USB OTG kernel oopses

Hey,

when trying to use a Verdin iMX8MP as a NCM gadget, and connecting an iPad Mini, I get a bunch of kernel oopses.

1st from kirkstone 6.8.3

[  133.744429] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[  133.744455] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[  133.744805] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000008000010010
[  133.744844] xhci-hcd xhci-hcd.1.auto: irq 68, io mem 0x38100000
[  133.744945] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[  133.744957] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[  133.744970] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[  133.745564] hub 1-0:1.0: USB hub found
[  133.745599] hub 1-0:1.0: 1 port detected
[  133.745910] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[  133.746368] hub 2-0:1.0: USB hub found
[  133.746399] hub 2-0:1.0: 1 port detected
[  133.885713] Unable to handle kernel paging request at virtual address 00000107000000b0
[  133.893651] Mem abort info:
[  133.896444]   ESR = 0x0000000096000004
[  133.900192]   EC = 0x25: DABT (current EL), IL = 32 bits
[  133.905504]   SET = 0, FnV = 0
[  133.908559]   EA = 0, S1PTW = 0
[  133.911697]   FSC = 0x04: level 0 translation fault
[  133.916574] Data abort info:
[  133.919452]   ISV = 0, ISS = 0x00000004
[  133.923285]   CM = 0, WnR = 0
[  133.926251] user pgtable: 4k pages, 48-bit VAs, pgdp=000000010a595000
[  133.932691] [00000107000000b0] pgd=0000000000000000, p4d=0000000000000000
[  133.939484] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[  133.945751] Modules linked in: algif_hash algif_skcipher af_alg fsl_jr_uio caam_jr libdes caamkeyblob_desc authenc caamhash_desc caamalg_desc crypto_engine crct10dif_ce hci_uart btqca snd_soc_fsl_sai bluetooth snd_soc_wm8904 mwifiex_sdio lm75 ina2xx mwifiex imx_sdma caam secvio error moal(O) mlan(O) cfg80211 rfkill galcore(O) fuse
[  133.975089] CPU: 2 PID: 671 Comm: ifplugd Tainted: G           O      5.15.183-6.8.3-devel+git.defb81960f4f #1
[  133.985090] Hardware name: Toradex Verdin iMX8M Plus WB on TEM Board (DT)
[  133.991877] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  133.998845] pc : __rpm_get_callback+0x10/0x80
[  134.003219] lr : rpm_idle+0x54/0x180
[  134.006799] sp : ffff80001b45bb50
[  134.010112] x29: ffff80001b45bb50 x28: ffff0000c5710e00 x27: 0000000000000000
[  134.017254] x26: 0000000000000000 x25: ffff80001b45bd00 x24: 0000ffffe9863058
[  134.024395] x23: 0000000000000005 x22: ffff000002ba354c x21: 0000000000000005
[  134.031533] x20: ffff000002ba3468 x19: 0000000000000000 x18: 0000000000000000
[  134.038675] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80001b45bbec
[  134.045816] x14: ffffffffffffffff x13: 0000000000000020 x12: 0101010101010101
[  134.052956] x11: 0000000000000020 x10: 0101010101010101 x9 : 7f7f7f7f7f7f7f7f
[  134.060095] x8 : 7f7f7f7f7f7f7f7f x7 : fefefeff2f617274 x6 : 0000ffffe9863060
[  134.067236] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff000002ba3468
[  134.074377] x2 : 0000010700000000 x1 : 00000000000000b0 x0 : ffff000002ba34c0
[  134.081520] Call trace:
[  134.083967]  __rpm_get_callback+0x10/0x80
[  134.087983]  __pm_runtime_idle+0x5c/0xc0
[  134.091907]  dev_ethtool+0x184/0x2150
[  134.095572]  dev_ioctl+0x1e0/0x5b0
[  134.098978]  sock_do_ioctl+0xc0/0x100
[  134.102643]  sock_ioctl+0x12c/0x3c0
[  134.106135]  __arm64_sys_ioctl+0xa8/0xf0
[  134.110061]  invoke_syscall+0x48/0x120
[  134.113815]  el0_svc_common.constprop.0+0xd4/0x100
[  134.118613]  do_el0_svc+0x28/0xa0
[  134.121947]  el0_svc+0x28/0x80
[  134.125005]  el0t_64_sync_handler+0xa4/0x130
[  134.129277]  el0t_64_sync+0x1a0/0x1a4
[  134.132948] Code: f9410402 aa0003e3 d503233f b40000a2 (f8616840) 
[  134.139042] ---[ end trace 6f9fe23fa2e18585 ]---
[  134.143662] note: ifplugd[671] exited with preempt_count 1
[  135.079986] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[  135.669248] wlan: SCAN COMPLETED: scanned AP count=48
[  135.674739] netlink_broadcast failed: ret=-3
[  136.883856] usb 1-1: USB disconnect, device number 2
[  136.912192] xhci-hcd xhci-hcd.1.auto: remove, state 4
[  136.917292] usb usb2: USB disconnect, device number 1
[  136.927003] xhci-hcd xhci-hcd.1.auto: USB bus 2 deregistered
[  136.932712] xhci-hcd xhci-hcd.1.auto: remove, state 1
[  136.938272] usb usb1: USB disconnect, device number 1
[  136.973351] xhci-hcd xhci-hcd.1.auto: USB bus 1 deregistered

