static void gic_set_irq(void *opaque, int irq, int level)

{

    gic_state *s = (gic_state *)opaque;

    /* The first external input line is internal interrupt 32.  */

    irq += GIC_INTERNAL;

    if (level == GIC_TEST_LEVEL(irq, ALL_CPU_MASK))

        return;

    if (level) {

        GIC_SET_LEVEL(irq, ALL_CPU_MASK);

        if (GIC_TEST_TRIGGER(irq) || GIC_TEST_ENABLED(irq, ALL_CPU_MASK)) {

            DPRINTF("Set %d pending mask %x\n", irq, GIC_TARGET(irq));

            GIC_SET_PENDING(irq, GIC_TARGET(irq));

        }

    } else {

        GIC_CLEAR_LEVEL(irq, ALL_CPU_MASK);

    }

    gic_update(s);

}


static void virtio_ccw_stop_ioeventfd(VirtioCcwDevice *dev)

{

    VirtIODevice *vdev;

    int n, r;

    if (!dev->ioeventfd_started) {

        return;

    }

    vdev = virtio_bus_get_device(&dev->bus);

    for (n = 0; n < VIRTIO_PCI_QUEUE_MAX; n++) {

        if (!virtio_queue_get_num(vdev, n)) {

            continue;

        }

        r = virtio_ccw_set_guest2host_notifier(dev, n, false, false);

        assert(r >= 0);

    }

    dev->ioeventfd_started = false;

}


static void pl181_fifo_run(pl181_state *s)

{

    uint32_t bits;

    uint32_t value;

    int n;

    int limit;

    int is_read;

    is_read = (s->datactrl & PL181_DATA_DIRECTION) != 0;

    if (s->datacnt != 0 && (!is_read || sd_data_ready(s->card))

            && !s->linux_hack) {

        limit = is_read ? PL181_FIFO_LEN : 0;

        n = 0;

        value = 0;

        while (s->datacnt && s->fifo_len != limit) {

            if (is_read) {

                value |= (uint32_t)sd_read_data(s->card) << (n * 8);

                n++;

                if (n == 4) {

                    pl181_fifo_push(s, value);

                    value = 0;

                    n = 0;

                }

            } else {

                if (n == 0) {

                    value = pl181_fifo_pop(s);

                    n = 4;

                }

                sd_write_data(s->card, value & 0xff);

                value >>= 8;

                n--;

            }

            s->datacnt--;

        }

        if (n && is_read) {

            pl181_fifo_push(s, value);

        }

    }

    s->status &= ~(PL181_STATUS_RX_FIFO | PL181_STATUS_TX_FIFO);

    if (s->datacnt == 0) {

        s->status |= PL181_STATUS_DATAEND;

        /* HACK: */

        s->status |= PL181_STATUS_DATABLOCKEND;

        DPRINTF("Transfer Complete\n");

    }

    if (s->datacnt == 0 && s->fifo_len == 0) {

        s->datactrl &= ~PL181_DATA_ENABLE;

        DPRINTF("Data engine idle\n");

    } else {

        /* Update FIFO bits.  */

        bits = PL181_STATUS_TXACTIVE | PL181_STATUS_RXACTIVE;

        if (s->fifo_len == 0) {

            bits |= PL181_STATUS_TXFIFOEMPTY;

            bits |= PL181_STATUS_RXFIFOEMPTY;

        } else {

            bits |= PL181_STATUS_TXDATAAVLBL;

            bits |= PL181_STATUS_RXDATAAVLBL;

        }

        if (s->fifo_len == 16) {

            bits |= PL181_STATUS_TXFIFOFULL;

            bits |= PL181_STATUS_RXFIFOFULL;

        }

        if (s->fifo_len <= 8) {

            bits |= PL181_STATUS_TXFIFOHALFEMPTY;

        }

        if (s->fifo_len >= 8) {

            bits |= PL181_STATUS_RXFIFOHALFFULL;

        }

        if (s->datactrl & PL181_DATA_DIRECTION) {

            bits &= PL181_STATUS_RX_FIFO;

        } else {

            bits &= PL181_STATUS_TX_FIFO;

        }

        s->status |= bits;

    }

}


envlist_setenv(envlist_t *envlist, const char *env)

{

	struct envlist_entry *entry = NULL;

	const char *eq_sign;

	size_t envname_len;

	if ((envlist == NULL) || (env == NULL))

		return (EINVAL);

	/* find out first equals sign in given env */

	if ((eq_sign = strchr(env, '=')) == NULL)

		return (EINVAL);

	envname_len = eq_sign - env + 1;

	/*

	 * If there already exists variable with given name

	 * we remove and release it before allocating a whole

	 * new entry.

	 */

	for (entry = envlist->el_entries.lh_first; entry != NULL;

	    entry = entry->ev_link.le_next) {

		if (strncmp(entry->ev_var, env, envname_len) == 0)

			break;

	}

	if (entry != NULL) {

		LIST_REMOVE(entry, ev_link);

		free((char *)entry->ev_var);

		free(entry);

	} else {

		envlist->el_count++;

	}

	if ((entry = malloc(sizeof (*entry))) == NULL)

		return (errno);

	if ((entry->ev_var = strdup(env)) == NULL) {

		free(entry);

		return (errno);

	}

	LIST_INSERT_HEAD(&envlist->el_entries, entry, ev_link);

	return (0);

}


int sclp_service_call(CPUS390XState *env, uint32_t sccb, uint64_t code)

{

    int r = 0;

    int shift = 0;

#ifdef DEBUG_HELPER

    printf("sclp(0x%x, 0x%" PRIx64 ")\n", sccb, code);

#endif

    if (sccb & ~0x7ffffff8ul) {

        fprintf(stderr, "KVM: invalid sccb address 0x%x\n", sccb);

        r = -1;

        goto out;

    }

    switch(code) {

        case SCLP_CMDW_READ_SCP_INFO:

        case SCLP_CMDW_READ_SCP_INFO_FORCED:

            while ((ram_size >> (20 + shift)) > 65535) {

                shift++;

            }

            stw_phys(sccb + SCP_MEM_CODE, ram_size >> (20 + shift));

            stb_phys(sccb + SCP_INCREMENT, 1 << shift);

            stw_phys(sccb + SCP_RESPONSE_CODE, 0x10);

            if (kvm_enabled()) {

#ifdef CONFIG_KVM

                kvm_s390_interrupt_internal(env, KVM_S390_INT_SERVICE,

                                            sccb & ~3, 0, 1);

#endif

            } else {

                env->psw.addr += 4;

                ext_interrupt(env, EXT_SERVICE, sccb & ~3, 0);

            }

            break;

        default:

#ifdef DEBUG_HELPER

            printf("KVM: invalid sclp call 0x%x / 0x%" PRIx64 "x\n", sccb, code);

#endif

            r = -1;

            break;

    }

out:

    return r;

}


static int coroutine_fn do_perform_cow(BlockDriverState *bs,

                                       uint64_t src_cluster_offset,

                                       uint64_t cluster_offset,

                                       int offset_in_cluster,

                                       int bytes)

{

    BDRVQcow2State *s = bs->opaque;

    QEMUIOVector qiov;

    struct iovec iov;

    int ret;

    iov.iov_len = bytes;

    iov.iov_base = qemu_try_blockalign(bs, iov.iov_len);

    if (iov.iov_base == NULL) {

        return -ENOMEM;

    }

    qemu_iovec_init_external(&qiov, &iov, 1);

    BLKDBG_EVENT(bs->file, BLKDBG_COW_READ);

    if (!bs->drv) {

        ret = -ENOMEDIUM;

        goto out;

    }

    /* Call .bdrv_co_readv() directly instead of using the public block-layer

     * interface.  This avoids double I/O throttling and request tracking,

     * which can lead to deadlock when block layer copy-on-read is enabled.

