From 8d5f07fa3bd3433e779d13eb1cda4fbb07acb67f Mon Sep 17 00:00:00 2001
From: bellard <bellard@c046a42c-6fe2-441c-8c8c-71466251a162>
Date: Mon, 4 Oct 2004 21:23:09 +0000
Subject: [PATCH] sparc merge (Blue Swirl)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@1098 c046a42c-6fe2-441c-8c8c-71466251a162
---
 Makefile                 |  11 +-
 Makefile.target          |   2 +-
 gdbstub.c                |   6 +
 hw/iommu.c               |  83 ++++-----
 hw/lance.c               |  42 ++---
 hw/m48t08.c              |   4 +-
 hw/m48t08.h              |   2 +-
 hw/magic-load.c          | 385 +++++++++++++++++++--------------------
 hw/sched.c               | 150 ++++-----------
 hw/sun4m.c               |  77 +++-----
 hw/tcx.c                 |  81 +++++---
 monitor.c                |   6 +-
 pc-bios/README           |   5 +
 pc-bios/proll.bin        | Bin 0 -> 56856 bytes
 pc-bios/proll.patch      |  50 +++++
 target-sparc/cpu.h       |   1 +
 target-sparc/exec.h      |   5 +-
 target-sparc/helper.c    |  22 +--
 target-sparc/op.c        |  96 +---------
 target-sparc/op_helper.c |  23 ++-
 target-sparc/op_mem.h    |   4 +
 tests/Makefile           |   2 +-
 vl.h                     |  11 +-
 23 files changed, 484 insertions(+), 584 deletions(-)
 create mode 100644 pc-bios/proll.bin
 create mode 100644 pc-bios/proll.patch

diff --git a/Makefile b/Makefile
index f80db8be9f2..d4d8028f3d3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-include config-host.mak
+-include config-host.mak
 
 CFLAGS=-Wall -O2 -g -fno-strict-aliasing 
 ifdef CONFIG_DARWIN
@@ -14,8 +14,9 @@ TOOLS=qemu-img
 ifdef CONFIG_STATIC
 LDFLAGS+=-static
 endif
+DOCS=qemu-doc.html qemu-tech.html qemu.1
 
-all: dyngen$(EXESUF) $(TOOLS) qemu-doc.html qemu-tech.html qemu.1
+all: dyngen$(EXESUF) $(TOOLS) $(DOCS)
 	for d in $(TARGET_DIRS); do \
 	$(MAKE) -C $$d $@ || exit 1 ; \
         done
@@ -29,14 +30,14 @@ dyngen$(EXESUF): dyngen.c
 clean:
 # avoid old build problems by removing potentially incorrect old files
 	rm -f config.mak config.h op-i386.h opc-i386.h gen-op-i386.h op-arm.h opc-arm.h gen-op-arm.h 
-	rm -f *.o *.a $(TOOLS) dyngen$(EXESUF) TAGS qemu.pod
+	rm -f *.o *.a $(TOOLS) dyngen$(EXESUF) TAGS qemu.pod *~ */*~
 	$(MAKE) -C tests clean
 	for d in $(TARGET_DIRS); do \
 	$(MAKE) -C $$d $@ || exit 1 ; \
         done
 
 distclean: clean
-	rm -f config-host.mak config-host.h
+	rm -f config-host.mak config-host.h $(DOCS)
 	for d in $(TARGET_DIRS); do \
 	rm -rf $$d || exit 1 ; \
         done
@@ -50,6 +51,7 @@ endif
 	install -m 644 pc-bios/bios.bin pc-bios/vgabios.bin \
                        pc-bios/vgabios-cirrus.bin \
                        pc-bios/ppc_rom.bin \
+                       pc-bios/proll.bin \
                        pc-bios/linux_boot.bin "$(datadir)"
 	mkdir -p "$(docdir)"
 	install -m 644 qemu-doc.html  qemu-tech.html "$(docdir)"
@@ -99,6 +101,7 @@ tarbin:
 	$(datadir)/vgabios.bin \
 	$(datadir)/vgabios-cirrus.bin \
 	$(datadir)/ppc_rom.bin \
+	$(datadir)/proll.bin \
 	$(datadir)/linux_boot.bin \
 	$(docdir)/qemu-doc.html \
 	$(docdir)/qemu-tech.html \
diff --git a/Makefile.target b/Makefile.target
index ff07be844f8..6ac8d9f1b06 100644
--- a/Makefile.target
+++ b/Makefile.target
@@ -279,7 +279,7 @@ VL_OBJS+= mc146818rtc.o serial.o i8259.o i8254.o fdc.o m48t59.o
 VL_OBJS+= ppc_prep.o ppc_chrp.o cuda.o adb.o openpic.o
 endif
 ifeq ($(TARGET_ARCH), sparc)
-VL_OBJS+= sun4m.o tcx.o lance.o iommu.o sched.o m48t08.o magic-load.o
+VL_OBJS+= sun4m.o tcx.o lance.o iommu.o sched.o m48t08.o magic-load.o timer.o
 endif
 ifdef CONFIG_GDBSTUB
 VL_OBJS+=gdbstub.o 
diff --git a/gdbstub.c b/gdbstub.c
index e15216a5906..2491c2cd772 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -387,6 +387,9 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             env->eip = addr;
 #elif defined (TARGET_PPC)
             env->nip = addr;
+#elif defined (TARGET_SPARC)
+            env->pc = addr;
+            env->npc = addr + 4;
 #endif
         }
         vm_start();
@@ -398,6 +401,9 @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             env->eip = addr;
 #elif defined (TARGET_PPC)
             env->nip = addr;
+#elif defined (TARGET_SPARC)
+            env->pc = addr;
+            env->npc = addr + 4;
 #endif
         }
         cpu_single_step(env, 1);
diff --git a/hw/iommu.c b/hw/iommu.c
index f00bb78b039..a9249c4ba72 100644
--- a/hw/iommu.c
+++ b/hw/iommu.c
@@ -107,29 +107,24 @@ struct iommu_regs {
 #define IOPTE_VALID         0x00000002 /* IOPTE is valid */
 #define IOPTE_WAZ           0x00000001 /* Write as zeros */
 
-#define PHYS_JJ_IOMMU	0x10000000	/* First page of sun4m IOMMU */
 #define PAGE_SHIFT      12
 #define PAGE_SIZE       (1 << PAGE_SHIFT)
 #define PAGE_MASK	(PAGE_SIZE - 1)
 
 typedef struct IOMMUState {
+    uint32_t addr;
     uint32_t regs[sizeof(struct iommu_regs)];
+    uint32_t iostart;
 } IOMMUState;
 
 static IOMMUState *ps;
 
-static int iommu_io_memory;
-
-static void iommu_reset(IOMMUState *s)
-{
-}
-
 static uint32_t iommu_mem_readw(void *opaque, target_phys_addr_t addr)
 {
     IOMMUState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_IOMMU) >> 2;
+    saddr = (addr - s->addr) >> 2;
     switch (saddr) {
     default:
 	return s->regs[saddr];
@@ -143,8 +138,37 @@ static void iommu_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val
     IOMMUState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_IOMMU) >> 2;
+    saddr = (addr - s->addr) >> 2;
     switch (saddr) {
+    case 0:
+	switch (val & IOMMU_CTRL_RNGE) {
+	case IOMMU_RNGE_16MB:
+	    s->iostart = 0xff000000;
+	    break;
+	case IOMMU_RNGE_32MB:
+	    s->iostart = 0xfe000000;
+	    break;
+	case IOMMU_RNGE_64MB:
+	    s->iostart = 0xfc000000;
+	    break;
+	case IOMMU_RNGE_128MB:
+	    s->iostart = 0xf8000000;
+	    break;
+	case IOMMU_RNGE_256MB:
+	    s->iostart = 0xf0000000;
+	    break;
+	case IOMMU_RNGE_512MB:
+	    s->iostart = 0xe0000000;
+	    break;
+	case IOMMU_RNGE_1GB:
+	    s->iostart = 0xc0000000;
+	    break;
+	default:
+	case IOMMU_RNGE_2GB:
+	    s->iostart = 0x80000000;
+	    break;
+	}
+	/* Fall through */
     default:
 	s->regs[saddr] = val;
 	break;
@@ -165,57 +189,30 @@ static CPUWriteMemoryFunc *iommu_mem_write[3] = {
 
 uint32_t iommu_translate(uint32_t addr)
 {
-    uint32_t *iopte = (void *)(ps->regs[1] << 4), pa, iostart;
-
-    switch (ps->regs[0] & IOMMU_CTRL_RNGE) {
-    case IOMMU_RNGE_16MB:
-	iostart = 0xff000000;
-	break;
-    case IOMMU_RNGE_32MB:
-	iostart = 0xfe000000;
-	break;
-    case IOMMU_RNGE_64MB:
-	iostart = 0xfc000000;
-	break;
-    case IOMMU_RNGE_128MB:
-	iostart = 0xf8000000;
-	break;
-    case IOMMU_RNGE_256MB:
-	iostart = 0xf0000000;
-	break;
-    case IOMMU_RNGE_512MB:
-	iostart = 0xe0000000;
-	break;
-    case IOMMU_RNGE_1GB:
-	iostart = 0xc0000000;
-	break;
-    default:
-    case IOMMU_RNGE_2GB:
-	iostart = 0x80000000;
-	break;
-    }
+    uint32_t *iopte = (void *)(ps->regs[1] << 4), pa;
 
-    iopte += ((addr - iostart) >> PAGE_SHIFT);
+    iopte += ((addr - ps->iostart) >> PAGE_SHIFT);
     cpu_physical_memory_rw((uint32_t)iopte, (void *) &pa, 4, 0);
     bswap32s(&pa);
     pa = (pa & IOPTE_PAGE) << 4;		/* Loose higher bits of 36 */
-    //return pa + PAGE_SIZE;
     return pa + (addr & PAGE_MASK);
 }
 
-void iommu_init()
+void iommu_init(uint32_t addr)
 {
     IOMMUState *s;
+    int iommu_io_memory;
 
     s = qemu_mallocz(sizeof(IOMMUState));
     if (!s)
         return;
 
+    s->addr = addr;
+
     iommu_io_memory = cpu_register_io_memory(0, iommu_mem_read, iommu_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_IOMMU, sizeof(struct iommu_regs),
+    cpu_register_physical_memory(addr, sizeof(struct iommu_regs),
                                  iommu_io_memory);
     
-    iommu_reset(s);
     ps = s;
 }
 
diff --git a/hw/lance.c b/hw/lance.c
index e461adead14..25ad8c45b2a 100644
--- a/hw/lance.c
+++ b/hw/lance.c
@@ -24,11 +24,7 @@
 #include "vl.h"
 
 /* debug LANCE card */
-#define DEBUG_LANCE
-
-#define PHYS_JJ_IOMMU	0x10000000	/* First page of sun4m IOMMU */
-#define PHYS_JJ_LEDMA   0x78400010      /* ledma, off by 10 from unused SCSI */
-#define PHYS_JJ_LE      0x78C00000      /* LANCE, typical sun4m */
+//#define DEBUG_LANCE
 
 #ifndef LANCE_LOG_TX_BUFFERS
 #define LANCE_LOG_TX_BUFFERS 4
@@ -162,10 +158,12 @@ struct sparc_dma_registers {
 #endif
 
 typedef struct LEDMAState {
+    uint32_t addr;
     uint32_t regs[LEDMA_REGS];
 } LEDMAState;
 
 typedef struct LANCEState {
+    uint32_t paddr;
     NetDriverState *nd;
     uint32_t leptr;
     uint16_t addr;
@@ -175,8 +173,6 @@ typedef struct LANCEState {
     LEDMAState *ledma;
 } LANCEState;
 
-static int lance_io_memory;
-
 static unsigned int rxptr, txptr;
 
 static void lance_send(void *opaque);
@@ -194,7 +190,7 @@ static uint32_t lance_mem_readw(void *opaque, target_phys_addr_t addr)
     LANCEState *s = opaque;
     uint32_t saddr;
 
-    saddr = addr - PHYS_JJ_LE;
+    saddr = addr - s->paddr;
     switch (saddr >> 1) {
     case LE_RDP:
 	return s->regs[s->addr];
@@ -210,9 +206,9 @@ static void lance_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val
 {
     LANCEState *s = opaque;
     uint32_t saddr;
-    uint16_t clear, reg;
+    uint16_t reg;
 
-    saddr = addr - PHYS_JJ_LE;
+    saddr = addr - s->paddr;
     switch (saddr >> 1) {
     case LE_RDP:
 	switch(s->addr) {
@@ -406,14 +402,12 @@ static void lance_send(void *opaque)
     }
 }
 
-static int ledma_io_memory;
-
 static uint32_t ledma_mem_readl(void *opaque, target_phys_addr_t addr)
 {
     LEDMAState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_LEDMA) >> 2;
+    saddr = (addr - s->addr) >> 2;
     if (saddr < LEDMA_REGS)
 	return s->regs[saddr];
     else
@@ -425,7 +419,7 @@ static void ledma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val
     LEDMAState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_LEDMA) >> 2;
+    saddr = (addr - s->addr) >> 2;
     if (saddr < LEDMA_REGS)
 	s->regs[saddr] = val;
 }
@@ -442,29 +436,31 @@ static CPUWriteMemoryFunc *ledma_mem_write[3] = {
     ledma_mem_writel,
 };
 
-void lance_init(NetDriverState *nd, int irq)
+void lance_init(NetDriverState *nd, int irq, uint32_t leaddr, uint32_t ledaddr)
 {
     LANCEState *s;
     LEDMAState *led;
+    int lance_io_memory, ledma_io_memory;
 
     s = qemu_mallocz(sizeof(LANCEState));
     if (!s)
         return;
 
+    s->paddr = leaddr;
+    s->nd = nd;
+    s->irq = irq;
+
     lance_io_memory = cpu_register_io_memory(0, lance_mem_read, lance_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_LE, 8,
-                                 lance_io_memory);
+    cpu_register_physical_memory(leaddr, 8, lance_io_memory);
+
     led = qemu_mallocz(sizeof(LEDMAState));
     if (!led)
         return;
 
-    ledma_io_memory = cpu_register_io_memory(0, ledma_mem_read, ledma_mem_write, led);
-    cpu_register_physical_memory(PHYS_JJ_LEDMA, 16,
-                                 ledma_io_memory);
-
-    s->nd = nd;
     s->ledma = led;
-    s->irq = irq;
+    led->addr = ledaddr;
+    ledma_io_memory = cpu_register_io_memory(0, ledma_mem_read, ledma_mem_write, led);
+    cpu_register_physical_memory(ledaddr, 16, ledma_io_memory);
 
     lance_reset(s);
     qemu_add_read_packet(nd, lance_can_receive, lance_receive, s);
diff --git a/hw/m48t08.c b/hw/m48t08.c
index c5b6e7a7280..46ec665570d 100644
--- a/hw/m48t08.c
+++ b/hw/m48t08.c
@@ -341,7 +341,7 @@ static CPUReadMemoryFunc *nvram_read[] = {
 };
 
 /* Initialisation routine */
-m48t08_t *m48t08_init(uint32_t mem_base, uint16_t size)
+m48t08_t *m48t08_init(uint32_t mem_base, uint16_t size, uint8_t *macaddr)
 {
     m48t08_t *s;
     int i;
@@ -367,7 +367,7 @@ m48t08_t *m48t08_init(uint32_t mem_base, uint16_t size)
     i = 0x1fd8;
     s->buffer[i++] = 0x01;
     s->buffer[i++] = 0x80; /* Sun4m OBP */
-    /* XXX: Ethernet address, etc */
+    memcpy(&s->buffer[i], macaddr, 6);
 