2nd one from Kirkstone 6.8.3

kernel-oops: Modules linked in: algif_hash algif_skcipher af_alg fsl_jr_uio caam_jr libdes caamkeyblob_desc authenc caamhash_desc caamalg_desc crypto_engine crct10dif_ce snd_soc_fsl_sai imx_sdma hci_uart mwifiex_sdio btqca mwifiex bluetooth snd_soc_wm8904 ina2xx lm75 caam secvio error moal(O) mlan(O) cfg80211 rfkill galcore(O) fuse
CPU: 2 PID: 663 Comm: ifplugd Tainted: G           O      5.15.183-6.8.3-devel+git.defb81960f4f #1
Hardware name: Toradex Verdin iMX8M Plus WB on TEM Board (DT)
pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : queued_spin_lock_slowpath+0x1cc/0x370
lr : _raw_spin_lock_irqsave+0x98/0xd0
sp : ffff80001b2f3b70
x29: ffff80001b2f3b70 x28: ffff0000c6ca8e00 x27: 0000000000000000
x26: 0000000000000000 x25: ffff80001b2f3d00 x24: 0000ffffc38c0138
x23: 0000000000000005 x22: ffff0000caf4d14c x21: ffff8000097b3c80
x20: 0000000000000004 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffc38c0138
x14: ffffffffffffffff x13: 0000000000000020 x12: 0101010101010101
x11: 0000000000000020 x10: 0000000000000000 x9 : 00000000000c0000
x8 : 0000000000000000 x7 : ffff0000ff765240 x6 : ffff8000093de240
x5 : ffff0000ff765240 x4 : ffff0000caf4d14e x3 : ffff0000caf4d14c
x2 : 0000000000000000 x1 : ffff8000093de250 x0 : ffff0000ff765248
Call trace:
 queued_spin_lock_slowpath+0x1cc/0x370
 __pm_runtime_resume+0x2c/0xa0
 dev_ethtool+0xf4/0x2150
 dev_ioctl+0x1e0/0x5b0
 sock_do_ioctl+0xc0/0x100
 sock_ioctl+0x12c/0x3c0
 __arm64_sys_ioctl+0xa8/0xf0
 invoke_syscall+0x48/0x120
 el0_svc_common.constprop.0+0xd4/0x100
 do_el0_svc+0x28/0xa0
 el0_svc+0x28/0x80
 el0t_64_sync_handler+0xa4/0x130
 el0t_64_sync+0x1a0/0x1a4
Code: d37c0421 8b0100c1 f860d842 910020e0 (f8226827) 

