Bluetooth CambridgeSiliconRadio : Pairing makes Kernel crash

[XavM]

Hello,

I have a CSR Bluetooth dongle reported to be working on the Wiki (http://elinux.org/RPi_VerifiedPeriphera ... h_adapters), but I always get a Kernel NULL Pointer dereference" crash as soon as I try to connect a Mouse, a Keyboard or a Telephone to it.

Has any one been able to pair any thing to it, and how did you get to ?

----

I tried with a fresh Debian stock image 20120419 where I only installed bluetooth, bluez-utils and blueman

I tried with this same image after installing latest kernel and firmware using rppi-update, and running an apt-get update and upgrade, but I still have the same problem.:

pi@raspberrypi:~$ uname -a
Linux raspberrypi 3.1.9+ #125 PREEMPT Sun Jun 17 16:09:36 BST 2012 armv6l GNU/Linux

The same problem happens wether I connect the BT dongle directly to the Raspberry Pi or thru an additional powered USB Hub.

The problem occurs even when the bluetooth adaptor is the only USB device connected to the Pi (no mouse or keyboard).

The BT dongle is detected :

pi@raspberrypi:~$ lsusb
Bus 001 Device 005: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)

HCI0 is UP and running :

pi@raspberrypi:~$ sudo hciconfig -a
hci0: Type: BR/EDR Bus: USB
BD Address: 00:1F:81:00:08:30 ACL MTU: 1021:4 SCO MTU: 180:1
UP RUNNING PSCAN
RX bytes:1066 acl:0 sco:0 events:32 errors:0
TX bytes:390 acl:0 sco:0 commands:31 errors:0
Features: 0xff 0x3e 0x09 0x76 0x80 0x01 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF PARK
Link mode: SLAVE ACCEPT
Name: 'Accel-OB2'
Class: 0x4a0100
Service Classes: Networking, Capturing, Telephony
Device Class: Computer, Uncategorized
HCI Version: 2.0 (0x3) Revision: 0x44
LMP Version: 2.0 (0x3) Subversion: 0x3
Manufacturer: Cambridge Silicon Radio (10)

I can scan and see bluetooth devices around :

pi@raspberrypi:~$ sudo hcitool scan
Scanning ...
D8:A2:5E:FA:C3:A9 MyDevice

It crashes as soon as I connect it to any thing :

pi@raspberrypi:~$ sudo hcitool cc D8:A2:5E:FA:C3:A9

At this step everything freeze and I get a nice "kernell NULL pointer" showing on the console (TV Screen) and the raspberry pi needs a hard reboot :

Unable to handle kernel NULL pointer dereference at virtual adress 00000001
etc ...

Nothing seems to be loggeg in /var/log after a reboot

I can reproduce the same problem with a simple l2ping to any MAC adress :

pi@raspberrypi:~$ sudo l2ping D8:A2:5E:FA:C3:A9
Ping: D8:A2:5E:FA:C3:A9 from 00:1F:81:00:08:30 (data size 44) ...
0 bytes from D8:A2:5E:FA:C3:A9 id 0 time 16.71ms
0 bytes from D8:A2:5E:FA:C3:A9 id 1 time 11.49ms
0 bytes from D8:A2:5E:FA:C3:A9 id 2 time 10.67ms

When I press "^C", everything freeze and I get the "kernell NULL pointer" showing on the console.

( I couldn't try with the new Wheezy Debian image because of this "Segmentation fault" problem starting bluetooth )

Has any one been able to pair any thing to this usb bluetooth dongle "0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)" ?

[XavM]

More info to my previous Post :

The same problem occurs using bluetooth-agent and rfcomm

The system freeze and I have the same "Kernel NULL pointer" issue using bluetooth-agent :

$ sudo hciconfig hci0 piscan
$ sudo hciconfig
hci0: Type: BR/EDR Bus: USB
BD Address: 00:1F:81:00:08:30 ACL MTU: 1021:4 SCO MTU: 180:1
UP RUNNING PSCAN ISCAN
RX bytes:1539 acl:0 sco:0 events:51 errors:0
TX bytes:470 acl:0 sco:0 commands:50 errors:0
$ sudo bluetooth-agent 0000

The Raspberry Pi appears on the telephone but when I try to connect the "Kernel NULL pointer" happens.

If try to initiate the connexion from the Raspberry Pi with rfcomm, it fails as well :

$ sudo hcitool scan
Scanning ...
5C:59:48:4A:0F:FC XiPhone$ sudo bluetooth-agent 0000
$ rfcomm connect hci0 5C:59:48:4A:0F:FC

"Kernel NULL pointer"

----

I have two Bluetooth dongles;
They are both the same "0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)".