     */

    ret = bs->drv->bdrv_co_preadv(bs, src_cluster_offset + offset_in_cluster,

                                  bytes, &qiov, 0);

    if (ret < 0) {

        goto out;

    }

    if (bs->encrypted) {

        Error *err = NULL;

        int64_t sector = (cluster_offset + offset_in_cluster)

                         >> BDRV_SECTOR_BITS;

        assert(s->cipher);

        assert((offset_in_cluster & ~BDRV_SECTOR_MASK) == 0);

        assert((bytes & ~BDRV_SECTOR_MASK) == 0);

        if (qcow2_encrypt_sectors(s, sector, iov.iov_base, iov.iov_base,

                                  bytes >> BDRV_SECTOR_BITS, true, &err) < 0) {

            ret = -EIO;

            error_free(err);

            goto out;

        }

    }

    ret = qcow2_pre_write_overlap_check(bs, 0,

            cluster_offset + offset_in_cluster, bytes);

    if (ret < 0) {

        goto out;

    }

    BLKDBG_EVENT(bs->file, BLKDBG_COW_WRITE);

    ret = bdrv_co_pwritev(bs->file->bs, cluster_offset + offset_in_cluster,

                          bytes, &qiov, 0);

    if (ret < 0) {

        goto out;

    }

    ret = 0;

out:

    qemu_vfree(iov.iov_base);

    return ret;

}


static int get_physical_address_code(CPUState *env,

                                     target_phys_addr_t *physical, int *prot,

                                     target_ulong address, int is_user)

{

    target_ulong mask;

    unsigned int i;

    if ((env->lsu & IMMU_E) == 0) { /* IMMU disabled */

        *physical = address;

        *prot = PAGE_EXEC;

        return 0;

    }

    for (i = 0; i < 64; i++) {

        switch ((env->itlb_tte[i] >> 61) & 3) {

        default:

        case 0x0: // 8k

            mask = 0xffffffffffffe000ULL;

            break;

        case 0x1: // 64k

            mask = 0xffffffffffff0000ULL;

            break;

        case 0x2: // 512k

            mask = 0xfffffffffff80000ULL;

            break;

        case 0x3: // 4M

            mask = 0xffffffffffc00000ULL;

                break;

        }

        // ctx match, vaddr match, valid?

        if (env->dmmuregs[1] == (env->itlb_tag[i] & 0x1fff) &&

            (address & mask) == (env->itlb_tag[i] & mask) &&

            (env->itlb_tte[i] & 0x8000000000000000ULL)) {

            // access ok?

            if ((env->itlb_tte[i] & 0x4) && is_user) {

                if (env->immuregs[3]) /* Fault status register */

                    env->immuregs[3] = 2; /* overflow (not read before

                                             another fault) */

                env->immuregs[3] |= (is_user << 3) | 1;

                env->exception_index = TT_TFAULT;

#ifdef DEBUG_MMU

                printf("TFAULT at 0x%" PRIx64 "\n", address);

#endif

                return 1;

            }

            *physical = ((env->itlb_tte[i] & mask) | (address & ~mask)) &

                        0x1ffffffe000ULL;

            *prot = PAGE_EXEC;

            return 0;

        }

    }

#ifdef DEBUG_MMU

    printf("TMISS at 0x%" PRIx64 "\n", address);

#endif

    /* Context is stored in DMMU (dmmuregs[1]) also for IMMU */

    env->immuregs[6] = (address & ~0x1fffULL) | (env->dmmuregs[1] & 0x1fff);

    env->exception_index = TT_TMISS;

    return 1;

}


BlockAIOCB *thread_pool_submit_aio(ThreadPool *pool,

        ThreadPoolFunc *func, void *arg,

        BlockCompletionFunc *cb, void *opaque)

{

    ThreadPoolElement *req;

    req = qemu_aio_get(&thread_pool_aiocb_info, NULL, cb, opaque);

    req->func = func;

    req->arg = arg;

    req->state = THREAD_QUEUED;

    req->pool = pool;

    QLIST_INSERT_HEAD(&pool->head, req, all);

    trace_thread_pool_submit(pool, req, arg);

    qemu_mutex_lock(&pool->lock);

    if (pool->idle_threads == 0 && pool->cur_threads < pool->max_threads) {

        spawn_thread(pool);

    }

    QTAILQ_INSERT_TAIL(&pool->request_list, req, reqs);

    qemu_mutex_unlock(&pool->lock);

    qemu_sem_post(&pool->sem);

    return &req->common;

}


static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)

{

    struct tcphdr *ptcp, *stcp;

    int res;

    trace_colo_compare_main("compare tcp");

    ptcp = (struct tcphdr *)ppkt->transport_header;

    stcp = (struct tcphdr *)spkt->transport_header;

    /*

     * The 'identification' field in the IP header is *very* random

     * it almost never matches.  Fudge this by ignoring differences in

     * unfragmented packets; they'll normally sort themselves out if different

     * anyway, and it should recover at the TCP level.

     * An alternative would be to get both the primary and secondary to rewrite

     * somehow; but that would need some sync traffic to sync the state

     */

    if (ntohs(ppkt->ip->ip_off) & IP_DF) {

        spkt->ip->ip_id = ppkt->ip->ip_id;

        /* and the sum will be different if the IDs were different */

        spkt->ip->ip_sum = ppkt->ip->ip_sum;

    }

    if (ptcp->th_sum == stcp->th_sum) {

        res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN);

    } else {

        res = -1;

    }

    if (res != 0 && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {

        trace_colo_compare_pkt_info_src(inet_ntoa(ppkt->ip->ip_src),

                                        ntohl(stcp->th_seq),

                                        ntohl(stcp->th_ack),

                                        res, stcp->th_flags,

                                        spkt->size);

        trace_colo_compare_pkt_info_dst(inet_ntoa(ppkt->ip->ip_dst),

                                        ntohl(ptcp->th_seq),

                                        ntohl(ptcp->th_ack),

                                        res, ptcp->th_flags,

                                        ppkt->size);

        qemu_hexdump((char *)ppkt->data, stderr,

                     "colo-compare ppkt", ppkt->size);

        qemu_hexdump((char *)spkt->data, stderr,

                     "colo-compare spkt", spkt->size);

    }

    return res;

}


static void data_plane_blk_insert_notifier(Notifier *n, void *data)

{

    VirtIOBlockDataPlane *s = container_of(n, VirtIOBlockDataPlane,

                                           insert_notifier);

    assert(s->conf->conf.blk == data);

    data_plane_set_up_op_blockers(s);

}


static void vapic_write(void *opaque, target_phys_addr_t addr, uint64_t data,

                        unsigned int size)

{

    CPUX86State *env = cpu_single_env;

    target_phys_addr_t rom_paddr;

    VAPICROMState *s = opaque;

    cpu_synchronize_state(env);

    /*

     * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.

     *  o 16-bit write access:

     *    Reports the option ROM initialization to the hypervisor. Written

     *    value is the offset of the state structure in the ROM.

     *  o 8-bit write access:

     *    Reactivates the VAPIC after a guest hibernation, i.e. after the

     *    option ROM content has been re-initialized by a guest power cycle.

     *  o 32-bit write access:

     *    Poll for pending IRQs, considering the current VAPIC state.

     */

    switch (size) {

    case 2:

        if (s->state == VAPIC_INACTIVE) {

            rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK;

            s->rom_state_paddr = rom_paddr + data;

            s->state = VAPIC_STANDBY;

        }

        if (vapic_prepare(s) < 0) {

            s->state = VAPIC_INACTIVE;

            break;

        }

        break;

    case 1:

        if (kvm_enabled()) {

            /*

             * Disable triggering instruction in ROM by writing a NOP.

             *

             * We cannot do this in TCG mode as the reported IP is not

             * accurate.

