crash during USB gadget driver unload

we observed kernel crash during usb gadget driver unload. we are using jetson tk1 board with 21.4 L4T release packages.

following is the log.


root@jetson:~# lsmod
Not tainted
libcomposite 31220 0 - Live 0xbf049000
configfs 23855 2 libcomposite, Live 0xbf03e000
ecryptfs 82807 2 - Live 0xbf01f000
mep_wiegand 9318 0 - Live 0xbf018000
ma1000_gpio 8796 0 - Live 0xbf011000
mep_tamper 3235 0 - Live 0xbf00d000
ma1000_sdac 8235 0 - Live 0xbf007000
ma1000_panel_feedback 10200 0 - Live 0xbf000000
root@jetson:~#
root@jetson:~#
root@jetson:~#
root@jetson:~#
root@jetson:~#
root@jetson:~#
root@jetson:~#
root@jetson:~# modprobe g_ether
[ 217.927636] g_ether gadget: using random self ethernet address
[ 217.933524] g_ether gadget: using random host ethernet address
[ 217.940112] usb0: MAC 6a:80:d3:67:5e:d2
[ 217.944012] usb0: HOST MAC 3e:a3:d6:4c:98:fb
[ 217.948441] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[ 217.955092] g_ether gadget: g_ether ready
[ 217.959152] tegra-udc: bind to driver g_ether
root@jetson:~# [ 218.015402] IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready

root@jetson:~#
root@jetson:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:04:4B:26:FC:7C
inet addr:10.102.1.157 Bcast:10.102.3.255 Mask:255.255.252.0
inet6 addr: 2001:db8:100:f101:204:4bff:fe26:fc7c/64 Scope:Global
inet6 addr: fe80::204:4bff:fe26:fc7c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8027 errors:0 dropped:0 overruns:0 frame:0
TX packets:42 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:589626 (575.8 KiB) TX bytes:4493 (4.3 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

usb0 Link encap:Ethernet HWaddr 6A:80:D3:67:5E:D2
inet addr:192.168.7.2 Bcast:192.168.7.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

root@jetson:~#
root@jetson:~# rmmod g_ether
[ 239.357574] Unable to handle kernel NULL pointer dereference at virtual address 00000044
[ 239.365670] pgd = ebc28000
[ 239.368379] [00000044] *pgd=ac82b831, *pte=00000000, *ppte=00000000
[ 239.374680] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 239.380074] Modules linked in: g_ether(-) libcomposite configfs ecryptfs mep_wiegand ma1000_gpio mep_tamper ma1000_sdac ma1000_panel_feedback [last unloaded: u_serial]
[ 239.395138] CPU: 1 PID: 1356 Comm: rmmod Not tainted 3.10.40 #6
[ 239.401058] task: ed302540 ti: ec0b2000 task.ti: ec0b2000
[ 239.406468] PC is at _raw_spin_lock_irqsave+0x2c/0x68
[ 239.411525] LR is at composite_disconnect+0x24/0x64 [libcomposite]
[ 239.417699] pc : [] lr : [] psr: a0000093
[ 239.417699] sp : ec0b3ed8 ip : 00000000 fp : 00000000
[ 239.429155] r10: 00000000 r9 : ec0b2000 r8 : 40000013
[ 239.434370] r7 : 00000000 r6 : ed05baa0 r5 : 00000044 r4 : 00000000
[ 239.440884] r3 : ec0b2000 r2 : 00000044 r1 : 00000001 r0 : a0000093
[ 239.447400] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 239.454608] Control: 10c5387d Table: abc2806a DAC: 00000015
[ 239.460341]
[ 239.460341] PC: 0xc07f8a88:
[ 239.464602] 8a88 e1a0300d e3c33d7f e3c3303f e5932004 e2822001 e5832004 e1903f9f e2832801
[ 239.472832] 8aa8 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003 0a000003 e320f002
[ 239.481062] 8ac8 e1d030b0 e1520003 1afffffb f57ff05f e12fff1e e52de004 e8bd4000 e1a02000
[ 239.489289] 8ae8 e10f0000 f10c0080 e1a0300d e3c33d7f e3c3303f e5931004 e2811001 e5831004
[ 239.497518] 8b08 e1923f9f e2831801 e182cf91 e33c0000 1afffffa e1a01823 e6ff3073 e1510003
[ 239.505745] 8b28 0a000003 e320f002 e1d230b0 e1510003 1afffffb f57ff05f e12fff1e e52de004
[ 239.513972] 8b48 e8bd4000 f10c0080 e1a0300d e3c33d7f e3c3303f e5932004 e2822001 e5832004
[ 239.522201] 8b68 e1903f9f e2832801 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003
[ 239.530430]
[ 239.530430] SP: 0xec0b3e58:
[ 239.534689] 3e58 ed302040 c009b708 ed30247c 00000000 60000093 ed302040 ed05a588 c01aa468
[ 239.542917] 3e78 c07f8b08 a0000093 ffffffff ec0b3ec4 40000013 c000ebd8 a0000093 00000001
[ 239.551144] 3e98 00000044 ec0b2000 00000000 00000044 ed05baa0 00000000 40000013 ec0b2000
[ 239.559371] 3eb8 00000000 00000000 00000000 ec0b3ed8 bf04a248 c07f8b08 a0000093 ffffffff
[ 239.567598] 3ed8 ed05ba9c ed05b800 ed05baa0 c0502434 00000001 ed05b800 ed05ba9c c0503668
[ 239.575826] 3ef8 ed05de00 ed05b800 ed05b800 ed05ba9c c000f224 c05038b8 ed05de00 bf071298
[ 239.584053] 3f18 00000000 00000880 c000f224 c04ffb1c 00000000 c04ffbc4 bf06f4f8 bf071a18
[ 239.592281] 3f38 ec0b2000 c00c6458 00000020 00000000 bf071a18 00000880 ec0b3f44 74655f67
[ 239.600509]
[ 239.600509] R3: 0xec0b1f80:
[ 239.604768] 1f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.612996] 1fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.621222] 1fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.629449] 1fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.637677] 2000 00000000 00000002 00000000 ed302540 c1035ef8 00000001 00000015 c22004c0
[ 239.645904] 2020 ed302540 ee0ae040 c0f9e4e8 ed273040 00000000 c0f674c0 ec0b3e2c ec0b3d80
[ 239.654131] 2040 c07f77cc 00000000 00000000 00000000 00000000 00000000 00010000 00000000
[ 239.662358] 2060 b6d9b6d0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.670585]
[ 239.670585] R6: 0xed05ba20:
[ 239.674844] ba20 00000000 ffffffe0 ed05ba28 ed05ba28 c050146c ffffffe0 ed05ba38 ed05ba38
[ 239.683073] ba40 c05015c8 ffffffe0 ed05ba48 ed05ba48 c050384c 00000001 00000000 00000000
[ 239.691300] ba60 00000000 fe200000 00000800 7d001000 00000020 00000034 00000000 00000000
[ 239.699530] ba80 00000001 00000000 00000000 00000000 00000000 0016e360 00000000 00020002
[ 239.707756] baa0 00000000 00000000 ed05baa8 ed05baa8 ed302540 00000000 01000102 00000100
[ 239.715985] bac0 ed0582c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.724211] bae0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.732438] bb00 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.740666]
[ 239.740666] R9: 0xec0b1f80:
[ 239.744924] 1f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.753150] 1fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.761385] 1fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.769611] 1fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.777839] 2000 00000000 00000002 00000000 ed302540 c1035ef8 00000001 00000015 c22004c0
[ 239.786065] 2020 ed302540 ee0ae040 c0f9e4e8 ed273040 00000000 c0f674c0 ec0b3e2c ec0b3d80
[ 239.794328] 2040 c07f77cc 00000000 00000000 00000000 00000000 00000000 00010000 00000000
[ 239.802583] 2060 b6d9b6d0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 239.810815] Process rmmod (pid: 1356, stack limit = 0xec0b2238)
[ 239.816722] Stack: (0xec0b3ed8 to 0xec0b4000)
[ 239.821070] 3ec0: ed05ba9c ed05b800
[ 239.829234] 3ee0: ed05baa0 c0502434 00000001 ed05b800 ed05ba9c c0503668 ed05de00 ed05b800
[ 239.837397] 3f00: ed05b800 ed05ba9c c000f224 c05038b8 ed05de00 bf071298 00000000 00000880
[ 239.845560] 3f20: c000f224 c04ffb1c 00000000 c04ffbc4 bf06f4f8 bf071a18 ec0b2000 c00c6458
[ 239.853724] 3f40: 00000020 00000000 bf071a18 00000880 ec0b3f44 74655f67 00726568 00004b74
[ 239.861887] 3f60: b6f46000 c000f224 ec0b2000 00000000 beb28acc c012e6a0 ffffffff b6f6e904
[ 239.870051] 3f80: b6f6e568 b6f46000 00004b74 00f6e904 b6f6e568 00018b2c 74655f67 00726568
[ 239.878215] 3fa0: 00000081 c000f080 00018b2c 74655f67 beb28b40 00000880 000a39b0 beb28de8
[ 239.886378] 3fc0: 00018b2c 74655f67 00726568 00000081 beb28de4 00096542 000a179c 00000000
[ 239.894541] 3fe0: beb28b38 beb28b28 00018974 b6e6cd30 600c0010 beb28b40 00000000 00000000
[ 239.902725] [] (_raw_spin_lock_irqsave+0x2c/0x68) from [] (composite_disconnect+0x24/0x64 [libcomposite])
[ 239.914036] [] (composite_disconnect+0x24/0x64 [libcomposite]) from [] (reset_queues+0x8c/0x9c)
[ 239.924463] [] (reset_queues+0x8c/0x9c) from [] (tegra_vbus_session+0xc8/0x2ac)
[ 239.933500] [] (tegra_vbus_session+0xc8/0x2ac) from [] (tegra_udc_stop+0x2c/0x8c)
[ 239.942711] [] (tegra_udc_stop+0x2c/0x8c) from [] (usb_gadget_remove_driver+0x80/0xb8)
[ 239.952354] [] (usb_gadget_remove_driver+0x80/0xb8) from [] (usb_gadget_unregister_driver+0x70/0x94)
[ 239.963213] [] (usb_gadget_unregister_driver+0x70/0x94) from [] (SyS_delete_module+0x254/0x380)
[ 239.973640] [] (SyS_delete_module+0x254/0x380) from [] (ret_fast_syscall+0x0/0x30)
[ 239.982933] Code: e3c3303f e5931004 e2811001 e5831004 (e1923f9f)
[ 239.989022] —[ end trace 3d62adaef726d8d7 ]—
[ 239.993634] note: rmmod[1356] exited with preempt_count 1
Segmentation fault