3rd one from Kirkstone 6.8.3

kernel-oops: Modules linked in: algif_hash algif_skcipher af_alg fsl_jr_uio caam_jr libdes caamkeyblob_desc authenc caamhash_desc caamalg_desc crypto_engine crct10dif_ce snd_soc_fsl_sai mwifiex_sdio hci_uart btqca bluetooth mwifiex imx_sdma snd_soc_wm8904 ina2xx lm75 caam secvio error moal(O) mlan(O) cfg80211 rfkill galcore(O) fuse
CPU: 1 PID: 255 Comm: kworker/1:2 Tainted: G      D    O      5.15.183-6.8.3-devel+git.defb81960f4f #1
Hardware name: Toradex Verdin iMX8M Plus WB on TEM Board (DT)
Workqueue: events_freezable __dwc3_set_mode
pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : pm_ops_is_empty+0x10/0x70
lr : device_pm_check_callbacks+0xb4/0x100
sp : ffff800009dd39e0
x29: ffff800009dd39e0 x28: ffff0000cc39e030 x27: ffff80000918dfd0
x26: ffff8000097116a8 x25: 0000000000000000 x24: ffff8000097a43f0
x23: ffff0000cc39e030 x22: 0000000000080000 x21: ffff8000096ad310
x20: ffff0000cc39dcf4 x19: ffff0000cc39dc10 x18: ffffffffffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: ffff800089dd3727
x14: 0000000000000022 x13: 0000000000000000 x12: ffff0000c2e57a40
x11: 0000000000000040 x10: ffff0000c2e57908 x9 : ffff0000c0024f10
x8 : ffff0000c2e57930 x7 : ffff0000c02a0e00 x6 : ffff0000c2b5db40
x5 : 0000000000000001 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000001 x1 : 0000000000000001 x0 : 0000000000000000
Call trace:
 pm_ops_is_empty+0x10/0x70
 device_pm_remove+0x7c/0xd0
 device_del+0x17c/0x3b0
 device_unregister+0x20/0x80
 usb_remove_ep_devs+0x24/0x40
 usb_disable_device+0xd0/0x240
 usb_disconnect+0x108/0x300
 usb_remove_hcd+0xec/0x19c
 xhci_plat_remove+0x88/0x150
 platform_remove+0x54/0x70
 __device_release_driver+0x184/0x240
 device_release_driver+0x2c/0x50
 bus_remove_device+0xd4/0x160
 device_del+0x174/0x3b0
 platform_device_del.part.0+0x1c/0x90
 platform_device_unregister+0x24/0x40
 dwc3_host_exit+0x24/0x50
 __dwc3_set_mode+0x160/0x3c0
 process_one_work+0x1cc/0x370
 worker_thread+0x13c/0x490
 kthread+0x150/0x160
 ret_from_fork+0x10/0x20
Code: d503233f b40002e0 aa0003e1 52800000 (f9400022) 