I have the exact same problem with both of them.

[tawalker]

Recently, I tried a generic "nano" Bluetooth USB dongle I bought from Amazon a year or two ago. Sadly, although the Pi "registered" the device (it showed up in the lsusb list as a Cambridge chipset), I wasn't able to get it to scan, let alone pair with any other BT devices.

The problem seems to be that, yes, the dongle has a Cambridge chipset, but the USB ID number is the "wrong" one. This presents difficulties when buying one of these devices on Amazon (or similar) - they tend to be generic, unbranded models, and more often than not you have no idea what specific chipset is in them. It's almost like playing a kind of "roulette" - will this particular dongle work?

What would really help, is if people could add links in the wiki (and/or in the forum) to specific BT dongles which actually work properly, rather than a general "Cambridge Radio" chipset reference (as, we have seen, some CR variants don't work properly with Linux). For instance, please could anyone point me to an Amazon UK link for a suitable device? (I did search around the forum, but apologies if I missed one )

[jayArr]

I had identical problems to XavM with bluetooth keyboard setup using CSR dongle.
However after much persistence I've managed to get everything working
I'm using Debian Wheezey
I installed bluetooth, bluez-utils and blueman
( I ignored lots off stuff that said things wern't 100% !) and then did
an apt-get update and upgrade
followed by a sudo reboot
having first set LXPanel to startup automatically
I think this is important and I also found that
UNLESS YOU DISCONNECT THE USB WIRED KEYBOARD BEFORE REBOOTING
THINGS DON'T WORK ?!?!
once LXPanel is up and running you should see the Bluetooth symbol in the bottom RH corner of the screen.
Now start up the Bluetooth manager under Preferences
You can now click on Search and get it to look for devices.
NB you should switch off all other Bluetooth devices in the vicinity except the bluetooth keyboard
Once the keyboard is found you can use Setup to pair up your keyboard and finally connect it up
(This last step took me over an hour of trying and was only successful once I'd switched off my G5 Mac which was also being picked by the CSR dongle).
Disconnecting the USB wired keyboard & switching off the MAC maybe coincidental to getting things working ... but they work for me.
FYI my keyboard is a mini CERULIAN (N53JN)
the bluetooth dongle is a NIKKAI
(got them both from MAPLIN)

[XavM]

Thank you for the update jayArr

Unfortunately, it doesn't work for me, and I still have the "Kernel NULL pointer" after installing Debian Wheezy.

-----

# I use 2012-06-18-wheezy-beta.img and I should be up to date :
sudo apt-get update && apt-get upgrade && rpi-update

#kernel version :
uname -a
Linux raspberrypi 3.1.9+ #125 PREEMPT Sun Jun 17 16:09:36 BST 2012 armv6l GNU/Linux

#firmware version :
/opt/vc/bin/vcgencmd version
Jun 17 2012 13:30:15
Copyright (c) 2012 Broadcom
version 320121 (release)

#Fisrt I installed bluez only and tried to connect with no success :
sudo apt-get install bluez
#Bluetooth dongle was "looking fine" :
sudo hciconfig -a

hci0: Type: BR/EDR Bus: USB
BD Address: 00:1F:81:00:08:30 ACL MTU: 1021:4 SCO MTU: 180:1
UP RUNNING PSCAN
RX bytes:975 acl:0 sco:0 events:42 errors:0
TX bytes:440 acl:0 sco:0 commands:44 errors:3
Features: 0xff 0x3e 0x09 0x76 0x80 0x01 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF
Link mode: SLAVE ACCEPT
Name: 'raspberrypi-0'
Class: 0x420100
Service Classes: Networking, Telephony
Device Class: Computer, Uncategorized
HCI Version: 2.0 (0x3) Revision: 0x44
LMP Version: 2.0 (0x3) Subversion: 0x3
Manufacturer: Cambridge Silicon Radio (10)

#I could see devices around :
sudo hcitool scan

Scanning ...
D8:A2:5E:FA:C3:A9 MyDevice

#"kernell NULL pointer" on TV Screen at every connexion :

sudo hcitool cc D8:A2:5E:FA:C3:A9

#Need a reboot to get out of freeze

#I then tried like you said
sudo apt-get install blueman
#When I starx and launch bluetooth Manager nothing happens
#I can see the following in /var/log/syslog :

Jun 21 14:14:26 raspberrypi blueman-mechanism: Starting blueman-mechanism
Jun 21 14:14:26 raspberrypi dbus[1365]: [system] Successfully activated service 'org.blueman.Mechanism'
Jun 21 14:14:26 raspberrypi blueman-mechanism: loading Config
Jun 21 14:14:26 raspberrypi blueman-mechanism: loading Network
Jun 21 14:14:26 raspberrypi blueman-mechanism: loading Ppp
Jun 21 14:14:26 raspberrypi blueman-mechanism: loading RfKill
Jun 21 14:14:56 raspberrypi blueman-mechanism: Exiting

[tawalker]

At lunchtime, I was in one of our local "pound shops" (Poundworld) - ironically, I went in looking for another RasPi item (a phono-to-phono composite video cable) which I didn't find...