Modprobe and rmmod without an actual USB device succeeds for me on R21.4, so reproducing the problem is easier with an actual device. The lsmod given was prior to g_ether modprobe, so I’m curious if after module load (with an actual device attached) the lsmod shows any “Used by” dependency?

which module you loaded and unloaded successfully on 21.4 ?

we have not connected anything on usb port.

see below new log with no other driver loaded before g_ether and lsmod after g_ether load.


root@jetson:~# lsmod
Not tainted
root@jetson:~#
root@jetson:~#
root@jetson:~# modprobe g_ether
[ 149.074730] g_ether gadget: using random self ethernet address
[ 149.080723] g_ether gadget: using random host ethernet address
[ 149.087370] usb0: MAC 6a:33:de:1e:12:96
[ 149.091375] usb0: HOST MAC 16:2d:0d:9b:ef:5f
[ 149.095840] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[ 149.102611] g_ether gadget: g_ether ready
[ 149.106729] tegra-udc: bind to driver g_ether
root@jetson:~# [ 149.162825] IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready

root@jetson:~# lsmod
Not tainted
g_ether 35119 0 - Live 0xbf057000
libcomposite 31220 1 g_ether, Live 0xbf049000
configfs 23855 2 libcomposite, Live 0xbf03e000
root@jetson:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:04:4B:26:FC:7C
inet addr:10.102.1.157 Bcast:10.102.3.255 Mask:255.255.252.0
inet6 addr: 2001:db8:100:f101:204:4bff:fe26:fc7c/64 Scope:Global
inet6 addr: fe80::204:4bff:fe26:fc7c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4531 errors:0 dropped:0 overruns:0 frame:0
TX packets:37 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:352927 (344.6 KiB) TX bytes:4218 (4.1 KiB)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

usb0 Link encap:Ethernet HWaddr 6A:33:DE:1E:12:96
inet addr:192.168.7.2 Bcast:192.168.7.255 Mask:255.255.255.0
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

root@jetson:~# rmmod g_ether
[ 166.951623] Unable to handle kernel NULL pointer dereference at virtual address 00000044
[ 166.959714] pgd = ec060000
[ 166.962429] [00000044] *pgd=ac1e0831, *pte=00000000, *ppte=00000000
[ 166.968738] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 166.974131] Modules linked in: g_ether(-) libcomposite configfs [last unloaded: ma1000_panel_feedback]
[ 166.983499] CPU: 0 PID: 1363 Comm: rmmod Not tainted 3.10.40 #6
[ 166.989418] task: ed72e580 ti: ec1c2000 task.ti: ec1c2000
[ 166.994830] PC is at _raw_spin_lock_irqsave+0x2c/0x68
[ 166.999892] LR is at composite_disconnect+0x24/0x64 [libcomposite]
[ 167.006067] pc : [] lr : [] psr: a00f0093
[ 167.006067] sp : ec1c3ed8 ip : 00000000 fp : 00000000
[ 167.017530] r10: 00000000 r9 : ec1c2000 r8 : 400f0013
[ 167.022746] r7 : 00000000 r6 : ed0516a0 r5 : 00000044 r4 : 00000000
[ 167.029261] r3 : ec1c2000 r2 : 00000044 r1 : 00000001 r0 : a00f0093
[ 167.035777] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 167.042986] Control: 10c5387d Table: ac06006a DAC: 00000015
[ 167.048720]
[ 167.048720] PC: 0xc07f8a88:
[ 167.052980] 8a88 e1a0300d e3c33d7f e3c3303f e5932004 e2822001 e5832004 e1903f9f e2832801
[ 167.061214] 8aa8 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003 0a000003 e320f002
[ 167.069446] 8ac8 e1d030b0 e1520003 1afffffb f57ff05f e12fff1e e52de004 e8bd4000 e1a02000
[ 167.077676] 8ae8 e10f0000 f10c0080 e1a0300d e3c33d7f e3c3303f e5931004 e2811001 e5831004
[ 167.085906] 8b08 e1923f9f e2831801 e182cf91 e33c0000 1afffffa e1a01823 e6ff3073 e1510003
[ 167.094136] 8b28 0a000003 e320f002 e1d230b0 e1510003 1afffffb f57ff05f e12fff1e e52de004
[ 167.102364] 8b48 e8bd4000 f10c0080 e1a0300d e3c33d7f e3c3303f e5932004 e2822001 e5832004
[ 167.110593] 8b68 e1903f9f e2832801 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003
[ 167.118823]
[ 167.118823] SP: 0xec1c3e58:
[ 167.123082] 3e58 df169ef5 00000026 c07f8034 edb72000 c0f9d488 c0f9d448 ed052a08 c01aa468
[ 167.131312] 3e78 c07f8b08 a00f0093 ffffffff ec1c3ec4 400f0013 c000ebd8 a00f0093 00000001
[ 167.139541] 3e98 00000044 ec1c2000 00000000 00000044 ed0516a0 00000000 400f0013 ec1c2000
[ 167.147768] 3eb8 00000000 00000000 00000000 ec1c3ed8 bf04a248 c07f8b08 a00f0093 ffffffff
[ 167.155996] 3ed8 ed05169c ed051400 ed0516a0 c0502434 00000001 ed051400 ed05169c c0503668
[ 167.164224] 3ef8 ed04c400 ed051400 ed051400 ed05169c c000f224 c05038b8 ed04c400 bf05e298
[ 167.172454] 3f18 00000000 00000880 c000f224 c04ffb1c 00000000 c04ffbc4 bf05c4f8 bf05ea18
[ 167.180681] 3f38 ec1c2000 c00c6458 00000020 00000000 bf05ea18 00000880 ec1c3f44 74655f67
[ 167.188911]
[ 167.188911] R3: 0xec1c1f80:
[ 167.193170] 1f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.201397] 1fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.209625] 1fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.217852] 1fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.226078] 2000 00000000 00000002 00000000 ed72e580 c1035ef8 00000000 00000015 c21f74c0
[ 167.234317] 2020 ed72e580 edb08580 c0f9e4e8 ed38a580 00000000 c0f674c0 ec1c3eec ec1c3e40
[ 167.242545] 2040 c07f77cc 00000000 00000000 00000000 00000000 00000000 01010000 00000000
[ 167.250772] 2060 b6dac6d0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.259000]
[ 167.259000] R6: 0xed051620:
[ 167.263259] 1620 00000000 ffffffe0 ed051628 ed051628 c050146c ffffffe0 ed051638 ed051638
[ 167.271487] 1640 c05015c8 ffffffe0 ed051648 ed051648 c050384c 00000001 00000000 00000000
[ 167.279715] 1660 00000000 fe200000 00000800 7d001000 00000020 00000034 00000000 00000000
[ 167.287943] 1680 00000001 00000000 00000000 00000000 00000000 0016e360 00000000 00020002
[ 167.296173] 16a0 00000000 00000000 ed0516a8 ed0516a8 ed72e580 00000000 01000102 00000100
[ 167.304402] 16c0 ed050540 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.312630] 16e0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.320856] 1700 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.329085]
[ 167.329085] R9: 0xec1c1f80:
[ 167.333344] 1f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.341571] 1fa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.349798] 1fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.358025] 1fe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.366253] 2000 00000000 00000002 00000000 ed72e580 c1035ef8 00000000 00000015 c21f74c0
[ 167.374480] 2020 ed72e580 edb08580 c0f9e4e8 ed38a580 00000000 c0f674c0 ec1c3eec ec1c3e40
[ 167.382709] 2040 c07f77cc 00000000 00000000 00000000 00000000 00000000 01010000 00000000
[ 167.390936] 2060 b6dac6d0 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 167.399168] Process rmmod (pid: 1363, stack limit = 0xec1c2238)
[ 167.405077] Stack: (0xec1c3ed8 to 0xec1c4000)
[ 167.409426] 3ec0: ed05169c ed051400
[ 167.417591] 3ee0: ed0516a0 c0502434 00000001 ed051400 ed05169c c0503668 ed04c400 ed051400
[ 167.425755] 3f00: ed051400 ed05169c c000f224 c05038b8 ed04c400 bf05e298 00000000 00000880
[ 167.433919] 3f20: c000f224 c04ffb1c 00000000 c04ffbc4 bf05c4f8 bf05ea18 ec1c2000 c00c6458
[ 167.442084] 3f40: 00000020 00000000 bf05ea18 00000880 ec1c3f44 74655f67 00726568 00004b74
[ 167.450248] 3f60: b6f57000 c000f224 ec1c2000 00000000 bec99acc c012e6a0 ffffffff b6f7f904
[ 167.458413] 3f80: b6f7f568 b6f57000 00004b74 00f7f904 b6f7f568 00018b2c 74655f67 00726568
[ 167.466578] 3fa0: 00000081 c000f080 00018b2c 74655f67 bec99b40 00000880 000a39b0 bec99de8
[ 167.474741] 3fc0: 00018b2c 74655f67 00726568 00000081 bec99de4 00096542 000a179c 00000000
[ 167.482905] 3fe0: bec99b38 bec99b28 00018974 b6e7dd30 600c0010 bec99b40 00000000 00000000
[ 167.491087] [] (_raw_spin_lock_irqsave+0x2c/0x68) from [] (composite_disconnect+0x24/0x64 [libcomposite])
[ 167.502391] [] (composite_disconnect+0x24/0x64 [libcomposite]) from [] (reset_queues+0x8c/0x9c)
[ 167.512818] [] (reset_queues+0x8c/0x9c) from [] (tegra_vbus_session+0xc8/0x2ac)
[ 167.521855] [] (tegra_vbus_session+0xc8/0x2ac) from [] (tegra_udc_stop+0x2c/0x8c)
[ 167.531066] [] (tegra_udc_stop+0x2c/0x8c) from [] (usb_gadget_remove_driver+0x80/0xb8)
[ 167.540709] [] (usb_gadget_remove_driver+0x80/0xb8) from [] (usb_gadget_unregister_driver+0x70/0x94)
[ 167.551567] [] (usb_gadget_unregister_driver+0x70/0x94) from [] (SyS_delete_module+0x254/0x380)
[ 167.561994] [] (SyS_delete_module+0x254/0x380) from [] (ret_fast_syscall+0x0/0x30)
[ 167.571288] Code: e3c3303f e5931004 e2811001 e5831004 (e1923f9f)
[ 167.577375] —[ end trace 3123e0adf09daaa9 ]—
[ 167.581988] note: rmmod[1363] exited with preempt_count 1
Segmentation fault

