MediaTek Preloader on a mobile device triggers cdc_acm kernel module usage by ModemManager
This is an interesting bug that is triggered under some circumstances if one of the official, MediaTek-SoC-based Ubuntu phones is connected to a Linux host via USB.
Ubuntu 15.04 Desktop, kernel 3.19.0-21-generic, package linux-image-generic 220.127.116.11.21 amd64, package modemmanager 1.4.0-1
Meizu MX4 (arale) and bq Aquaris E4.5 (krillin), image version irrelevant because the Preloader comes with all devices and cannot be changed
How to reproduce, possibility 1:
1. Disconnect the USB connection, if necessary.
2. Turn off the phone.
3. Connect the phone via USB. It will take a bit and then turn on, displaying the "charge animation".
How to reproduce, possibility 2:
1. Reboot the phone while it is still attached to the host.
The kernel ringbuffer will contain the following log messages (example for krillin):
[288774.244158] usb 1-1: new high-speed USB device number 22 using xhci_hcd
[288774.373589] usb 1-1: New USB device found, idVendor=0e8d, idProduct=2000
[288774.373593] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[288774.373594] usb 1-1: Product: MT65xx Preloader
[288774.373596] usb 1-1: Manufacturer: MediaTek
[288774.435247] cdc_acm 1-1:1.1: ttyACM26: USB ACM device
[288774.874607] usb 1-1: USB disconnect, device number 22
[288774.874755] cdc_acm 1-1:1.1: failed to set dtr/rts
And syslog will contain the following log messages:
Jul 10 00:58:07 fire ModemManager: <info> (tty/ttyACM27): released by modem /sys/devices/
Jul 10 00:58:10 fire ModemManager: <warn> (Plugin Manager) (Iridium) [ttyACM27] error when checking support: '(Iridium) Missing port probe for port (tty/ttyACM27)'
Jul 10 00:58:10 fire ModemManager: <warn> (Plugin Manager) (Cinterion) [ttyACM27] error when checking support: '(Cinterion) Missing port probe for port (tty/ttyACM27)'
Jul 10 00:58:10 fire ModemManager: <warn> (Plugin Manager) (Nokia) [ttyACM27] error when checking support: '(Nokia) Missing port probe for port (tty/ttyACM27)'
Jul 10 00:58:10 fire ModemManager: <warn> (Plugin Manager) (Generic) [ttyACM27] error when checking support: '(Generic) Missing port probe for port (tty/ttyACM27)'
Jul 10 00:58:10 fire ModemManager: <warn> Couldn't find support for device at '/sys/devices/
The allocated ttyACMx device is never freed, and after a couple of days developing on the phone (with lots of phone restarts) I've noticed that my machine has accumulated an usage count of 58:
$ lsmod | grep cdc_acm
cdc_acm 36864 58
lsof show that ModemManager still holds the devices:
# sudo lsof | grep ACM
ModemMana 9214 root 9u CHR 166,1 0t0 7599355 /dev/ttyACM1 (deleted)
ModemMana 9214 root 10u CHR 166,0 0t0 7596974 /dev/ttyACM0 (deleted)
Restarting ModemManager immediately reduces the usage count to 0 again and frees all devices.
Why does this happen? Luckily I've read the MediaTek Preloader source code. The Preloader is the first-stage bootloader on MediaTek SoCs and exposes a proprietary USB interface that can be used for debugging purposes and to download firmware to the device. The implementation of this interface is rudimentary and emulates a CDC ACM serial port, which probably doesn't fully conform to the standard and also just falls from the bus after a short amount of time if the host doesn't initiate the proprietary protocol. So I think the kernel and ModemManager immediately try to use the emulated device when it becomes available, but because the implementation in the Preloader is incomplete some bug (timeout?) is triggered and ModemManager never closes the device.
Sadly I don't have the expertise to decide if this is a bug in ModemManager or the kernel or both, so I file it with ModemManager.