             */

            pause_all_vcpus();

            patch_byte(env, env->eip - 2, 0x66);

            patch_byte(env, env->eip - 1, 0x90);

            resume_all_vcpus();

        }

        if (s->state == VAPIC_ACTIVE) {

            break;

        }

        if (update_rom_mapping(s, env, env->eip) < 0) {

            break;

        }

        if (find_real_tpr_addr(s, env) < 0) {

            break;

        }

        vapic_enable(s, env);

        break;

    default:

    case 4:

        if (!kvm_irqchip_in_kernel()) {

            apic_poll_irq(env->apic_state);

        }

        break;

    }

}


long do_rt_sigreturn(CPUM68KState *env)

{

    struct target_rt_sigframe *frame;

    abi_ulong frame_addr = env->aregs[7] - 4;

    target_sigset_t target_set;

    sigset_t set;

    int d0;

    if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1))

        goto badframe;

    target_to_host_sigset_internal(&set, &target_set);

    sigprocmask(SIG_SETMASK, &set, NULL);

    /* restore registers */

    if (target_rt_restore_ucontext(env, &frame->uc, &d0))

        goto badframe;

    if (do_sigaltstack(frame_addr +

                       offsetof(struct target_rt_sigframe, uc.tuc_stack),

                       0, get_sp_from_cpustate(env)) == -EFAULT)

        goto badframe;

    unlock_user_struct(frame, frame_addr, 0);

    return d0;

badframe:

    unlock_user_struct(frame, frame_addr, 0);

    force_sig(TARGET_SIGSEGV);

    return 0;

}


static int32_t scsi_unit_attention(SCSIRequest *req, uint8_t *buf)

{

    if (req->dev && req->dev->unit_attention.key == UNIT_ATTENTION) {

        scsi_req_build_sense(req, req->dev->unit_attention);

    } else if (req->bus->unit_attention.key == UNIT_ATTENTION) {

        scsi_req_build_sense(req, req->bus->unit_attention);

    }

    scsi_req_complete(req, CHECK_CONDITION);

    return 0;

}


static void vc1_decode_skip_blocks(VC1Context *v)

{

    MpegEncContext *s = &v->s;

    ff_er_add_slice(s, 0, s->start_mb_y, s->mb_width - 1, s->end_mb_y - 1, ER_MB_END);

    s->first_slice_line = 1;

    for (s->mb_y = s->start_mb_y; s->mb_y < s->end_mb_y; s->mb_y++) {

        s->mb_x = 0;

        ff_init_block_index(s);

        ff_update_block_index(s);

        if (s->last_picture.f.data[0]) {

            memcpy(s->dest[0], s->last_picture.f.data[0] + s->mb_y * 16 * s->linesize,   s->linesize   * 16);

            memcpy(s->dest[1], s->last_picture.f.data[1] + s->mb_y *  8 * s->uvlinesize, s->uvlinesize *  8);

            memcpy(s->dest[2], s->last_picture.f.data[2] + s->mb_y *  8 * s->uvlinesize, s->uvlinesize *  8);

        }

        ff_draw_horiz_band(s, s->mb_y * 16, 16);

        s->first_slice_line = 0;

    }

    s->pict_type = AV_PICTURE_TYPE_P;

}


static ExitStatus gen_mfpr(TCGv va, int regno)

{

    int data = cpu_pr_data(regno);

    /* Special help for VMTIME and WALLTIME.  */

    if (regno == 250 || regno == 249) {

	void (*helper)(TCGv) = gen_helper_get_walltime;

	if (regno == 249) {

		helper = gen_helper_get_vmtime;

	}

        if (use_icount) {

            gen_io_start();

            helper(va);

            gen_io_end();

            return EXIT_PC_STALE;

        } else {

            helper(va);

            return NO_EXIT;

        }

    }

    /* The basic registers are data only, and unknown registers

       are read-zero, write-ignore.  */

    if (data == 0) {

        tcg_gen_movi_i64(va, 0);

    } else if (data & PR_BYTE) {

        tcg_gen_ld8u_i64(va, cpu_env, data & ~PR_BYTE);

    } else if (data & PR_LONG) {

        tcg_gen_ld32s_i64(va, cpu_env, data & ~PR_LONG);

    } else {

        tcg_gen_ld_i64(va, cpu_env, data);

    }

    return NO_EXIT;

}


static char *SocketAddress_to_str(const char *prefix, SocketAddress *addr,

                                  bool is_listen, bool is_telnet)

{

    switch (addr->type) {

    case SOCKET_ADDRESS_KIND_INET:

        return g_strdup_printf("%s%s:%s:%s%s", prefix,

                               is_telnet ? "telnet" : "tcp", addr->u.inet->host,

                               addr->u.inet->port, is_listen ? ",server" : "");

        break;

    case SOCKET_ADDRESS_KIND_UNIX:

        return g_strdup_printf("%sunix:%s%s", prefix,

                               addr->u.q_unix->path,

                               is_listen ? ",server" : "");

        break;

    case SOCKET_ADDRESS_KIND_FD:

        return g_strdup_printf("%sfd:%s%s", prefix, addr->u.fd->str,

                               is_listen ? ",server" : "");

        break;

    default:

        abort();

    }

}


static void blkdebug_refresh_limits(BlockDriverState *bs, Error **errp)

{

    BDRVBlkdebugState *s = bs->opaque;

    if (s->align) {

        bs->request_alignment = s->align;

    }

}


static int add_rule(QemuOpts *opts, void *opaque)

{

    struct add_rule_data *d = opaque;

    BDRVBlkdebugState *s = d->s;

    const char* event_name;

    BlkDebugEvent event;

    struct BlkdebugRule *rule;

    /* Find the right event for the rule */

    event_name = qemu_opt_get(opts, "event");

    if (!event_name || get_event_by_name(event_name, &event) < 0) {

        return -1;

    }

    /* Set attributes common for all actions */

    rule = g_malloc0(sizeof(*rule));

    *rule = (struct BlkdebugRule) {

        .event  = event,

        .action = d->action,

        .state  = qemu_opt_get_number(opts, "state", 0),

    };

    /* Parse action-specific options */

    switch (d->action) {

    case ACTION_INJECT_ERROR:

        rule->options.inject.error = qemu_opt_get_number(opts, "errno", EIO);

        rule->options.inject.once  = qemu_opt_get_bool(opts, "once", 0);

        rule->options.inject.immediately =

            qemu_opt_get_bool(opts, "immediately", 0);

        rule->options.inject.sector = qemu_opt_get_number(opts, "sector", -1);

        break;

    case ACTION_SET_STATE:

        rule->options.set_state.new_state =

            qemu_opt_get_number(opts, "new_state", 0);

        break;

    case ACTION_SUSPEND:

        rule->options.suspend.tag =

            g_strdup(qemu_opt_get(opts, "tag"));

        break;

    };

    /* Add the rule */

    QLIST_INSERT_HEAD(&s->rules[event], rule, next);

    return 0;

}


static int cmos_get_fd_drive_type(FloppyDriveType fd0)

{

    int val;

    switch (fd0) {

    case FLOPPY_DRIVE_TYPE_144:

        /* 1.44 Mb 3"5 drive */

        val = 4;

        break;

    case FLOPPY_DRIVE_TYPE_288:

        /* 2.88 Mb 3"5 drive */

        val = 5;

        break;

    case FLOPPY_DRIVE_TYPE_120:

        /* 1.2 Mb 5"5 drive */

        val = 2;

        break;

    case FLOPPY_DRIVE_TYPE_NONE:

    default:

        val = 0;

        break;

    }

    return val;

}


void bdrv_flush_io_queue(BlockDriverState *bs)

{

    BlockDriver *drv = bs->drv;

    if (drv && drv->bdrv_flush_io_queue) {

        drv->bdrv_flush_io_queue(bs);

    } else if (bs->file) {

        bdrv_flush_io_queue(bs->file);

    }

}


static void rtas_event_log_queue(int log_type, void *data, bool exception)

{

    sPAPRMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());

    sPAPREventLogEntry *entry = g_new(sPAPREventLogEntry, 1);

    g_assert(data);

    entry->log_type = log_type;

    entry->exception = exception;

    entry->data = data;

    QTAILQ_INSERT_TAIL(&spapr->pending_events, entry, next);

}


static int pci_set_default_subsystem_id(PCIDevice *pci_dev)