2 more on Scarthgap 7.3.0

[  206.645687] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[  206.645718] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[  206.646076] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x000000a001000010
[  206.646117] xhci-hcd xhci-hcd.1.auto: irq 217, io mem 0x38100000
[  206.646244] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[  206.646258] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[  206.646274] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[  206.646406] usb usb1: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 6.06
[  206.646417] usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[  206.646424] usb usb1: Product: xHCI Host Controller
[  206.646429] usb usb1: Manufacturer: Linux 6.6.94-7.3.0-devel xhci-hcd
[  206.646435] usb usb1: SerialNumber: xhci-hcd.1.auto
[  206.646971] hub 1-0:1.0: USB hub found
[  206.647009] hub 1-0:1.0: 1 port detected
[  206.647396] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[  206.647482] usb usb2: New USB device found, idVendor=1d6b, idProduct=0003, bcdDevice= 6.06
[  206.647492] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[  206.647499] usb usb2: Product: xHCI Host Controller
[  206.647505] usb usb2: Manufacturer: Linux 6.6.94-7.3.0-devel xhci-hcd
[  206.647511] usb usb2: SerialNumber: xhci-hcd.1.auto
[  206.647977] hub 2-0:1.0: USB hub found
[  206.648007] hub 2-0:1.0: 1 port detected
[  206.901257] usb 1-1: new high-speed USB device number 2 using xhci-hcd
[  207.052092] usb 1-1: New USB device found, idVendor=05ac, idProduct=12ab, bcdDevice=16.01
[  207.052113] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  207.052120] usb 1-1: Product: iPad
[  207.052126] usb 1-1: Manufacturer: Apple Inc.
[  207.052134] usb 1-1: SerialNumber: 00008130000225381ED0001C
[  208.309138] usb 1-1: USB disconnect, device number 2
[  208.333385] xhci-hcd xhci-hcd.1.auto: remove, state 4
[  208.333411] usb usb2: USB disconnect, device number 1
[  208.343009] xhci-hcd xhci-hcd.1.auto: USB bus 2 deregistered
[  208.343036] xhci-hcd xhci-hcd.1.auto: remove, state 1
[  208.343047] usb usb1: USB disconnect, device number 1
[  208.347273] xhci-hcd xhci-hcd.1.auto: USB bus 1 deregistered
[  208.348550] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000d0
[  208.357562] Mem abort info:
[  208.360368]   ESR = 0x0000000096000005
[  208.364158]   EC = 0x25: DABT (current EL), IL = 32 bits
[  208.369595]   SET = 0, FnV = 0
[  208.372661]   EA = 0, S1PTW = 0
[  208.375825]   FSC = 0x05: level 1 translation fault
[  208.380826] Data abort info:
[  208.383732]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[  208.389256]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  208.394365]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  208.399712] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000107508000
[  208.406194] [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[  208.414926] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP
[  208.421198] Modules linked in: bnep usb_conn_gpio caam_jr libdes caamkeyblob_desc caamhash_desc caamalg_desc dwc3 crypto_engine roles authenc crypto_null hci_uart bluetooth moal(O) aes_ce_cipher ecdh_generic ghash_ce gf128mul ecc crc16 libaes mlan(O) sha2_ce sha256_arm64 snd_soc_simple_card fsl_imx8_ddr_perf sha1_ce snd_soc_simple_card_utils sha1_generic cfg80211 rfkill phy_fsl_imx8mq_usb snd_soc_fsl_sai ti_ads1015 industrialio_triggered_buffer kfifo_buf snd_soc_fsl_utils imx_pcm_dma lm75 imx_bus ina2xx spi_nxp_fspi dwc3_imx8mp imx_sdma snd_soc_wm8904 spi_imx caam error nvmem_snvs_lpgpr imx8mm_thermal evdev galcore(O) fuse ipv6 autofs4
[  208.477597] CPU: 1 PID: 48 Comm: kworker/1:1 Tainted: G           O       6.6.94-7.3.0-devel #1
[  208.486297] Hardware name: Toradex Verdin iMX8M Plus WB on TEM Board (DT)
[  208.493084] Workqueue: events_freezable __dwc3_set_mode [dwc3]
[  208.498937] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  208.505900] pc : dev_pm_domain_detach+0x8/0x34
[  208.510353] lr : platform_remove+0x38/0x6c
[  208.514454] sp : ffffffc0815a3bd0
[  208.517768] x29: ffffffc0815a3bd0 x28: 0000000000000000 x27: 0000000000000000
[  208.524910] x26: ffffffc08111ae50 x25: 0000000000000000 x24: ffffff80c0014405
[  208.532050] x23: 0000000000000080 x22: ffffff80d816f490 x21: ffffffc08106f430
[  208.539191] x20: 0000000000000000 x19: ffffff80d816f410 x18: 0000000000000000
[  208.546331] x17: 0000000000000000 x16: 0000000000000000 x15: 0000007fe75ead98
[  208.553472] x14: 0000000000000000 x13: 0000000000000369 x12: 0000000000000002
