stl_raw(p++, 0x01a00008);                                     /* jr t5 */    stl_raw(p++, 0x01602021);                                     /* move a0,t3 */    /* 0x83c YAMON print_count */    stl_raw(p++, 0x03e06821);                                     /* move t5,ra */    stl_raw(p++, 0x00805821);                                     /* move t3,a0 */    stl_raw(p++, 0x00a05021);                                     /* move t2,a1 */    stl_raw(p++, 0x00c06021);                                     /* move t4,a2 */    stl_raw(p++, 0x91440000);                                     /* lbu a0,0(t2) */    stl_raw(p++, 0x0ff0021c);                                     /* jal 870 */    stl_raw(p++, 0x00000000);                                     /* nop */    stl_raw(p++, 0x254a0001);                                     /* addiu t2,t2,1 */    stl_raw(p++, 0x258cffff);                                     /* addiu t4,t4,-1 */    stl_raw(p++, 0x1580fffa);                                     /* bnez t4,84c */    stl_raw(p++, 0x00000000);                                     /* nop */    stl_raw(p++, 0x01a00008);                                     /* jr t5 */    stl_raw(p++, 0x01602021);                                     /* move a0,t3 */    /* 0x870 */    stl_raw(p++, 0x3c08b800);                                     /* lui t0,0xb400 */    stl_raw(p++, 0x350803f8);                                     /* ori t0,t0,0x3f8 */    stl_raw(p++, 0x91090005);                                     /* lbu t1,5(t0) */    stl_raw(p++, 0x00000000);                                     /* nop */    stl_raw(p++, 0x31290040);                                     /* andi t1,t1,0x40 */    stl_raw(p++, 0x1120fffc);                                     /* beqz t1,878 <outch+0x8> */    stl_raw(p++, 0x00000000);                                     /* nop */    stl_raw(p++, 0x03e00008);                                     /* jr ra */    stl_raw(p++, 0xa1040000);                                     /* sb a0,0(t0) */}static void prom_set(int index, const char *string, ...){    va_list ap;    int32_t *p;    int32_t table_addr;    char *s;    if (index >= ENVP_NB_ENTRIES)        return;    p = (int32_t *) (phys_ram_base + ENVP_ADDR + VIRT_TO_PHYS_ADDEND);    p += index;    if (string == NULL) {        stl_raw(p, 0);        return;    }    table_addr = ENVP_ADDR + sizeof(int32_t) * ENVP_NB_ENTRIES + index * ENVP_ENTRY_SIZE;    s = (char *) (phys_ram_base + VIRT_TO_PHYS_ADDEND + table_addr);    stl_raw(p, table_addr);    va_start(ap, string);    vsnprintf (s, ENVP_ENTRY_SIZE, string, ap);    va_end(ap);}/* Kernel */static int64_t load_kernel (CPUState *env){    int64_t kernel_entry, kernel_low, kernel_high;    int index = 0;    long initrd_size;    ram_addr_t initrd_offset;    if (load_elf(loaderparams.kernel_filename, VIRT_TO_PHYS_ADDEND,                 &kernel_entry, &kernel_low, &kernel_high) < 0) {        fprintf(stderr, "qemu: could not load kernel '%s'\n",                loaderparams.kernel_filename);        exit(1);    }    /* load initrd */    initrd_size = 0;    initrd_offset = 0;    if (loaderparams.initrd_filename) {        initrd_size = get_image_size (loaderparams.initrd_filename);        if (initrd_size > 0) {            initrd_offset = (kernel_high + ~TARGET_PAGE_MASK) & TARGET_PAGE_MASK;            if (initrd_offset + initrd_size > ram_size) {                fprintf(stderr,                        "qemu: memory too small for initial ram disk '%s'\n",                        loaderparams.initrd_filename);                exit(1);            }            initrd_size = load_image(loaderparams.initrd_filename,                                     phys_ram_base + initrd_offset);        }        if (initrd_size == (target_ulong) -1) {            fprintf(stderr, "qemu: could not load initial ram disk '%s'\n",                    loaderparams.initrd_filename);            exit(1);        }    }    /* Store command line.  */    prom_set(index++, loaderparams.kernel_filename);    if (initrd_size > 0)        prom_set(index++, "rd_start=0x" TARGET_FMT_lx " rd_size=%li %s",                 PHYS_TO_VIRT(initrd_offset), initrd_size,                 loaderparams.kernel_cmdline);    else        prom_set(index++, loaderparams.kernel_cmdline);    /* Setup minimum environment variables */    prom_set(index++, "memsize");    prom_set(index++, "%i", loaderparams.ram_size);    prom_set(index++, "modetty0");    prom_set(index++, "38400n8r");    prom_set(index++, NULL);    return kernel_entry;}static void main_cpu_reset(void *opaque){    CPUState *env = opaque;    cpu_reset(env);    /* The bootload does not need to be rewritten as it is located in a       read only location. The kernel location and the arguments table       location does not change. */    if (loaderparams.kernel_filename) {        env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));        load_kernel (env);    }}staticvoid mips_malta_init (int ram_size, int vga_ram_size,                      const char *boot_device, DisplayState *ds,                      const char *kernel_filename, const char *kernel_cmdline,                      const char *initrd_filename, const char *cpu_model){    char buf[1024];    unsigned long bios_offset;    target_long bios_size;    int64_t kernel_entry;    PCIBus *pci_bus;    CPUState *env;    RTCState *rtc_state;    fdctrl_t *floppy_controller;    MaltaFPGAState *malta_fpga;    qemu_irq *i8259;    int piix4_devfn;    uint8_t *eeprom_buf;    i2c_bus *smbus;    int i;    int index;    BlockDriverState *hd[MAX_IDE_BUS * MAX_IDE_DEVS];    BlockDriverState *fd[MAX_FD];    int fl_idx = 0;    int fl_sectors = 0;    /* init CPUs */    if (cpu_model == NULL) {#ifdef TARGET_MIPS64        cpu_model = "20Kc";#else        cpu_model = "24Kf";#endif    }    env = cpu_init(cpu_model);    if (!env) {        fprintf(stderr, "Unable to find CPU definition\n");        exit(1);    }    register_savevm("cpu", 0, 3, cpu_save, cpu_load, env);    qemu_register_reset(main_cpu_reset, env);    /* allocate RAM */    cpu_register_physical_memory(0, ram_size, IO_MEM_RAM);    /* Map the bios at two physical locations, as on the real board. */    bios_offset = ram_size + vga_ram_size;    cpu_register_physical_memory(0x1e000000LL,                                 BIOS_SIZE, bios_offset | IO_MEM_ROM);    cpu_register_physical_memory(0x1fc00000LL,                                 BIOS_SIZE, bios_offset | IO_MEM_ROM);    /* FPGA */    malta_fpga = malta_fpga_init(0x1f000000LL, env);    /* Load firmware in flash / BIOS unless we boot directly into a kernel. */    if (kernel_filename) {        /* Write a small bootloader to the flash location. */        loaderparams.ram_size = ram_size;        loaderparams.kernel_filename = kernel_filename;        loaderparams.kernel_cmdline = kernel_cmdline;        loaderparams.initrd_filename = initrd_filename;        kernel_entry = load_kernel(env);        env->CP0_Status &= ~((1 << CP0St_BEV) | (1 << CP0St_ERL));        write_bootloader(env, bios_offset, kernel_entry);    } else {        index = drive_get_index(IF_PFLASH, 0, fl_idx);        if (index != -1) {            /* Load firmware from flash. */            bios_size = 0x400000;            fl_sectors = bios_size >> 16;#ifdef DEBUG_BOARD_INIT            printf("Register parallel flash %d size " TARGET_FMT_lx " at "                   "offset %08lx addr %08llx '%s' %x\n",                   