This is interesting, I had originally assumed that ifconfig showed usb0 because you had an actual device, and my own Jetson is not failing. It just seems strange to see this in ifconfig without hardware, but perhaps the driver does this because it is hotplug over USB. ifconfig shows the device on my system as well, without an actual device.

I’ve recreated the steps for modprobe and rmmod without any error using R21.4. Since USB is involved, I tried this with the default USB2 driver (tegra-ehci) and again with the USB3 driver (tegra-xhci) loaded. I see no difference and no error.

What comes to mind is that this install is updated via:

apt update
apt-get upgrade

Perhaps this is from an older driver mix. Can you run the above update/upgrade and see if the problem persists? You can run this before and after to be sure nVidia-specific hardware files are properly in place:

sha1sum -c /etc/nv_tegra_release

Also, is there anything at all customized about the system, e.g., kernel rebuilds, boot loader argument changes, etc?

we have customized system with our own file system. there is no apt or apt-get commands in our system.

we have used kernel, bootloader from 21.4 only. there is no change in boot argument.

why use run apt update ? is there is any update after 21.4 release ? can you try to run with kernel and modules compiled from 21.4 release package only ?

I know an unmodified R21.4 works correctly for load/unload of the module. The only thing about my working test system which is not default is that it ran through apt-get upgrade…the kernel itself is not changed. So that implies that what is different is outside of the kernel itself or its modules. Upgrade was an attempt to make our two systems match and guarantee it wasn’t an issue from a bug which had been fixed in related packages.

I did not know your system was custom, and so it seemed as if the difference was either hardware failure (which is unlikely since it otherwise works) or a software issue outside of the kernel (our kernels are the same). If it is a software issue, then it could be configuration rather than corrupt or altered files…mostly due to kernel boot parameters because the issue involves load/unload of a module not in use (and boot parameters are kernel configuration). We know this isn’t the issue because we have both tried with unaltered kernel parameters on matching kernels.

So it comes down to something in your file system outside of the kernel or its configuration. Quite possibly something in kernel code has a weakness where it should gracefully handle non-kernel missing or broken support packages, but instead does not and ends up dumping state as a last resort.

The message “Unable to handle kernel NULL pointer dereference” is a very common error, almost always being something which could have been avoided through testing of pointers before using them. Something such as kgdb could be used to obtain a backtrace and point directly at the offending code (which requires it to be run on your system, else the NULL pointer dereference will never occur). Alternatively, if you are able to merge just parts of modified file system back in and re-try until the error no longer occurs, you could track down the real cause without kernel debugging. There are perhaps other ways of debugging this, but time and expertise required increases substantially.

NOTE: I will reflash a Jetson in the next few hours and try without updated packages. It’ll take a bit of time because I will clone the system before the flash.

I just reflashed with a “pure” R21.4, no updates of any kind. This system succeeds with modprobe and rmmod of g_ether, so this strongly suggests the custom file system has something in its environment which the module or module loader depends on. If you developed the custom system in stages, I’d suggest re-loading each stage of development and testing at each stage. You can clone your existing work to save it if you desire. Clone info:
http://elinux.org/Jetson/Cloning

we are able to generate crash in 21.4 release.

difference is in filesystem init script /etc/init/nv.conf specifically following lines

    machine=`cat /sys/devices/soc0/machine`
    if [ "${machine}" = "jetson-tk1" ] ; then
            echo 4 > /sys/class/graphics/fb0/blank
            if [ -e /sys/devices/platform/tegra-otg/enable_device ] ; then
                    echo 0 > /sys/devices/platform/tegra-otg/enable_device
            fi
            if [ -e /sys/devices/platform/tegra-otg/enable_host ] ; then
                    echo 1 > /sys/devices/platform/tegra-otg/enable_host
            fi
    fi

Fire following command and then try to load and unload module … then it will create crash
echo 1 > /sys/devices/platform/tegra-otg/enable_device

why enabling device mode creates crash during module unload ?

The OTG port has two mutually exclusive modes, host or device. Normal boot runs as a host, normal recovery mode runs as a device. Device mode could be used in normal boot, but so far I don’t know of any drivers making use of this. The point of mentioning this is that the physical hardware cannot be put in both host and device modes at the same time…if you enable device while still in host mode, or if you enable host while in device mode, there will be a failure. Granted, it would be nice if an error were gracefully detected and does not cause an OOPS, but it is still an error to attempt both modes at once.

Change the order of echo 1 to enable_device to first run echo 0 to enable_host. The following works:

root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep '[01]' enable_*
enable_device:0
enable_host:1
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 0 > enable_host 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 1 > enable_device
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep '[01]' enable_*
enable_device:1
enable_host:0

NOTE: As long as the “no two modes at once” rule is followed, you can then modprobe and rmmod g_ether without error. I tested this in both host and device modes.

we changed the order as you suggested but still there is crash when we unload g_ether.

