Bug 7858

Summary: cat to Novatel XU870 (HSDPA) card at /dev/ttyUSB* causes panic
Product: Drivers Reporter: Elliot Mackenzie (macka)
Component: USBAssignee: Greg Kroah-Hartman (greg)
Status: RESOLVED CODE_FIX    
Severity: normal CC: jikos, protasnb
Priority: P2    
Hardware: i386   
OS: Linux   
Kernel Version: 2.6.20-r5 Subsystem:
Regression: --- Bisected commit-id:
Bug Depends on:    
Bug Blocks: 5089    
Attachments: 9400 Kernel config

Description Elliot Mackenzie 2007-01-21 07:01:03 UTC 
Most recent kernel where this bug did *NOT* occur: Confirmed in 2.6.18->2.6.20
Distribution: Gentoo, but with vanilla kernel
Hardware Environment: Dell 9400 Laptop, Novatel Merlin XU870 HSDPA/3G
Software Environment: Bare build with 2.6.20 kernel.
Problem Description:
System hangs when writing to USB serial port mapped to the XU870.  

There appear to be six serial ports mapped to this device.

crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB0
crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB1
crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB2
crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB3
crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB4
crw-rw---- 1 root tty 188, 0 Jan 21 14:54 /dev/ttyUSB5

lsusb:
Bus 001 Device 003: ID 1410:1430
(NB: No device description is output in lsusb for this device)

usbcore: registered new interface driver usbserial_generic
drivers/usb/serial/usb-serial.c: USB Serial Driver core
drivers/usb/serial/usb-serial.c: USB Serial support registered for airprime
airprime 1-1.3:1.0: airprime converter detected
usb 1-1.3: airprime converter now attached to ttyUSB0
usb 1-1.3: airprime converter now attached to ttyUSB1
usb 1-1.3: airprime converter now attached to ttyUSB2
airprime 1-1.3:1.1: airprime converter detected
usb 1-1.3: airprime converter now attached to ttyUSB3
usb 1-1.3: airprime converter now attached to ttyUSB4
usb 1-1.3: airprime converter now attached to ttyUSB5
usbcore: registered new interface driver airprime

Steps to reproduce:
modprobe airprime
cat "at+cgdcont=1,\"IP\",\"internet\",\"\",0,0" > /dev/ttyUSB[0..5]
<system hang>
Comment 1 Elliot Mackenzie 2007-01-21 07:02:37 UTC 
"System hang", by the way, means the system completely locks up, and the caps
and num-lock lights start flashing.
Comment 2 Elliot Mackenzie 2007-01-21 07:07:32 UTC 
Created attachment 10142 [details]
9400 Kernel config
Comment 3 Elliot Mackenzie 2007-01-21 07:23:31 UTC 
More information....

If I do this:
cat /dev/ttyUSB0
... then in another term do this:
cat "at....." /dev/ttyUSB0 (as before)

Then it does not crash: I get "OK" as expected.

However..
If I omit reading the USB tty, ie I do not do a cat /dev/ttyUSB0 before the
write, then I get a kernel panic.

Unfortunately I do not have a serial device to capture the panic, however, this
is the part that I can see:

panic+0x4d/0xe8
die+0x1e5/0x219
do_page_fault+0x450/0x525
do_page_fault+0x0/0x525
error_code+0x7c/0x84
_spin_lock_irqsave+0x3/0x27
airprime_write_bulk_callbackk+0x7d/0x96 [airprime]
usb_hcd_giveback_urb+0x28/0x57
ehci_urb_done+0x68/0x72
qh_completions+0x73/0x2ee
ehci_work+0x98/0x53b
acpi_ut_status_exit+0x67/0x75
ehci_irq+0x113/0x124
acpi_ut_status_exit+0x67/0x75
usb_hcd_irq+0x21/0x4e
handle_IRQ_event+0x1a/0x3f
handle_fasteoi_irq+0x6d/0xa0
do_IRQ+0x82/0x9c
common_interrupt+0x23/0x28
acpi_processor_idle+0x1ce/0x363
cpu_idle+0x5e/0000x73
start_kernel+0x388/0x390
unknown_bootoption+0x0/0x202
Comment 4 Elliot Mackenzie 2007-01-22 02:15:00 UTC 
I have just noticed another (perhaps related?) problem with this device.

If I do this:
`cat /dev/ttyUSB0`

...as before (to avoid the kernel panic), then:
`cat "at+cgdcont=1,\"IP\",\"internet\",\"\",0,0" > /dev/ttyUSB0`

...then sometimes I get this sort of thing on the echo:
"at+cgdcgdcgdcgdcgdcgdcgdcgd" or 
this "at+cgdcontcgdcontcgdcontcgdcontcgdcontcgdcont"  
(ie repeated patterns).  

I'm not convinced this would be a timing issue as the characters echoed back 
are the actual correct characters, save for being repeated incorrectly.  If it 
were timing, I'd be expecting some weird characters coming back, but I see 
only sensible characters repeatedly.

Now if I repeat the above line a few times, sometimes I get a perfect echo, 
followed by an "OK" response from the modem, other times I get the above 
repetition followed by an "ERROR" from the modem.
Comment 5 Natalie Protasevich 2007-06-13 19:11:08 UTC 
Can you please try 2.6.22-rc4? - there were multiple fixes in USB/HCD area that went into it.

Thanks.
Comment 6 Natalie Protasevich 2007-08-11 10:55:07 UTC 
Elliot - ping..
Also, can you please clarify if the device used to work in 2.6.18?
Thanks.
Comment 7 Elliot Mackenzie 2007-08-13 00:30:03 UTC 
Oops, sorry, this one slipped through my mailbox.  I have been testing for two weeks against 2.6.20-16 (ubuntu build, not vanilla), and the device stable and fully functional.

I will try against vanilla 2.6.22+ (gentoo most likely) as soon as I have a minute free (probably later this week as I am current tied to a severity 1 fault and am out of the country for a couple of days).  Hope that's OK.

As for 2.6.18, I don't think so.  From memory I think I had to manually hack the XU870 into the airprime.c to be supported.  The module loaded, but I don't recall having much luck with it even then.

Thanks,
Elliot.
Comment 8 Greg Kroah-Hartman 2007-09-05 06:35:27 UTC 
Ok, I'm marking this as fixed.