{

    uint16_t *id;

    id = (void*)(&pci_dev->config[PCI_SUBSYSTEM_VENDOR_ID]);

    id[0] = cpu_to_le16(pci_default_sub_vendor_id);

    id[1] = cpu_to_le16(pci_default_sub_device_id);

    return 0;

}


static inline uint8_t *get_seg_base(uint32_t e1, uint32_t e2)

{

    return (uint8_t *)((e1 >> 16) | ((e2 & 0xff) << 16) | (e2 & 0xff000000));

}


int ff_h264_decode_seq_parameter_set(GetBitContext *gb, AVCodecContext *avctx,

                                     H264ParamSets *ps, int ignore_truncation)

{

    AVBufferRef *sps_buf;

    int profile_idc, level_idc, constraint_set_flags = 0;

    unsigned int sps_id;

    int i, log2_max_frame_num_minus4;

    SPS *sps;

    sps_buf = av_buffer_allocz(sizeof(*sps));

    if (!sps_buf)

        return AVERROR(ENOMEM);

    sps = (SPS*)sps_buf->data;

    sps->data_size = gb->buffer_end - gb->buffer;

    if (sps->data_size > sizeof(sps->data)) {

        av_log(avctx, AV_LOG_WARNING, "Truncating likely oversized SPS\n");

        sps->data_size = sizeof(sps->data);

    }

    memcpy(sps->data, gb->buffer, sps->data_size);

    profile_idc           = get_bits(gb, 8);

    constraint_set_flags |= get_bits1(gb) << 0;   // constraint_set0_flag

    constraint_set_flags |= get_bits1(gb) << 1;   // constraint_set1_flag

    constraint_set_flags |= get_bits1(gb) << 2;   // constraint_set2_flag

    constraint_set_flags |= get_bits1(gb) << 3;   // constraint_set3_flag

    constraint_set_flags |= get_bits1(gb) << 4;   // constraint_set4_flag

    constraint_set_flags |= get_bits1(gb) << 5;   // constraint_set5_flag

    skip_bits(gb, 2);                             // reserved_zero_2bits

    level_idc = get_bits(gb, 8);

    sps_id    = get_ue_golomb_31(gb);

    if (sps_id >= MAX_SPS_COUNT) {

        av_log(avctx, AV_LOG_ERROR, "sps_id %u out of range\n", sps_id);

        goto fail;

    }

    sps->sps_id               = sps_id;

    sps->time_offset_length   = 24;

    sps->profile_idc          = profile_idc;

    sps->constraint_set_flags = constraint_set_flags;

    sps->level_idc            = level_idc;

    sps->full_range           = -1;

    memset(sps->scaling_matrix4, 16, sizeof(sps->scaling_matrix4));

    memset(sps->scaling_matrix8, 16, sizeof(sps->scaling_matrix8));

    sps->scaling_matrix_present = 0;

    sps->colorspace = 2; //AVCOL_SPC_UNSPECIFIED

    if (sps->profile_idc == 100 ||  // High profile

        sps->profile_idc == 110 ||  // High10 profile

        sps->profile_idc == 122 ||  // High422 profile

        sps->profile_idc == 244 ||  // High444 Predictive profile

        sps->profile_idc ==  44 ||  // Cavlc444 profile

        sps->profile_idc ==  83 ||  // Scalable Constrained High profile (SVC)

        sps->profile_idc ==  86 ||  // Scalable High Intra profile (SVC)

        sps->profile_idc == 118 ||  // Stereo High profile (MVC)

        sps->profile_idc == 128 ||  // Multiview High profile (MVC)

        sps->profile_idc == 138 ||  // Multiview Depth High profile (MVCD)

        sps->profile_idc == 144) {  // old High444 profile

        sps->chroma_format_idc = get_ue_golomb_31(gb);

        if (sps->chroma_format_idc > 3U) {

            avpriv_request_sample(avctx, "chroma_format_idc %u",

                                  sps->chroma_format_idc);

            goto fail;

        } else if (sps->chroma_format_idc == 3) {

            sps->residual_color_transform_flag = get_bits1(gb);

            if (sps->residual_color_transform_flag) {

                av_log(avctx, AV_LOG_ERROR, "separate color planes are not supported\n");

                goto fail;

            }

        }

        sps->bit_depth_luma   = get_ue_golomb(gb) + 8;

        sps->bit_depth_chroma = get_ue_golomb(gb) + 8;

        if (sps->bit_depth_chroma != sps->bit_depth_luma) {

            avpriv_request_sample(avctx,

                                  "Different chroma and luma bit depth");

            goto fail;

        }

        if (sps->bit_depth_luma   < 8 || sps->bit_depth_luma   > 14 ||

            sps->bit_depth_chroma < 8 || sps->bit_depth_chroma > 14) {

            av_log(avctx, AV_LOG_ERROR, "illegal bit depth value (%d, %d)\n",

                   sps->bit_depth_luma, sps->bit_depth_chroma);

            goto fail;

        }

        sps->transform_bypass = get_bits1(gb);

        sps->scaling_matrix_present |= decode_scaling_matrices(gb, sps, NULL, 1,

                                sps->scaling_matrix4, sps->scaling_matrix8);

    } else {

        sps->chroma_format_idc = 1;

        sps->bit_depth_luma    = 8;

        sps->bit_depth_chroma  = 8;

    }

    log2_max_frame_num_minus4 = get_ue_golomb(gb);

    if (log2_max_frame_num_minus4 < MIN_LOG2_MAX_FRAME_NUM - 4 ||

        log2_max_frame_num_minus4 > MAX_LOG2_MAX_FRAME_NUM - 4) {

        av_log(avctx, AV_LOG_ERROR,

               "log2_max_frame_num_minus4 out of range (0-12): %d\n",

               log2_max_frame_num_minus4);

        goto fail;

    }

    sps->log2_max_frame_num = log2_max_frame_num_minus4 + 4;

    sps->poc_type = get_ue_golomb_31(gb);

    if (sps->poc_type == 0) { // FIXME #define

        unsigned t = get_ue_golomb(gb);

        if (t>12) {

            av_log(avctx, AV_LOG_ERROR, "log2_max_poc_lsb (%d) is out of range\n", t);

            goto fail;

        }

        sps->log2_max_poc_lsb = t + 4;

    } else if (sps->poc_type == 1) { // FIXME #define

        sps->delta_pic_order_always_zero_flag = get_bits1(gb);

        sps->offset_for_non_ref_pic           = get_se_golomb(gb);

        sps->offset_for_top_to_bottom_field   = get_se_golomb(gb);

        sps->poc_cycle_length                 = get_ue_golomb(gb);

        if ((unsigned)sps->poc_cycle_length >=

            FF_ARRAY_ELEMS(sps->offset_for_ref_frame)) {

            av_log(avctx, AV_LOG_ERROR,

                   "poc_cycle_length overflow %d\n", sps->poc_cycle_length);

            goto fail;

        }

        for (i = 0; i < sps->poc_cycle_length; i++)

            sps->offset_for_ref_frame[i] = get_se_golomb(gb);

    } else if (sps->poc_type != 2) {

        av_log(avctx, AV_LOG_ERROR, "illegal POC type %d\n", sps->poc_type);

        goto fail;

    }

    sps->ref_frame_count = get_ue_golomb_31(gb);

    if (avctx->codec_tag == MKTAG('S', 'M', 'V', '2'))

        sps->ref_frame_count = FFMAX(2, sps->ref_frame_count);

    if (sps->ref_frame_count > H264_MAX_PICTURE_COUNT - 2 ||

        sps->ref_frame_count > 16U) {

        av_log(avctx, AV_LOG_ERROR,

               "too many reference frames %d\n", sps->ref_frame_count);

        goto fail;

    }

    sps->gaps_in_frame_num_allowed_flag = get_bits1(gb);

    sps->mb_width                       = get_ue_golomb(gb) + 1;

    sps->mb_height                      = get_ue_golomb(gb) + 1;

    if ((unsigned)sps->mb_width  >= INT_MAX / 16 ||

        (unsigned)sps->mb_height >= INT_MAX / 16 ||

        av_image_check_size(16 * sps->mb_width,

                            16 * sps->mb_height, 0, avctx)) {

        av_log(avctx, AV_LOG_ERROR, "mb_width/height overflow\n");

        goto fail;

