APU2 Quectel EC25-EUX : Error at startup

[adrenalinedj]

Hello, I've installed OPNsense 22.1 on an APU2 with a Quectel EC25-EUX and i've compiled and installed the kernel module. The modem was well detected and visible in PPP interfaces when it was in PPP/QMI mode. But when I've switched the modem from PPP/QMI to MBIM mode, I've encountered errors during startup. Here is the error log:

ugen1.3: <Quectel EC25-EUX> at usbus1
u3g0 on uhub2
u3g0: <Quectel EC25-EUX, class 239/2, rev 2.00/3.18, addr 3> on usbus1
u3g0: Found 4 ports.
umb0 on uhub2
umb0: <EC25-EUX> on usbus1
umb0: version 1.0

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address   = 0x28
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80db7b84
stack pointer           = 0x28:0xfffffe005040ce50
frame pointer           = 0x28:0xfffffe005040ce80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 15 (umb0)
trap number             = 12
panic: page fault
cpuid = 1
time = 3
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe005040cc10
vpanic() at vpanic+0x17f/frame 0xfffffe005040cc60
panic() at panic+0x43/frame 0xfffffe005040ccc0
trap_fatal() at trap_fatal+0x385/frame 0xfffffe005040cd20
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe005040cd80
calltrap() at calltrap+0x8/frame 0xfffffe005040cd80
--- trap 0xc, rip = 0xffffffff80db7b84, rsp = 0xfffffe005040ce50, rbp = 0xfffffe005040ce80 ---
if_alloc_domain() at if_alloc_domain+0xa4/frame 0xfffffe005040ce80
umb_attach_task() at umb_attach_task+0x37/frame 0xfffffe005040ceb0
usb_process() at usb_process+0x100/frame 0xfffffe005040cef0
fork_exit() at fork_exit+0x7e/frame 0xfffffe005040cf30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe005040cf30
--- trap 0, rip = 0xffffffff80c2bd3f, rsp = 0, rbp = 0xfffff8000355a300 ---
mi_startup() at mi_startup+0xdf/frame 0xfffff8000355a300
??() at 0/frame 0xfffff800035ac000
null_method() at null_method/frame 0xffffffff81b03cd0
bus_generic_new_pass() at bus_generic_new_pass/frame 0xffffffff81b03cc8
bus_new_pass_desc() at bus_new_pass_desc
KDB: enter: panic
[ thread pid 15 tid 100131 ]
Stopped at      kdb_enter+0x37: movq    $0,0x11fc49e(%rip)

[NKnusperer]

Same issue here using a Sierra Wireless EM7565 LTE card on OPNsense 22.7.6.

[adrenalinedj]

During my research, i've found that on freebsd bugtracker this issue was related to the fact that the interface was already attached when umb tries to attach it. I think that a way to fix this, is to add a check if the interface is already attached, is to detach it and attach it as umb device.

The link on FreeBSD bug tracker: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=263783

[NKnusperer]

Thank you for the input. After some research I actually found a way to "detach" a device using the set_config 255 flag for usbconfig:

The special value of 255 unconfigures the device, detaching the interface drivers and reducing the power consumption to minimum, but without going into power saving mode or detaching from the bus.

I'm now able to load the kernel module without a crash (kldload if_umb) however no new network interface umb0 is created. show_ifdrv also shows no driver attached. usbconfig also provides a detach_kernel_driver flag:

Detach kernel driver for the selected interface and USB device.

Using this the kernel still crashes.