...but I did stumble across a Bluetooth USB dongle, which I confirmed cost £1 (in that store, it's worth making certain). As this is even cheaper than Amazon, and I could buy it there and then, I figured it was worth taking a risk with.

I can't test the adapter with my Pi until I get home, but fortunately I had my netbook (running Arch/x86) with me. It identified the chipset as the "right" USB ID number (0a12:0001), and I was able to run hcitool scan successfully - even if the Pi doesn't "like" it, I can use the dongle with the netbook

(One thought about why I couldn't get the old BT dongle to do anything: could the power have been insufficient? The adapter was plugged into a powered USB hub, so I thought that would've provided enough "juice" - possibly not?)

In case this helps anyone: the dongle sold in Poundworld is in a small plastic pack, with the "brand"-name Livewire. As I mentioned, the USB ID is the "right" one - hopefully I'll be able to confirm later whether the Pi decides to play with it...

[jayArr]

Xavm
if it's any help I've duplicated your commands on my pi. Here's the output
(I've italicised what I think are the significant differences)

pi@raspberrypi ~ $ uname -a
Linux raspberrypi 3.1.9+ #125 PREEMPT Sun Jun 17 16:09:36 BST 2012 armv6l GNU/Linux

pi@raspberrypi ~ $ /opt/vc/bin/vcgencmd version
Jun 17 2012 13:33:14
Copyright (c) 2012 Broadcom
version 320121 (release)

pi@raspberrypi ~ $ sudo hciconfig -a
hci0: Type: BR/EDR Bus: USB
BD Address: 00:15:83:44:69:37 ACL MTU: 310:10 SCO MTU: 64:8
UP RUNNING PSCAN
RX bytes:8584 acl:271 sco:0 events:318 errors:0
TX bytes:3211 acl:16 sco:0 commands:111 errors:0
Features: 0xff 0xff 0x8f 0xfe 0x9b 0xff 0x59 0x83
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF PARK
Link mode: SLAVE ACCEPT
Name: 'raspberrypi-0'
Class: 0x420100
Service Classes: Networking, Telephony
Device Class: Computer, Uncategorized
HCI Version: 2.1 (0x4) Revision: 0x149c
LMP Version: 2.1 (0x4) Subversion: 0x149c
Manufacturer: Cambridge Silicon Radio (10)

pi@raspberrypi ~ $ sudo hcitool scan
Scanning ...

pi@raspberrypi ~ $ cat /var/log/syslog

Jun 22 05:59:26 raspberrypi kernel: [ 530.727410] Bluetooth: hci0 command tx timeout
Jun 22 05:59:26 raspberrypi blueman-mechanism: Starting blueman-mechanism
Jun 22 05:59:26 raspberrypi dbus[1331]: [system] Successfully activated service 'org.blueman.Mechanism'
Jun 22 05:59:27 raspberrypi blueman-mechanism: loading Config
Jun 22 05:59:27 raspberrypi blueman-mechanism: loading Network
Jun 22 05:59:27 raspberrypi blueman-mechanism: loading Ppp
Jun 22 05:59:27 raspberrypi blueman-mechanism: loading RfKill

I'm a Linux noobe - I can't understand why sudo hcitool scan doesn't reveal any thing??

[dom]

Can you make sure you are on latest firmware, and then post the backtrace following "Unable to handle kernel NULL pointer dereference at virtual adress". If necessary, post a photo of the screen.