    }

    sps->frame_mbs_only_flag = get_bits1(gb);

    if (!sps->frame_mbs_only_flag)

        sps->mb_aff = get_bits1(gb);

    else

        sps->mb_aff = 0;

    sps->direct_8x8_inference_flag = get_bits1(gb);

#ifndef ALLOW_INTERLACE

    if (sps->mb_aff)

        av_log(avctx, AV_LOG_ERROR,

               "MBAFF support not included; enable it at compile-time.\n");

#endif

    sps->crop = get_bits1(gb);

    if (sps->crop) {

        unsigned int crop_left   = get_ue_golomb(gb);

        unsigned int crop_right  = get_ue_golomb(gb);

        unsigned int crop_top    = get_ue_golomb(gb);

        unsigned int crop_bottom = get_ue_golomb(gb);

        int width  = 16 * sps->mb_width;

        int height = 16 * sps->mb_height * (2 - sps->frame_mbs_only_flag);

        if (avctx->flags2 & AV_CODEC_FLAG2_IGNORE_CROP) {

            av_log(avctx, AV_LOG_DEBUG, "discarding sps cropping, original "

                                           "values are l:%d r:%d t:%d b:%d\n",

                   crop_left, crop_right, crop_top, crop_bottom);

            sps->crop_left   =

            sps->crop_right  =

            sps->crop_top    =

            sps->crop_bottom = 0;

        } else {

            int vsub   = (sps->chroma_format_idc == 1) ? 1 : 0;

            int hsub   = (sps->chroma_format_idc == 1 ||

                          sps->chroma_format_idc == 2) ? 1 : 0;

            int step_x = 1 << hsub;

            int step_y = (2 - sps->frame_mbs_only_flag) << vsub;

            if (crop_left & (0x1F >> (sps->bit_depth_luma > 8)) &&

                !(avctx->flags & AV_CODEC_FLAG_UNALIGNED)) {

                crop_left &= ~(0x1F >> (sps->bit_depth_luma > 8));

                av_log(avctx, AV_LOG_WARNING,

                       "Reducing left cropping to %d "

                       "chroma samples to preserve alignment.\n",

                       crop_left);

            }

            if (crop_left  > (unsigned)INT_MAX / 4 / step_x ||

                crop_right > (unsigned)INT_MAX / 4 / step_x ||

                crop_top   > (unsigned)INT_MAX / 4 / step_y ||

                crop_bottom> (unsigned)INT_MAX / 4 / step_y ||

                (crop_left + crop_right ) * step_x >= width ||

                (crop_top  + crop_bottom) * step_y >= height

            ) {

                av_log(avctx, AV_LOG_ERROR, "crop values invalid %d %d %d %d / %d %d\n", crop_left, crop_right, crop_top, crop_bottom, width, height);

                goto fail;

            }

            sps->crop_left   = crop_left   * step_x;

            sps->crop_right  = crop_right  * step_x;

            sps->crop_top    = crop_top    * step_y;

            sps->crop_bottom = crop_bottom * step_y;

        }

    } else {

        sps->crop_left   =

        sps->crop_right  =

        sps->crop_top    =

        sps->crop_bottom =

        sps->crop        = 0;

    }

    sps->vui_parameters_present_flag = get_bits1(gb);

    if (sps->vui_parameters_present_flag) {

        int ret = decode_vui_parameters(gb, avctx, sps);

        if (ret < 0)

            goto fail;

    }

    if (get_bits_left(gb) < 0) {

        av_log(avctx, ignore_truncation ? AV_LOG_WARNING : AV_LOG_ERROR,

               "Overread %s by %d bits\n", sps->vui_parameters_present_flag ? "VUI" : "SPS", -get_bits_left(gb));

        if (!ignore_truncation)

            goto fail;

    }

    /* if the maximum delay is not stored in the SPS, derive it based on the

     * level */

    if (!sps->bitstream_restriction_flag) {

        sps->num_reorder_frames = MAX_DELAYED_PIC_COUNT - 1;

        for (i = 0; i < FF_ARRAY_ELEMS(level_max_dpb_mbs); i++) {

            if (level_max_dpb_mbs[i][0] == sps->level_idc) {

                sps->num_reorder_frames = FFMIN(level_max_dpb_mbs[i][1] / (sps->mb_width * sps->mb_height),

                                                sps->num_reorder_frames);

                break;

            }

        }

    }

    if (!sps->sar.den)

        sps->sar.den = 1;

    if (avctx->debug & FF_DEBUG_PICT_INFO) {

        static const char csp[4][5] = { "Gray", "420", "422", "444" };

        av_log(avctx, AV_LOG_DEBUG,

               "sps:%u profile:%d/%d poc:%d ref:%d %dx%d %s %s crop:%u/%u/%u/%u %s %s %"PRId32"/%"PRId32" b%d reo:%d\n",

               sps_id, sps->profile_idc, sps->level_idc,

               sps->poc_type,

               sps->ref_frame_count,

               sps->mb_width, sps->mb_height,

               sps->frame_mbs_only_flag ? "FRM" : (sps->mb_aff ? "MB-AFF" : "PIC-AFF"),

               sps->direct_8x8_inference_flag ? "8B8" : "",

               sps->crop_left, sps->crop_right,

               sps->crop_top, sps->crop_bottom,

               sps->vui_parameters_present_flag ? "VUI" : "",

               csp[sps->chroma_format_idc],

               sps->timing_info_present_flag ? sps->num_units_in_tick : 0,

               sps->timing_info_present_flag ? sps->time_scale : 0,

               sps->bit_depth_luma,

               sps->bitstream_restriction_flag ? sps->num_reorder_frames : -1

               );

    }

    /* check if this is a repeat of an already parsed SPS, then keep the

     * original one.

     * otherwise drop all PPSes that depend on it */

    if (ps->sps_list[sps_id] &&

        !memcmp(ps->sps_list[sps_id]->data, sps_buf->data, sps_buf->size)) {

        av_buffer_unref(&sps_buf);

    } else {

        remove_sps(ps, sps_id);

        ps->sps_list[sps_id] = sps_buf;

    }

    return 0;

fail:

    av_buffer_unref(&sps_buf);

    return AVERROR_INVALIDDATA;

}


static void invalidate_and_set_dirty(MemoryRegion *mr, hwaddr addr,

                                     hwaddr length)

{

    if (cpu_physical_memory_range_includes_clean(addr, length)) {

        uint8_t dirty_log_mask = memory_region_get_dirty_log_mask(mr);

        if (dirty_log_mask & (1 << DIRTY_MEMORY_CODE)) {

            tb_invalidate_phys_range(addr, addr + length);

            dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);

        }

        cpu_physical_memory_set_dirty_range(addr, length, dirty_log_mask);

    } else {

        xen_modified_memory(addr, length);

    }

}


void ich9_lpc_pm_init(PCIDevice *lpc_pci)

{

    ICH9LPCState *lpc = ICH9_LPC_DEVICE(lpc_pci);

    ich9_pm_init(lpc_pci, &lpc->pm, qemu_allocate_irq(ich9_set_sci, lpc, 0));

    ich9_lpc_reset(&lpc->d.qdev);

}


static void term_show_prompt(void)

{

    term_show_prompt2();

    term_cmd_buf_index = 0;

    term_cmd_buf_size = 0;

}


static int vfio_add_capabilities(VFIOPCIDevice *vdev)

{

    PCIDevice *pdev = &vdev->pdev;

    int ret;

    if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST) ||

        !pdev->config[PCI_CAPABILITY_LIST]) {

        return 0; /* Nothing to add */

    }

    ret = vfio_add_std_cap(vdev, pdev->config[PCI_CAPABILITY_LIST]);

    if (ret) {

        return ret;

    }

    /* on PCI bus, it doesn't make sense to expose extended capabilities. */

    if (!pci_is_express(pdev) ||

        !pci_bus_is_express(pdev->bus) ||

        !pci_get_long(pdev->config + PCI_CONFIG_SPACE_SIZE)) {

        return 0;