     /* Calculate checksum */
     for (i = 0x1fd8; i < 0x1fe7; i++) {
diff --git a/hw/m48t08.h b/hw/m48t08.h
index 2a754b698e6..9b44bc0d160 100644
--- a/hw/m48t08.h
+++ b/hw/m48t08.h
@@ -7,6 +7,6 @@ void m48t08_write (m48t08_t *NVRAM, uint32_t val);
 uint32_t m48t08_read (m48t08_t *NVRAM);
 void m48t08_set_addr (m48t08_t *NVRAM, uint32_t addr);
 void m48t08_toggle_lock (m48t08_t *NVRAM, int lock);
-m48t08_t *m48t08_init(uint32_t mem_base, uint16_t size);
+m48t08_t *m48t08_init(uint32_t mem_base, uint16_t size, uint8_t *macaddr);
 
 #endif /* !defined (__M48T08_H__) */
diff --git a/hw/magic-load.c b/hw/magic-load.c
index 7365183da28..06a5f743af6 100644
--- a/hw/magic-load.c
+++ b/hw/magic-load.c
@@ -1,41 +1,12 @@
-/* This is the Linux kernel elf-loading code, ported into user space */
 #include "vl.h"
 #include "disas.h"
 
-/* XXX: this code is not used as it is under the GPL license. Please
-   remove or recode it */
-//#define USE_ELF_LOADER
-
-#ifdef USE_ELF_LOADER
-/* should probably go in elf.h */
-#ifndef ELIBBAD
-#define ELIBBAD 80
-#endif
-
-
-#define ELF_START_MMAP 0x80000000
-
-#define elf_check_arch(x) ( (x) == EM_SPARC )
-
 #define ELF_CLASS   ELFCLASS32
 #define ELF_DATA    ELFDATA2MSB
 #define ELF_ARCH    EM_SPARC
 
 #include "elf.h"
 
-/*
- * This structure is used to hold the arguments that are 
- * used when loading binaries.
- */
-struct linux_binprm {
-        char buf[128];
-	int fd;
-};
-
-#define TARGET_ELF_EXEC_PAGESIZE TARGET_PAGE_SIZE
-#define TARGET_ELF_PAGESTART(_v) ((_v) & ~(unsigned long)(TARGET_ELF_EXEC_PAGESIZE-1))
-#define TARGET_ELF_PAGEOFFSET(_v) ((_v) & (TARGET_ELF_EXEC_PAGESIZE-1))
-
 #ifdef BSWAP_NEEDED
 static void bswap_ehdr(Elf32_Ehdr *ehdr)
 {
@@ -87,186 +58,192 @@ static void bswap_sym(Elf32_Sym *sym)
     bswap32s(&sym->st_size);
     bswap16s(&sym->st_shndx);
 }
+#else
+#define bswap_ehdr(e) do { } while (0)
+#define bswap_phdr(e) do { } while (0)
+#define bswap_shdr(e) do { } while (0)
+#define bswap_sym(e) do { } while (0)
 #endif
 
-static int prepare_binprm(struct linux_binprm *bprm)
+static int find_phdr(struct elfhdr *ehdr, int fd, struct elf_phdr *phdr, uint32_t type)
 {
-    int retval;
-
-    memset(bprm->buf, 0, sizeof(bprm->buf));
-    retval = lseek(bprm->fd, 0L, SEEK_SET);
-    if(retval >= 0) {
-        retval = read(bprm->fd, bprm->buf, 128);
-    }
-    if(retval < 0) {
-	perror("prepare_binprm");
-	exit(-1);
-	/* return(-errno); */
-    }
-    else {
-	return(retval);
+    int i, retval;
+
+    retval = lseek(fd, ehdr->e_phoff, SEEK_SET);
+    if (retval < 0)
+	return -1;
+
+    for (i = 0; i < ehdr->e_phnum; i++) {
+	retval = read(fd, phdr, sizeof(*phdr));
+	if (retval < 0)
+	    return -1;
+	bswap_phdr(phdr);
+	if (phdr->p_type == type)
+	    return 0;
     }
+    return -1;
 }
 
-/* Best attempt to load symbols from this ELF object. */
-static void load_symbols(struct elfhdr *hdr, int fd)
+static void *find_shdr(struct elfhdr *ehdr, int fd, struct elf_shdr *shdr, uint32_t type)
 {
-    unsigned int i;
-    struct elf_shdr sechdr, symtab, strtab;
-    char *strings;
-
-    lseek(fd, hdr->e_shoff, SEEK_SET);
-    for (i = 0; i < hdr->e_shnum; i++) {
-	if (read(fd, &sechdr, sizeof(sechdr)) != sizeof(sechdr))
-	    return;
-#ifdef BSWAP_NEEDED
-	bswap_shdr(&sechdr);
-#endif
-	if (sechdr.sh_type == SHT_SYMTAB) {
-	    symtab = sechdr;
-	    lseek(fd, hdr->e_shoff
-		  + sizeof(sechdr) * sechdr.sh_link, SEEK_SET);
-	    if (read(fd, &strtab, sizeof(strtab))
-		!= sizeof(strtab))
-		return;
-#ifdef BSWAP_NEEDED
-	    bswap_shdr(&strtab);
-#endif
-	    goto found;
-	}
+    int i, retval;
+
+    retval = lseek(fd, ehdr->e_shoff, SEEK_SET);
+    if (retval < 0)
+	return NULL;
+
+    for (i = 0; i < ehdr->e_shnum; i++) {
+	retval = read(fd, shdr, sizeof(*shdr));
+	if (retval < 0)
+	    return NULL;
+	bswap_shdr(shdr);
+	if (shdr->sh_type == type)
+	    return qemu_malloc(shdr->sh_size);
     }
-    return; /* Shouldn't happen... */
-
- found:
-    /* Now know where the strtab and symtab are.  Snarf them. */
-    disas_symtab = qemu_malloc(symtab.sh_size);
-    disas_strtab = strings = qemu_malloc(strtab.sh_size);
-    if (!disas_symtab || !disas_strtab)
-	return;
-	
-    lseek(fd, symtab.sh_offset, SEEK_SET);
-    if (read(fd, disas_symtab, symtab.sh_size) != symtab.sh_size)
-	return;
+    return NULL;
+}
 
-#ifdef BSWAP_NEEDED
-    for (i = 0; i < symtab.sh_size / sizeof(struct elf_sym); i++)
-	bswap_sym(disas_symtab + sizeof(struct elf_sym)*i);
-#endif
+static int find_strtab(struct elfhdr *ehdr, int fd, struct elf_shdr *shdr, struct elf_shdr *symtab)
+{
+    int retval;
 
-    lseek(fd, strtab.sh_offset, SEEK_SET);
-    if (read(fd, strings, strtab.sh_size) != strtab.sh_size)
-	return;
-    disas_num_syms = symtab.sh_size / sizeof(struct elf_sym);
+    retval = lseek(fd, ehdr->e_shoff + sizeof(struct elf_shdr) * symtab->sh_link, SEEK_SET);
+    if (retval < 0)
+	return -1;
+
+    retval = read(fd, shdr, sizeof(*shdr));
+    if (retval < 0)
+	return -1;
+    bswap_shdr(shdr);
+    if (shdr->sh_type == SHT_STRTAB)
+	return qemu_malloc(shdr->sh_size);;
+    return 0;
 }
 
-static int load_elf_binary(struct linux_binprm * bprm, uint8_t *addr)
+static int read_program(int fd, struct elf_phdr *phdr, void *dst)
 {
-    struct elfhdr elf_ex;
-    unsigned long startaddr = addr;
-    int i;
-    struct elf_phdr * elf_ppnt;
-    struct elf_phdr *elf_phdata;
     int retval;
+    retval = lseek(fd, 0x4000, SEEK_SET);
+    if (retval < 0)
+	return -1;
+    return read(fd, dst, phdr->p_filesz);
+}
 
-    elf_ex = *((struct elfhdr *) bprm->buf);          /* exec-header */
-#ifdef BSWAP_NEEDED
-    bswap_ehdr(&elf_ex);
-#endif
+static int read_section(int fd, struct elf_shdr *s, void *dst)
+{
+    int retval;
 
-    if (elf_ex.e_ident[0] != 0x7f ||
-	strncmp(&elf_ex.e_ident[1], "ELF",3) != 0) {
-	return  -ENOEXEC;
-    }
+    retval = lseek(fd, s->sh_offset, SEEK_SET);
+    if (retval < 0)
+	return -1;
+    retval = read(fd, dst, s->sh_size);
+    if (retval < 0)
+	return -1;
+    return 0;
+}
 
-    /* First of all, some simple consistency checks */
-    if (! elf_check_arch(elf_ex.e_machine)) {
-	return -ENOEXEC;
-    }
+static void *process_section(struct elfhdr *ehdr, int fd, struct elf_shdr *shdr, uint32_t type)
+{
+    void *dst;
+
+    dst = find_shdr(ehdr, fd, shdr, type);
+    if (!dst)
+	goto error;
+
+    if (read_section(fd, shdr, dst))
+	goto error;
+    return dst;
+ error:
+    qemu_free(dst);
+    return NULL;
+}
 
-    /* Now read in all of the header information */
-    elf_phdata = (struct elf_phdr *)qemu_malloc(elf_ex.e_phentsize*elf_ex.e_phnum);
-    if (elf_phdata == NULL) {
-	return -ENOMEM;
-    }
+static void *process_strtab(struct elfhdr *ehdr, int fd, struct elf_shdr *shdr, struct elf_shdr *symtab)
+{
+    void *dst;
+
+    dst = find_strtab(ehdr, fd, shdr, symtab);
+    if (!dst)
+	goto error;
+
+    if (read_section(fd, shdr, dst))
+	goto error;
+    return dst;
+ error:
+    qemu_free(dst);
+    return NULL;
+}
 
-    retval = lseek(bprm->fd, elf_ex.e_phoff, SEEK_SET);
-    if(retval > 0) {
-	retval = read(bprm->fd, (char *) elf_phdata, 
-				elf_ex.e_phentsize * elf_ex.e_phnum);
-    }
+static void load_symbols(struct elfhdr *ehdr, int fd)
+{
+    struct elf_shdr symtab, strtab;
+    struct elf_sym *syms;
+    int nsyms, i;
+    char *str;
+
+    /* Symbol table */
+    syms = process_section(ehdr, fd, &symtab, SHT_SYMTAB);
+    if (!syms)
+	return;
 
-    if (retval < 0) {
-	perror("load_elf_binary");
-	exit(-1);
-	qemu_free (elf_phdata);
-	return -errno;
-    }
+    nsyms = symtab.sh_size / sizeof(struct elf_sym);
+    for (i = 0; i < nsyms; i++)
+	bswap_sym(&syms[i]);
+
+    /* String table */
+    str = process_strtab(ehdr, fd, &strtab, &symtab);
+    if (!str)
+	goto error_freesyms;
+
+    /* Commit */
+    if (disas_symtab)
+	qemu_free(disas_symtab); /* XXX Merge with old symbols? */
+    if (disas_strtab)
+	qemu_free(disas_strtab);
+    disas_symtab = syms;
+    disas_num_syms = nsyms;
+    disas_strtab = str;
+    return;
+ error_freesyms:
+    qemu_free(syms);
+    return;
+}
 
-#ifdef BSWAP_NEEDED
-    elf_ppnt = elf_phdata;
-    for (i=0; i<elf_ex.e_phnum; i++, elf_ppnt++) {
-        bswap_phdr(elf_ppnt);
-    }
-#endif
-    elf_ppnt = elf_phdata;
-
-    /* Now we do a little grungy work by mmaping the ELF image into
-     * the correct location in memory.  At this point, we assume that
-     * the image should be loaded at fixed address, not at a variable
-     * address.
-     */
-
-    for(i = 0, elf_ppnt = elf_phdata; i < elf_ex.e_phnum; i++, elf_ppnt++) {
-        unsigned long error, offset, len;
-        
-	if (elf_ppnt->p_type != PT_LOAD)
-            continue;
-#if 0        
-        error = target_mmap(TARGET_ELF_PAGESTART(load_bias + elf_ppnt->p_vaddr),
-                            elf_prot,
-                            (MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE),
-                            bprm->fd,
-                            (elf_ppnt->p_offset - 
-                             TARGET_ELF_PAGEOFFSET(elf_ppnt->p_vaddr)));
-#endif
-	//offset = elf_ppnt->p_offset - TARGET_ELF_PAGEOFFSET(elf_ppnt->p_vaddr);
-	offset = 0x4000;
-	lseek(bprm->fd, offset, SEEK_SET);
-	len = elf_ppnt->p_filesz + TARGET_ELF_PAGEOFFSET(elf_ppnt->p_vaddr);
-	error = read(bprm->fd, addr, len); 
-
-        if (error == -1) {
-            perror("mmap");
-            exit(-1);
-        }
-	addr += len;
-    }
+int load_elf(const char * filename, uint8_t *addr)
+{
+    struct elfhdr ehdr;
+    struct elf_phdr phdr;
+    int retval, fd;
 
-    qemu_free(elf_phdata);
+    fd = open(filename, O_RDONLY | O_BINARY);
+    if (fd < 0)
+	goto error;
 
-    load_symbols(&elf_ex, bprm->fd);
+    retval = read(fd, &ehdr, sizeof(ehdr));
+    if (retval < 0)
+	goto error;
 
-    return addr-startaddr;
-}
+    bswap_ehdr(&ehdr);
 
-int elf_exec(const char * filename, uint8_t *addr)
-{
-        struct linux_binprm bprm;
-        int retval;
+    if (ehdr.e_ident[0] != 0x7f || ehdr.e_ident[1] != 'E'
+	|| ehdr.e_ident[2] != 'L' || ehdr.e_ident[3] != 'F'
+	|| ehdr.e_machine != EM_SPARC)
+	goto error;
 
-        retval = open(filename, O_RDONLY);
-        if (retval < 0)
-            return retval;
-        bprm.fd = retval;
+    if (find_phdr(&ehdr, fd, &phdr, PT_LOAD))
+	goto error;
+    retval = read_program(fd, &phdr, addr);
+    if (retval < 0)
+	goto error;
 
-        retval = prepare_binprm(&bprm);
+    load_symbols(&ehdr, fd);
 
-        if(retval>=0) {
-	    retval = load_elf_binary(&bprm, addr);
-	}
-	return retval;
+    close(fd);
+    return retval;
+ error:
+    close(fd);
+    return -1;
 }
-#endif
 
 int load_kernel(const char *filename, uint8_t *addr)
 {
@@ -286,28 +263,31 @@ int load_kernel(const char *filename, uint8_t *addr)
     return -1;
 }
 
-static char saved_kfn[1024];
-static uint32_t saved_addr;
-static int magic_state;
+typedef struct MAGICState {
+    uint32_t addr;
+    uint32_t saved_addr;
+    int magic_state;
+    char saved_kfn[1024];
+} MAGICState;
 
 static uint32_t magic_mem_readl(void *opaque, target_phys_addr_t addr)
 {
     int ret;
+    MAGICState *s = opaque;
 