see below steps

ubuntu@tegra-ubuntu:~$ sudo su
[sudo] password for ubuntu:
root@tegra-ubuntu:/home/ubuntu#
root@tegra-ubuntu:/home/ubuntu#
root@tegra-ubuntu:/home/ubuntu# cd /sys/devices/platform/tegra-otg
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep ‘[01]’ enable_*
enable_device:0
enable_host:1
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 0 > enable_host
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 1 > enable_device
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep ‘[01]’ enable_*
enable_device:1
enable_host:0
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# modprobe g_ether
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# rmmod g_ether
[ 61.683180] Unable to handle kernel NULL pointer dereference at virtual address 00000044
[ 61.691279] pgd = e8d28000
[ 61.693981] [00000044] *pgd=00000000
[ 61.697569] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 61.702873] Modules linked in: g_ether(-) libcomposite configfs dm_crypt dm_mod rfcomm bnep bluetooth rfkill nvhost_vi
[ 61.713682] CPU: 0 PID: 1854 Comm: rmmod Not tainted 3.10.40-gdacac96 #1
[ 61.720374] task: eabdfac0 ti: ea574000 task.ti: ea574000
[ 61.725778] PC is at _raw_spin_lock_irqsave+0x2c/0x68
[ 61.730832] LR is at composite_disconnect+0x24/0x64 [libcomposite]
[ 61.737002] pc : [] lr : [] psr: a0010093
[ 61.737002] sp : ea575ed8 ip : 00000000 fp : 00000800
[ 61.748459] r10: 00000000 r9 : ea574000 r8 : 60010013
[ 61.753673] r7 : ed57fa9c r6 : 00000000 r5 : 00000044 r4 : 00000000
[ 61.760189] r3 : ea574000 r2 : 00000044 r1 : 00000001 r0 : a0010093
[ 61.766707] Flags: NzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user
[ 61.773916] Control: 10c5387d Table: a8d2806a DAC: 00000015
[ 61.779651]
[ 61.779651] PC: 0xc08153f8:
[ 61.783911] 53f8 e1a0200d e3c23d7f e3c3303f e5932004 e2822001 e5832004 e1903f9f e2832801
[ 61.792164] 5418 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003 0a000003 e320f002
[ 61.800419] 5438 e1d030b0 e1530002 1afffffb f57ff05f e12fff1e e92d4000 e8bd4000 e1a02000
[ 61.808674] 5458 e10f0000 f10c0080 e1a0100d e3c13d7f e3c3303f e5931004 e2811001 e5831004
[ 61.816928] 5478 e1923f9f e2831801 e182cf91 e33c0000 1afffffa e1a01823 e6ff3073 e1510003
[ 61.825182] 5498 0a000003 e320f002 e1d230b0 e1530001 1afffffb f57ff05f e12fff1e e92d4000
[ 61.833432] 54b8 e8bd4000 f10c0080 e1a0200d e3c23d7f e3c3303f e5932004 e2822001 e5832004
[ 61.841683] 54d8 e1903f9f e2832801 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003
[ 61.849934]
[ 61.849934] SP: 0xea575e58:
[ 61.854195] 5e58 5c99961a 0000000e ed581bc8 c01b1f54 ed581bc8 eb229ec8 c0d9367c 000031ea
[ 61.862448] 5e78 c0815478 a0010093 ffffffff ea575ec4 60010013 c000ecd8 a0010093 00000001
[ 61.870697] 5e98 00000044 ea574000 00000000 00000044 00000000 ed57fa9c 60010013 ea574000
[ 61.878947] 5eb8 00000000 00000800 00000000 ea575ed8 bf064450 c0815478 a0010093 ffffffff
[ 61.887199] 5ed8 ed57fa9c ed57f800 00000000 c05117a8 00000003 ed57f800 ed57faa0 c0511b74
[ 61.895451] 5ef8 ed57f800 ed57fa9c bf0b0950 b6fbbda4 c000f324 c0511c00 ed57d800 c0cd5b84
[ 61.903699] 5f18 bf0b0950 b6fbbda4 c000f324 c050e940 00000000 c050e9ec bf0ae4d8 ea574000
[ 61.911950] 5f38 00000000 c00cbb28 00000010 74655f67 00726568 00000000 0000001d eabdfee8
[ 61.920204]
[ 61.920204] R3: 0xea573f80:
[ 61.924465] 3f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 61.932714] 3fa0 00000001 ea573fe4 ea573f64 00000000 00000000 00000000 00000000 00000000
[ 61.940968] 3fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 61.949218] 3fe0 00000001 ea572164 ea573fa4 00000000 00000000 00000000 00000000 00000000
[ 61.957466] 4000 00000000 00000002 00000000 eabdfac0 c0c99eb8 00000000 00000015 eabdfac0
[ 61.965721] 4020 00000000 c1df64c0 ea574000 2dfc148f edb0a580 ed1bac80 ea575eec ea575e28
[ 61.973971] 4040 c0814550 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[ 61.982217] 4060 b6f93850 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 61.990467]
[ 61.990467] R7: 0xed57fa1c:
[ 61.994727] fa1c 00000000 00000000 ffffffe0 ed57fa28 ed57fa28 c0510dd0 ffffffe0 ed57fa38
[ 62.002981] fa3c ed57fa38 c0510774 ffffffe0 ed57fa48 ed57fa48 c0511d24 00000001 00000000
[ 62.011235] fa5c 00000000 00000000 fe200000 00000800 7d001000 00000020 00000034 00000000
[ 62.019485] fa7c 00000000 00000001 00000000 00000000 00000000 00000000 0016e360 00000000
[ 62.027737] fa9c 00040004 00000000 00000000 ed57faa8 ed57faa8 eabdfac0 00000000 01000102
[ 62.035992] fabc 00000100 ed579140 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.044243] fadc 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.052496] fafc 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.060744]
[ 62.060744] R9: 0xea573f80:
[ 62.065004] 3f80 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.073252] 3fa0 00000001 ea573fe4 ea573f64 00000000 00000000 00000000 00000000 00000000
[ 62.081503] 3fc0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.089749] 3fe0 00000001 ea572164 ea573fa4 00000000 00000000 00000000 00000000 00000000
[ 62.098001] 4000 00000000 00000002 00000000 eabdfac0 c0c99eb8 00000000 00000015 eabdfac0
[ 62.106251] 4020 00000000 c1df64c0 ea574000 2dfc148f edb0a580 ed1bac80 ea575eec ea575e28
[ 62.114501] 4040 c0814550 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[ 62.122750] 4060 b6f93850 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 62.131005] Process rmmod (pid: 1854, stack limit = 0xea574238)
[ 62.136914] Stack: (0xea575ed8 to 0xea576000)
[ 62.141264] 5ec0: ed57fa9c ed57f800
[ 62.149427] 5ee0: 00000000 c05117a8 00000003 ed57f800 ed57faa0 c0511b74 ed57f800 ed57fa9c
[ 62.157591] 5f00: bf0b0950 b6fbbda4 c000f324 c0511c00 ed57d800 c0cd5b84 bf0b0950 b6fbbda4
[ 62.165754] 5f20: c000f324 c050e940 00000000 c050e9ec bf0ae4d8 ea574000 00000000 c00cbb28
[ 62.173917] 5f40: 00000010 74655f67 00726568 00000000 0000001d eabdfee8 00000000 eabdfac0
[ 62.182081] 5f60: c0d54cf8 c016ea94 eabdfee8 c008bc4c 00000800 c008bc4c eabe7840 00030003
[ 62.190245] 5f80: bf0b0950 00000800 ea575f8c 00000000 c000f324 b6fbbd70 bea37915 00000001
[ 62.198408] 5fa0: 00000081 c000f180 b6fbbd70 bea37915 b6fbbda4 00000800 3eb8c100 3eb8c100
[ 62.206571] 5fc0: b6fbbd70 bea37915 00000001 00000081 00000002 bea3761c bea37620 00000800
[ 62.214734] 5fe0: b6f0eda1 bea375ac b6fa60c3 b6f0eda6 80010030 b6fbbda4 00000000 00000000
[ 62.222915] [] (_raw_spin_lock_irqsave+0x2c/0x68) from [] (composite_disconnect+0x24/0x64 [libcomposite])
[ 62.234224] [] (composite_disconnect+0x24/0x64 [libcomposite]) from [] (reset_queues+0x6c/0x7c)
[ 62.244649] [] (reset_queues+0x6c/0x7c) from [] (tegra_vbus_session+0xfc/0x164)
[ 62.253682] [] (tegra_vbus_session+0xfc/0x164) from [] (tegra_udc_stop+0x24/0x90)
[ 62.262891] [] (tegra_udc_stop+0x24/0x90) from [] (usb_gadget_remove_driver+0x7c/0xb8)
[ 62.272532] [] (usb_gadget_remove_driver+0x7c/0xb8) from [] (usb_gadget_unregister_driver+0x70/0x8c)
[ 62.283389] [] (usb_gadget_unregister_driver+0x70/0x8c) from [] (SyS_delete_module+0x260/0x36c)
[ 62.293817] [] (SyS_delete_module+0x260/0x36c) from [] (ret_fast_syscall+0x0/0x30)
[ 62.303112] Code: e3c3303f e5931004 e2811001 e5831004 (e1923f9f)
[ 62.309198] —[ end trace 045c1fb700d73e8f ]—
[ 62.324246] note: rmmod[1854] exited with preempt_count 1
Segmentation fault
root@tegra-ubuntu:/sys/devices/platform/tegra-otg#

also it is not possible to enable both modes at the same time.
enabling one mode automatically disables other mode.

I did this again and did end up with the segmentation fault (all packages were updated on this system), so it is repeatable. I’m not sure why it succeeded on my previous test, although the package “update” state would likely have been different. I’ll see what I can find out.

For reference, the test with repeatable OOPS, L4T R21.4, default kernel, all apt-get update and apt-get upgrade current (no USB connected to the OTG port, only HUB/keyboard/mouse on the other port):

Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.10.40-gdacac96 armv7l)

 * Documentation:  https://help.ubuntu.com/

0 packages can be updated.
0 updates are security updates.                                                                                                                                                   
                                                                                                                                                                                  