    }

    return vfio_add_ext_cap(vdev);

}


static void test_qemu_strtosz_units(void)

{

    const char *none = "1";

    const char *b = "1B";

    const char *k = "1K";

    const char *m = "1M";

    const char *g = "1G";

    const char *t = "1T";

    const char *p = "1P";

    const char *e = "1E";

    char *endptr = NULL;

    int64_t res;

    /* default is M */

    res = qemu_strtosz_MiB(none, &endptr);

    g_assert_cmpint(res, ==, M_BYTE);

    g_assert(endptr == none + 1);

    res = qemu_strtosz(b, &endptr);

    g_assert_cmpint(res, ==, 1);

    g_assert(endptr == b + 2);

    res = qemu_strtosz(k, &endptr);

    g_assert_cmpint(res, ==, K_BYTE);

    g_assert(endptr == k + 2);

    res = qemu_strtosz(m, &endptr);

    g_assert_cmpint(res, ==, M_BYTE);

    g_assert(endptr == m + 2);

    res = qemu_strtosz(g, &endptr);

    g_assert_cmpint(res, ==, G_BYTE);

    g_assert(endptr == g + 2);

    res = qemu_strtosz(t, &endptr);

    g_assert_cmpint(res, ==, T_BYTE);

    g_assert(endptr == t + 2);

    res = qemu_strtosz(p, &endptr);

    g_assert_cmpint(res, ==, P_BYTE);

    g_assert(endptr == p + 2);

    res = qemu_strtosz(e, &endptr);

    g_assert_cmpint(res, ==, E_BYTE);

    g_assert(endptr == e + 2);

}


static inline void gen_op_arith_divd(DisasContext *ctx, TCGv ret, TCGv arg1,

                                     TCGv arg2, int sign, int compute_ov)

{

    int l1 = gen_new_label();

    int l2 = gen_new_label();

    tcg_gen_brcondi_i64(TCG_COND_EQ, arg2, 0, l1);

    if (sign) {

        int l3 = gen_new_label();

        tcg_gen_brcondi_i64(TCG_COND_NE, arg2, -1, l3);

        tcg_gen_brcondi_i64(TCG_COND_EQ, arg1, INT64_MIN, l1);

        gen_set_label(l3);

        tcg_gen_div_i64(ret, arg1, arg2);

    } else {

        tcg_gen_divu_i64(ret, arg1, arg2);

    }

    if (compute_ov) {

        tcg_gen_movi_tl(cpu_ov, 0);

    }

    tcg_gen_br(l2);

    gen_set_label(l1);

    if (sign) {

        tcg_gen_sari_i64(ret, arg1, 63);

    } else {

        tcg_gen_movi_i64(ret, 0);

    }

    if (compute_ov) {

        tcg_gen_movi_tl(cpu_ov, 1);

        tcg_gen_movi_tl(cpu_so, 1);

    }

    gen_set_label(l2);

    if (unlikely(Rc(ctx->opcode) != 0))

        gen_set_Rc0(ctx, ret);

}


static int os_host_main_loop_wait(int timeout)

{

    int ret, i;

    PollingEntry *pe;

    WaitObjects *w = &wait_objects;

    static struct timeval tv0;

    /* XXX: need to suppress polling by better using win32 events */

    ret = 0;

    for (pe = first_polling_entry; pe != NULL; pe = pe->next) {

        ret |= pe->func(pe->opaque);

    }

    if (ret != 0) {

        return ret;

    }

    if (nfds >= 0) {

        ret = select(nfds + 1, &rfds, &wfds, &xfds, &tv0);

        if (ret != 0) {

            timeout = 0;

        }

    }

    for (i = 0; i < w->num; i++) {

        poll_fds[i].fd = (DWORD) w->events[i];

        poll_fds[i].events = G_IO_IN;

    }

    qemu_mutex_unlock_iothread();

    ret = g_poll(poll_fds, w->num, timeout);

    qemu_mutex_lock_iothread();

    if (ret > 0) {

        for (i = 0; i < w->num; i++) {

            w->revents[i] = poll_fds[i].revents;

        }

        for (i = 0; i < w->num; i++) {

            if (w->revents[i] && w->func[i]) {

                w->func[i](w->opaque[i]);

            }

        }

    }

    /* If an edge-triggered socket event occurred, select will return a

     * positive result on the next iteration.  We do not need to do anything

     * here.

     */

    return ret;

}


static int asf_write_header(AVFormatContext *s)

{

    ASFContext *asf = s->priv_data;

    asf->packet_size = PACKET_SIZE;

    asf->nb_packets = 0;

    asf->last_indexed_pts = 0;

    asf->index_ptr = (ASFIndex*)av_malloc( sizeof(ASFIndex) * ASF_INDEX_BLOCK );

    asf->nb_index_memory_alloc = ASF_INDEX_BLOCK;

    asf->nb_index_count = 0;

    asf->maximum_packet = 0;

    /* the data-chunk-size has to be 50, which is data_size - asf->data_offset

     *  at the moment this function is done. It is needed to use asf as

     *  streamable format. */

    if (asf_write_header1(s, 0, 50) < 0) {

        //av_free(asf);

        return -1;

    }

    put_flush_packet(s->pb);

    asf->packet_nb_payloads = 0;

    asf->packet_timestamp_start = -1;

    asf->packet_timestamp_end = -1;

    init_put_byte(&asf->pb, asf->packet_buf, asf->packet_size, 1,

                  NULL, NULL, NULL, NULL);

    return 0;

}


static int do_syscall(CPUState *env,

                      struct kqemu_cpu_state *kenv)

{

    int selector;

    selector = (env->star >> 32) & 0xffff;

#ifdef TARGET_X86_64

    if (env->hflags & HF_LMA_MASK) {

        int code64;

        env->regs[R_ECX] = kenv->next_eip;

        env->regs[11] = env->eflags;

        code64 = env->hflags & HF_CS64_MASK;

        cpu_x86_set_cpl(env, 0);

        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,

                               0, 0xffffffff,

                               DESC_G_MASK | DESC_P_MASK |

                               DESC_S_MASK |

                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);

        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,

                               0, 0xffffffff,

                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |

                               DESC_S_MASK |

                               DESC_W_MASK | DESC_A_MASK);

        env->eflags &= ~env->fmask;

        if (code64)

            env->eip = env->lstar;

        else

            env->eip = env->cstar;

    } else

#endif

    {

        env->regs[R_ECX] = (uint32_t)kenv->next_eip;

        cpu_x86_set_cpl(env, 0);

        cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,

                           0, 0xffffffff,

                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |

                               DESC_S_MASK |

                               DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);

        cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,

                               0, 0xffffffff,

                               DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |

                               DESC_S_MASK |

                               DESC_W_MASK | DESC_A_MASK);

        env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);

        env->eip = (uint32_t)env->star;

    }

    return 2;

}


gdb_handlesig(CPUState *cpu, int sig)

{

    GDBState *s;

    char buf[256];

    int n;

    s = gdbserver_state;

    if (gdbserver_fd < 0 || s->fd < 0) {

        return sig;

    }

    /* disable single step if it was enabled */

    cpu_single_step(cpu, 0);

    tb_flush(cpu);

    if (sig != 0) {

        snprintf(buf, sizeof(buf), "S%02x", target_signal_to_gdb(sig));

        put_packet(s, buf);

    }

    /* put_packet() might have detected that the peer terminated the

       connection.  */

    if (s->fd < 0) {

        return sig;

    }

    sig = 0;

    s->state = RS_IDLE;

    s->running_state = 0;

    while (s->running_state == 0) {

        n = read(s->fd, buf, 256);

        if (n > 0) {

            int i;

            for (i = 0; i < n; i++) {

                gdb_read_byte(s, buf[i]);

            }

        } else if (n == 0 || errno != EAGAIN) {

            /* XXX: Connection closed.  Should probably wait for another

               connection before continuing.  */

            return sig;