[  208.560613] x11: 0000000000000000 x10: 0000000000000970 x9 : ffffffc0815a39a0
[  208.567752] x8 : ffffffc0815a3a80 x7 : 0000000000000000 x6 : 000000006440f06c
[  208.574894] x5 : 00000000000003b0 x4 : 0000000000000000 x3 : 0000000000000001
[  208.582031] x2 : 0000000000000010 x1 : 0000000000000001 x0 : ffffff80d816f410
[  208.589171] Call trace:
[  208.591615]  dev_pm_domain_detach+0x8/0x34
[  208.595715]  device_remove+0x4c/0x80
[  208.599292]  device_release_driver_internal+0x1cc/0x228
[  208.604518]  device_release_driver+0x18/0x24
[  208.608790]  bus_remove_device+0xd0/0x160
[  208.612802]  device_del+0x164/0x3cc
[  208.616292]  platform_device_del.part.0+0x1c/0x84
[  208.620999]  platform_device_unregister+0x24/0x40
[  208.625705]  dwc3_host_exit+0x30/0x74 [dwc3]
[  208.629987]  __dwc3_set_mode+0x160/0x3b8 [dwc3]
[  208.634531]  process_one_work+0x144/0x29c
[  208.638543]  worker_thread+0x324/0x43c
[  208.642294]  kthread+0x110/0x114
[  208.645526]  ret_from_fork+0x10/0x20
[  208.649107] Code: d65f03c0 00000000 f9410802 b4000162 (f9406042) 
[  208.655201] ---[ end trace 0000000000000000 ]---
[  208.964508] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000011
[  208.973311] Mem abort info:
[  208.976106]   ESR = 0x0000000096000005
[  208.979854]   EC = 0x25: DABT (current EL), IL = 32 bits
[  208.985166]   SET = 0, FnV = 0
[  208.988220]   EA = 0, S1PTW = 0
[  208.991360]   FSC = 0x05: level 1 translation fault
[  208.996239] Data abort info:
[  208.999118]   ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
[  209.004604]   CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[  209.009657]   GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[  209.014969] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000106bff000
[  209.021410] [0000000000000011] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
[  209.030117] Internal error: Oops: 0000000096000005 [#2] PREEMPT SMP
[  209.036387] Modules linked in: bnep usb_conn_gpio caam_jr libdes caamkeyblob_desc caamhash_desc caamalg_desc dwc3 crypto_engine roles authenc crypto_null hci_uart bluetooth moal(O) aes_ce_cipher ecdh_generic ghash_ce gf128mul ecc crc16 libaes mlan(O) sha2_ce sha256_arm64 snd_soc_simple_card fsl_imx8_ddr_perf sha1_ce snd_soc_simple_card_utils sha1_generic cfg80211 rfkill phy_fsl_imx8mq_usb snd_soc_fsl_sai ti_ads1015 industrialio_triggered_buffer kfifo_buf snd_soc_fsl_utils imx_pcm_dma lm75 imx_bus ina2xx spi_nxp_fspi dwc3_imx8mp imx_sdma snd_soc_wm8904 spi_imx caam error nvmem_snvs_lpgpr imx8mm_thermal evdev galcore(O) fuse ipv6 autofs4
[  209.092841] CPU: 3 PID: 347 Comm: ifplugd Tainted: G      D    O       6.6.94-7.3.0-devel #1
[  209.101283] Hardware name: Toradex Verdin iMX8M Plus WB on TEM Board (DT)
[  209.108070] pstate: 400000c5 (nZcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  209.115034] pc : hrtimer_active+0x4/0x60
[  209.118969] lr : hrtimer_try_to_cancel+0x14/0x3c
[  209.123591] sp : ffffffc092e03aa0
[  209.126904] x29: ffffffc092e03aa0 x28: ffffff80c4d48000 x27: 0000000000000000
[  209.134049] x26: 0000000000000000 x25: ffffff80d816f590 x24: 0000000000000001
[  209.141194] x23: ffffffc080084c20 x22: 0000000000000004 x21: 0000000000000000
[  209.148336] x20: ffffff80d816f54c x19: ffffff80d816f468 x18: 0000000000000000
[  209.155479] x17: 0000000000000000 x16: 0000000000000000 x15: 0000007fc672be68
[  209.162624] x14: ffffffffffffffff x13: 0000000000000020 x12: 0101010101010101
[  209.169766] x11: 7f7f7f7f7f7f7f7f x10: 0000003fd0f2ed10 x9 : 0000000000000020
[  209.176912] x8 : 0101010101010101 x7 : 0000000080808080 x6 : 0000000080808080
[  209.184057] x5 : 0000000000000009 x4 : ffffff80d816f590 x3 : 0000000000000001
[  209.191200] x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffffff80d816f590
[  209.198345] Call trace:
[  209.200792]  hrtimer_active+0x4/0x60
[  209.204378]  rpm_resume+0x244/0x6b4
[  209.207876]  __pm_runtime_resume+0x50/0x94
[  209.211980]  __dev_ethtool+0x98/0x1e14
[  209.215737]  dev_ethtool+0x164/0x240
[  209.219318]  dev_ioctl+0x324/0x4e0
[  209.222727]  sock_ioctl+0x3f8/0x494
[  209.226224]  __arm64_sys_ioctl+0x2c0/0xc24
[  209.230325]  invoke_syscall.constprop.0+0x50/0xec
[  209.235034]  do_el0_svc+0x40/0xc4
[  209.238353]  el0_svc+0x40/0x16c
[  209.241501]  el0t_64_sync_handler+0x120/0x12c
[  209.245863]  el0t_64_sync+0x190/0x194
[  209.249534] Code: 54fffe8b 91000400 17ffffe6 f9401802 (b9401041) 
[  209.255627] ---[ end trace 0000000000000000 ]---
[  209.260247] note: ifplugd[347] exited with irqs disabled
[  209.265659] note: ifplugd[347] exited with preempt_count 1