Last login: Mon Aug 31 10:30:04 2015                                                                                                                                              
ubuntu@tegra-ubuntu:~$ sudo -s                                                                                                                                                    
[sudo] password for ubuntu:                                                                                                                                                       
root@tegra-ubuntu:~# cd /sys/devices/platform/tegra-otg/                                                                                                                          
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# ls                                                                                                                             
./  ../  driver@  enable_device  enable_host  modalias  power/  subsystem@  uevent                                                                                                
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod                                                                                                                          
Module                  Size  Used by
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep '[01]' enable_*
enable_device:0
enable_host:1
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# modprobe g_ether
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
g_ether                36246  0 
libcomposite           32879  1 g_ether
configfs               24673  2 libcomposite
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# rmmod g_ether
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
libcomposite           32879  0 
configfs               24673  2 libcomposite
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# rmmod libcomposite
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
configfs               24673  0 
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# rmmod configfs
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep '[01]' enable_*
enable_device:0
enable_host:1
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 0 > enable_host 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# echo 1 > enable_device 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# egrep '[01]' enable_*
enable_device:1
enable_host:0
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# modprobe g_ether
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
g_ether                36246  0 
libcomposite           32879  1 g_ether
configfs               24673  2 libcomposite
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# rmmod g_ether
Segmentation fault
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# lsmod
Module                  Size  Used by
g_ether                36246  0 
libcomposite           32879  1 g_ether
configfs               24673  2 libcomposite
dm_crypt               13259  0 
dm_mod                 73887  1 dm_crypt
rfcomm                 38359  0 
bnep                   10469  2 
bluetooth             307068  10 bnep,rfcomm
rfkill                 10365  3 bluetooth
nvhost_vi               3064  0 
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# dmesg | tail -n 150
[   10.314265] hot_plug: disabled
[   10.314285] remote_wakeup: enabled
[   10.342522] vi vi.0: vi_probe: ++
[   10.351938] vi vi.0: initialized
[   10.354028] vi vi.1: vi_probe: ++
[   10.364293] vi vi.1: initialized
[   10.609576] Bluetooth: Core ver 2.16
[   10.613301] NET: Registered protocol family 31
[   10.613324] Bluetooth: HCI device and connection manager initialized
[   10.613546] Bluetooth: HCI socket layer initialized
[   10.613583] Bluetooth: L2CAP socket layer initialized
[   10.613693] Bluetooth: SCO socket layer initialized
[   10.662623] Bluetooth: BNEP (Ethernet Emulation) ver 1.3
[   10.662742] Bluetooth: BNEP socket layer initialized
[   10.798730] Bluetooth: RFCOMM socket layer initialized
[   10.798761] Bluetooth: RFCOMM ver 1.11
[   11.317171] tegra-ehci tegra-ehci.0: Tegra EHCI Host Controller
[   11.317257] tegra-ehci tegra-ehci.0: new USB bus registered, assigned bus number 3
[   11.317552] tegra-ehci tegra-ehci.0: irq 52, io mem 0x7d000000
[   11.322699] tegra-ehci tegra-ehci.0: USB 2.0 started, EHCI 1.10
[   11.323767] usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
[   11.323802] usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
[   11.323828] usb usb3: Product: Tegra EHCI Host Controller
[   11.323846] usb usb3: Manufacturer: Linux 3.10.40-gdacac96 ehci_hcd
[   11.323869] usb usb3: SerialNumber: tegra-ehci.0
[   11.325085] hub 3-0:1.0: USB hub found
[   11.325159] hub 3-0:1.0: 1 port detected
[   11.469822] r8169 0000:01:00.0 eth0: link down
[   11.469895] r8169 0000:01:00.0 eth0: link down
[   11.470126] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[   11.732246] device-mapper: uevent: version 1.0.3
[   11.732700] device-mapper: ioctl: 4.24.0-ioctl (2013-01-15) initialised: dm-devel@redhat.com
[   13.934501] init: plymouth-upstart-bridge main process ended, respawning
[   14.274590] r8169 0000:01:00.0 eth0: link up
[   14.274645] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[   14.578896] tegradc tegradc.1: nominal-pclk:146262000 parent:438000000 div:3.0 pclk:146000000 144799380~159425580
[   15.140931] init: Failed to obtain startpar-bridge instance: Unknown parameter: INSTANCE
[   18.867662] device eth0 entered promiscuous mode
[   18.964908] init: plymouth-stop pre-start process (1358) terminated with status 1
[   72.826385] g_ether gadget: using random self ethernet address
[   72.826410] g_ether gadget: using random host ethernet address
[   72.827091] usb0: MAC 36:31:c4:c4:4d:ef
[   72.827104] usb0: HOST MAC 32:12:af:63:22:f0
[   72.827172] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[   72.827250] g_ether gadget: g_ether ready
[   72.827262] tegra-udc: bind to driver g_ether
[   72.890481] IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready
[  135.467916] init: plymouth-stop pre-start process (1684) terminated with status 1
[  155.399309] otg state changed: HOST --> SUSPEND
[  155.403508] tegra-ehci tegra-ehci.0: remove, state 4
[  155.403572] usb usb3: USB disconnect, device number 1
[  155.408842] tegra-ehci tegra-ehci.0: USB bus 3 deregistered
[  162.273115] otg state changed: SUSPEND --> PERIPHERAL
[  192.020305] g_ether gadget: using random self ethernet address
[  192.020345] g_ether gadget: using random host ethernet address
[  192.029806] usb0: MAC 2a:e2:5e:89:f1:7e
[  192.029839] usb0: HOST MAC aa:a3:fe:ba:27:c2
[  192.029980] g_ether gadget: Ethernet Gadget, version: Memorial Day 2008
[  192.029990] g_ether gadget: g_ether ready
[  192.030054] tegra-udc: bind to driver g_ether
[  192.063692] IPv6: ADDRCONF(NETDEV_UP): usb0: link is not ready
[  201.876078] Unable to handle kernel NULL pointer dereference at virtual address 00000044
[  201.884206] pgd = eb0c8000
[  201.886912] [00000044] *pgd=00000000
[  201.890513] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[  201.895823] Modules linked in: g_ether(-) libcomposite configfs dm_crypt dm_mod rfcomm bnep bluetooth rfkill nvhost_vi [last unloaded: configfs]
[  201.908920] CPU: 0 PID: 1702 Comm: rmmod Not tainted 3.10.40-gdacac96 #1
[  201.915615] task: ebc09ac0 ti: ebee6000 task.ti: ebee6000
[  201.921033] PC is at _raw_spin_lock_irqsave+0x2c/0x68
[  201.926098] LR is at composite_disconnect+0x24/0x64 [libcomposite]
[  201.932271] pc : [<c0815478>]    lr : [<bf0c0450>]    psr: a0010093
[  201.932271] sp : ebee7ed8  ip : 00000000  fp : 00000800
[  201.943729] r10: 00000000  r9 : ebee6000  r8 : 60010013
[  201.948946] r7 : ed052a9c  r6 : 00000000  r5 : 00000044  r4 : 00000000
[  201.955462] r3 : ebee6000  r2 : 00000044  r1 : 00000001  r0 : a0010093
[  201.961985] Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  201.969196] Control: 10c5387d  Table: ab0c806a  DAC: 00000015
[  201.974934] 
[  201.974934] PC: 0xc08153f8:
[  201.979195] 53f8  e1a0200d e3c23d7f e3c3303f e5932004 e2822001 e5832004 e1903f9f e2832801
[  201.987460] 5418  e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003 0a000003 e320f002
[  201.995724] 5438  e1d030b0 e1530002 1afffffb f57ff05f e12fff1e e92d4000 e8bd4000 e1a02000
[  202.003985] 5458  e10f0000 f10c0080 e1a0100d e3c13d7f e3c3303f e5931004 e2811001 e5831004
[  202.012248] 5478  e1923f9f e2831801 e182cf91 e33c0000 1afffffa e1a01823 e6ff3073 e1510003
[  202.020511] 5498  0a000003 e320f002 e1d230b0 e1530001 1afffffb f57ff05f e12fff1e e92d4000
[  202.028777] 54b8  e8bd4000 f10c0080 e1a0200d e3c23d7f e3c3303f e5932004 e2822001 e5832004
[  202.037041] 54d8  e1903f9f e2832801 e1801f92 e3310000 1afffffa e1a02823 e6ff3073 e1520003
[  202.045307] 
[  202.045307] SP: 0xebee7e58:
[  202.049569] 7e58  00beb776 0000002f ed051588 c01b1f54 ed051588 eaff8d08 c0d9367c 00003430
[  202.057836] 7e78  c0815478 a0010093 ffffffff ebee7ec4 60010013 c000ecd8 a0010093 00000001
[  202.066100] 7e98  00000044 ebee6000 00000000 00000044 00000000 ed052a9c 60010013 ebee6000
[  202.074365] 7eb8  00000000 00000800 00000000 ebee7ed8 bf0c0450 c0815478 a0010093 ffffffff
[  202.082631] 7ed8  ed052a9c ed052800 00000000 c05117a8 00000005 ed052800 ed052aa0 c0511b74
[  202.090890] 7ef8  ed052800 ed052a9c bf0d5950 b6fa2da4 c000f324 c0511c00 ed054e00 c0cd5b84
[  202.099156] 7f18  bf0d5950 b6fa2da4 c000f324 c050e940 00000000 c050e9ec bf0d34d8 ebee6000
[  202.107422] 7f38  00000000 c00cbb28 00000010 74655f67 00726568 00000000 0000001d ebc09ee8
[  202.115690] 
[  202.115690] R3: 0xebee5f80:
[  202.119950] 5f80  00010000 00010000 ffffffff ffffffff ffffffff ffffffff 00003a9f 00003a9f
[  202.128216] 5fa0  000c8000 000c8000 00000000 00000000 00000000 00000000 ffffffff ffffffff
[  202.136479] 5fc0  00000000 00020002 ebee5fc8 ebee5fc8 00000000 00000000 00000001 00000000
[  202.144744] 5fe0  ebee5fe0 ebee5fe0 00000000 00000000 ffffffff fff7ffdf ffffffff ffffdfff
[  202.153010] 6000  00000000 00000002 00000000 ebc09ac0 c0c99eb8 00000000 00000015 ebc09ac0
[  202.161276] 6020  00000000 c1df64c0 ebee6000 e6814a54 ed7b7a40 ea66a900 ebee7eec ebee7e28
[  202.169540] 6040  c0814550 00000000 00000000 00000000 00000000 00000000 01010000 00000000
[  202.177802] 6060  b6f7a850 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  202.186068] 
[  202.186068] R7: 0xed052a1c:
[  202.190330] 2a1c  00000000 00000000 ffffffe0 ed052a28 ed052a28 c0510dd0 ffffffe0 ed052a38
[  202.198596] 2a3c  ed052a38 c0510774 ffffffe0 ed052a48 ed052a48 c0511d24 00000001 00000000
[  202.206858] 2a5c  00000000 00000000 fe200000 00000800 7d001000 00000020 00000034 00000000
[  202.215123] 2a7c  00000000 00000001 00000000 00000000 00000000 00000000 0016e360 00000000
[  202.223386] 2a9c  00060006 00000000 00000000 ed052aa8 ed052aa8 ebc09ac0 00000000 01000102
[  202.231647] 2abc  00000100 ed04f2c0 00000000 00000000 00000000 00000000 00000000 00000000
[  202.239911] 2adc  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  202.248174] 2afc  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  202.256439] 
[  202.256439] R9: 0xebee5f80:
[  202.260700] 5f80  00010000 00010000 ffffffff ffffffff ffffffff ffffffff 00003a9f 00003a9f
[  202.268966] 5fa0  000c8000 000c8000 00000000 00000000 00000000 00000000 ffffffff ffffffff
[  202.277231] 5fc0  00000000 00020002 ebee5fc8 ebee5fc8 00000000 00000000 00000001 00000000
[  202.285495] 5fe0  ebee5fe0 ebee5fe0 00000000 00000000 ffffffff fff7ffdf ffffffff ffffdfff
[  202.293758] 6000  00000000 00000002 00000000 ebc09ac0 c0c99eb8 00000000 00000015 ebc09ac0
[  202.302020] 6020  00000000 c1df64c0 ebee6000 e6814a54 ed7b7a40 ea66a900 ebee7eec ebee7e28
[  202.310284] 6040  c0814550 00000000 00000000 00000000 00000000 00000000 01010000 00000000
[  202.318550] 6060  b6f7a850 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  202.326817] Process rmmod (pid: 1702, stack limit = 0xebee6238)
[  202.332729] Stack: (0xebee7ed8 to 0xebee8000)
[  202.337079] 7ec0:                                                       ed052a9c ed052800
[  202.345245] 7ee0: 00000000 c05117a8 00000005 ed052800 ed052aa0 c0511b74 ed052800 ed052a9c
[  202.353411] 7f00: bf0d5950 b6fa2da4 c000f324 c0511c00 ed054e00 c0cd5b84 bf0d5950 b6fa2da4
[  202.361577] 7f20: c000f324 c050e940 00000000 c050e9ec bf0d34d8 ebee6000 00000000 c00cbb28
[  202.369743] 7f40: 00000010 74655f67 00726568 00000000 0000001d ebc09ee8 00000000 ebc09ac0
[  202.377908] 7f60: c0d54cf8 c016ea94 ebc09ee8 c008bc4c 00000800 c008bc4c ea16f500 00030003
[  202.386073] 7f80: bf0d5950 00000800 ebee7f8c 00000000 c000f324 b6fa2d70 bec9791a 00000001
[  202.394239] 7fa0: 00000081 c000f180 b6fa2d70 bec9791a b6fa2da4 00000800 83e6c200 83e6c200
[  202.402404] 7fc0: b6fa2d70 bec9791a 00000001 00000081 00000002 bec9761c bec97620 00000800
[  202.410568] 7fe0: b6ef3631 bec975ac b6f8d0c3 b6ef3636 80010030 b6fa2da4 00000000 00000000
[  202.418760] [<c0815478>] (_raw_spin_lock_irqsave+0x2c/0x68) from [<bf0c0450>] (composite_disconnect+0x24/0x64 [libcomposite])
[  202.430092] [<bf0c0450>] (composite_disconnect+0x24/0x64 [libcomposite]) from [<c05117a8>] (reset_queues+0x6c/0x7c)
[  202.440524] [<c05117a8>] (reset_queues+0x6c/0x7c) from [<c0511b74>] (tegra_vbus_session+0xfc/0x164)
[  202.449559] [<c0511b74>] (tegra_vbus_session+0xfc/0x164) from [<c0511c00>] (tegra_udc_stop+0x24/0x90)
[  202.458774] [<c0511c00>] (tegra_udc_stop+0x24/0x90) from [<c050e940>] (usb_gadget_remove_driver+0x7c/0xb8)
[  202.468419] [<c050e940>] (usb_gadget_remove_driver+0x7c/0xb8) from [<c050e9ec>] (usb_gadget_unregister_driver+0x70/0x8c)
[  202.479283] [<c050e9ec>] (usb_gadget_unregister_driver+0x70/0x8c) from [<c00cbb28>] (SyS_delete_module+0x260/0x36c)
[  202.489722] [<c00cbb28>] (SyS_delete_module+0x260/0x36c) from [<c000f180>] (ret_fast_syscall+0x0/0x30)
[  202.499023] Code: e3c3303f e5931004 e2811001 e5831004 (e1923f9f) 
[  202.505115] ---[ end trace 993a1693143b16b8 ]---
[  202.519294] note: rmmod[1702] exited with preempt_count 1
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# shutdown -h now
root@tegra-ubuntu:/sys/devices/platform/tegra-otg# 
Broadcast message from ubuntu@tegra-ubuntu
        (/dev/pts/1) at 10:33 ...