[XavM]

@dom :

You can see a Photo of the screen including the backtrace here : http://t.co/YILfSL0

Firmware and Kernel are uptodate :

pi@raspberrypi:~$ uname -a
Linux raspberrypi 3.1.9+ #128 PREEMPT Thu Jun 21 01:59:01 BST 2012 armv6l GNU/Linux
pi@raspberrypi:~$ /opt/vc/bin/vcgencmd version
Jun 17 2012 13:33:14
Copyright (c) 2012 Broadcom
version 320121 (release)
pi@raspberrypi:~$ sudo rpi-update
Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS
Performing self-update
Autodetecting memory split
Using ARM/GPU memory split of 192MB/64MB
Updating firmware (this will take a few minutes)
Your firmware is already up to date

(I had the same problem with Squeeze)

[XavM]

@jayArr : I am no Bluetooth expert <- I cannot even manage to get mine work, but I would say that the problem is here in /var/log/syslog -> "hci0 command tx timeout" just after you "hcitool scan"

Try to reproduce the problem and if "hcitool scan" shows nothing again, check you still have some "hci0 command tx timeout" in syslog.
If "yes" run "sudo hciconfig -a" again <- I guess hci0 will not be "UP RUNNING" but "DOWN"

I've had this same problem when my BT dongle was connected to a powered USB Hub, and it desapeared when I connected it directly to the Raspberry Pi.

But again <- I am not a bluetooth expert and it makes not much sens that a USB dongle works better on the Pi rather than connected to a powered USB Hub

@tawalker : Did you have time to test your brand new 1£ BT Dongle ?
Can you confirm whether the Pi decides to play with it ?

XavM

[kofe71]

Hi!
For Cambridge Silicon Radio Bluetooth Dongle work properly, you should make following:
add line "blacklist hci_usb" into /etc/modprobe.d/raspi-blacklist.conf and line "hci_usb reset=1" into /etc/modules. After reboot dongle work stably well.

[Solenoid]

Hi!
For Cambridge Silicon Radio Bluetooth Dongle work properly, you should make following:
add line "blacklist hci_usb" into /etc/modprobe.d/raspi-blacklist.conf and line "hci_usb reset=1" into /etc/modules. After reboot dongle work stably well.

I tried and still no game. I've even tried a solution for other distro: http://forums.whirlpool.net.au/archive/1202496, but I keep getting a hard reset. The error is still the same kernell NULL pointer, the firmware is the latest I just updated.

Code: Select all

$ uname -a
Linux raspberrypi 3.6.11+ #375 PREEMPT Tue Feb 12 01:41:07 GMT 2013 armv6l GNU/Linux

$ /opt/vc/bin/vcgencmd version
Feb  7 2013 16:46:17 
Copyright (c) 2012 Broadcom
version 367974 (release)

The error pops up systematically during the second connection, I use python and the first connection goes well (connect, send, recv, close), the second time though it crashes when I try to close the connection. It's as if some resources are still being used or something.

[sgkini]

Hi,
Were you able to solve the problem or did you buy another Bluetooth adapter ? I have the same problem with 2 BT adapters from Cambridge Silicon Radio.



Regards
Satish

[sgkini]

I got a new Bluetooth Adapter from Amazon http://www.amazon.de/gp/product/B003WJBZK0 and it works fine. Tried to connect and disconnect couple of time . The older one still crashes .

Both show as Cambridge Silicon Radio.

Code: Select all

 $ uname -a
Linux CarPC 3.6.11+ #408 PREEMPT Wed Apr 10 20:33:39 BST 2013 armv6l GNU/Linux

$ /opt/vc/bin/vcgencmd version
Apr  2 2013 22:57:46 
Copyright (c) 2012 Broadcom
version 381148 (release)

[pfile]

are there any updates on this issue? seems like it could be caused by bogus/counterfeit/grey market CSR chips? i see some checkins over here: https://github.com/raspberrypi/linux/issues/177 but i assume that if one is running the latest raspbian image then you have those changes. i also tried to update my firmware, however, i'm not sure what that really means in the context of the raspberry pi. is the firmware like a BIOS/monitor for this arm chip, or is it a new kernel, or what?

when this thing locks up my rpi, it corrupts the filesystem as well and i have to restore from my raspbian image and start over from scratch, so it's pretty annoying.

[xantofyll]

I have the same probably "fake" BT chipset and ran into exactly the same problems. Here are the statements that got me a little further:

Pair my device (this worked, but when I hit a button, my system froze up):

pi@raspberrypi ~ $ sudo bluez-simple-agent hci0 00:00:00:00:0B:9D
RequestPinCode (/org/bluez/5942/hci0/dev_00_00_00_00_0B_9D)
Enter PIN Code: 1234
Release
New device (/org/bluez/5942/hci0/dev_00_00_00_00_0B_9D)

BEFORE using the keyboard, it seemed I had to perform the following two steps as well (or my Pi would panic and crash)

Establish a trust:

pi@raspberrypi ~ $ sudo bluez-test-device trusted 00:00:00:00:0B:9D yes

And connect:

pi@raspberrypi ~ $ sudo bluez-test-input connect 00:00:00:00:0B:9D yes


Although this enabled me to log in using my bluetooth keyboard from the console, my Pi did panic and crash when I issued the "sudo reboot" command, just like it did when I hit any key before performing the two latter statements above. However, it might help to include a statement that disconnects the bluetooth device as part of the shutdown process. Anyway, I haven't tried that yet.

