Kernel crash with USB printer on sparc64

[raymond.meyer]

uname -a
NetBSD ultra10 4.99.72 NetBSD 4.99.72 (GENERIC_SUN4U) #0: Wed Aug 13 00:33:40
BST 2008  root@p3smp:/opt/obj.sparc/sys/arch/sparc/compile/GENERIC_SUN4U
sparc64

I can always reproduce this crash.

I try to print something on a USB printer from a KDE application, all I get is
garbage on the first page and then the printer feeds empty pages one after
another. Switching the printer off and then on again crashes NetBSD kernel

ulpt0: at uhub1 port 2 (addr 3) disconnected
ulpt0: detached
text_access_fault: pc=4090000 va=4090000
kernel trap 64: +fast instruction access MMU miss
Stopped in pid 194.1 (usb) at 0x4090000: undefined
db> bt
usbd_free_xfer(0, 0, 0, dab0a44, dfeddcc, dfede10) at
netbsd:usbd_fee_xfer+0x1c
ulptclose(2d5ab00, 2, 2000, dab0a40, 0, 2) at netbsd:ulptclose+0xb4

... and so on

Anyone knows a fix, coz this bug drives me mad.

[Martin Husemann]

No idea about the garbage output, but try this for the crash (not even
compile tested, but you get the idea)

Martin

Index: ulpt.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/ulpt.c,v
retrieving revision 1.81
diff -u -p -r1.81 ulpt.c
--- ulpt.c 24 May 2008 16:40:58 -0000 1.81
+++ ulpt.c 6 Oct 2008 00:12:01 -0000
@@ -186,6 +186,7 @@ int ulpt_statusmsg(u_char, struct ulpt_s
 void ulpt_read_cb(usbd_xfer_handle xfer, usbd_private_handle priv,
   usbd_status status);
 void ulpt_tick(void *xsc);
+Static void ulpt_do_close(strcut ulpt_softc *sc);
 
 #if 0
 void ieee1284_print_id(char *);
@@ -386,10 +387,7 @@ USB_DETACH(ulpt)
  DPRINTFN(1, ("ulpt_detach: sc=%p\n", sc));
 
  sc->sc_dying = 1;
- if (sc->sc_out_pipe != NULL)
- usbd_abort_pipe(sc->sc_out_pipe);
- if (sc->sc_in_pipe != NULL)
- usbd_abort_pipe(sc->sc_in_pipe);
+ ulpt_do_close(sc);
 
  s = splusb();
  if (--sc->sc_refcnt >= 0) {
@@ -629,13 +627,9 @@ ulpt_statusmsg(u_char status, struct ulp
  return (status);
 }
 
-int
-ulptclose(dev_t dev, int flag, int mode,
-    struct lwp *l)
+Static void
+ulpt_do_close(strcut ulpt_softc *sc)
 {
- struct ulpt_softc *sc;
-
- USB_GET_SC(ulpt, ULPTUNIT(dev), sc);
 
  if (sc->sc_state != ULPT_OPEN)
  /* We are being forced to close before the open completed. */
@@ -668,6 +662,16 @@ ulptclose(dev_t dev, int flag, int mode,
  }
 
  sc->sc_state = 0;
+}
+
+int
+ulptclose(dev_t dev, int flag, int mode,
+    struct lwp *l)
+{
+ struct ulpt_softc *sc;
+
+ USB_GET_SC(ulpt, ULPTUNIT(dev), sc);
+ ulpt_do_close(sc);
 
  DPRINTFN(2, ("ulptclose: closed\n"));
  return (0);