fl_idx, bios_size, bios_offset, 0x1e000000LL,                   bdrv_get_device_name(drives_table[index].bdrv), fl_sectors);#endif            pflash_cfi01_register(0x1e000000LL, bios_offset,                                  drives_table[index].bdrv, 65536, fl_sectors,                                  4, 0x0000, 0x0000, 0x0000, 0x0000);            fl_idx++;        } else {            /* Load a BIOS image. */            if (bios_name == NULL)                bios_name = BIOS_FILENAME;            snprintf(buf, sizeof(buf), "%s/%s", bios_dir, bios_name);            bios_size = load_image(buf, phys_ram_base + bios_offset);            if ((bios_size < 0 || bios_size > BIOS_SIZE) && !kernel_filename) {                fprintf(stderr,                        "qemu: Could not load MIPS bios '%s', and no -kernel argument was specified\n",                        buf);                exit(1);            }        }        /* In little endian mode the 32bit words in the bios are swapped,           a neat trick which allows bi-endian firmware. */#ifndef TARGET_WORDS_BIGENDIAN        {            uint32_t *addr;            for (addr = (uint32_t *)(phys_ram_base + bios_offset);                 addr < (uint32_t *)(phys_ram_base + bios_offset + bios_size);                 addr++) {                *addr = bswap32(*addr);            }        }#endif    }    /* Board ID = 0x420 (Malta Board with CoreLV)       XXX: theoretically 0x1e000010 should map to flash and 0x1fc00010 should       map to the board ID. */    stl_raw(phys_ram_base + bios_offset + 0x10, 0x00000420);    /* Init internal devices */    cpu_mips_irq_init_cpu(env);    cpu_mips_clock_init(env);    cpu_mips_irqctrl_init();    /* Interrupt controller */    /* The 8259 is attached to the MIPS CPU INT0 pin, ie interrupt 2 */    i8259 = i8259_init(env->irq[2]);    /* Northbridge */    pci_bus = pci_gt64120_init(i8259);    /* Southbridge */    if (drive_get_max_bus(IF_IDE) >= MAX_IDE_BUS) {        fprintf(stderr, "qemu: too many IDE bus\n");        exit(1);    }    for(i = 0; i < MAX_IDE_BUS * MAX_IDE_DEVS; i++) {        index = drive_get_index(IF_IDE, i / MAX_IDE_DEVS, i % MAX_IDE_DEVS);        if (index != -1)            hd[i] = drives_table[index].bdrv;        else            hd[i] = NULL;    }    piix4_devfn = piix4_init(pci_bus, 80);    pci_piix4_ide_init(pci_bus, hd, piix4_devfn + 1, i8259);    usb_uhci_piix4_init(pci_bus, piix4_devfn + 2);    smbus = piix4_pm_init(pci_bus, piix4_devfn + 3, 0x1100);    eeprom_buf = qemu_mallocz(8 * 256); /* XXX: make this persistent */    for (i = 0; i < 8; i++) {        /* TODO: Populate SPD eeprom data.  */        smbus_eeprom_device_init(smbus, 0x50 + i, eeprom_buf + (i * 256));    }    pit = pit_init(0x40, i8259[0]);    DMA_init(0);    /* Super I/O */    i8042_init(i8259[1], i8259[12], 0x60);    rtc_state = rtc_init(0x70, i8259[8]);    if (serial_hds[0])        serial_init(0x3f8, i8259[4], serial_hds[0]);    if (serial_hds[1])        serial_init(0x2f8, i8259[3], serial_hds[1]);    if (parallel_hds[0])        parallel_init(0x378, i8259[7], parallel_hds[0]);    for(i = 0; i < MAX_FD; i++) {        index = drive_get_index(IF_FLOPPY, 0, i);       if (index != -1)           fd[i] = drives_table[index].bdrv;       else           fd[i] = NULL;    }    floppy_controller = fdctrl_init(i8259[6], 2, 0, 0x3f0, fd);    /* Sound card */#ifdef HAS_AUDIO    audio_init(pci_bus);#endif    /* Network card */    network_init(pci_bus);    /* Optional PCI video card */    pci_cirrus_vga_init(pci_bus, ds, phys_ram_base + ram_size,                        ram_size, vga_ram_size);}QEMUMachine mips_malta_machine = {    "malta",    "MIPS Malta Core LV",    mips_malta_init,};