[Qemu-devel] Question about hcd-ohci and address_space_translate

[BALATON Zoltan]

Hello,

I'm trying to port a USB driver from coreboot to OpenBIOS to fix keyboard 
in qemu-system-ppc64 -M mac99. The driver sets up a HCCA struct in RAM and 
writes its address into the mmio mapped area of the card but then QEMU 
complains that it cannot read this struct and I don't understand why. This 
is what I could find out:

> > ohci_init: addr = 80080000
[...]
usb-ohci: Reset pci-ohci
> > HCCA addr 07c9ae00
[...]
usb-ohci: pci-ohci: USB Operational
Unassigned mem read 0000000007c9ae00
Unassigned mem read 0000000007c9ae04
[...]
Unassigned mem read 0000000007c9ae84
usb-ohci: HCCA read error at 7c9ae00
ohci_die: DMA error

The read happens through ohci_read_hcca which eventually calls 
phys_page_find that returns &sections[PHYS_SECTION_UNASSIGNED] here:

phys_page_find (lp=..., addr=130657792, nodes=0x0, sections=0x7fffdc04d400)
    at qemu/exec.c:280
286             if (lp.ptr == PHYS_MAP_NODE_NIL) {
287                 return &sections[PHYS_SECTION_UNASSIGNED];
(gdb) p lp
$7 = {skip = 1, ptr = 67108863}

which is called from

address_space_lookup_region (d=0x7fffdc04d3c0, addr=130657792, resolve_subpage=
    true) at qemu/exec.c:311
311     {
315         section = phys_page_find(d->phys_map, addr, d->map.nodes, 
d->map.sections);
(gdb) p *d
$9 = {phys_map = {skip = 1, ptr = 67108863}, map = {sections_nb = 4,
    sections_nb_alloc = 16, nodes_nb = 0, nodes_nb_alloc = 0, nodes = 0x0,
    sections = 0x7fffdc04d400}, as = 0x5555563fcfd8}

which comes from

address_space_translate (as=0x5555563fcfd8, addr=
    130657792, xlat=0x7fffffffd7f0, plen=0x7fffffffd7e0, is_write=false)
    at qemu/exec.c:364
364             section = address_space_translate_internal(as->dispatch, addr, 
&addr, plen, true);
(gdb) p *as
$10 = {name = 0x5555564261e0 "pci-ohci", root = 0x5555563fd0b0, current_map =
    0x7fffdc0413c0, ioeventfd_nb = 0, ioeventfds = 0x0, dispatch =
    0x7fffdc04d3c0, next_dispatch = 0x7fffdc04d3c0, dispatch_listener = {
    begin = 0x55555586840b <mem_begin>, commit = 0x555555868599 <mem_commit>,
    region_add = 0x555555865f9f <mem_add>, region_del = 0x0, region_nop =
    0x555555865f9f <mem_add>, log_start = 0x0, log_stop = 0x0, log_sync = 0x0,
    log_global_start = 0x0, log_global_stop = 0x0, eventfd_add = 0x0,
    eventfd_del = 0x0, coalesced_mmio_add = 0x0, coalesced_mmio_del = 0x0,
    priority = 0, address_space_filter = 0x5555563fcfd8, link = {tqe_next =
    0x5555564c0450, tqe_prev = 0x55555641b6f0}}, address_spaces_link = {
    tqe_next = 0x5555564c0418, tqe_prev = 0x55555641b700}}

The address is in the ram area but these functions still think they are 
unassigned. Is this a bug? If it is how could it be fixed?

Regards,
BALATON Zoltan