The system is going down for halt NOW!
Connection to tk1 closed by remote host.
Connection to tk1 closed.

thanks linuxdev for confirmation.

we will wait for nvidia solution for this issue. Thanks again.

For those interested, here is some added information found using a kgdboc debug version of the kernel.

rmmod g_ether while in device mode:

Entering kdb (current=0xea0c6080, pid 1359) on processor 0 due to Keyboard Entry
[0]kdb> 825.354009] ---[ end trace 65222b331a2d7cb4 ]---
[18825.368405] note: rmmod[11929] exited with preempt_count 1
[18825.373989] BUG: scheduling while atomic: rmmod/11929/0x40000002
[18825.379994] Modules linked in: g_ether(-) libcomposite configfs dm_crypt dm_mod rfcomm bnep bluetooth rfkill nvhost_vi
[18825.390843] CPU: 0 PID: 11929 Comm: rmmod Tainted: G      D      3.10.40-gdacac96_dbg1 #1
[18825.399062] [<c001746c>] (unwind_backtrace+0x0/0x138) from [<c001368c>] (show_stack+0x18/0x1c)
[18825.407681] [<c001368c>] (show_stack+0x18/0x1c) from [<c02d80d8>] (dump_stack+0x1c/0x20)
[18825.415782] [<c02d80d8>] (dump_stack+0x1c/0x20) from [<c00a5548>] (__schedule_bug+0x58/0x68)
[18825.424229] [<c00a5548>] (__schedule_bug+0x58/0x68) from [<c0876e34>] (__schedule+0xb0/0x690)
[18825.432756] [<c0876e34>] (__schedule+0xb0/0x690) from [<c00a8358>] (__cond_resched+0x2c/0x3c)
[18825.441281] [<c00a8358>] (__cond_resched+0x2c/0x3c) from [<c08777b8>] (_cond_resched+0x4c/0x54)
[18825.449978] [<c08777b8>] (_cond_resched+0x4c/0x54) from [<c014989c>] (unmap_page_range+0x158/0x174)
[18825.459019] [<c014989c>] (unmap_page_range+0x158/0x174) from [<c0149904>] (unmap_single_vma+0x4c/0x54)
[18825.468315] [<c0149904>] (unmap_single_vma+0x4c/0x54) from [<c014af3c>] (unmap_vmas+0x4c/0x6c)
[18825.476921] [<c014af3c>] (unmap_vmas+0x4c/0x6c) from [<c01508b0>] (exit_mmap+0xcc/0x200)
[18825.485015] [<c01508b0>] (exit_mmap+0xcc/0x200) from [<c006c8fc>] (mmput+0x58/0xfc)
[18825.492673] [<c006c8fc>] (mmput+0x58/0xfc) from [<c00739c8>] (exit_mm+0x188/0x190)
[18825.500242] [<c00739c8>] (exit_mm+0x188/0x190) from [<c0074954>] (do_exit+0x230/0x43c)
[18825.508159] [<c0074954>] (do_exit+0x230/0x43c) from [<c001fbc8>] (do_page_fault+0x0/0x324)
[18825.516421] [<c001fbc8>] (do_page_fault+0x0/0x324) from [<00000044>] (0x44)
[18825.555583] BUG: scheduling while atomic: rmmod/11929/0x40000002
[18825.561710] Modules linked in: g_ether(-) libcomposite configfs dm_crypt dm_mod rfcomm bnep bluetooth rfkill nvhost_vi
[18825.572748] CPU: 0 PID: 11929 Comm: rmmod Tainted: G      D W    3.10.40-gdacac96_dbg1 #1
[18825.580979] [<c001746c>] (unwind_backtrace+0x0/0x138) from [<c001368c>] (show_stack+0x18/0x1c)
[18825.589801] [<c001368c>] (show_stack+0x18/0x1c) from [<c02d80d8>] (dump_stack+0x1c/0x20)
[18825.597944] [<c02d80d8>] (dump_stack+0x1c/0x20) from [<c00a5548>] (__schedule_bug+0x58/0x68)
[18825.606443] [<c00a5548>] (__schedule_bug+0x58/0x68) from [<c0876e34>] (__schedule+0xb0/0x690)
[18825.615055] [<c0876e34>] (__schedule+0xb0/0x690) from [<c00a8358>] (__cond_resched+0x2c/0x3c)
[18825.623701] [<c00a8358>] (__cond_resched+0x2c/0x3c) from [<c08777b8>] (_cond_resched+0x4c/0x54)
[18825.632652] [<c08777b8>] (_cond_resched+0x4c/0x54) from [<c014989c>] (unmap_page_range+0x158/0x174)
[18825.641792] [<c014989c>] (unmap_page_range+0x158/0x174) from [<c0149904>] (unmap_single_vma+0x4c/0x54)
[18825.651172] [<c0149904>] (unmap_single_vma+0x4c/0x54) from [<c014af3c>] (unmap_vmas+0x4c/0x6c)
[18825.659833] [<c014af3c>] (unmap_vmas+0x4c/0x6c) from [<c01508b0>] (exit_mmap+0xcc/0x200)
[18825.668023] [<c01508b0>] (exit_mmap+0xcc/0x200) from [<c006c8fc>] (mmput+0x58/0xfc)
[18825.675854] [<c006c8fc>] (mmput+0x58/0xfc) from [<c00739c8>] (exit_mm+0x188/0x190)
[18825.683533] [<c00739c8>] (exit_mm+0x188/0x190) from [<c0074954>] (do_exit+0x230/0x43c)
[18825.691664] [<c0074954>] (do_exit+0x230/0x43c) from [<c001fbc8>] (do_page_fault+0x0/0x324)
[18825.700036] [<c001fbc8>] (do_page_fault+0x0/0x324) from [<00000044>] (0x44)
[18825.708894] BUG: scheduling while atomic: rmmod/11929/0x40000002
[18825.715032] Modules linked in: g_ether(-) libcomposite configfs dm_crypt dm_mod rfcomm bnep bluetooth rfkill nvhost_vi
[18825.726460] CPU: 0 PID: 11929 Comm: rmmod Tainted: G      D W    3.10.40-gdacac96_dbg1 #1
[18825.734813] [<c001746c>] (unwind_backtrace+0x0/0x138) from [<c001368c>] (show_stack+0x18/0x1c)
[18825.743535] [<c001368c>] (show_stack+0x18/0x1c) from [<c02d80d8>] (dump_stack+0x1c/0x20)
[18825.751717] [<c02d80d8>] (dump_stack+0x1c/0x20) from [<c00a5548>] (__schedule_bug+0x58/0x68)
[18825.760364] [<c00a5548>] (__schedule_bug+0x58/0x68) from [<c0876e34>] (__schedule+0xb0/0x690)
[18825.768955] [<c0876e34>] (__schedule+0xb0/0x690) from [<c00a8358>] (__cond_resched+0x2c/0x3c)
[18825.777554] [<c00a8358>] (__cond_resched+0x2c/0x3c) from [<c08777b8>] (_cond_resched+0x4c/0x54)
[18825.786358] [<c08777b8>] (_cond_resched+0x4c/0x54) from [<c014989c>] (unmap_page_range+0x158/0x174)
[18825.795518] [<c014989c>] (unmap_page_range+0x158/0x174) from [<c0149904>] (unmap_single_vma+0x4c/0x54)
[18825.805006] [<c0149904>] (unmap_single_vma+0x4c/0x54) from [<c014af3c>] (unmap_vmas+0x4c/0x6c)
[18825.813775] [<c014af3c>] (unmap_vmas+0x4c/0x6c) from [<c01508b0>] (exit_mmap+0xcc/0x200)
[18825.821969] [<c01508b0>] (exit_mmap+0xcc/0x200) from [<c006c8fc>] (mmput+0x58/0xfc)
[18825.829795] [<c006c8fc>] (mmput+0x58/0xfc) from [<c00739c8>] (exit_mm+0x188/0x190)
[18825.837448] [<c00739c8>] (exit_mm+0x188/0x190) from [<c0074954>] (do_exit+0x230/0x43c)
[18825.845404] [<c0074954>] (do_exit+0x230/0x43c) from [<c001fbc8>] (do_page_fault+0x0/0x324)
[18825.853832] [<c001fbc8>] (do_page_fault+0x0/0x324) from [<00000044>] (0x44)