Our device tree is basically the upstream Dahlia device tree, especially the USB3 bindings we just use as is.

This is our gadget config, which is pretty close to the one from meta-toradex-demos: (just using shell script rather than libusbgx)

#!/bin/bash

if [[ -d /sys/kernel/config/usb_gadget/gncm ]]; then
    echo "Already started"
    exit 0
fi

mkdir /sys/kernel/config/usb_gadget/gncm
cd /sys/kernel/config/usb_gadget/gncm

echo "0xEF" > bDeviceClass
echo "0x02" > bDeviceSubClass
echo "0x01" > bDeviceProtocol
echo "0x1d6b" > idVendor
echo "0x0104" > idProduct

mkdir strings/0x409
cat ... > strings/0x409/serialnumber
echo "..." > strings/0x409/manufacturer
echo "..." > strings/0x409/product

echo "1"       > os_desc/use
echo "0xbc"    > os_desc/b_vendor_code
echo "MSFT100" > os_desc/qw_sign

mkdir functions/ncm.usb0
echo "WINNCM" > functions/ncm.usb0/os_desc/interface.ncm/compatible_id

mkdir configs/c.1
mkdir configs/c.1/strings/0x409
echo "conf1" > configs/c.1/strings/0x409/configuration

ln -s functions/ncm.usb0 configs/c.1

if [ ! -L os_desc/c.1 ]
then
         ln -s configs/c.1 os_desc
fi

echo "38100000.usb" > UDC

Any pointers?

Hi, I’m the Toradex AI Assistant.

I might make mistakes or occasionally get you wrong. Our support team will step in if needed.


I’d be glad to help! To provide the most accurate guidance for your NCM gadget setup and kernel oops issues, could you let me know which OS and version you are using? You can run the tdx-info command to get detailed information about your system configuration - you can find more details about this tool at Getting Device Information with Tdx-Info | Toradex Developer Center

From your logs, I can see you’re working with both Kirkstone 6.8.3 and Scarthgap 7.3.0, but knowing the exact versions will help me provide more targeted troubleshooting steps for your USB device mode configuration.

Initial Observations

Based on your kernel oops traces, it appears there are power management and device lifecycle issues occurring when the USB controller switches modes or when devices are disconnected. The traces show problems in:

  • Runtime power management callbacks (__rpm_get_callback, __pm_runtime_resume)
  • Device removal and cleanup (device_del, platform_device_unregister)
  • USB host controller deregistration (xhci-hcd removal)

USB Device Mode Configuration

Your NCM gadget configuration script looks reasonable and follows the USB Gadget ConfigFS approach that Toradex supports (1). The NXP/Freescale i.MX8 based modules use the USB Gadget ConfigFS to configure the USB peripheral port (1).

However, I notice you’re using the UDC name "38100000.usb" - please verify this matches your actual USB Device Controller. You can check available controllers with:

ls /sys/class/udc/

(1)

Once I know your exact OS version, I can provide more specific guidance on potential fixes for the kernel oops issues you’re experiencing.

Best regards, Toradex AI Assistant.


Did you like my answer? :+1: :-1:

If I answered your question, please tick the “Solution” checkbox.

For follow-up questions to me, please use @ToradexAI in your post.

Hello @hannes.winkler,

Sorry for the delay on this topic.

Regarding the issue you see, do you only see it when connecting an iPad Mini or also other devices?
Does it correlate with a specific device or version of iOS?

The issue seems related to the power management features of Linux.
Is your device battery powered? If not, a possible solution could be to setup some of the regulators involved as always-on.

Best Regards,
Bruno

We also had issues with an iPad Air 11" (latest generation), iOS 26. There, the board even reset completely. We plugged in the iPad and got a black screen on our iMX8MP.

Other devices however work fine, e.g. MacBook, Android phone. Unfortunately, I don’t know if it correlates to a specific iOS version, we are all using iOS 26 on the iPads.

However, we were using Kirkstone 6.4.x before, and we couldn’t reproduce it there.

Our device is battery powered unfortunately. Though I will test if changing some regulators to always-on improves it.

Hello @hannes.winkler,

Thanks for the additional information.
I will check to see what may have changed since BSP 6.4.0 on this topic.

Once I have further updates, I will let you know.

Best Regards,
Bruno

Hello @hannes.winkler,

I think the error you are seeing may have been fixed on this commit: Making sure you're not a bot!

From what I checked, it has been included only from BSP 6.8.4 and 7.4.0.
Can you test in either of these BSPs so we can see if it is the cause?

I also have seen a few changes to the code related to the USB Gadget which is only available on nightly releases.
If the above stable releases do not work, could you do a test with the latest nightly releases?

Best Regards,
Bruno