-    if (magic_state == 0) {
-#ifdef USE_ELF_LOADER
-        ret = elf_exec(saved_kfn, saved_addr);
-#else
-        ret = load_kernel(saved_kfn, (uint8_t *)saved_addr);
-#endif
+    if (s->magic_state == 0) {
+        ret = load_elf(s->saved_kfn, (uint8_t *)s->saved_addr);
+	if (ret < 0)
+	    ret = load_kernel(s->saved_kfn, (uint8_t *)s->saved_addr);
         if (ret < 0) {
             fprintf(stderr, "qemu: could not load kernel '%s'\n", 
-                    saved_kfn);
+                    s->saved_kfn);
         }
-	magic_state = 1; /* No more magic */
+	s->magic_state = 1; /* No more magic */
 	tb_flush();
+	return bswap32(ret);
     }
-    return ret;
+    return 0;
 }
 
 static void magic_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
@@ -327,15 +307,20 @@ static CPUWriteMemoryFunc *magic_mem_write[3] = {
     magic_mem_writel,
 };
 
-void magic_init(const char *kfn, int kloadaddr)
+void magic_init(const char *kfn, int kloadaddr, uint32_t addr)
 {
     int magic_io_memory;
-
-    strcpy(saved_kfn, kfn);
-    saved_addr = kloadaddr;
-    magic_state = 0;
-    magic_io_memory = cpu_register_io_memory(0, magic_mem_read, magic_mem_write, 0);
-    cpu_register_physical_memory(0x20000000, 4,
-                                 magic_io_memory);
+    MAGICState *s;
+
+    s = qemu_mallocz(sizeof(MAGICState));
+    if (!s)
+        return;
+
+    strcpy(s->saved_kfn, kfn);
+    s->saved_addr = kloadaddr;
+    s->magic_state = 0;
+    s->addr = addr;
+    magic_io_memory = cpu_register_io_memory(0, magic_mem_read, magic_mem_write, s);
+    cpu_register_physical_memory(addr, 4, magic_io_memory);
 }
 
diff --git a/hw/sched.c b/hw/sched.c
index c9a685d44a2..2ab966de4c3 100644
--- a/hw/sched.c
+++ b/hw/sched.c
@@ -1,5 +1,5 @@
 /*
- * QEMU interrupt controller & timer emulation
+ * QEMU interrupt controller emulation
  * 
  * Copyright (c) 2003-2004 Fabrice Bellard
  * 
@@ -22,11 +22,7 @@
  * THE SOFTWARE.
  */
 #include "vl.h"
-
-#define PHYS_JJ_CLOCK	0x71D00000
-#define PHYS_JJ_CLOCK1	0x71D10000
-#define PHYS_JJ_INTR0	0x71E00000	/* CPU0 interrupt control registers */
-#define PHYS_JJ_INTR_G	0x71E10000	/* Master interrupt control registers */
+//#define DEBUG_IRQ_COUNT
 
 /* These registers are used for sending/receiving irqs from/to
  * different cpu's.
@@ -63,18 +59,6 @@ struct sun4m_intreg_master {
 	/* This register is both READ and WRITE. */
 	unsigned int undirected_target;  /* Which cpu gets undirected irqs. */
 };
-/*
- * Registers of hardware timer in sun4m.
- */
-struct sun4m_timer_percpu {
-	volatile unsigned int l14_timer_limit; /* Initial value is 0x009c4000 */
-	volatile unsigned int l14_cur_count;
-};
-
-struct sun4m_timer_global {
-        volatile unsigned int l10_timer_limit;
-        volatile unsigned int l10_cur_count;
-};
 
 #define SUN4M_INT_ENABLE        0x80000000
 #define SUN4M_INT_E14           0x00000080
@@ -101,29 +85,25 @@ struct sun4m_timer_global {
 #define SUN4M_INT_VME(x)        (1 << (x))
 
 typedef struct SCHEDState {
+    uint32_t addr, addrg;
     uint32_t intreg_pending;
     uint32_t intreg_enabled;
     uint32_t intregm_pending;
     uint32_t intregm_enabled;
-    uint32_t timer_regs[2];
-    uint32_t timerm_regs[2];
 } SCHEDState;
 
 static SCHEDState *ps;
 
-static int intreg_io_memory, intregm_io_memory,
-    timer_io_memory, timerm_io_memory;
-
-static void sched_reset(SCHEDState *s)
-{
-}
+#ifdef DEBUG_IRQ_COUNT
+static uint64_t irq_count[32];
+#endif
 
 static uint32_t intreg_mem_readl(void *opaque, target_phys_addr_t addr)
 {
     SCHEDState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_INTR0) >> 2;
+    saddr = (addr - s->addr) >> 2;
     switch (saddr) {
     case 0:
 	return s->intreg_pending;
@@ -139,7 +119,7 @@ static void intreg_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t va
     SCHEDState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_INTR0) >> 2;
+    saddr = (addr - s->addr) >> 2;
     switch (saddr) {
     case 0:
 	s->intreg_pending = val;
@@ -172,7 +152,7 @@ static uint32_t intregm_mem_readl(void *opaque, target_phys_addr_t addr)
     SCHEDState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_INTR_G) >> 2;
+    saddr = (addr - s->addrg) >> 2;
     switch (saddr) {
     case 0:
 	return s->intregm_pending;
@@ -191,7 +171,7 @@ static void intregm_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t v
     SCHEDState *s = opaque;
     uint32_t saddr;
 
-    saddr = (addr - PHYS_JJ_INTR_G) >> 2;
+    saddr = (addr - s->addrg) >> 2;
     switch (saddr) {
     case 0:
 	s->intregm_pending = val;
@@ -222,87 +202,29 @@ static CPUWriteMemoryFunc *intregm_mem_write[3] = {
     intregm_mem_writel,
 };
 
-static uint32_t timer_mem_readl(void *opaque, target_phys_addr_t addr)
+void pic_info(void)
 {
-    SCHEDState *s = opaque;
-    uint32_t saddr;
-
-    saddr = (addr - PHYS_JJ_CLOCK) >> 2;
-    switch (saddr) {
-    default:
-	return s->timer_regs[saddr];
-	break;
-    }
-    return 0;
+    term_printf("per-cpu: pending 0x%08x, enabled 0x%08x\n", ps->intreg_pending, ps->intreg_enabled);
+    term_printf("master: pending 0x%08x, enabled 0x%08x\n", ps->intregm_pending, ps->intregm_enabled);
 }
 
-static void timer_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
+void irq_info(void)
 {
-    SCHEDState *s = opaque;
-    uint32_t saddr;
-
-    saddr = (addr - PHYS_JJ_CLOCK) >> 2;
-    switch (saddr) {
-    default:
-	s->timer_regs[saddr] = val;
-	break;
+#ifndef DEBUG_IRQ_COUNT
+    term_printf("irq statistic code not compiled.\n");
+#else
+    int i;
+    int64_t count;
+
+    term_printf("IRQ statistics:\n");
+    for (i = 0; i < 32; i++) {
+        count = irq_count[i];
+        if (count > 0)
+            term_printf("%2d: %lld\n", i, count);
     }
+#endif
 }
 
-static CPUReadMemoryFunc *timer_mem_read[3] = {
-    timer_mem_readl,
-    timer_mem_readl,
-    timer_mem_readl,
-};
-
-static CPUWriteMemoryFunc *timer_mem_write[3] = {
-    timer_mem_writel,
-    timer_mem_writel,
-    timer_mem_writel,
-};
-
-static uint32_t timerm_mem_readl(void *opaque, target_phys_addr_t addr)
-{
-    SCHEDState *s = opaque;
-    uint32_t saddr;
-
-    saddr = (addr - PHYS_JJ_CLOCK1) >> 2;
-    switch (saddr) {
-    default:
-	return s->timerm_regs[saddr];
-	break;
-    }
-    return 0;
-}
-
-static void timerm_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
-{
-    SCHEDState *s = opaque;
-    uint32_t saddr;
-
-    saddr = (addr - PHYS_JJ_CLOCK1) >> 2;
-    switch (saddr) {
-    default:
-	s->timerm_regs[saddr] = val;
-	break;
-    }
-}
-
-static CPUReadMemoryFunc *timerm_mem_read[3] = {
-    timerm_mem_readl,
-    timerm_mem_readl,
-    timerm_mem_readl,
-};
-
-static CPUWriteMemoryFunc *timerm_mem_write[3] = {
-    timerm_mem_writel,
-    timerm_mem_writel,
-    timerm_mem_writel,
-};
-
-void pic_info() {}
-void irq_info() {}
-
 static const unsigned int intr_to_mask[16] = {
 	0,	0,	0,	0,	0,	0, SUN4M_INT_ETHERNET,	0,
 	0,	0,	0,	0,	0,	0,	0,	0,
@@ -318,29 +240,29 @@ void pic_set_irq(int irq, int level)
 	    cpu_interrupt(cpu_single_env, CPU_INTERRUPT_HARD);
 	}
     }
+#ifdef DEBUG_IRQ_COUNT
+    if (level == 1)
+	irq_count[irq]++;
+#endif
 }
 
-void sched_init()
+void sched_init(uint32_t addr, uint32_t addrg)
 {
+    int intreg_io_memory, intregm_io_memory;
     SCHEDState *s;
 
     s = qemu_mallocz(sizeof(SCHEDState));
     if (!s)
         return;
+    s->addr = addr;
+    s->addrg = addrg;
 
     intreg_io_memory = cpu_register_io_memory(0, intreg_mem_read, intreg_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_INTR0, 3, intreg_io_memory);
+    cpu_register_physical_memory(addr, 3, intreg_io_memory);
 
     intregm_io_memory = cpu_register_io_memory(0, intregm_mem_read, intregm_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_INTR_G, 5, intregm_io_memory);
-
-    timer_io_memory = cpu_register_io_memory(0, timer_mem_read, timer_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_CLOCK, 2, timer_io_memory);
-
-    timerm_io_memory = cpu_register_io_memory(0, timerm_mem_read, timerm_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_CLOCK1, 2, timerm_io_memory);
+    cpu_register_physical_memory(addrg, 5, intregm_io_memory);
 
-    sched_reset(s);
     ps = s;
 }
 
diff --git a/hw/sun4m.c b/hw/sun4m.c
index 05dbd56a5fa..80305e09c39 100644
--- a/hw/sun4m.c
+++ b/hw/sun4m.c
@@ -28,12 +28,26 @@
 #define MMU_CONTEXT_TBL      0x00003000
 #define MMU_L1PTP            (MMU_CONTEXT_TBL + 0x0400)
 #define MMU_L2PTP            (MMU_CONTEXT_TBL + 0x0800)
-#define ROMVEC_DATA          (MMU_CONTEXT_TBL + 0x1800)
 #define PROM_ADDR	     0xffd04000
-#define PROM_FILENAME	     "proll.bin"
+#define PROM_FILENAMEB	     "proll.bin"
+#define PROM_FILENAMEE	     "proll.elf"
+#define PROLL_MAGIC_ADDR 0x20000000
 #define PHYS_JJ_EEPROM	0x71200000	/* [2000] MK48T08 */
 #define PHYS_JJ_IDPROM_OFF	0x1FD8
 #define PHYS_JJ_EEPROM_SIZE	0x2000
+#define PHYS_JJ_IOMMU	0x10000000	/* First page of sun4m IOMMU */
+#define PHYS_JJ_TCX_FB	0x50800000	/* Start address, frame buffer body */
+#define PHYS_JJ_TCX_0E	0x5E000000	/* Top address, one byte used. */
+#define PHYS_JJ_IOMMU	0x10000000	/* First page of sun4m IOMMU */
+#define PHYS_JJ_LEDMA   0x78400010      /* ledma, off by 10 from unused SCSI */
+#define PHYS_JJ_LE      0x78C00000      /* LANCE, typical sun4m */
+#define PHYS_JJ_LE_IRQ  6
+#define PHYS_JJ_CLOCK	0x71D00000
+#define PHYS_JJ_CLOCK_IRQ  10
+#define PHYS_JJ_CLOCK1	0x71D10000
+#define PHYS_JJ_CLOCK1_IRQ  14
+#define PHYS_JJ_INTR0	0x71E00000	/* CPU0 interrupt control registers */
+#define PHYS_JJ_INTR_G	0x71E10000	/* Master interrupt control registers */
 
 /* TSC handling */
 
@@ -44,8 +58,6 @@ uint64_t cpu_get_tsc()
 
 void DMA_run() {}
 void SB16_run() {}
-void vga_invalidate_display() {}
-void vga_screen_dump(const char *filename) {}
 int serial_can_receive(SerialState *s) { return 0; }
 void serial_receive_byte(SerialState *s, int ch) {}
 void serial_receive_break(SerialState *s) {}
@@ -59,7 +71,7 @@ void sun4m_init(int ram_size, int vga_ram_size, int boot_device,
              const char *initrd_filename)
 {
     char buf[1024];
-    int ret, linux_boot, bios_size;
+    int ret, linux_boot;
     unsigned long bios_offset;
 
     linux_boot = (kernel_filename != NULL);
@@ -68,32 +80,21 @@ void sun4m_init(int ram_size, int vga_ram_size, int boot_device,
     cpu_register_physical_memory(0, ram_size, 0);
     bios_offset = ram_size;
 
-    iommu_init();
-    sched_init();
-    tcx_init(ds);
-    lance_init(&nd_table[0], 6);
-    nvram = m48t08_init(PHYS_JJ_EEPROM, PHYS_JJ_EEPROM_SIZE);
-
-    magic_init(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR);
-
-#if 0
-    snprintf(buf, sizeof(buf), "%s/%s", bios_dir, PROM_FILENAME);
-    bios_size = get_image_size(buf);
-    ret = load_image(buf, phys_ram_base + bios_offset);
-    if (ret != bios_size) {
-        fprintf(stderr, "qemu: could not load prom '%s'\n", buf);
-        exit(1);
-    }
-    cpu_register_physical_memory(PROM_ADDR, 
-                                 bios_size, bios_offset | IO_MEM_ROM);
-#endif
+    iommu_init(PHYS_JJ_IOMMU);
+    sched_init(PHYS_JJ_INTR0, PHYS_JJ_INTR_G);
+    tcx_init(ds, PHYS_JJ_TCX_FB);
+    lance_init(&nd_table[0], PHYS_JJ_LE_IRQ, PHYS_JJ_LE, PHYS_JJ_LEDMA);
+    nvram = m48t08_init(PHYS_JJ_EEPROM, PHYS_JJ_EEPROM_SIZE, &nd_table[0].macaddr);
+    timer_init(PHYS_JJ_CLOCK, PHYS_JJ_CLOCK_IRQ);
+    timer_init(PHYS_JJ_CLOCK1, PHYS_JJ_CLOCK1_IRQ);
+    magic_init(kernel_filename, phys_ram_base + KERNEL_LOAD_ADDR, PROLL_MAGIC_ADDR);
 