When it dropped into gdb:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 11929]
__raw_spin_lock_irqsave (lock=0x44) at include/linux/spinlock_api_smp.h:119
119             do_raw_spin_lock_flags(lock, &flags);
(gdb) l
114              * that interrupts are not re-enabled during lock-acquire:
115              */
116     #ifdef CONFIG_LOCKDEP
117             LOCK_CONTENDED(lock, do_raw_spin_trylock, do_raw_spin_lock);
118     #else
119             do_raw_spin_lock_flags(lock, &flags);
120     #endif
121             return flags;
122     }
123
(gdb) bt
#0  __raw_spin_lock_irqsave (lock=0x44) at include/linux/spinlock_api_smp.h:119
#1  _raw_spin_lock_irqsave (Cannot access memory at address 0x800
lock=0x44) at kernel/spinlock.c:145
#2  0xbf0677c8 in ?? ()
Cannot access memory at address 0x800
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) f 1
#1  _raw_spin_lock_irqsave (lock=0x44) at kernel/spinlock.c:145
145             return __raw_spin_lock_irqsave(lock);
(gdb) l
140     #endif
141
142     #ifndef CONFIG_INLINE_SPIN_LOCK_IRQSAVE
143     unsigned long __lockfunc _raw_spin_lock_irqsave(raw_spinlock_t *lock)
144     {
145             return __raw_spin_lock_irqsave(lock);
146     }
147     EXPORT_SYMBOL(_raw_spin_lock_irqsave);
148     #endif
149
(gdb) f 0
#0  __raw_spin_lock_irqsave (lock=0x44) at include/linux/spinlock_api_smp.h:119
119             do_raw_spin_lock_flags(lock, &flags);
(gdb) l
114              * that interrupts are not re-enabled during lock-acquire:
115              */
116     #ifdef CONFIG_LOCKDEP
117             LOCK_CONTENDED(lock, do_raw_spin_trylock, do_raw_spin_lock);
118     #else
119             do_raw_spin_lock_flags(lock, &flags);
120     #endif
121             return flags;
122     }
123
(gdb) p lock
$1 = (raw_spinlock_t *) 0x44
(gdb) p flags
$2 = 2684420243

So…there is a spinlock issue, the exact cause of which is not yet known.

Additional Data (while in device mode, tested modprobe and rmmod of g_ether dependencies libcomposite and configfs, which did not trigger any error…error occurred only rmmod of g_ether…this is a separate OOPS from the previous OOPS):

root@tegra-ubuntu:~# rmmod g_ether
[  247.204503] Unable to handle kernel NULL pointer dereference at virtual address 00000044
[  247.212630] pgd = eadbc000
[  247.215335] [00000044] *pgd=00000000
[  247.218938] Internal error: Oops: 5 [#1] PREEMPT SMP ARM

Entering kdb (current=0xea66a580, pid 1655) on processor 0 Oops: (null)
due to oops @ 0xc08781b4

dCPU: 0 PID: 1655 Comm: rmmod Not tainted 3.10.40-gdacac96_dbg1 #1
dtask: ea66a580 ti: e9c0a000 task.ti: e9c0a000
PC is at _raw_spin_lock_irqsave+0x2c/0x6c
LR is at composite_disconnect+0x24/0x64 [libcomposite]
pc : [<c08781b4>]    lr : [<bf0f67c8>]    psr: a0010093
sp : e9c0bed0  ip : 00000000  fp : 00000800
r10: 00000000  r9 : e9c0a000  r8 : c000eee4
r7 : 40010013  r6 : ed05c29c  r5 : 00000044  r4 : 00000000
r3 : e9c0a000  r2 : 00000044  r1 : 00000001  r0 : a0010093
Flags: NzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c5387d  Table: aadbc06a  DAC: 00000015

PC: 0xc0878134:
8134  e3c23d7f e3c3303f e5932004 e2822001 e5832004 e1903f9f e2832801 e1801f92
8154  e3310000 1afffffa e1a02823 e6ff3073 e1530002 0a000004 e320f002 e1d030b0
8174  e6ff3073 e1530002 1afffffa f57ff05f e12fff1e e52de004 e8bd4000 e1a02000
8194  e10f0000 f10c0080 e1a0100d e3c13d7f e3c3303f e5931004 e2811001 e5831004
81b4  e1923f9f e2831801 e182cf91 e33c0000 1afffffa e1a01823 e6ff3073 e1530001
81d4  0a000004 e320f002 e1d230b0 e6ff3073 e1530001 1afffffa f57ff05f e12fff1e
81f4  e52de004 e8bd4000 f10c0080 e1a0200d e3c23d7f e3c3303f e5932004 e2822001
8214  e5832004 e1903f9f e2832801 e1801f92 e3310000 1afffffa e1a02823 e6ff3073

SP: 0xe9c0be50:
be50  c0e757bc c0a81320 c0a84dbc c01d3040 ed05d588 ec3fca08 c0e757bc c0a81320
be70  c0a84dbc c08781b4 a0010093 ffffffff e9c0bebc c000e898 a0010093 00000001
be90  00000044 e9c0a000 00000000 00000044 ed05c29c 40010013 c000eee4 e9c0a000
beb0  00000000 00000800 00000000 e9c0bed0 bf0f67c8 c08781b4 a0010093 ffffffff
bed0  ed05c29c ed05c000 ed05c29c c0551c74 00000005 ed05c000 ed05c2a0 c055285c
bef0  c0e84c00 ed05fe00 c0d705bc 00000000 ed05c000 c0552998 c0552974 ed05fe00
bf10  c0d705bc 00000000 b6ff1da4 c000eee4 e9c0a000 c0550390 bf10c578 c0550410
bf30  bf10a8e8 bf10ccf8 be938961 bf0f8140 bf10a8e8 bf10a8f8 bf10a8e8 c00d7240

R3: 0xe9c09f80:
9f80  e9c09f7c 00000000 c089e650 00000000 ec5e6d40 00000000 b6e25000 b6e4d000
9fa0  e9c09f40 e9c09d88 e9c09609 e9c09138 e9c09e48 00000000 ed0dd740 0000059f
9fc0  00000075 ec752624 00000000 00000000 00000027 e9c09fd4 e9c09fd4 00000000
9fe0  c089e650 00000000 ecbcf2c0 00000000 ffbfffff ffffffff ffffffff ffffffff
a000  00000002 00000004 00000000 ea66a580 c0d340b8 00000000 00000015 00000000
a020  0000000a ea66a580 c20124c0 edb18580 eb980200 c0c654c0 e9c0beb4 e9c0be08
a040  c08772c4 00000000 00000000 00000000 00000000 00000000 01010000 00000000
a060  b6fc9850 00000000 00000000 00000000 00000000 00000000 00000000 00000000

R6: 0xed05c21c:
c21c  00000000 00000000 ffffffe0 ed05c228 ed05c228 c0551824 ffffffe0 ed05c238
c23c  ed05c238 c0552c08 ffffffe0 ed05c248 ed05c248 c0552928 00000001 00000000
c25c  00000000 00000000 fe200000 00000800 7d001000 00000020 00000034 00000000
c27c  00000000 00000001 00000000 00000000 00000000 00000000 0016e360 00000000
c29c  00060006 00000000 00000000 ed05c2a8 ed05c2a8 ea66a580 00000000 01000102
c2bc  00000100 ed0592c0 00000000 00000000 00000000 00000000 00000000 00000000
c2dc  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
c2fc  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

R8: 0xc000ee64:
ee64  e31a0c0f 1a000008 e3570f5f e24fef4e 3798f107 e28d1008 e3a08000 e357080f
ee84  e2270000 2a0012dc ea022c73 e1a01007 e28d0008 eb000ac0 e28fe024 e1a07000
eea4  e28d1008 e3570f5f 3891007f 388d0030 3798f107 e3770001 1affffee e28dd008
eec4  eaffffb2 e5ad0008 e1a0000d eb000aeb eaffffae e320f000 e320f000 c0ca576c
eee4  c0085884 c00755cc c006dca0 c016cbd4 c016cd78 c016b428 c016b824 c009a060
ef04  c016b6d4 c017dcdc c017d610 c0174ef8 c016a0b0 c009a060 c017ced8 c016a920
ef24  c00d0f98 c009a060 c009a060 c016c05c c008b1d0 c018f7a0 c009a060 c00d16a4
ef44  c00d266c c009a060 c007e3a4 c009a060 c009a060 c0087adc c009a060 c009a060