        }

    }

    sig = s->signal;

    s->signal = 0;

    return sig;

}


void xen_map_cache_init(void)

{

    unsigned long size;

    struct rlimit rlimit_as;

    mapcache = g_malloc0(sizeof (MapCache));

    QTAILQ_INIT(&mapcache->locked_entries);

    mapcache->last_address_index = -1;

    if (geteuid() == 0) {

        rlimit_as.rlim_cur = RLIM_INFINITY;

        rlimit_as.rlim_max = RLIM_INFINITY;

        mapcache->max_mcache_size = MCACHE_MAX_SIZE;

    } else {

        getrlimit(RLIMIT_AS, &rlimit_as);

        rlimit_as.rlim_cur = rlimit_as.rlim_max;

        if (rlimit_as.rlim_max != RLIM_INFINITY) {

            fprintf(stderr, "Warning: QEMU's maximum size of virtual"

                    " memory is not infinity.\n");

        }

        if (rlimit_as.rlim_max < MCACHE_MAX_SIZE + NON_MCACHE_MEMORY_SIZE) {

            mapcache->max_mcache_size = rlimit_as.rlim_max -

                NON_MCACHE_MEMORY_SIZE;

        } else {

            mapcache->max_mcache_size = MCACHE_MAX_SIZE;

        }

    }

    setrlimit(RLIMIT_AS, &rlimit_as);

    mapcache->nr_buckets =

        (((mapcache->max_mcache_size >> XC_PAGE_SHIFT) +

          (1UL << (MCACHE_BUCKET_SHIFT - XC_PAGE_SHIFT)) - 1) >>

         (MCACHE_BUCKET_SHIFT - XC_PAGE_SHIFT));

    size = mapcache->nr_buckets * sizeof (MapCacheEntry);

    size = (size + XC_PAGE_SIZE - 1) & ~(XC_PAGE_SIZE - 1);

    DPRINTF("%s, nr_buckets = %lx size %lu\n", __func__,

            mapcache->nr_buckets, size);

    mapcache->entry = g_malloc0(size);

}


static void nvdimm_build_nfit(AcpiNVDIMMState *state, GArray *table_offsets,

                              GArray *table_data, BIOSLinker *linker)

{

    NvdimmFitBuffer *fit_buf = &state->fit_buf;

    unsigned int header;

    /* NVDIMM device is not plugged? */

    if (!fit_buf->fit->len) {

        return;

    }

    acpi_add_table(table_offsets, table_data);

    /* NFIT header. */

    header = table_data->len;

    acpi_data_push(table_data, sizeof(NvdimmNfitHeader));

    /* NVDIMM device structures. */

    g_array_append_vals(table_data, fit_buf->fit->data, fit_buf->fit->len);

    build_header(linker, table_data,

                 (void *)(table_data->data + header), "NFIT",

                 sizeof(NvdimmNfitHeader) + fit_buf->fit->len, 1, NULL, NULL);

}


static inline uint32_t efsctui(uint32_t val)

{

    CPU_FloatU u;

    u.l = val;

    /* NaN are not treated the same way IEEE 754 does */

    if (unlikely(float32_is_nan(u.f)))

        return 0;

    return float32_to_uint32(u.f, &env->vec_status);

}


BlockAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,

        unsigned long int req, void *buf,

        BlockCompletionFunc *cb, void *opaque)

{

    BlockDriver *drv = bs->drv;

    if (drv && drv->bdrv_aio_ioctl)

        return drv->bdrv_aio_ioctl(bs, req, buf, cb, opaque);

    return NULL;

}


static int lsi_scsi_init(PCIDevice *dev)

{

    LSIState *s = DO_UPCAST(LSIState, dev, dev);

    uint8_t *pci_conf;

    pci_conf = s->dev.config;

    /* PCI Vendor ID (word) */

    pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_LSI_LOGIC);

    /* PCI device ID (word) */

    pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_LSI_53C895A);

    /* PCI base class code */

    pci_config_set_class(pci_conf, PCI_CLASS_STORAGE_SCSI);

    /* PCI subsystem ID */

    pci_conf[PCI_SUBSYSTEM_ID] = 0x00;

    pci_conf[PCI_SUBSYSTEM_ID + 1] = 0x10;

    /* PCI latency timer = 255 */

    pci_conf[PCI_LATENCY_TIMER] = 0xff;

    /* TODO: RST# value should be 0 */

    /* Interrupt pin 1 */

    pci_conf[PCI_INTERRUPT_PIN] = 0x01;

    s->mmio_io_addr = cpu_register_io_memory(lsi_mmio_readfn,

                                             lsi_mmio_writefn, s,

                                             DEVICE_NATIVE_ENDIAN);

    s->ram_io_addr = cpu_register_io_memory(lsi_ram_readfn,

                                            lsi_ram_writefn, s,

                                            DEVICE_NATIVE_ENDIAN);

    pci_register_bar(&s->dev, 0, 256,

                           PCI_BASE_ADDRESS_SPACE_IO, lsi_io_mapfunc);

    pci_register_bar_simple(&s->dev, 1, 0x400, 0, s->mmio_io_addr);

    pci_register_bar(&s->dev, 2, 0x2000,

                           PCI_BASE_ADDRESS_SPACE_MEMORY, lsi_ram_mapfunc);

    QTAILQ_INIT(&s->queue);

    scsi_bus_new(&s->bus, &dev->qdev, 1, LSI_MAX_DEVS, lsi_command_complete);

    if (!dev->qdev.hotplugged) {

        return scsi_bus_legacy_handle_cmdline(&s->bus);

    }

    return 0;

}


void cpu_physical_memory_write_rom(hwaddr addr,

                                   const uint8_t *buf, int len)

{

    hwaddr l;

    uint8_t *ptr;

    hwaddr addr1;

    MemoryRegion *mr;

    while (len > 0) {

        l = len;

        mr = address_space_translate(&address_space_memory,

                                     addr, &addr1, &l, true);

        if (!(memory_region_is_ram(mr) ||

              memory_region_is_romd(mr))) {

            /* do nothing */

        } else {

            addr1 += memory_region_get_ram_addr(mr);

            /* ROM/RAM case */

            ptr = qemu_get_ram_ptr(addr1);

            memcpy(ptr, buf, l);

            invalidate_and_set_dirty(addr1, l);

        }

        len -= l;

        buf += l;

        addr += l;

    }

}


static int decode_cabac_mb_type( H264Context *h ) {

    MpegEncContext * const s = &h->s;

    if( h->slice_type == I_TYPE ) {

        return decode_cabac_intra_mb_type(h, 3, 1);

    } else if( h->slice_type == P_TYPE ) {

        if( get_cabac( &h->cabac, &h->cabac_state[14] ) == 0 ) {

            /* P-type */

            if( get_cabac( &h->cabac, &h->cabac_state[15] ) == 0 ) {

                /* P_L0_D16x16, P_8x8 */

                return 3 * get_cabac( &h->cabac, &h->cabac_state[16] );

            } else {

                /* P_L0_D8x16, P_L0_D16x8 */

                return 2 - get_cabac( &h->cabac, &h->cabac_state[17] );

            }

        } else {

            return decode_cabac_intra_mb_type(h, 17, 0) + 5;

        }

    } else if( h->slice_type == B_TYPE ) {

        const int mba_xy = h->left_mb_xy[0];

        const int mbb_xy = h->top_mb_xy;

        int ctx = 0;

        int bits;

        if( h->slice_table[mba_xy] == h->slice_num && !IS_DIRECT( s->current_picture.mb_type[mba_xy] ) )

            ctx++;

        if( h->slice_table[mbb_xy] == h->slice_num && !IS_DIRECT( s->current_picture.mb_type[mbb_xy] ) )

            ctx++;

        if( !get_cabac( &h->cabac, &h->cabac_state[27+ctx] ) )

            return 0; /* B_Direct_16x16 */

        if( !get_cabac( &h->cabac, &h->cabac_state[27+3] ) ) {

            return 1 + get_cabac( &h->cabac, &h->cabac_state[27+5] ); /* B_L[01]_16x16 */

        }

        bits = get_cabac( &h->cabac, &h->cabac_state[27+4] ) << 3;

        bits|= get_cabac( &h->cabac, &h->cabac_state[27+5] ) << 2;

        bits|= get_cabac( &h->cabac, &h->cabac_state[27+5] ) << 1;

        bits|= get_cabac( &h->cabac, &h->cabac_state[27+5] );

        if( bits < 8 )

            return bits + 3; /* B_Bi_16x16 through B_L1_L0_16x8 */

        else if( bits == 13 ) {

            return decode_cabac_intra_mb_type(h, 32, 0) + 23;