     /* We load Proll as the kernel and start it. It will issue a magic
        IO to load the real kernel */
     if (linux_boot) {
-	snprintf(buf, sizeof(buf), "%s/%s", bios_dir, PROM_FILENAME);
+	snprintf(buf, sizeof(buf), "%s/%s", bios_dir, PROM_FILENAMEB);
         ret = load_kernel(buf, 
-                          phys_ram_base + KERNEL_LOAD_ADDR);
+		       phys_ram_base + KERNEL_LOAD_ADDR);
         if (ret < 0) {
             fprintf(stderr, "qemu: could not load kernel '%s'\n", 
                     buf);
@@ -103,28 +104,10 @@ void sun4m_init(int ram_size, int vga_ram_size, int boot_device,
     /* Setup a MMU entry for entire address space */
     stl_raw(phys_ram_base + MMU_CONTEXT_TBL, (MMU_L1PTP >> 4) | 1);
     stl_raw(phys_ram_base + MMU_L1PTP, (MMU_L2PTP >> 4) | 1);
-#if 0
-    stl_raw(phys_ram_base + MMU_L1PTP + (0x50 << 2), (MMU_L2PTP >> 4) | 1); // frame buffer at 50..
-#endif
+    stl_raw(phys_ram_base + MMU_L1PTP + (0x01 << 2), (MMU_L2PTP >> 4) | 1); // 01.. == 00..
     stl_raw(phys_ram_base + MMU_L1PTP + (0xff << 2), (MMU_L2PTP >> 4) | 1); // ff.. == 00..
+    stl_raw(phys_ram_base + MMU_L1PTP + (0xf0 << 2), (MMU_L2PTP >> 4) | 1); // f0.. == 00..
     /* 3 = U:RWX S:RWX */
     stl_raw(phys_ram_base + MMU_L2PTP, (3 << PTE_ACCESS_SHIFT) | 2);
-#if 0
-    stl_raw(phys_ram_base + MMU_L2PTP + 0x84, (PHYS_JJ_TCX_FB >> 4) \
-	    | (3 << PTE_ACCESS_SHIFT) | 2); // frame buf
-    stl_raw(phys_ram_base + MMU_L2PTP + 0x88, (PHYS_JJ_TCX_FB >> 4) \
-	    | (3 << PTE_ACCESS_SHIFT) | 2); // frame buf
-    stl_raw(phys_ram_base + MMU_L2PTP + 0x140, (PHYS_JJ_TCX_FB >> 4) \
-	    | (3 << PTE_ACCESS_SHIFT) | 2); // frame buf
-    // "Empirical constant"
-    stl_raw(phys_ram_base + ROMVEC_DATA, 0x10010407);
-
-    // Version: V3 prom
-    stl_raw(phys_ram_base + ROMVEC_DATA + 4, 3);
-
-    stl_raw(phys_ram_base + ROMVEC_DATA + 0x1c, ROMVEC_DATA+0x400);
-    stl_raw(phys_ram_base + ROMVEC_DATA + 0x400, ROMVEC_DATA+0x404);
-    stl_raw(phys_ram_base + ROMVEC_DATA + 0x404, 0x81c3e008); // retl
-    stl_raw(phys_ram_base + ROMVEC_DATA + 0x408, 0x01000000); // nop
-#endif
+    stl_raw(phys_ram_base + MMU_L2PTP, ((0x01 << PTE_PPN_SHIFT) >> 4 ) | (3 << PTE_ACCESS_SHIFT) | 2);
 }
diff --git a/hw/tcx.c b/hw/tcx.c
index d9b91c68fff..7f979946fc9 100644
--- a/hw/tcx.c
+++ b/hw/tcx.c
@@ -23,9 +23,6 @@
  */
 #include "vl.h"
 
-#define PHYS_JJ_TCX_FB	0x50800000	/* Start address, frame buffer body */
-#define PHYS_JJ_TCX_0E	0x5E000000	/* Top address, one byte used. */
-
 #define MAXX 1024
 #define MAXY 768
 #define XSZ (8*80)
@@ -33,38 +30,32 @@
 #define XOFF (MAXX-XSZ)
 #define YOFF (MAXY-YSZ)
 
-#define DEBUG_VGA_MEM
-
 typedef struct TCXState {
-    uint8_t *vram_ptr;
-    unsigned long vram_offset;
-    unsigned int vram_size;
+    uint32_t addr;
     DisplayState *ds;
+    uint8_t *vram;
 } TCXState;
 
 static TCXState *ts;
 
-static int tcx_io_memory;
-
 void vga_update_display()
 {
     dpy_update(ts->ds, 0, 0, XSZ, YSZ);
 }
 
+void vga_invalidate_display() {}
+
 static uint32_t tcx_mem_readb(void *opaque, target_phys_addr_t addr)
 {
     TCXState *s = opaque;
     uint32_t saddr;
     unsigned int x, y;
-    char *sptr;
 
-    saddr = addr - PHYS_JJ_TCX_FB - YOFF*MAXX - XOFF;
+    saddr = addr - s->addr - YOFF*MAXX - XOFF;
     y = saddr / MAXX;
     x = saddr - y * MAXX;
-    if (x < MAXX && y < MAXY) {
-	sptr = 	s->ds->data;
-	if (sptr)
-	    return sptr[y * s->ds->linesize + x*4];
+    if (x < XSZ && y < YSZ) {
+	return s->vram[y * XSZ + x];
     }
     return 0;
 }
@@ -99,7 +90,6 @@ static uint32_t tcx_mem_readl(void *opaque, target_phys_addr_t addr)
     return v;
 }
 
-/* called for accesses between 0xa0000 and 0xc0000 */
 static void tcx_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
 {
     TCXState *s = opaque;
@@ -107,17 +97,24 @@ static void tcx_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
     unsigned int x, y;
     char *sptr;
 
-    saddr = addr - PHYS_JJ_TCX_FB - YOFF*MAXX - XOFF;
+    saddr = addr - s->addr - YOFF*MAXX - XOFF;
     y = saddr / MAXX;
     x = saddr - y * MAXX;
-    if (x < MAXX && y < MAXY) {
+    if (x < XSZ && y < YSZ) {
 	sptr = 	s->ds->data;
 	if (sptr) {
-	    sptr[y * s->ds->linesize + x*4] = val;
-	    sptr[y * s->ds->linesize + x*4+1] = val;
-	    sptr[y * s->ds->linesize + x*4+2] = val;
-	    cpu_physical_memory_set_dirty(addr);
+	    if (s->ds->depth == 24 || s->ds->depth == 32) {
+		/* XXX need to do CLUT translation */
+		sptr[y * s->ds->linesize + x*4] = val & 0xff;
+		sptr[y * s->ds->linesize + x*4+1] = val & 0xff;
+		sptr[y * s->ds->linesize + x*4+2] = val & 0xff;
+	    }
+	    else if (s->ds->depth == 8) {
+		sptr[y * s->ds->linesize + x] = val & 0xff;
+	    }
 	}
+	cpu_physical_memory_set_dirty(addr);
+	s->vram[y * XSZ + x] = val & 0xff;
     }
 }
 
@@ -159,18 +156,52 @@ static CPUWriteMemoryFunc *tcx_mem_write[3] = {
     tcx_mem_writel,
 };
 
-void tcx_init(DisplayState *ds)
+void tcx_init(DisplayState *ds, uint32_t addr)
 {
     TCXState *s;
+    int tcx_io_memory;
 
     s = qemu_mallocz(sizeof(TCXState));
     if (!s)
         return;
     s->ds = ds;
+    s->addr = addr;
     ts = s;
     tcx_io_memory = cpu_register_io_memory(0, tcx_mem_read, tcx_mem_write, s);
-    cpu_register_physical_memory(PHYS_JJ_TCX_FB, 0x100000, 
+    cpu_register_physical_memory(addr, 0x100000, 
                                  tcx_io_memory);
+    s->vram = qemu_mallocz(XSZ*YSZ);
     dpy_resize(s->ds, XSZ, YSZ);
 }
 
+void vga_screen_dump(const char *filename)
+{
+    TCXState *s = ts;
+    FILE *f;
+    uint8_t *d, *d1;
+    unsigned int v;
+    int y, x;
+
+    f = fopen(filename, "wb");
+    if (!f)
+        return -1;
+    fprintf(f, "P6\n%d %d\n%d\n",
+            XSZ, YSZ, 255);
+    d1 = s->vram;
+    for(y = 0; y < YSZ; y++) {
+        d = d1;
+        for(x = 0; x < XSZ; x++) {
+            v = *d;
+            fputc((v) & 0xff, f);
+            fputc((v) & 0xff, f);
+            fputc((v) & 0xff, f);
+            d++;
+        }
+        d1 += XSZ;
+    }
+    fclose(f);
+    return;
+}
+
+
+
diff --git a/monitor.c b/monitor.c
index 15b54d3e712..c39f3b23912 100644
--- a/monitor.c
+++ b/monitor.c
@@ -952,11 +952,7 @@ static int monitor_get_tbl (struct MonitorDef *md, int val)
 #if defined(TARGET_SPARC)
 static int monitor_get_psr (struct MonitorDef *md, int val)
 {
-    return (0<<28) | (4<<24) | cpu_single_env->psr	\
-	| (cpu_single_env->psrs? PSR_S : 0)		\
-	| (cpu_single_env->psrs? PSR_PS : 0)		\
-	| (cpu_single_env->psret? PSR_ET : 0)		\
-	| cpu_single_env->cwp;
+    return GET_PSR(cpu_single_env);
 }
 
 static int monitor_get_reg(struct MonitorDef *md, int val)
diff --git a/pc-bios/README b/pc-bios/README
index 31f91f3ceff..a10a9f0dfa1 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -6,3 +6,8 @@
 