[blackberry-pi]

I bought this mini-keyboard and this combo wifi/bluetooth dongle from Amazon. The dongle for the keyboard and the combo dongle both use the CSR chipset. The latter also contains a Genesys Logic four-port USB 2 hub and a RealTek Wifi chipset (which also works).

I solved my CSR and blueman issues by adding the user account to the group bluetooth:

sudo usermod pi -a -G bluetooth

That's all it took.

[Schorschi]

Can't find hci_usb, and the blacklist and add to modules file changes don't seem applicable, why blacklist the module, only to load it, hci_usb reset=1 alone would make sense, except the hci_sub module does not exist on my Pi.

Running the latest firmware and following OS image...

# /opt/vc/bin/vcgencmd version
Jun 17 2013 20:43:10
Copyright (c) 2012 Broadcom
version d380dde43fe729f043befb5cf775f99e54586cde (clean) (release)

# uname -a
Linux Prototype 3.6.11+ #474 PREEMPT Thu Jun 13 17:14:42 BST 2013 armv6l GNU/Linux

# hciconfig -a
hci0: Type: BR/EDR Bus: USB
BD Address: 00:FF:FF:FF:FF:FF ACL MTU: 1021:4 SCO MTU: 180:1
UP RUNNING PSCAN ISCAN
RX bytes:1240 acl:0 sco:0 events:44 errors:0
TX bytes:446 acl:0 sco:0 commands:43 errors:0
Features: 0xff 0x3e 0x09 0x76 0x80 0x01 0x00 0x80
Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3
Link policy: RSWITCH HOLD SNIFF
Link mode: SLAVE ACCEPT
Name: 'Prototype'
Class: 0x420100
Service Classes: Networking, Telephony
Device Class: Computer, Uncategorized
HCI Version: 2.0 (0x3) Revision: 0x44
LMP Version: 2.0 (0x3) Subversion: 0x3
Manufacturer: Cambridge Silicon Radio (10)

I tried the add user step...

# usermod pi -a -G bluetooth

Consistently the following command will crash the Pi...

# bluez-simple-agent hci0 10:FF:FF:FF:FF:FF
RequestPinCode (/org/bluez/2745/hci0/dev_10_FF_FF_FF_FF_FF)
Enter PIN Code: 0000
Release
New device (/org/bluez/2745/hci0/dev_10_FF_FF_FF_FF_FF)

<Enable Visibility...>
<Accept Connection...>

Crash!

I also read in a few sources on the web, adding dwc_otg.speed=1 in the /boot/config.txt, but this did not seem to impact the situation in any positive way.

Anyone figure this out? Given all the previous steps?

[funky81]

Any news for this?
I've just recently update the latest rpi update (dated july 5th)
but still doesnt work.

Please help....

[Schorschi]

I have not had any success using the Bluetooth dongle based on the CSR chip. The bug appears to be something in Bluetooth driver broken with the latest kernel, the second I pair, Pi crash via kernel error. At least some other Linux distributions with the same CSR based dongles as well. I finally ordered a Bluetooth dongle that is based on a different chipset, once it arrives I will try in on my Raspberry Pi. The CSR based dongle works fine in Windows 7, tested that as well. Recently JAMECO electronics, where I got my CSR based dongle via Amazon web site, changed their advertising that once stated the given dongle was Raspberry Pi compatible, removing the reference to Raspberry Pi.

[funky81]

Finally, i bought this dongle http://img12.imageshack.us/img12/6823/andri1i.jpg
Still based on CSR, and its works

[DrDoom]

Also getting Kernel panic:
It says: BUG: unable to handle kernel NULL pointer dereference at 0000000000000004d
USB dongle is:
Bus 003 Device 002: ID 0a12:0001 Cambridge Silicon Radio, Ltd Bluetooth Dongle (HCI mode)

just run as root:

Code: Select all

hcitool scan --flush

then ping to the blueetooth device 10 times

Code: Select all

l2ping -c 10 XX:YY:ZZ:00:01:02

Then the system crashes almost every time.
Tried on latest raspbian upgrade, also the same result on a PC with Fedora 16 x64.

So it must be the USB (very cheap) dongle, I own two dongles, same model, same results.

[Joshun]

I have the same problem, also happens on my Debian 7 pc but doesn't happen in Ubuntu 13.10 - must be fixed in a newer kernel release. Perhaps this is related:
https://bugzilla.kernel.org/show_bug.cgi?id=60824