at the GSM traffic through wireshark. In every packet, wireshark tells me about the frame number. But a paging message is spread over four frames. (You need to read four frames to get a single paging message.) So which among these four frames does the frame number displayed in wireshark correspond to for the paging message? Regards, RM

2 2

Problem building OsmocomBB
by Dennis Weider 22 Mar '12

22 Mar '12

Hi! I tried this tutorial to build my osmocomBB enviroment: http://bb.osmocom.org/trac/wiki/GettingStarted I downloaded the gnuarm toolchain from here: http://bb.osmocom.org/trac/wiki/toolchain I set the Path and i tried make, but it stops at > arm-elf-ld: ../../shared/libosmocore/build-target/src/.libs/libosmocore.a(msgb.o): Relocations in generic ELF (EM: 3) > ../../shared/libosmocore/build-target/src/.libs/libosmocore.a: could not read symbols: File in wrong format > make[1]: *** [board/compal_e88/hello_world.compalram.elf] Fehler 1 I found a similar Thread on the mailing list here: http://baseband-devel.722152.n3.nabble.com/unknown-error-td2758006.html#a27… But there is not a solution for the problem I would be happy if anybody would be able to giv a solution. MFG Kandanalor

1 1

GSM specs describing Random Access Procedure
by R M 21 Mar '12

21 Mar '12

Hi, I want to understand the RACH channel acess procedure. I tried to search for it in google. It doesnt lead me to the right GSM spec. Does any one know which GSM spec details out the RACH link access procedure ? Regards, RM

3 2

Video : Deepsec 2010 Targeted Dos Attack And Various Fun With Gsm Um
by R M 21 Mar '12

21 Mar '12

Hi, I am looking for this video. I found it at the official Deepsec video archives. But you require to register to the video host site and I am unable to download it using wget Does any one know of any bit torrent site that has this video so that I can download it? Regards, RM

3 3

Working with OpenBSC + Osmocon: Paging response fails to activate SDCCH
by David Bahr 20 Mar '12

20 Mar '12

Hi, Ive just setup an OpenBSC + nanoBTS environment to experiment around with your Osmocom software and a Motorola C123. I tried wo write a little application similiar to app_ccch scan, which is able of responding to paging requests by sending a rach request and the following paging response procedure. The rach access is working fine, but i cant get the paging response to work properly. The message itself is correct (layer2/layer3 parts) according to the specs. OpenBSC is also working correctly as it is working with my normal cell phone or your mobile application. What i'm doing in my code is the following: 1. After getting the immediate assignment i call l1ctl_tx_dm_est_req_h0 in l1ctl.c (l1ctl_tx_dm_est_req_h0(ms, arfcn, ia->chan_desc.chan_nr, ia->chan_desc.h0.tsc, GSM48_CMODE_SIGN, 0)) in order to tune to the assigned channel (or the h1 procedure for hopping). 2. Afterwards i build the paging response (layer2 + layer3), pad the msg and send it via osmo_send_l1(ms, msg) similiar to l1ctl_tx_data_req in l1ctl.c That it is not working can be seen in the OpenBSC abis debug output: <0004> abis_rsl.c:1318 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=OTHER ra=0x67 ta=0 <0004> abis_rsl.c:1064 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK <0004> abis_rsl.c:891 (bts=0,trx=0,ts=0,ss=0) CONNECTION FAIL: RELEASING CAUSE=0x01(Radio Link Failure) <0004> abis_rsl.c:621 (bts=0,trx=0,ts=0,ss=0) RF Channel Release CMD due error 1 <0004> abis_rsl.c:658 (bts=0,trx=0,ts=0,ss=0) RF CHANNEL RELEASE ACK <0004> abis_rsl.c:594 (bts=0,trx=0,ts=0,ss=0) is back in operation. It should be looking like this: <0004> abis_rsl.c:1318 (bts=0,trx=0,ts=0,ss=0) Activating ARFCN(514) SS(0) lctype SDCCH r=OTHER ra=0x10 ta=0 <0004> abis_rsl.c:1064 (bts=0,trx=0,ts=0,ss=0) CHANNEL ACTIVATE ACK <0000> abis_rsl.c:1490 (bts=0,trx=0,ts=0,ss=0) SAPI=0 ESTABLISH INDICATION <0003> gsm_04_08.c:1076 PAGING RESPONSE: mi_type=0x04 MI(...) Has anyone an idea what I'm doing wrong? Thanks in advance for any help! Best regards, David

1 0

Use OsmocomBB as OpenBTS / airprobe clock generator
by Harald Welte 15 Mar '12

15 Mar '12

Hi! Recently we've had the idea of using OsmocomBB with a simple firmware that synchronizes to an existing GSM networks FCCH and use the resulting 13MHz clock to drive the USRP for airprobe or OpenBTS. Ideally, we would even use the Calypso-internal PLL (for ARM or DSP) to multiply it up to the required 52 MHz. However, neither the Openmoko nor the Compal/Motorola phones expose any of the 3 clock output pads :( So the only choice is to use something along the lines of the http://focus.ti.com/docs/prod/folders/print/cdcvf25084.html as a quad clock multiplier and attach it to the CLK13OUT signal of the phone. The chip is available for 9 USD in single quantities at digikey, and possibly cheaper at other sources. Combined with a sub-20EUR phone it might be a very cheap but still accurate frequency source for OpenBTS - at least as long as there are any commercial gsm networks available. Regards, Harald -- - Harald Welte <laforge(a)gnumonks.org> http://laforge.gnumonks.org/ ============================================================================ "Privacy in residential applications is a desirable marketing option." (ETSI EN 300 175-7 Ch. A6)

8 17

any one have clone of MTK project hosted on google
by Akib Sayyed 12 Mar '12

12 Mar '12

guys i recently came across mobile-phone-mtk-project.googlecode.com but it seems to be down.does any one have copy of this one?? also can be create osmocom like project with help of MTK chipsets?? -- Akib Sayyed Matrix-Shell akibsayyed(a)gmail.com akibsayyed(a)matrixshell.com Mob:- +91-966-514-2243

1 0

osmocom
by Carlos Cecanecchia Neto 11 Mar '12

11 Mar '12

Dear Srs, We are working in a project that uses a GSM modem to send a GMSK beacom in 904 MHZ with 2W. This beacom send a random bits, but we only need to measure the RSSI Visiting you site, we found a GSM RSSI software working in a phone. Can we use it in 904 Mhz ? This is the uplink GSM ARFCN channel 70. It is possible ? Best Regards Carlos Cecanecchia Neto www.mobipower.com.br 55-11-3257.7736 <http://www.mobipower.com.br/> New Picture (2)

2 2