 - The PowerPC Open Hack'Ware Open Firmware Compatible BIOS is
   available at http://site.voila.fr/jmayer/OpenHackWare/index.htm.
+
+- Proll is a GPL'd boot PROM for Sparc JavaStations
+  (http://people.redhat.com/zaitcev/linux/).
+  Applying proll.patch allows circumventing some bugs and enables
+  faster kernel load through a hack.
diff --git a/pc-bios/proll.bin b/pc-bios/proll.bin
new file mode 100644
index 0000000000000000000000000000000000000000..0489cc245fc524bb89eb36582304617ec4ca5b59
GIT binary patch
literal 56856
zc-rl}eRx#YnJ0Ma)>Wxg6i_MzE`$PCC4m)L1|chiU>TKdY!kQb&<;sF-N{n=G{izu
zBtdY7h0CWI$D0&onb3~MDTIO<w|7RSNy4N(quNA6yxr;UvYMso?o4mBP3Q5Zy@~9`
zHUUiS?|1IGQt4QZy`5(^`$yeJrF%Z#^PczXyyxqNY_r%Sgm8by)(i361|dSW`N)3^
zS)P#Xy_}zq_$4hq@d5QGwD`Cxe^INS{eb$vhxVC&K`Vbwi)Xa>Pqp~VT6|24r?vP?
zTKtR_Kdr?_wD=2J{G=8i*5WBG{)`qss>KJjctVRmp~Vkr@%>ud*5W(0_zo>Tpv8N&
zc$XI6ti{{4czkC5d;eVV{~@jXMlHTUi{Gck*K6^0T0Ex3o3!|9E#9cb>$P~D7O&Cb
z)mq%r;uTsvqQ%R!cu0!}wYXo4n_65<j~mytxTgPxrvJu-7JoyFzplkK{Wr2&{AXHR
z(|<$Le?!xML(_jl(|<$Le?!xML(_jl(|<$Le?!xML(_jl(|<$Le?!xML(_jl(|<$L
ze?!xML(_jl(|<$Le?!xML(_jl(|<$Le?!xML(_jl(|<$Le<QBNzo^AE{WmoIH#Ge>
zH2pU;{WmoIH#Ge>H2pU;{WmoIH#Ge>H2pU;{WmoIH#Ge>H2pU;{WmoIH#Ge>H2pU;
z{WmoIH#GhCX!`Hb^xvcDzem%5kEZ_~P5(Wb{(Ch2_h|a>(e&S=>Ay$Qe~+gB9!>u}
zn*Mt<{r714@6q(%qv^j#(|?bq{~k^MJ(~V|H2wEz`tQ;7-=pcjN7H|grvDyI|2>-i
zdo=y`X!`Hb^xvcDzem%5kEZ_~P5(Wb{(Ch2_h|a>(e&S=>Ay$Qe~+gB9!>u}n*Mt<
z{r714@6q(%qv^j#(|?bq{~k^MJ(~V|H2wEz`tQ;7-=pcjN7H|grvDyI|2>-ido=wQ
zn*Iw-|AnUiLeqbt>A%qQUugO-H2oKv{tHe2g{J>P(|@7qztHqwX!<WS{TG`43r+up
zrvF0If1&BW(DYwu`Y$y77n=SHP5*_a|3cG$q3OTS^j~QDFEsrZn*Iw-|AnUiLeqbt
z>A%qQUugO-H2oKv{tHe2g{J>P(|@7qztHqwX!<WS{TG`43r+uprvF0If1&BW(DYwu
z`Y$y77n=SHP5*_a|3cG$q3OTS^j}QV|5;_0@px(5M2Tq59V)HLy?ksP%gDTan2UY0
zJ|3};W$!R-;ltZBRQ>!idqX{9&!PA<JF+)aDSl+f?0q$H^GEhNv9CUEBJ3YS_&|Ni
zJW!MJzijUp2SwYpv-X&HtUhZ#R+IHVF0vWous0+`sStiU74w&?KBQB(rw`P`J?YdQ
zd#{LxLZi7~J8e}XFBbPUUn<)hivMg++QFr?`BLLwMlG?Q`L=EE4OQVCvx|f%-XA)i
z-g7854QJF}jrzjPe@4WNmoNtfoO=@CXk=dVr31-uYZiU?N_?V1*h8YkH=4ViFf4O#
z$TIdMrqkhI$nuu}kF%AQdC<ywRM=nKd?|D=lofl9W~Y^Z4D{S{XnGpr(_|zj#HoB9
zyny~akG{Qez_x#JAZFjxd@1(){J8i<QB2t1jS29qh~*Gofbgsj;``&CxIdr&3Xb_g
z$nw0gG$w}1QexOlnR}kFrsFpj6MKGYi#<Qi`p1V%`OfTh-s7iKJgMT(tN7!l`1h}k
zrmLDSiAwM-RTe#(surbt#vGVKke^rg$L!;Ear4#v>%{TKxcR4basMYkw@(UTo(YMC
z_Hzi>Vj0Vyxlt@Swkj1#1+Cn%I?G5E$3m~}H--H~+#A+p_84HHjQ{wmRCp*DZ$=wN
z$`qwpS>BqVyycb;=9fRd$})$_;{Wy4VN;y;rOQWr=?G-<?;ZRhbHlN?!Z$>G0nf+0
zE55Y&zAtNDS%$&Hmon|=EKxR^yL#qE%XDZ_m2&B@=O<bJp4Wx=<HoG-<ZNsAf2hlP
z5H3DBU(825x92HKFrUBdqLjF}DCK{BQ7ZJtqEuvJQOdfsC{=TLQL6shqSWd=S(M}N
z1Nis#x~%W<lK5`6^L$7Yy$}+<|InEAAienU(pVYta<cy6xX9j$wr)jRx1z0E(blbK
z>sGXNE84mhZ2_OhLt_3DA+g|t+5`WOLbvuM!q#TU^naaKCUx!RM7SyoUAs9Z=DwH=
zw_UEJ{*^@|F){o1lhCn@8I9OOpc&{n<ml&elsy4BqTUw&GxarNpv-X0zrYp?PN2-q
zC<A%Ehj}N%(F(qY!%^#4UEG_PpNb?yqV!ym2m#LEdD9MM@H^aKm7Ort{vk8&$rQCp
zc+mB?S%+<+y?T^Cgu3$xJ2}5K!g51KbM7$8ykNx5q!IULi)??!i1{Hi{?g`Li0>QO
z@3QQnrL-w!Ls`J7oZtMmsFLaNoiQ<|avtR7B*Nond}pZ$LhtANuL;0OghXg}F1Hf-
z6R39s;qa&6%q1L@DMR@Xa0@LJvnHT^;fyKaK0_F)osoGci#o>q=3fiNi$TOESPwk8
z;{@Qw#0{GqyA%A0^Dg}(zS&olTY&s$2T?v168>{$)<106;imyx(I^I9hQ8I93S2Pb
zBY@rXciy;P@$6H`-?2M){Zgr)IwSn54%(dCK%UG84cOoB{KyvIJ!$awh|eRg!0!i?
z9al&4<Y^FfAun@x0I!A2Km5AzAE>oF`-Sbt*yB}i5A3tBQ)vToQgjfmD8t}!j$zs<
z_EW;GSdX@6-v^reQ%OrSU`)dJRIK_@j5d$rT`R{Oq(g=;B*16%eP1%%Vgv7UgCQ$K
zxyweQjXKV$u=P^Hq51wKZQGD+W6nsZIhS3Av1XYS#4m)OiJz1K(gQHXdDCLO=PsC5
za0Kyu*r_8a+Q?g9^$9TyJD!;n6Q_J}&*54ta(InJJqln<C{3BoIp|X{;<NE9Hq@9)
ze<S0wIPTAJ{SC&^-fh4kf_T&(CSSy-5|ZX(sY<U<>9?r(4eW#Jmk%)f7ugTr?i_uR
z4ElvJ)PuJldBJhyCk#;n*$;Az4FDenZwcWM7Qz9Bncg^>`*ZdUX*V!!WSJexr^7k)
zA8<pejnKG}3MsfH31fGTX{Z+<P0u0k2xt`(o`py8&W8iMOnWGfPK&wZ#W~<<52YBN
z#drqoocBq7ynF%u$nQ(W;i2T83zIUI0FRxwH7)MS9&E(E;j&|8m6VgR%JtCQdw|=M
ziL%z!jvQ1$4yw_2&)*(_>>w>n{T&QdzI!B8x%+6S(vQ50PluxRMaWWi8ON>G)vro9
zlJuy-JC<2))uoqPH)qTg$`@TC?G;@JuQX$j??t~HhfQN&P=|D@Mt>~)$dfYsDja=t
z`l9-9$UYH=11aXe?vwlt*(ao5S8AU~2@HdGQ_e{%`-IK(S@wx6%a<g4u|?x74_>Xd
zh4KApY$3->=&PCV*%gqTPqOYf>#8zmqOo$yJMdl@6TU~ri>%-Y*cQag5q}tQ|F9EZ
zgm@eCQ%<}B@lDJ>iujlruSQxa?K|v9_z3M#+7^H3v#Nn>1!Wn0zkxcJUNQRatB#C8
z2Ye5>FcF6x_T5XEgHF6UQ<eJS>s6^Z;MY@L$g3m8qwiAI6nsn5<3krIXP^~m5_}77
zIW&~C@{?AeVeJ$R)BalO6maBxgXs#_*>3?haRjZ(p@$_ZUWWK0#ETfmubMvY&k@G2
zI_uDqw2O?J@PVdiSBALk*IVe*McF5--jPXBn%}3VK|{SyipRl=lQNNZ`UC!=KdUGE
z^PKPp$nRoN4!j!j`Mn1GJ{^r!C>()P(XaAw1V4-Z*~Kx#zRrXv<OKXK|7g4|`WwQZ
z;%(7i=fSU@g8$KZ%l?865B;1xeoop)mv={5mbk$F-T-=eG+a)Po7sF^Mi8IY*Ps7p
zT&f8Z{_agD*$#9RbpN-C?yinDK+YCo45_EQMQpJgI$1&aSw&r2W-rv^*-70idV=^3
zPwHOLA;#$+Dc<a7{Ar82MjIsg5$2c%o|F<tjA<tO3tHTiSY}rMUjy{{)Je*;gYRcF
ze0>UEllc0jorsZ^cR6}6Bc81qp8u1E=O0KsLm!T(g7<*S7ghgW#!;4brBvCKpkt#g
zalvbuE<dPu<o$FR6lLK1J9&IxrSZKXkMGqV!1s5i%b+OBAJ@(RkMHA$Ijs00enrif
z);$Z44)1#og@)Fjot6IBX{4XR?|aKrp8fu;=kx;Gpf3SF6q}g8JhnRP!Tj8WZ&mRa
zeJhbRFsC;TT4@8}MF@NL&q?LZ6k8t1`CRbGKekeMF&6@iY=AtQ#6!eAKP(39=Q?&*
zkLF%w`^05Ga2dlGwm)RqV;INq_T%lxdlue7w@-+B#xOrW7q!gssO3K&rM*aT-0-HO
zR%j42!~<(m-m$1v2Dl3WcOAmj2$$~<rMeKVLAg37FLjAy8Pe)ydm3EAJ2wgE_{J$X
zLoejPi6EYJ;gIGTUrc1smn-PUWyhz3?3ttEzIYjaLDy%<_~N1O`_le*Fcu?RhBWwO
z@oJ8}c-L_J#=9Qx`h35_^&c)f{-b#bZM-ALb2;V*-*Vt^ERSR!u;D*=A4Izt<IQJP
z`xWEB5x$})6OOT5MZU}=d}+wK`6O&{8SSz3*QAdnN{$$!{Ji56R3rjfFJO4#TSW$=
zG5Sjp*t3#z@EekW+_iC(8{fMQy3>rd;DZHX{_(uFDA(}UEcjil7m#xgBNaKj*94!N
z#eo{TWPeTCIBTRT_Va*;T7yvi-|>1e^r1Kvhi?5Id|;u*^F`3d3e2O<KqtfW8R>T;
zy&P%(JMzNg#iKvV6pv2WLzws3B7*ou#9wC|a#S%0d-7`W=o?ulJ)60g{=3%$zsW?|
zH$a>F;41|YzTo(>d9=K7^is;SJlPvZFQ#vl?fi_sDauYHL8EiUqnDmqW0#=Z&jtf2
zk3BS+L*FBmVc2Ug@GQgcW60xJXgyVnvalJ0VcQS7RwRwxm+7Z27|s0^Xer11B<&G=
zIP&}45a|uRBQG?XJ4-&H-zP|iVKe2)z`oeSHs`zFO91~F_&(p|dy;ZWz8|#xb+D~y
zqZo4w?;z%x=adX211ay5wQ;X3=d=BZfK{9fb1rKwIUN-x@NJe*CN4>t7|oZ7>yU}^
z-yjo9W{`>NzoksvGJ{O~=wB}r#?C33@c!ig1DWuAfK22*f=n#=*T}@5u81#5(T5lo
zi$I69f7%>hg847x#QSy13H9H#4TG=^t}W)AD`BLTKwgSa#-KdGc9cL~Fwe8B1Y~3I
zaf>{jb5xGsb_K?Xq9<=cy{KJr_$J{`Hh^|}$3!B4dMjcji7@1GXiOY2vY1m+MnnbL
z3M8HJcox&IKpsG=lBCR!RiIB-nMe5W4`z`Mgr7v4Pu42<wJ1M#3O>uQzo`2Y_BEd#
zKb#xS9a|BP99|I*rOJdKZ$IDoeT?I){alQ6T9YV_kw$lXkPS`3c7hJ3qJx)n^&_yE
zhig;bJbL&*55J@b==?sK)Crv?=1ernPSM1ifhIwY$8H<%qf2nA4QJerkuHD6{^irf
zelAYF-$*~{hnDyl`tHq_k5lOPDPOFdzMYZ}_?Pi%@^KnvkdC^>rExiTk@E%G9d9zw
ze2sI4{jfbB1cPfonW=iUtOq;r@fX)vfFTwo;P(OcfB!A;`pXZ*OWL~MjMs?8Ii2N}
zi6nfMSK>A&z64{abqcnC>sE<n>5ti|H0{pnQ^<Q3Jb7`sWqcnz9aM7~>KSDQzN?YU
z)1PnE#vJ_t505mY{p0&gk=eISz|PJBKWEW4j~_S1QTV1$d*k_fH2a7nGqafv`3bTN
z*ZVWDAA?esST;@hxy*8|PM!AI82{~xr*29ICfg$(0mz|hk7d+49OdV)K$FM}^0Of2
zi!Gx3IR3WL=jzW1H5PH*7Qb@%{^ZA(-TZ?pAO5HxzjD%>Yg{ijfWD^W`zDsX=)elU
z>cA=`tW-7HbIN?4WdJJ-7^N;8^6kY{fD_Ep*D+JzQz~eAPXu$<o^|<kT=MI)2mQHg
zL(};c0>9=de$4~FywveLp83GDDINdld<!YQE!fZb0m~wtW9y(d?mxG8zc}KJ2hT%~
zGpLt9J?`P)?LX(dgXf1NJj_*uv7hi#HhKF?zz^lwl8+)6<_vNX1Z^F;K!2aAi+!MM
zu-vm=$i{Ig8>d0{eA(E+z0b@8F*#ojtG$+lTr(C=a6P!*7V8lHcMPj?OT(kNw>gJV
z@pk$ka!xa3^~gQXA!`TsJn?=AFhNVJP43w^`NiYD(QB-SydtjehU7SG1@QButy;PE
zIhy-9;j;|N_Om|H{vq?gXimZGVp<lkGWQ8*zCW6~!0`nzz9jKg>A?3I(^3Bw!c@3@
zreQSq7mO25(!r_A@d>!@WChgPtZ&?i3Do@&%jVI}PQh0xZN7BZP`EOobZQ^kEzbmD
z<LiVR>zs7Y-zKG9k+{5b3OqlBx?Dddj%Z_LQm)C0g%OEsbIxr?$#wv9p}P)-jwJ@s
z$^8Lq?wCJqjDgqEkHMI8xWO`~t-Uv2x;GiFTwjUzIWt-|0lx-%6QPYnAB$Ha{XFI^
z-}zBma83mt%t=>AF}I194Z?o{+@F|oz7Z{(Ct<a$Pous3I%(uhTQ^4^*v5-%Wjg`N
z)8RTR0(qJZpXl%D7c$N@bj1HA8JZgZ?WFVti}9B0ly*``Tb{HqKEOsios_a*QeT|)
zUeYE#J79~apeMp>$hZgbnxo7+9`lq#zrKNa+qZ9uQ+BRFw>(epi_J!Q@i#nK5BJ%>
zeM{W)v^VAnF|Cq%5}Oqm&Am%Hg6;<2-#C`_z;E5o@R4YG_MklD@A%KqKjsw?4)eG!
zk9o4^h=Fp^l!tZUJHBft)7)q4ATDgfKbpIKbf4ux8y!chKyTy&mI+uZBrNm|;T!V8
zv+}}4ZkT5|(B9l5du8~3gl99XmAMD$vs9UN2$!fb9|ZGO&h=IK)d&~O0J8z<UR7p=
z?DO7_jB^#`Sk<)<es2c&<w(D(%G`kPuRjFmIVkh4DnAS1w`YJ^g!F$=WekMhJbK(B
ze}+hZ`W@g~iIT5bN+$h}m%}eA$Ynt;e}{5Op4o?EPS_FwC2N7Bm_O{<3%UB^6`a@B