R9: 0xe9c09f80:
9f80  e9c09f7c 00000000 c089e650 00000000 ec5e6d40 00000000 b6e25000 b6e4d000
9fa0  e9c09f40 e9c09d88 e9c09609 e9c09138 e9c09e48 00000000 ed0dd740 0000059f
9fc0  00000075 ec752624 00000000 00000000 00000027 e9c09fd4 e9c09fd4 00000000
9fe0  c089e650 00000000 ecbcf2c0 00000000 ffbfffff ffffffff ffffffff ffffffff
a000  00000002 00000004 00000000 ea66a580 c0d340b8 00000000 00000015 00000000
a020  0000000a ea66a580 c20124c0 edb18580 eb980200 c0c654c0 e9c0beb4 e9c0be08
a040  c08772c4 00000000 00000000 00000000 00000000 00000000 01010000 00000000
a060  b6fc9850 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dCPU: 0 PID: 1655 Comm: rmmod Not tainted 3.10.40-gdacac96_dbg1 #1
[<c001746c>] (unwind_backtrace+0x0/0x138) from [<c001368c>] (show_stack+0x18/0x1c)
[<c001368c>] (show_stack+0x18/0x1c) from [<c02d80d8>] (dump_stack+0x1c/0x20)
[<c02d80d8>] (dump_stack+0x1c/0x20) from [<c0010120>] (show_regs+0x28/0x2c)
[<c0010120>] (show_regs+0x28/0x2c) from [<c00e6f5c>] (kdb_dumpregs+0x38/0x58)
[<c00e6f5c>] (kdb_dumpregs+0x38/0x58) from [<c00ea3ec>] (kdb_local+0x228/0x51c)
[<c00ea3ec>] (kdb_local+0x228/0x51c) from [<c00ea7ac>] (kdb_main_loop+0xcc/0x1cc)
[<c00ea7ac>] (kdb_main_loop+0xcc/0x1cc) from [<c00ed3cc>] (kdb_stub+0x2e4/0x45c)
[<c00ed3cc>] (kdb_stub+0x2e4/0x45c) from [<c00e29dc>] (kgdb_cpu_enter+0x44c/0x680)
[<c00e29dc>] (kgdb_cpu_enter+0x44c/0x680) from [<c00e2f3c>] (kgdb_handle_exception+0xcc/0x10c)
[<c00e2f3c>] (kgdb_handle_exception+0xcc/0x10c) from [<c0016878>] (__kgdb_notify+0x24/0x38)
[<c0016878>] (__kgdb_notify+0x24/0x38) from [<c00168a8>] (kgdb_notify+0x1c/0x24)
[<c00168a8>] (kgdb_notify+0x1c/0x24) from [<c009f5b4>] (notifier_call_chain+0x40/0x88)
[<c009f5b4>] (notifier_call_chain+0x40/0x88) from [<c009f754>] (__atomic_notifier_call_chain+0x40/0x54)
[<c009f754>] (__atomic_notifier_call_chain+0x40/0x54) from [<c009f788>] (atomic_notifier_call_chain+0x20/0x28)
[<c009f788>] (atomic_notifier_call_chain+0x20/0x28) from [<c009fafc>] (notify_die+0x3c/0x44)
[<c009fafc>] (notify_die+0x3c/0x44) from [<c0013348>] (__die+0x78/0x130)
[<c0013348>] (__die+0x78/0x130) from [<c00136e8>] (die+0x58/0x78)
[<c00136e8>] (die+0x58/0x78) from [<c001fbb8>] (__do_kernel_fault+0x84/0x94)
[<c001fbb8>] (__do_kernel_fault+0x84/0x94) from [<c001fee0>] (do_page_fault+0x318/0x324)
[<c001fee0>] (do_page_fault+0x318/0x324) from [<c001ff94>] (do_translation_fault+0x18/0xb4)
[<c001ff94>] (do_translation_fault+0x18/0xb4) from [<c000833c>] (do_DataAbort+0x40/0xa0)
[<c000833c>] (do_DataAbort+0x40/0xa0) from [<c000e898>] (__dabt_svc+0x38/0x60)
Exception stack(0xe9c0be88 to 0xe9c0bed0)
be80:                   a0010093 00000001 00000044 e9c0a000 00000000 00000044
bea0: ed05c29c 40010013 c000eee4 e9c0a000 00000000 00000800 00000000 e9c0bed0
bec0: bf0f67c8 c08781b4 a0010093 ffffffff
[<c000e898>] (__dabt_svc+0x38/0x60) from [<c08781b4>] (_raw_spin_lock_irqsave+0x2c/0x6c)
[<c08781b4>] (_raw_spin_lock_irqsave+0x2c/0x6c) from [<bf0f67c8>] (composite_disconnect+0x24/0x64 [libcomposite])
[<bf0f67c8>] (composite_disconnect+0x24/0x64 [libcomposite]) from [<c0551c74>] (reset_queues+0x6c/0x7c)
[<c0551c74>] (reset_queues+0x6c/0x7c) from [<c055285c>] (tegra_vbus_session+0x54/0x120)
[<c055285c>] (tegra_vbus_session+0x54/0x120) from [<c0552998>] (tegra_udc_stop+0x24/0x98)
[<c0552998>] (tegra_udc_stop+0x24/0x98) from [<c0550390>] (usb_gadget_remove_driver+0x9c/0xb8)
[<c0550390>] (usb_gadget_remove_driver+0x9c/0xb8) from [<c0550410>] (usb_gadget_unregister_driver+0x64/0xb0)
[<c0550410>] (usb_gadget_unregister_driver+0x64/0xb0) from [<bf0f8140>] (usb_composite_unregister+0x14/0x18 [libcomposite])
[<bf0f8140>] (usb_composite_unregister+0x14/0x18 [libcomposite]) from [<bf10a8f8>] (cleanup+0x10/0x14 [g_ether])
[<bf10a8f8>] (cleanup+0x10/0x14 [g_ether]) from [<c00d7240>] (SyS_delete_module+0x208/0x31c)
[<c00d7240>] (SyS_delete_module+0x208/0x31c) from [<c000ed40>] (ret_fast_syscall+0x0/0x30)

[0]kdb>

config-3.10.40-gdacac96_dbg1.gz (25.8 KB)

Just an update. The spinlock issue is independent of a specific gadget driver, e.g., g_ether and g_mass_storage will fail in the same way if removed while in device mode. Some of the important information regarding spinlocks is being optimized out even with debug settings, so it is slow tracing this.

The failure is showing itself in function composite_disconnect, but so far I haven’t pinpointed in the call stack where the spinlock issue actually starts, which is passed as a pointer in a number of structs kgdboc does not have access to. The reset_queues function in tegra_udc.c is suspicious, as it unlocks a spinlock and calls composite_disconnect passing data which is used to re-lock in composite_disconnect. It seems that this momentary unlock/relock has a strong chance to be the issue, but I can’t verify yet (and even if it is verified, there may be a reason why there was an unlock/relock which would complicate the fix).

The root cause should be cdev NULL in composite_disconnect() because composite disconnect gadget twice [ called composite_disconnect() twice ] and the gadget has already unbinded at second call . This is why the log shows
[ 61.683180] Unable to handle kernel NULL pointer dereference at virtual address 00000044 . (cdev == NULL)

In usb_gadget_remove_driver() function, udc->driver->disconnect() will call composite_disconnect() first, and usb_gadget_udc_stop() calls composite_disconnect() only when vbus is ON .
(usb_gadget_udc_stop() -> tegra_vbus_session()-> reset_queues() -> composite_disconnect())

In host mode , VBUS is default off and waiting for HW interrupt, this is why we didn’t see this issue on host mode.
When switching to device mode(echo 1 > sys/devices/platform/tegra-otg/enable_device), the vbus would be turn ON:
[ 2611.960608] otg state changed: HOST --> SUSPEND
[ 2611.964593] tegra-ehci tegra-ehci.0: remove, state 4
[ 2611.964604] usb usb3: USB disconnect, device number 1
[ 2611.965315] tegra-ehci tegra-ehci.0: USB bus 3 deregistered
[ 2611.965457] otg state changed: SUSPEND --> PERIPHERAL
[ 2611.965462] tegra_udc: tegra_vbus_session(1559) turn VBUS state from off to on

If unplugging device from USB port, it will trigger an interrupt and off VBUS. In this case tegra udc driver will not call composite_disconnect() twice because that VBUS is off .

This issue should only happen when executing rmmod case.

PratikPatel,
Can you try below patch and see if the issue goes away?

— a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -1520,6 +1520,9 @@
/* REVISIT: should we have config and device level
* disconnect callbacks?
*/

  • if (!cdev )
  •   return;
    
  • spin_lock_irqsave(&cdev->lock, flags);
    if (cdev->config)
    reset_config(cdev);

This worked for me, using both g_ether and g_mass_storage.

I have facing strange issue with Jetson Board with R21.4. For me USB OTG is working good in host mode. I connected Thumb drive and tested the same. But When I tried to test the Device mode nothing happens (It does not work for me).
Before trying to test the device mode I followed the following steps,

echo 0 > /sys/devices/platform/tegra-otg/enable_host
echo 1 > /sys/devices/platform/tegra-otg/enable_device
//I switched to device mode from Host mode

//Then I tried mass storage
modprobe g_mass_storage file=/dev/mmcblk0p1

Also In another boot I tried ether also

modprobe g_ether

In the PC side nothing happens. I tried with different cables and different PCs. Am I missing something?

The gadget interface is just a stub, you still have to write more code. As an example a mass storage device (or any other device) sends the information which would be present from “lsusb -v” for a specific device…including vendor ID and product ID. When you set up the mass storage, your backing store is set up, but none of the vendor-specific information. On your PC you might plug in a mass storage device (like a flash card reader) and see what lsusb -v shows for it…technical details like bulk versus isochronous modes are set, but everything else you need to add.