Huawei E392 firmware crash caused by MM issuing "AT*CNTI=2"

[Dan Williams]

On Mon, 2013-11-18 at 09:55 +0100, Bjørn Mork wrote:
> Hello,
> 
> It's been a while since I last used my E392.  And when I tried today, I
> was surprised to find that MM caused the firmware to crash as soon as I
> attempted to enable it.
> 
> The relevant part of the log goes like this:
> 
> ModemManager[29396]: <debug> [1384763552.885863] [mm-serial-port.c:892] mm_serial_port_open(): (ttyUSB1) opening serial port...
> ModemManager[29396]: <warn>  [1384763552.889075] [mm-serial-port.c:416] real_config_fd(): (ttyUSB1): port attributes not fully set
> ModemManager[29396]: <debug> [1384763552.889181] [mm-serial-port.c:969] mm_serial_port_open(): (ttyUSB1) device open count is 1 (open)
> ModemManager[29396]: <debug> [1384763552.889213] [mm-at-serial-port.c:473] mm_at_serial_port_run_init_sequence(): (ttyUSB1): running init sequence...
> ModemManager[29396]: <debug> [1384763552.889287] [mm-serial-port.c:969] mm_serial_port_open(): (ttyUSB1) device open count is 2 (open)
> ModemManager[29396]: <debug> [1384763552.889345] [mm-serial-port.c:969] mm_serial_port_open(): (ttyUSB1) device open count is 3 (open)
> ModemManager[29396]: <debug> [1384763552.889456] [mm-broadband-modem.c:1591] modem_load_supported_modes(): loading supported modes...
> ModemManager[29396]: <debug> [1384763552.889504] [mm-serial-port.c:969] mm_serial_port_open(): (ttyUSB1) device open count is 4 (open)
> ModemManager[29396]: <debug> [1384763552.889566] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'ATE0<CR>'
> ModemManager[29396]: <debug> [1384763552.897699] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.897835] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'ATV1<CR>'
> ModemManager[29396]: <debug> [1384763552.904627] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.904731] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'AT+CMEE=1<CR>'
> ModemManager[29396]: <debug> [1384763552.918543] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.918660] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'ATX4<CR>'
> ModemManager[29396]: <debug> [1384763552.926664] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.926778] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'AT&C1<CR>'
> ModemManager[29396]: <debug> [1384763552.933783] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.933890] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'ATE0<CR>'
> ModemManager[29396]: <debug> [1384763552.943280] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.943374] [mm-serial-port.c:1015] mm_serial_port_close(): (ttyUSB1) device open count is 3 (close)
> ModemManager[29396]: <debug> [1384763552.943438] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'AT+CMEE=1<CR>'
> ModemManager[29396]: <debug> [1384763552.956182] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): <-- '<CR><LF>OK<CR><LF>'
> ModemManager[29396]: <debug> [1384763552.956281] [mm-serial-port.c:1015] mm_serial_port_close(): (ttyUSB1) device open count is 2 (close)
> ModemManager[29396]: <debug> [1384763552.956341] [mm-at-serial-port.c:436] debug_log(): (ttyUSB1): --> 'AT*CNTI=2<CR>'
> ModemManager[29396]: <debug> [1384763553.944689] [mm-serial-port.c:752] data_available(): (ttyUSB1) unexpected port hangup!
> ModemManager[29396]: <debug> [1384763553.944766] [mm-serial-port.c:1139] mm_serial_port_close_force(): (ttyUSB1) forced to close port
> ModemManager[29396]: <debug> [1384763553.944797] [mm-serial-port.c:1015] mm_serial_port_close(): (ttyUSB1) device open count is 0 (close)
> ModemManager[29396]: <debug> [1384763553.944830] [mm-serial-port.c:1031] mm_serial_port_close(): (ttyUSB1) closing serial port...
> ModemManager[29396]: <debug> [1384763553.944891] [mm-serial-port.c:1064] mm_serial_port_close(): (ttyUSB1) serial port closed
> ModemManager[29396]: <debug> [1384763553.944934] [mm-broadband-modem.c:1525] supported_modes_cnti_ready(): Generic query of supported 3GPP networks with *CNTI failed: 'Serial port is now closed'
> ModemManager[29396]: <debug> [1384763553.944987] [mm-serial-port.c:892] mm_serial_port_open(): (ttyUSB1) opening serial port...
> ModemManager[29396]: <warn>  [1384763553.945084] [mm-serial-port.c:914] mm_serial_port_open(): (ttyUSB1) could not open serial device (19)
> ModemManager[29396]: mm_serial_port_close: assertion `priv->open_count > 0' failed
> ModemManager[29396]: <debug> [1384763553.945185] [mm-broadband-modem.c:1473] supported_modes_ws46_test_ready(): Generic query of supported 3GPP networks with WS46=? failed: 'Cannot run sequence: 'Could not open serial device ttyUSB1: No such device''
> 
> 
> And sure enough: Trying "AT*CNTI=2" (after enabling the SIM with
> AT+CPIN=....) in minicom makes the firmware crash, every time.
> 
> I see that this command was recently introduced by commit 4901ee8632f91
> (" broadband-modem: run *CNTI=2 to when loading supported modes") as an
> optional, better(?) alternative to AT+WS46.  FWIW, this is the E392
> respons to at+ws46=?:
> 
> at+ws46=?
> +WS46: (12,22,25,28,29)
> 
> OK
> 
> 
> 
> I guess the *CNTI command should be blacklisted for Huawei modems, at
> least for some firmware versions.  My E392 reports:

After looking at my own Huawei devices (E397, E392, E1550, E160, E367,
K3520) I would agree it should be blacklisted for Huawei devices.

My E397 and E392 *do* implement CNTI=2 and do not crash, but they fail
to report LTE capabilities in the command.  +WS46 provides an accurate
result for all Huawei devices I have.

Many modems don't implement +WS46 correctly, or even at all, since it's
an optional 27.007 command, and has only been in the spec for a couple
years at most.  Hence the addition of CNTI=2, which works on a lot of
modems but apparently not most Huawei devices...

Dan