z96cn&A61Ex-|<g8wI;q~5Pk?ymTL&feIoF$f%9$DKYWuF1g**v^I}rRk~Vyl2Zhwr
zCu7d}2&IQb)WgFW%P8n#K^Ol=>Y}TEd+e!mIx?+KloaH#AdkN*pCw-&`5S~h4nAl*
z`B4!VH!S~{VTFpD)8b%_?Uj2z4RK??KbIS8h;a|dVEnPw+0a=h?qz%|Y^`Q~8sYqT
z##x``e@A44{~)p<35(|$tZW5-5&Ww0v(l^5Vr-7JWNdlXz<V*?Uc4*uHu1LbF2cJC
zZy(-Kyo<SScF6mWks{HYONNf;_WH6%f9T6TlL*y|GrsJz2e_Xm?D7LODW7`tlBRLW
zZ<jo_Jmr0>KIR?qrM(B%#zSMvt#7B7TTf>`8S|z;DZH5PdF&IZkU5&0ARM+;Bt&F?
z=-AVTylI1N4mxc{k|E1RyA_Ghr!J%2#lNB5zzpp!8eeXeYwgZ;+dbvYMvBqa!O&~D
zQ*&an&dTOoc7Mo@jIGLs-&&Ooq0CV?Po*zFdRcl|){kE>fBu#6Sv6|kyXsY*6@q=q
zU=n9PZW)~Ok!R3nk4g(--gup9S;SGd5os3Z#-)%P&dKH4Yn?o^wLcNIEXGl;PPKt@
zp=srI=ib?dxn5be+7<}+A^dW>F>c7cv&NV>0y>YE#dy}sN`xzcL(C7ng7#3hooSe_
za;+6}&um+nTt~>ZXHedLT$Didt}t$>ez<T518Lzzs8XC`nmh}~vpYpSm|xBsmo$kJ
zUwQ6~b9v;i<{M=?)%h%WW{fxj*E{&mugCKQET55etxzT!6Z)Ako<n%u%my=NHo~>0
zgkeR7iiCeW7&q+4<2L%a?s>=(aE`nXu6#NXh<iato||2X{21OV<bF(9+?NQf$PF9K
z*J7gNWWs2^uFlTQo~X7=)xY(?{gdN9AwXZ>FY4k3+vUDTB4Ewsx@@Kzad|eb<ga-C
zQ-w3!gJ;<%Yb{UGi20wajr-Kwi}wP#PhSL^fpRGSGxAK;&2o(bed8I=P^OyawMt%N
z-b^^K{h8<hKK__}ch5VKc3IHwylDl`nO1ei<Q~3Fo^E{AwESGp1B|0dBkj)w2*a{L
ziwDkCTh-i~9}ZcjN{^w=Es};|^a<mx{df)ew*)k=2i$rkx8+g}Osg&lA9K9gsyiC4
z>{YxjI`5Nb;FrrWF<hBo81JJzdk_=m-%+M0(-$ElyK~pmTqDB!kJb57p0f)<$Cj~8
zC7TNr&r+!WXNqTT{Sj6F+p7LtReu5d1UgC?;n_cqRVwXTrZ#RcJ{U;N&7;?hv;w{V
zGigG4=`@$;KOCC)E`rty&zFH`YFwVnaL)au8&gIG3MtPA1v~9bqwVP46S99^gx507
zexhB{(0-y7eaqb{&lw^dMH=W`jkE(y8=vHJ%#Uh*gsUOvZ!+ElA4RP%2kj>|3zV(k
zK90S&ITz&m5YpUz2++mg`8lSc-No`eo@v!&VD~N<mU#olIMt^M><?tR6n)!r<R&qT
z`$NPT@LfHZYoB>~Zc)#{n|l<G8XO*7KOtov?aKB5gJ(?hZ2@UZ*#$0KJA++|r(+_x
zc#!mP=w0mK6@{HL?*b0&Zv-~zZDlV_+MtX%Y0rK0(HHg$Wkbn8EHECmg22U6xXp5L
zO1ozjmdpHq%k&YhP2}N6Jw9*5{pSpfA+_<KEFX=Rr5jRC+YLO|5S*7WvSoQPlgRqw
z{x{ICUzqZIMVZ2_>9lj6{6NNtUf@{>$*&=cHr%}vaN;!V>$&;1;zu-wei!qc1Yx32
ze)<(o+td2Jz&R`Iy@on9Odsc%=J3aM_;cw3$C+t)f#%)JW7;`623nzcpda`3GSL+1
z^4>VtW%2$mq>qbxW?9@!FN-Vs#e)c!frea<<{I^O(6OAnP&oY!aO&k<E{+|JuEfh;
z_gTUJv|dcV*E9cD@4M^sn{<Hd=_f*hGBL;guGKWD149<io%xx!=YPrScMu<tXSGnC
zKH-Uw)kOG1u*FZ+!L}F0pGjC^ULssCK;uB7DE@4^0rT^^xF=zVQrK#rdc%fPMuv-G
zv=9EI90$C8+$Xn((`8Y)rW^MrOdF%Ew=G$nE|YPT$2hZZycT{I@tqt8tO~9lXN*=k
zHe{l$Tn}EK`GhU<=^hjQ@Q2w3h-H90L0?NGzw_u4<@rCPF+Wd!r2J(dcRVMc(~SI_
zwtnrinlAB7b;#<1{`BJAf%jM7x7A--ZuP;3>{s%eK;OTR^jW=1_LrXsM^i(lwV3D9
zhr^Y2!UvlfwEda7Sa~vF<>2=fslA0Y_*tk=yE0Gtghkb(xwlzI$yN+)oXp5`MV_79
z7dxGl{kfmx3i2u-_hGajlINpWS!;l6ab}gZn&*||St#dx6Z6ZIeY+91p;4ZNa?UO=
z98~*00n$+QZ3OLGJhQFre?4t6>eg|cGwsCvjH~=QRqq1og;|e&===5bUw$d|)Hj2k
z@?7fURx#j*B`nZ2Q!NDi9gayB`wKa$QQ?;mu2bPl2-n9%@q<c7ee}zaJ`oefuf|RC
zcxo?2?u#rANgob$T?V>_)HqViGi46#jekspt7-u23req>dCp$t{T=c)@O&WqP}(H8
zhv+Z0IFFC{A%i><ZbT$K<$3poJhxsNn#?axIP>sTgi%`Kq=PrG<CZtVaiMy$?2Sk(
z;u%g^wr(<g5z>7~Uz+hv;(Qu-J%qFy8RvZfmHr=*z8UG2TKY+(bMJ4FmOg~^Lr9;m
zr9Xr8qe!2tr5{212=$S1+S++dLfQB#_z}i8k^#F!mHj$pTKAiseX3|89gQYR7sED1
z<CHrCZ;neoylJ0dKcW>%r;8N4uky|le5D(>#|7Ww-zCbTCzU*hojt481k*US5r(5T
zIp5&a`Cu1TJ78S~ER*$|@vwE;xxJ4I`ahO9A<yf?7M7z8o`HHEHd5Y)GNCU%L3=rG
zzA(9`$GzRMOi|30F@txacqYgmwigCQbN_O}Oqad7ObBfct=t|K<?KVkhq@=E?wYWH
z*SHptG@Gw6opI-Gk60-0DLVZL@oddo%j9@a%JYlI8{y~sVx<W=pAd7B#_nrw-}B1)
zUPam3(cG)Y>MYM&>b}FYGXxGE4bGmZ=gwpv4b{ET6@UX8b8qj>zmVsjLYx!6`DYw!
zPdfYDtlNmX9(7K)h<U2+t-KqC@-K1BNv(Fyk|BO3DgCZD&#>$X2j=&fr_QUh%zsKc
zXU{OEzxhH^j#aS`Xt<QHF>Zxv|ESOO&4I(bJp4`7{vw6@vo7umU%!hl`%1i2`MJbb
zwf{|p<2N<DxNjaNF3RUyfjXGGd0tLB_j|m=N!N)Jb5`U|ndyb6d_B28SrreC%&B+p
znT<RNzXbKS%ooBOPD)ufPdWF2<Xr*##BS~b%!M2g&wWE-YiGukXA5{1A>!Q85#PLE
z#{H@4dcnG^6CTaIJF=`^jF|SkY3CL(uO8nkY|IZ$p1VMwKA$jR5odlS?}-*C0=p;J
zH{g{7j&aux!<XQlry}n2>OQEVMXz(`%(I_oZw{}DbI!;%Zlf--j{OaJeyduQw^8=d
zq_fX#j?8Hms1xFx2zBbUIya~~hft?Ws}oRls<b)*RR`m{XA|qF_)*0FFgd4(^5au!
zaio2oWpw^k%6o#=p`>%aXb$fg$-6XDX(ddfjFpO66VPY>plSP`YDi(unerqh?czq#
z;F*ee&K%9Xcdk0^2TvDPHD97V%$*EZ<=i_)JO^_`*@B}eGgRG68&&2X&0Qvss~{_=
zTUsiXd{DhvGu8V!?7&6Xfw%JRUa^0W?+Wtj7<hHr2lMewIY$kR%x#`fa*BRd67F9O
z;+=GSms@0C&6xj;5%d4&Pg>@g8!XS|WllZv#^vRRk2*fVyM2)}<c$MAJOlh6<iTGw
z6MRPxC!RxpEArY2xb2*oGa^`)_iAVhP{*KN;@yPbORE02Sl`iC>-|1O^QBliDt(05
zMAW$xLVai5d7}BhqyA&ba2xF`$D0`9avrSe30cpWvbP7F^~hqbd!|$WTlzpvR^Hz~
zD6%0tl`a8)uI@*_dFCUNvTb=+KV`@B*JU&E&Yg3nhw@5a!JSJg`8^5xoj|{qK&I!Y
z@$vMyF?m;y<?e+aX--7t`H&*?&BR!JdLqhSd=lSclp7PTp0-mq*Yk>s7>6$~X1#iv
z;e(-}(_>s^L_Y6JokbgC{8?F(VLO$TW5HS0k@eDoVK-f-sq$koU7p?bkxpZ>zPw9l
z^4kJP^YBf6s5Nn~>t|$*=xN@2<k>#nA*P)km-F<Y3-qnlz^~21XM~UNQ~HyfYk%iQ
zavmAXnys>K1N?N>ar-{5?ls7J`cX^nPoix<_kG4NzfOqJ9OhL4?%DEO)>$LVvtM5L
z4@LV8%w1Bpw+3=G7M;4w=<?7#OAUPfZ=R<fNlwjaz&kVl{0!HtcvhKnEa%Mf?i_G^
zFI_uzuOTGYkw$Z4weY=VxwwaMo{2`;t7Cy_WrMuW$Ni@Rwb{sl)v3tYdr=Sga=zf$
zrmT{4OXR`1bbgj|hRlU^khEBzmV9&9Z`uCXy$&xMoNqyR)E))-m3ZsM)cQ*|rtW*^
z#?*$(H>NgTxiR&Sd+!}{Iog5w@Y#OGd0m2My``SMbKhWbYQ1KQ?;0wreBqo~`9dl0
zxrQrK^Tg+$Oc*w7%;lBv5kCPv@?@$jU&xfj4X(eB)XK3U^y1p->pIjM@ZxWQL&p8i
z!9i!NFX7(Dfg0QI`U#+y$3A3xL6&Pg8=KG9-ML>${eQ8+iaga|`R57IO#3hhUwLE!
z?{bI|jJJM-OL*rP?`ih;N!Z?}R>iq4-wYbCo<AAJoPJKskMa!r|73YQ;@GZVZAN_B
zd1Cq%)6dhw&sbvxUE4|@1O41UALFDWbAHUpLMr`Ura!NI57yyc8to$HmHX$>21Bl2
zC=$FcS~fK0FViRCdd|KR(kIE9&V4XB26=Ypu7CLg@4;7(2>Qva!#z!oL#)TOh{RI#
zufYncv%_W{?Aaq|v(%HzB|(qFjqt?-JX>uY<h*W#Wv5{NnlOK{%oh56u2See@2c<4
zz4x7DIBu$S_u{NGHze=>05C7Oyw9Nga}8Dn-`@o<hl8oPoO31vyI(_n*m_&Yxss6Y
z;5g=X>1y5|vVzCa4}KG4YCIFAfY18~rAc*He%zUN(pFD!J(XqLwq3u0-zAXaK(%EO
zwo|?`;@-bKkG`XB9q-VQhrCw}TL1N6sD9FCan7^L`)jn->AXAt#+XPOuu&!XddoFw
z_#~HEPQQ0eTSb{Vl9Xq$Lr>LaJ)BdWH(DVVS*I@V>qT29()g))TKX``L2hP|w{Jyb
ze%2c_>{(CMrVLePOxi=kE&=|3i8-84o1ZN5tM4*p<_P+p{_Gsf!@Vi^Tc6>a&fUAf
zyock|Hm9r{Cw+*2Ma2zO*Q@Hr5}_KQ)$LSec{bHVymi>ev#Z{BLE|~7vx@miIakU3
zDg7;!^(nZ;3U2KTIBjrjyZ4^}C&Igmx5#fcc%m6!%djeQk5k4Y*AlAa`Oemt2<OQL
z2`iGRwZ(XCig)o#iTnHWQwH+A<4BitZ20ynY$9BQdb~ej%uvsVdc_zEUrL$mr?^JE
z*iYd6V~&{_<c-g<=D>bM&dssrf`6gGuw8<*5N#Um6w*t%FN8YZPcjd696hK!%5Q&w
zzn>?69h~5+8u2jFexGS*^JnOj@5x%Z&Ry|jL!5Vojtr``Ja>P?KGB?$XNON%VkO1^
z=uO|qg32?H<1K6}V^j{?Cj{4CI!c$MxhCXM@fJ5fvDo<*#kkROQtm-IbGW;ZH=^wP
z=NX?s9DH6O=Z%p2RknEWa2@F{Ui@$#iIe|29*L(3`@?vozWI@4e-xko4f&+<dA|AU
z%FkflgO1;$^W(j@NPF@Yd;>4u`zN*b@Tks<`Je~*(J&Z3b|xl@o<#awyuahFQE<L!
z52v`V@|sI8o^5A7&sUOeA+_fUdl05Q;92F71<^6s_{h|`=w><3Eh2x!v0>h8=XaVI
zKP!%%v{O0e7ws>Hk9EkN{5}!SQD>}UBl$LqJXUt|p-i+T!Sy75$Ax`!^%G^5LNERa
z<8&fZ9ev48Vcr;<n)lIXMjO1(x{v+zp}nGdXK$H%5BmecDCRn$<3E{2t7TsCyyje5
z=G8lS@MC%Bgm~@)p2K`g-_kmEa_U<xl}8<a=e;L%I|v+~V!t4df0nl{R6I}0LD9$Z
z_~6g$cO0;eL(UU;pUwY<68q2gNduQ==&J`dymZi+r!*hIJOw`Ib^4F|M%mc_#t(jU
z+pvuTYf_>8{uFJw0Y7CH>y~k?+pr8Z&j`|waqH@J2!B7|qpqR+9p}3rwIaa&at#ji
z+mQ6jK$DcTx$m_noI8kqXYbm3n_PoP$~7l>_Z?}EurD0r;R@XAq#2J9#w{Y2PA+Ki
zE13#7_SUeao-Al7R_T7V4m1n&+kyNY9ADu-#D>F=xnXNb8Oo&0=B%P|3V7YCeCy?M
zZP{m8&ba?x`JjX6-9u(9M4UjQD{OCpTwBdyoXkxqIA>6Pb<&KL@Ov?Ylfs-=<z<|8
zsQ2m#k9uaPb)iy+MoH!?e>0a1+9m8uSglPtKF)iUfHT4Q9_u0gG4509YaBx|FSj#~
z=Ec)#Ze(4Whq;e699zUYLvoJ_<5(l)T;27j?J3`#yY{!l`Lxdtkp?UeJIb}0QqV=X
zyaHX`Oe{;6GF@Af;C%W(DjdBqVt!KY%R|0bz;CDl?7x7lnra=kd_;aD9sTn;-_PMX
z0Ky*n4JbpqF<Z?OF@A_pxm?c|r7EBIOx|W3^OiR;uB&>YlzZWXqtnXyZdA()z~fs<
zXTN9#_cNXE9JRt{y7n~jqi%zy#oU8Wp}bs&u4{QAQ%64w_P5S5)LJ<AJxq81Y<KSM
z+W|K~KWRMNdWCypuH8c38syQAlK->i*^Nf}fVtW9`2dGLeSm%(!evTdzMTwJ)=ggr
zB)_l!MDC-8cqYqQ2OjhLOm~hrxI=cXCDE^Xj(74~UGPDN!<Fp!vyy+#x2jy6%ZT%_
zIxBRnN#5Nge&5Sfw_Zw={o@O4e^9OsdjAdP2a5)i(x%?bcKEH2aWiFdKAQ?z%P}rp
zQu`=nh&Q9Xy=?Ev<#G>l3D38T7`wCZ1-xbQ8y8j+=gY*Ka)@`6;tA~FwHE3~{b=s5
z?V)2g!OqQ+{y-pl)Lmm&bAdK~%SYMLSyTFR?e_tPdoCrEb;R#Se1p;_%yX`N8gYAu
zHN$(SXmjZ=NE@^<gt6wbYU5*4*B!lEmzY{Z_d8>}=OM~6c=WA2T0@?$KZ&vbCA=SU
zY(wr7+-p*Ok$R1~pH_7bIXZv+<N0HN8h32KsdLwqfUm9ki+OnTP(5r>#;mLZoW<(<
zU6AXm7ahN$vToe4YPgn?HzpOS`bDUpLj9o9jopLc$}b+SjeC_G8{<*TZ=JQ!D8HG(
zJQp`-&T?F+J7j|AV(g)mQ4RiL?!t5_=UjV=a-Yvi3ui4#t~<PaP-Oi~8@IBQVH>(v
zpYI#M54eXu{g9fIWzD#<wb3;CcV4aIN1eSwQSQ+A>IwFHa;!EjAJUF7?eN;TA9@^o
ztInG3wuk&V$p523=icg^Om&=daeEx}K4--1`5iZYQ%TX@-LFvg`Rez8OIBZ#1b_Bq
z%&KZ7BR*$+UVO^^o@u(es+xFWJoSGNpWVF?l;i#%_h0Ra=ybav@2w4W3e3IARN2EQ
z8*|1c*q7y)Q_J~V+ZQk|#yl^@d0qf~EumhHPkp0}d&=_61MM>9U<Cdcd762^k(uZy
z=a!a7@tCr31!XIAU7B$AMR(JmgAMQ|qp=9)9!9!Wl%&vR=Dx}O9JLl&1--x8#=fNM
zroLS^W>}EBnBlJNsc)IdZ><q`&cE%UW&EZh_tS$RXS^y=Fl}e;?&|&LeAB-%2e?7b
zsrlV4p5xKh{1!TM^sDm+^Uf!n<+)vdHb@^S<Im1cgoTmso3ZYEsXNCW;#sGB{UN=%
zhc%A*`aC&*X-PY0F<R2YQ~O|dV+`f~$DWMg$PHxe_LJz(jU03Ci@P*iA$d|%ndZ7y
zW@%+QT^IL^m~rz+*=ur*aol{3_ZAJ%C3wUD?ToZ=&YH#i(77w}ESp>hl{|gN)mhV?
zq#b;vEBr<W?bQ?NTX<paol>qRAiMmA9PcKdckbqMU-K>AO9U*R`@KAtcYPGfyR-M2
ziUO}$LuR}}&E?X0vM||q;Pv0w=Slj*KYgqw8yO35oi7zS7)l!m8{`MWnSkYW)|=D*
z0}b)WSS|cn%!kH6bG-d{J91QOd6j<dO_WvEp`S_GJ+3#xhgy1gl@&@NJ=0iOcO+B^
z+Qbchqt6|C<i6X9l&I!?O*x0O<+ll)^ZU8nxGd|OWjyWUnrxOn)7z}W@}<%zs(Lwd
zZ`I2RW{GpQFeW%BrJc>(8*}f?US%HZ@eSG83%g#&^-k{fC8KtUW^>#=eJLqz)3rA_
zUma5Yar$`e4fZi3&$-dJ^VmG!k`HIt@#Xf=<|IQ=)43Py`2zg_<xlz?TXSVQ%5W_f
zK1lOb-X9(DHD6PCJv<-4Z&M@hx_u%_8|Bv9j6C|dpP=2OObwM)(NFwuJaaLQ@Z`G8
zkUXP2i)E1iU${oh`7YqpC&JXzE1%=MSB(MJQRXzqR~-iDV1&VXsI#7X%{*s;I`5@e
zwk}25e3#|N%j6nVeqH((Z2#Y9!d10-?bowyz-#1MA7EY6Z28`Fw5pLl!^aW633cF`
z?S($?W!wC=rP^QkqWWITG1sr~@$6M~+v<zeuQkcD6-dWCd=K}@M;27oWz4qKn1f$;
zzxU>R*TX7lRPznsR4LcM0#@_kI?I;`&|XvvY4ev>)vLSJ>%iN)l&t+jLi$HnJc;@7
z^)s9k*$drla>u}VP9GYab?3H5l|E-ko>!)AYim?>fM+GY(@B40uc8V4J=Tv-ARqnO
zOW9q@^1iA@^mmh5=ak>t%T!mbX1e1e<?hZbt7^p9D&bc13~Kdp`jc}fkmjT}UpE|E
zwio5su&%TI952C`^?xz$;-Qb*YTmN<t%f#!19tDFhPFHANjO)34}IE@H=l<twyoct
z`}Nlco%2B4o7CqXhlYGs8RTYeW`QG9-=$2Qh*v-tZW}g7-+(<VMtF@qeEbdYZl|QD
zGtapTHgv~`bN)L582mnid+xSR`5wOpTp#DA$y&K*5u)uu{+As%7SHCDBHqb(rPGf$
zs6)_?SiX#-%$F3*i^w;p@<bSTeO~#c-$}?Z;p#s~*>d(KW^=EL>j=X>XAeWJ?Kyhm
zbA3(b@g5Q3Fbr56SHghx=fuldtG%)zA@$(uk9qHaG|qtjh>zyugmLdOWa1&_C*Ti)
zFJI)jedTN2<oNm52jsf%jiaw4{1xJj@EhqBqZ6b{X2s~6gqiu|=v$}E-Q2@^-O<Hg
z-vE9BzpF!Tn=hix5q{^!@h6TY)j8rQ_uOS$SHH#fkD=_bMoXT@S7nc|?4UCjpuK>f
z^Xrc%Lry*Y?moYV%l>}?{c^vTuJo!X<2(M4n)_Z+=Y94<cOJt0c%d_g5(~N3YC2~q
zsCQp<eBsNl4LWO8f9TeO+&`rIkR#4HpuImgs^YNKxAQx9!)CTj;e7~jt}0*q%St9o
zl4go~cz;g#ppW0tx2qdrBjvel72kmP9ht_IaafK&SMPJ?z$r7`2w&kF@;;k+O8S0w
z<P_%bDbrr)%$=^TbJtDXGuA_<^i2u(HuQ0W$}>5Z!FS|7N-6yN64lm9HQx>>S!+o8
z;z6`6*A-nq1$FL9hMGho+?Hb=<C(g&NY`aO)ZfE(wDDILJFv2bluM&+qvON1ZFJ`L
zR~M*!^egMbFCf1)TbEThWlK_KHl%Q$Gllzm{|EbpyrAlH@l>DR`%85`n*5}XY|sXv
z4a`liT;aO4v-T@W)!Hv$U;C56@bPJTuxg!=d_2kZRn-0G{5=)q--LSKNQUDlW#6K0
zaeaOD8SiMK7<mWOH-GpY>M`rJ9hm>^Ju8lPajrL3m1-~Y96ZMJ1N60?sTxh>jUBxc
zJUj4>Tjlq^9GiCeFwcN;pZm$1EPkJSFZ_a?{07@NzlEgk1u$Kn12E*8gOu;{M%94o
z(+I!Y;>h^r2hSVw&H>x&I%hyuEFluLwtpV*;#ym|{Pu|aj+Z<)#IobEY)q7*49~;P
zlj{Jj7u0#_3%hggW?bC?+#TvW?(P`KvsUn@+jdBQJleKHA3LF!bN$X-uHIR%v?d^*
zUNwfGzoH~#$aB>0-30WjlDfNC>72YD^%e}yrD%$9?n3?;=2phItQU9Zio|b#bEOZ#
zp%nFNJ_rY%5h1NrSs%*AK)Z#C7xm71^}Fw?@6&kGz$*>BbYHZzVu1J1>cC_Fq#diS
z+N|Jmz0_9aVkj5Y%5|x7OIgn4lglI3*Uda@;=tI!wn_mbm<OX*!6*Zald2rsDyAN(
z@oUz2HDqZ?F2}WPo_keop>8h4^RVuDI@Nc|!<qN{4ICfeDN8ClEYFNOXCjv7pA%u(
zqnz^{mut%l=R3N&?_gN^l>7FFEzXPfJsp;N$@`ALPkrhp&bjR%_hJ)<ZDg!;fcld0
z#Y!?&u|Se<BX07n2;pMdaVZl`2MBvGoC+nq%{k0RIq#SA(Y*E-gLiVB>e;XrQ+V8`
z@K~qtSbrF8o%5;r_6a*cKmNSIwOe}@zgJt!JFv^_0Lrlqc|IU%2=91R+JDZn{dsu(
z@_bdyukecLc)7SF!&YNDYSBjvk^ZGZOyKQT>p8Zwz7+?(->u{Ki{L-rGqS+CrrEr^
zA=jG^FPAvUbBz=7`)YFB4y!fjp!(J<#_D&g0n1i8DEAyj4qCye+6!~fZ*k3v;e7pq
zUA+5X=(WxH`}PM#R-Q@9h_vwm`F=Ow^*iCKj=SH{H`LkG31j-%KUMB!cWqyNcUj3O
z*M;dnz4LR<&nJBE|7Lq0j2}#I%MxfSI79iw#EQ{(-LpT*;?Z|^=U%6e<jLRfMgB_U
zuSVN%Dw`$pzJ;_B>Hp07Go=3$&y~9Ad^SAznfvaumiAls_ubjk+1b$%aMC}$Zslse
zALy~Rc5LnGd(`Ue+1A~za)oGZ>3+mo+HTeFSi0j6`R_|k7LxA2!y4!rXz7v(_dAuh
z^>?(dv9@pN8;~{D$ZAX5fA34ymY%IGy;F&916@5W?OVDZwjSx|>+a}UBdqqG?v6UE
zf6Lc8&}=|#>E1H1X-j)=U(ePxR$EJVch7)DKph=S3W$vlS$(MAzeWLEisk`-_43tD
z6Ax<ni1!Zkt+Ct^8@2d-w?A;_UDmelp5Bh`j&`f1bD*P-{U6xU_DFx7)z;rvf7{Z=
z<&8U*I{@2}a@$mMVrl;xOVOhLE899czJ|`UcXW325euugrR|Z90aj(XJ6n(n@b~rf
z57b!$eUGxp(tZhO<A%E=yxTwb=}EX7cdW7Qdho$bcYN;doqT`p?)&PjzK;HZmc9X0
z4Y=i69&Xvvt>~MF4{+$|18E0Z2DbHEOY0kV)LAX<?dV?psxFry_qBAlbr7}g8wae1
zI|i&ReP5A`P!F2x7+`BwS4aESmdSLsGtk%4-M@9q0Eo2}wCmY6ptU9|J5@HSvLtUy
zTU$qeztz^$-PyIJO_E2#b9kZP?^xQ#_oUo(kki}xiAl@0fu5V&9Ae(w-Z9Y8Hn63q
z+hI_CInZ=@AP-;A@G}ptu^!xEwRE?Gx{jn+6tSLet7Cgdx7A8zXz6=&`Bb~;^(IQ?
zG;!?fcz8=c`qJ-~L#g^T!2Q9F?OXbRjaBb-<gU-&X-%fBv_yVb%BLG|aN_Ilzsp+p
z`TK9T9&Q=vu+YbrN3Ch)R$3eG``l+Omk-;zAL;J-YPW^<t?j^vMV9U$-kYE>tzd0;
zkJZ`N(E<JiM1Fc#N4>><S)DCg(93|!@0NC?Z0j1ZS{$8rGQQfk1^B!_qkGbhOe-z`
zdV5RPmUc^}^tK>mZEumtF~4i23|d_c>V1pzhOx4y%!O#(_V5~IETowAQG_9E17F?J
z*5S4ZZgsZ6GA$S4&M6*!`ZM?6|2Y?sN^j}v>S-foWu`UI(%RKw<=Z)#zQ)?JwYQ6A
zfF$L+x8>muRa&(PL|v<8wLUt~p(LTDuUEbUO4y`5TRJHw(*CWnV0~MbLtlXB!&}-=
z$Qsz(fkx3vAivzFx5{>VdaVA<J$+OqC!H+Y*4Hs<t^z8Z#uU*SBKYxqv{ZiE<_?&(
zZCkCLM`ljnx}|?>%Rt-aNqpP(epc$?9iREk#tmz%&vtZ6^WE10W7j{hW>O9Vx3>bp
zNih<R_99(X{In8>zK*t@K9q71ko0lPq!iVTfz9;+J)MabEwp3P0<JvfSL}bJHQ#Pc
z&!?qA*Q9n#f{;(g*4}|fH??l-gc<Fk@INZGWio%=wqDpMN(_+b=-UK?wyhVr?H$`U
zNnzTAhSx|Ib@hNSHA~w+&dQGvijxNc`D#nQ1%hpxq7QO5^==!;uXz&+s@l-2j)5(m
zoBA*UwD<M&_LAlUkM@GOFssz)ZQX6MU{BjX#{li?-K6qHXb8kA;Krwz;>2ApICKe2
z*1L-|k>s0RuBW%Hr@dpU+#Tq!bPp<TQ^Z#7Jh(w>r_(l{&#gmpD{P4?T5GJ$81|Iv
zZ0mDv#kTg|O_EnL&`{d9c1NGuHb1gS>OYKocYjCUcBp^5)Xa{)w%%>a2U->Etu3_6
zlkvdhI3@*l6NWbjulJ2}`T5)WA61!>jWbl5O3xRYDTveSwe&qqyOGykKj_l_{&A&i
zWus%}0>8Q3of|#}t1-~WL3E(6r|ZMuKHSyQ+R`;cmHutrjay0Io~^wt16yF=960y3
zY;XB2#&T$k>lb!owC!%$>J)HXG$B6wxd*;bmsj}al}>%PAO=dOe9zXc+Zb=@ez>C_
z?SjT~+}zUN+tu<Y^$8r^L>X6h0bK0c);rKI+;|_~18qBQUVU@xmH~I%?dToYOgpxv
zyF=PLSO2%P%k<41TOQtw!rQ@+uW%gNvO|V8clP%5wQWYa^WNP5Xg5vPcJ<!es`Axa
z_7jb}bZ*(!zNLrnt}QKW6C$~#rAyJ{&d)YB+~N?TtpyCZxtr+qPsJI%nWKjQRc`KX
z8<>O(S(fk5Zrrf4er3akdv15qds=04Xm^JUOwz}#2gd~|V(TM~s|V^=i>=VxF50&a
zhfn?6-0`%pe?T_fKjq)Z^nOQkZU)D;vnQ_q<GyP??(nm<r$_pOHB0+HzD7Dv94tGw
zcA)+CI;jR<bG=jGOAGYARM5AjYo_GFQ+Ntb;VC?Yr|=Y>!c%w(&;OW*TLpgniVLJD
zJcXz56rRFUcnVM9DLjRz@D!fHQ+Ntb;VC?Yr|=Y>!c%w(PvI#%g{SZop2Aaj3QyrF
zJcXz56rRFUcnVM9DLjRz@D!fHQ+Ntb;VC?Yr|=Y>!c%w(PvI#%g{SZop2Aajem76O
zdY1D;!7~+jKD;<+^hTo5h!BxTE+WE)VQh#jbK;_D<Kj7n(Yvcw#dpbk5ost>`OjZ@
zYv*+lslB{p$>qyA5fSnm`@(NA7iBhDy}i9+*JK>|8}jp?cgkO$%>VEw!jf^{_1NmX
zczv+T>JlR7#v_rgUBSHkV0~9)aYPolyd;-%@*^rAf2+E>%m>6BEFj}utGbL`=&qX|
znZzw8<MqLh#(+p?SLXwh#bbzHZ~AgIz;zN}TtwD&b*?H4MIud%*NaHBt1}YxM<Tn}
zI!V&i+4Z1M`Gj)4>GM&+`pERj{Jt*=!bjZ5Z#tx*;{OQfHbt76>UTBmYHA`f!KT)V
z&d!L>*V@@B;dl0x$K%1ZYvV|b1b5ZP{~%Joy0f#hz6o)kh}Wa5@m=xGNas!<yQ@BO
zcjUfK6b^RAB^N{!K*yV!f=x}Ji3mo1OLT$n+NQO;b~SZ2?dtUH?QFWE3E13yH_&Tc
z<vZKi`L)hYU#HLK>x{$~`+nKo`Q^^FzRtyqx9^I?=lHJg>ipU+ncpe%&u{NEI$59b
z&Q*7#ep4sm`*wCVHFfSf+u8Kn>LZ{5(@sF%)ntIBZ0-+ayfx^nZ(`gRLA<H6J{YX;
zWV{LS^I(4v1QTmJ*Txw~G+2+gZ~H2s+H}1$a(6J!I4FU#kfB{ou_j1R?6<==B*0a%
zTKFRMJ|CIV#CVsCQy8I#;Ae0r@;ZavtC}J^*LLm%yVpkQR|T(kvje`)U5i1_`o+QX
zow7rnz98dkyBOcOwrMBocdoAQTz!6$zHuQ|O=GhV6(1RArJ41SVArm^I0SIj9cy=P
zZ(8ioU#fIx=L5v%Jn2pP0=Xu}sa{ULFW%MJg#4h4uifcuTKz@PcPE4!fPL{Pj48~M
z@eh!c`jrj0G=5^$Cs%*!_B-xech}u{S=8NcO&S^bd`L$<|L^&kbDzwQ;`psc(mcFl
zxp7IQ5W@BNStJ|Yj8hMN`Squi)hiSne!SI(_vYLy3pP%Xe5(9p|ECmv68qRx+NAy3
zFqP&NQzUlNOgF7pr71jY1dH(A0X+62+^*qa2zwHUVNBs+NPxDJ?#l}Y^2!AB!gKP%
z5(x*WA*@OK4B1)XubAwYNA<BfuS|`T<NZI!Nrse?oR2A*A5#5~I4{%fI(bs0x>n@$
z{l{#r1n-*MD>s~GL4+-YUr^x)!e>-Cgz!r$>_<4Q!UEwjC;X$!2%l8p34}*f_;rL|
zR^cqdKULuj!Wk8Q8R2s(44Jrrq<aS8GvG^^aQHQX^b70@!YPEas(b>!L;3b!@y;8Z
z5|<*k|Eli~DR~9VNFK~c9uAS0RT;qlF~zGG@Ade_-Y?&hQ5M;w;FB-2RNbSBR)=!0
zENoO^$lJozDvY)kHs#Bxt^;3DqM%@pOv&s*_PgwT^%9PZsPbo~bZudJMqSJ1ji>)8
zT)k#pmJg`96OLSIbu)Q&Uzt`nqv(pd<#jXGwVZ#d{Ob;lW%<nx?SGub@4^hcg<&u*
zEBLHS+`Ovp@C<!4{V|CnTWogfjQOYNQhrXg2N^EU&cF-PpPtk~eiv)mlq`+aOtrnJ
z%z-loeOY8FS%Qo$s@D4ex%Rsnj<8D`1L3$T>qYo=m2N`bFHXwvE9Dmz9zMXXn}qvH
zBs&#eNI5N0;b&BG0Cfp_mV&d+r4_>bWbkYiri{%|b$>bub37QruMxjkF7tiJ_V-8d
z%iwo8m-#^>eob3?Z{vr6d#yhFzpcBoU(#u;KKDvRO#BWX_j|?f8{b~3*f{CCcue=3
zXZH(_0s2=|;0K#nQH@_sE^|8Zk;cqdDj-J{zn+X|e$b9zmkKA;`vvtLL)lBJ-o*c3
H=Y{_dN;ii_

literal 0
Hc-jL100001

diff --git a/pc-bios/proll.patch b/pc-bios/proll.patch
new file mode 100644
index 00000000000..b0860e26f47
--- /dev/null
+++ b/pc-bios/proll.patch
@@ -0,0 +1,50 @@
+diff -ru proll_18.orig/mrcoffee/main.c proll_18/mrcoffee/main.c
+--- proll_18.orig/mrcoffee/main.c	2002-09-13 16:16:59.000000000 +0200
++++ proll_18/mrcoffee/main.c	2004-09-26 11:52:23.000000000 +0200
+@@ -101,6 +101,7 @@
+ 	le_probe();
+ 	init_net();
+ 
++#ifdef ORIG
+ #if 0 /* RARP */
+ 	if (rarp() != 0) fatal();
+ 	/* printrarp(); */
+@@ -117,13 +118,20 @@
+ 	xtoa(myipaddr, fname, 8);
+ 	if (load(boot_rec.bp_siaddr, fname) != 0) fatal();
+ #endif
++#endif
+ 
+ 	romvec = init_openprom(bb.nbanks, bb.bankv, hiphybas);
+ 
+ 	printk("Memory used: virt 0x%x:0x%x[%dK] iomap 0x%x:0x%x\n",
+ 	    PROLBASE, (int)cmem.curp, ((unsigned) cmem.curp - PROLBASE)/1024,
+ 	    (int)cio.start, (int)cio.curp);
++#ifdef ORIG
+ 	set_timeout(5);  while (!chk_timeout()) { }  /* P3: let me read */
++#else
++	printk("loading kernel:");
++	i = ld_bypass(0x20000000);
++	printk(" done, size %d\n", i);
++#endif
+ 
+ 	{
+ 		void (*entry)(void *, int) = (void (*)(void*, int)) LOADBASE;
+diff -ru proll_18.orig/mrcoffee/openprom.c proll_18/mrcoffee/openprom.c
+--- proll_18.orig/mrcoffee/openprom.c	2002-09-13 16:17:03.000000000 +0200
++++ proll_18/mrcoffee/openprom.c	2004-09-21 21:27:16.000000000 +0200
+@@ -144,10 +144,14 @@
+ };
+ 
+ static int cpu_nctx = NCTX_SWIFT;
++static int cpu_cache_line_size = 0x20;
++static int cpu_cache_nlines = 0x200;
+ static struct property propv_cpu[] = {
+ 	{"name",	"STP1012PGA", sizeof("STP1012PGA") },
+ 	{"device_type",	"cpu", 4 },
+ 	{"mmu-nctx",	(char*)&cpu_nctx, sizeof(int)},
++	{"cache-line-size",	(char*)&cpu_cache_line_size, sizeof(int)},
++	{"cache-nlines",	(char*)&cpu_cache_nlines, sizeof(int)},
+ 	{NULL, NULL, -1}
+ };
+ 
diff --git a/target-sparc/cpu.h b/target-sparc/cpu.h
index 4c23b924a44..03698df21f6 100644
--- a/target-sparc/cpu.h
+++ b/target-sparc/cpu.h
@@ -76,6 +76,7 @@
 #define PTE_ENTRYTYPE_MASK 3
 #define PTE_ACCESS_MASK    0x1c
 #define PTE_ACCESS_SHIFT   2
+#define PTE_PPN_SHIFT      7
 #define PTE_ADDR_MASK      0xffffff00
 
 #define PG_ACCESSED_BIT	5
diff --git a/target-sparc/exec.h b/target-sparc/exec.h
index f9fcf532ad7..cea9616b361 100644
--- a/target-sparc/exec.h
+++ b/target-sparc/exec.h
@@ -23,13 +23,16 @@ void helper_flush(target_ulong addr);
 void helper_ld_asi(int asi, int size, int sign);
 void helper_st_asi(int asi, int size, int sign);
 void helper_rett(void);
-void helper_stfsr(void);
+void helper_ldfsr(void);
 void set_cwp(int new_cwp);
 void do_fabss(void);
 void do_fsqrts(void);
 void do_fsqrtd(void);
 void do_fcmps(void);
 void do_fcmpd(void);
+void do_ldd_kernel(uint32_t addr);
+void do_ldd_user(uint32_t addr);
+void do_ldd_raw(uint32_t addr);
 void do_interrupt(int intno, int is_int, int error_code, 
                   unsigned int next_eip, int is_hw);
 void raise_exception_err(int exception_index, int error_code);
diff --git a/target-sparc/helper.c b/target-sparc/helper.c
index ae70595c5f4..63d08e77d5f 100644
--- a/target-sparc/helper.c
+++ b/target-sparc/helper.c
@@ -21,19 +21,10 @@
 
 #define DEBUG_PCALL
 
-#if 0
-#define raise_exception_err(a, b)\
-do {\
-    fprintf(logfile, "raise_exception line=%d\n", __LINE__);\
-    (raise_exception_err)(a, b);\
-} while (0)
-#endif
-
 /* Sparc MMU emulation */
 int cpu_sparc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
                               int is_user, int is_softmmu);
 
-
 /* thread support */
 
 spinlock_t global_cpu_lock = SPIN_LOCK_UNLOCKED;
@@ -48,15 +39,6 @@ void cpu_unlock(void)
     spin_unlock(&global_cpu_lock);
 }
 
-#if 0
-void cpu_loop_exit(void)
-{
-    /* NOTE: the register at this point must be saved by hand because
-       longjmp restore them */
-    longjmp(env->jmp_env, 1);
-}
-#endif
-
 #if !defined(CONFIG_USER_ONLY) 
 
 #define MMUSUFFIX _mmu
@@ -258,7 +240,7 @@ int cpu_sparc_handle_mmu_fault (CPUState *env, uint32_t address, int rw,
     env->mmuregs[3] |= (access_index << 5) | (error_code << 2) | 2;
     env->mmuregs[4] = address; /* Fault address register */
 
-    if (env->mmuregs[0] & MMU_NF) // No fault
+    if (env->mmuregs[0] & MMU_NF || env->psret == 0) // No fault
 	return 0;
 
     env->exception_index = exception;
@@ -306,7 +288,7 @@ void do_interrupt(int intno, int is_int, int error_code,
 	fprintf(logfile, "%6d: v=%02x e=%04x i=%d pc=%08x npc=%08x SP=%08x\n",
                     count, intno, error_code, is_int,
                     env->pc,
-                    env->npc, env->gregs[7]);
+                    env->npc, env->regwptr[6]);
 #if 0
 	cpu_sparc_dump_state(env, logfile, 0);
 	{
diff --git a/target-sparc/op.c b/target-sparc/op.c
index a2d37469d48..042fd6199a1 100644
--- a/target-sparc/op.c
+++ b/target-sparc/op.c
@@ -474,92 +474,6 @@ void OPPROTO op_sra(void)
     T0 = ((int32_t) T0) >> T1;
 }
 
-#if 0
-void OPPROTO op_st(void)
-{
-    stl((void *) T0, T1);
-}
-
-void OPPROTO op_stb(void)
-{
-    stb((void *) T0, T1);
-}
-
-void OPPROTO op_sth(void)
-{
-    stw((void *) T0, T1);
-}
-
-void OPPROTO op_std(void)
-{
-    stl((void *) T0, T1);
-    stl((void *) (T0 + 4), T2);
-}
-
-void OPPROTO op_ld(void)
-{
-    T1 = ldl((void *) T0);
-}
-
-void OPPROTO op_ldub(void)
-{
-    T1 = ldub((void *) T0);
-}
-
-void OPPROTO op_lduh(void)
-{
-    T1 = lduw((void *) T0);
-}
-
-void OPPROTO op_ldsb(void)
-{
-    T1 = ldsb((void *) T0);
-}
-
-void OPPROTO op_ldsh(void)
-{
-    T1 = ldsw((void *) T0);
-}
-
-void OPPROTO op_ldstub(void)
-{
-    T1 = ldub((void *) T0);
-    stb((void *) T0, 0xff);	/* XXX: Should be Atomically */
-}
-
-void OPPROTO op_swap(void)
-{
-    unsigned int tmp = ldl((void *) T0);
-    stl((void *) T0, T1);	/* XXX: Should be Atomically */
-    T1 = tmp;
-}
-
-void OPPROTO op_ldd(void)
-{
-    T1 = ldl((void *) T0);
-    T0 = ldl((void *) (T0 + 4));
-}
-
-void OPPROTO op_stf(void)
-{
-    stfl((void *) T0, FT0);
-}
-
-void OPPROTO op_stdf(void)
-{
-    stfq((void *) T0, DT0);
-}
-
-void OPPROTO op_ldf(void)
-{
-    FT0 = ldfl((void *) T0);
-}
-
-void OPPROTO op_lddf(void)
-{
-    DT0 = ldfq((void *) T0);
-}
-#else
 /* Load and store */
 #define MEMSUFFIX _raw
 #include "op_mem.h"
@@ -570,19 +484,16 @@ void OPPROTO op_lddf(void)
 #define MEMSUFFIX _kernel
 #include "op_mem.h"
 #endif
-#endif
 
 void OPPROTO op_ldfsr(void)
 {
     env->fsr = *((uint32_t *) &FT0);
-    FORCE_RET();
+    helper_ldfsr();
 }
 
 void OPPROTO op_stfsr(void)
 {
     *((uint32_t *) &FT0) = env->fsr;
-    helper_stfsr();
-    FORCE_RET();
 }
 
 void OPPROTO op_wry(void)
@@ -609,16 +520,17 @@ void OPPROTO op_wrwim(void)
 void OPPROTO op_rdpsr(void)
 {
     T0 = GET_PSR(env);
-    FORCE_RET();
 }
 
 void OPPROTO op_wrpsr(void)
 {
+    int cwp;
     env->psr = T0 & ~PSR_ICC;
     env->psrs = (T0 & PSR_S)? 1 : 0;
     env->psrps = (T0 & PSR_PS)? 1 : 0;
     env->psret = (T0 & PSR_ET)? 1 : 0;
-    env->cwp = (T0 & PSR_CWP);
+    cwp = (T0 & PSR_CWP) & (NWINDOWS - 1);
+    set_cwp(cwp);
     FORCE_RET();
 }
 
diff --git a/target-sparc/op_helper.c b/target-sparc/op_helper.c
index 253bcff6f15..909639af0f5 100644
--- a/target-sparc/op_helper.c
+++ b/target-sparc/op_helper.c
@@ -104,6 +104,27 @@ void OPPROTO helper_st_asi(int asi, int size, int sign)
     }
 }
 
+#if 0
+void do_ldd_raw(uint32_t addr)
+{
+    T1 = ldl_raw((void *) addr);
+    T0 = ldl_raw((void *) (addr + 4));
+}
+
+#if !defined(CONFIG_USER_ONLY)
+void do_ldd_user(uint32_t addr)
+{
+    T1 = ldl_user((void *) addr);
+    T0 = ldl_user((void *) (addr + 4));
+}
+void do_ldd_kernel(uint32_t addr)
+{
+    T1 = ldl_kernel((void *) addr);
+    T0 = ldl_kernel((void *) (addr + 4));
+}
+#endif
+#endif
+
 void OPPROTO helper_rett()
 {
     int cwp;
@@ -116,7 +137,7 @@ void OPPROTO helper_rett()
     env->psrs = env->psrps;
 }
 
-void helper_stfsr(void)
+void helper_ldfsr(void)
 {
     switch (env->fsr & FSR_RD_MASK) {
     case FSR_RD_NEAREST:
diff --git a/target-sparc/op_mem.h b/target-sparc/op_mem.h
index 9c839a00473..2ae74f2cefc 100644
--- a/target-sparc/op_mem.h
+++ b/target-sparc/op_mem.h
@@ -43,8 +43,12 @@ void OPPROTO glue(op_swap, MEMSUFFIX)(void)
 
 void OPPROTO glue(op_ldd, MEMSUFFIX)(void)
 {
+#if 1
     T1 = glue(ldl, MEMSUFFIX)((void *) T0);
     T0 = glue(ldl, MEMSUFFIX)((void *) (T0 + 4));
+#else
+    glue(do_ldd, MEMSUFFIX)(T0);
+#endif
 }
 
 /***                         Floating-point store                          ***/
diff --git a/tests/Makefile b/tests/Makefile
index 1142deaede9..c0ee7b2a03a 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -1,4 +1,4 @@
-include ../config-host.mak
+-include ../config-host.mak
 
 CFLAGS=-Wall -O2 -g
 LDFLAGS=
diff --git a/vl.h b/vl.h
index 8ebb268d213..f25bbaa5cff 100644
--- a/vl.h
+++ b/vl.h
@@ -673,20 +673,23 @@ void sun4m_init(int ram_size, int vga_ram_size, int boot_device,
              const char *initrd_filename);
 
 /* iommu.c */
-void iommu_init();
+void iommu_init(uint32_t addr);
 uint32_t iommu_translate(uint32_t addr);
 
 /* lance.c */
-void lance_init(NetDriverState *nd, int irq);
+void lance_init(NetDriverState *nd, int irq, uint32_t leaddr, uint32_t ledaddr);
 
 /* tcx.c */
-void tcx_init(DisplayState *ds);
+void tcx_init(DisplayState *ds, uint32_t addr);
 
 /* sched.c */
 void sched_init();
 
 /* magic-load.c */
-void magic_init(const char *kfn, int kloadaddr);
+void magic_init(const char *kfn, int kloadaddr, uint32_t addr);
+
+/* timer.c */
+void timer_init(uint32_t addr, int irq);
 
 /* NVRAM helpers */
 #include "hw/m48t59.h"
-- 
2.39.5