        } else if( bits == 14 )

            return 11; /* B_L1_L0_8x16 */

        else if( bits == 15 )

            return 22; /* B_8x8 */

        bits= ( bits<<1 ) | get_cabac( &h->cabac, &h->cabac_state[27+5] );

        return bits - 4; /* B_L0_Bi_* through B_Bi_Bi_* */

    } else {

        /* TODO SI/SP frames? */

        return -1;

    }

}


static int ehci_state_fetchentry(EHCIState *ehci, int async)

{

    int again = 0;

    uint32_t entry = ehci_get_fetch_addr(ehci, async);

    if (entry < 0x1000) {

        DPRINTF("fetchentry: entry invalid (0x%08x)\n", entry);

        ehci_set_state(ehci, async, EST_ACTIVE);

        goto out;

    }

    /* section 4.8, only QH in async schedule */

    if (async && (NLPTR_TYPE_GET(entry) != NLPTR_TYPE_QH)) {

        fprintf(stderr, "non queue head request in async schedule\n");

        return -1;

    }

    switch (NLPTR_TYPE_GET(entry)) {

    case NLPTR_TYPE_QH:

        ehci_set_state(ehci, async, EST_FETCHQH);

        again = 1;

        break;

    case NLPTR_TYPE_ITD:

        ehci_set_state(ehci, async, EST_FETCHITD);

        again = 1;

        break;

    case NLPTR_TYPE_STITD:

        ehci_set_state(ehci, async, EST_FETCHSITD);

        again = 1;

        break;

    default:

        /* TODO: handle FSTN type */

        fprintf(stderr, "FETCHENTRY: entry at %X is of type %d "

                "which is not supported yet\n", entry, NLPTR_TYPE_GET(entry));

        return -1;

    }

out:

    return again;

}


static int ssi_slave_init(DeviceState *dev, DeviceInfo *base_info)

{

    SSISlaveInfo *info = container_of(base_info, SSISlaveInfo, qdev);

    SSISlave *s = SSI_SLAVE_FROM_QDEV(dev);

    SSIBus *bus;

    bus = FROM_QBUS(SSIBus, qdev_get_parent_bus(dev));

    if (LIST_FIRST(&bus->qbus.children) != dev

        || LIST_NEXT(dev, sibling) != NULL) {

        hw_error("Too many devices on SSI bus");

    }

    s->info = info;

    return info->init(s);

}


struct pxa2xx_state_s *pxa255_init(unsigned int sdram_size,

                DisplayState *ds)

{

    struct pxa2xx_state_s *s;

    struct pxa2xx_ssp_s *ssp;

    int iomemtype, i;

    s = (struct pxa2xx_state_s *) qemu_mallocz(sizeof(struct pxa2xx_state_s));

    s->env = cpu_init();

    cpu_arm_set_model(s->env, "pxa255");

    register_savevm("cpu", 0, 0, cpu_save, cpu_load, s->env);

    /* SDRAM & Internal Memory Storage */

    cpu_register_physical_memory(PXA2XX_SDRAM_BASE, sdram_size,

                    qemu_ram_alloc(sdram_size) | IO_MEM_RAM);

    cpu_register_physical_memory(PXA2XX_INTERNAL_BASE, PXA2XX_INTERNAL_SIZE,

                    qemu_ram_alloc(PXA2XX_INTERNAL_SIZE) | IO_MEM_RAM);

    s->pic = pxa2xx_pic_init(0x40d00000, s->env);

    s->dma = pxa255_dma_init(0x40000000, s->pic[PXA2XX_PIC_DMA]);

    pxa25x_timer_init(0x40a00000, &s->pic[PXA2XX_PIC_OST_0]);

    s->gpio = pxa2xx_gpio_init(0x40e00000, s->env, s->pic, 85);

    s->mmc = pxa2xx_mmci_init(0x41100000, s->pic[PXA2XX_PIC_MMC], s->dma);

    for (i = 0; pxa255_serial[i].io_base; i ++)

        if (serial_hds[i])

            serial_mm_init(pxa255_serial[i].io_base, 2,

                            s->pic[pxa255_serial[i].irqn], serial_hds[i], 1);

        else

            break;

    if (serial_hds[i])

        s->fir = pxa2xx_fir_init(0x40800000, s->pic[PXA2XX_PIC_ICP],

                        s->dma, serial_hds[i]);

    if (ds)

        s->lcd = pxa2xx_lcdc_init(0x44000000, s->pic[PXA2XX_PIC_LCD], ds);

    s->cm_base = 0x41300000;

    s->cm_regs[CCCR >> 4] = 0x02000210;	/* 416.0 MHz */

    s->clkcfg = 0x00000009;		/* Turbo mode active */

    iomemtype = cpu_register_io_memory(0, pxa2xx_cm_readfn,

                    pxa2xx_cm_writefn, s);

    cpu_register_physical_memory(s->cm_base, 0xfff, iomemtype);

    register_savevm("pxa2xx_cm", 0, 0, pxa2xx_cm_save, pxa2xx_cm_load, s);

    cpu_arm_set_cp_io(s->env, 14, pxa2xx_cp14_read, pxa2xx_cp14_write, s);

    s->mm_base = 0x48000000;

    s->mm_regs[MDMRS >> 2] = 0x00020002;

    s->mm_regs[MDREFR >> 2] = 0x03ca4000;

    s->mm_regs[MECR >> 2] = 0x00000001;	/* Two PC Card sockets */

    iomemtype = cpu_register_io_memory(0, pxa2xx_mm_readfn,

                    pxa2xx_mm_writefn, s);

    cpu_register_physical_memory(s->mm_base, 0xfff, iomemtype);

    register_savevm("pxa2xx_mm", 0, 0, pxa2xx_mm_save, pxa2xx_mm_load, s);

    for (i = 0; pxa255_ssp[i].io_base; i ++);

    s->ssp = (struct pxa2xx_ssp_s **)

            qemu_mallocz(sizeof(struct pxa2xx_ssp_s *) * i);

    ssp = (struct pxa2xx_ssp_s *)

            qemu_mallocz(sizeof(struct pxa2xx_ssp_s) * i);

    for (i = 0; pxa255_ssp[i].io_base; i ++) {

        s->ssp[i] = &ssp[i];

        ssp[i].base = pxa255_ssp[i].io_base;

        ssp[i].irq = s->pic[pxa255_ssp[i].irqn];

        iomemtype = cpu_register_io_memory(0, pxa2xx_ssp_readfn,

                        pxa2xx_ssp_writefn, &ssp[i]);

        cpu_register_physical_memory(ssp[i].base, 0xfff, iomemtype);

        register_savevm("pxa2xx_ssp", i, 0,

                        pxa2xx_ssp_save, pxa2xx_ssp_load, s);

    }

    if (usb_enabled) {

        usb_ohci_init_pxa(0x4c000000, 3, -1, s->pic[PXA2XX_PIC_USBH1]);

    }

    s->pcmcia[0] = pxa2xx_pcmcia_init(0x20000000);

    s->pcmcia[1] = pxa2xx_pcmcia_init(0x30000000);

    s->rtc_base = 0x40900000;

    iomemtype = cpu_register_io_memory(0, pxa2xx_rtc_readfn,

                    pxa2xx_rtc_writefn, s);

    cpu_register_physical_memory(s->rtc_base, 0xfff, iomemtype);

    pxa2xx_rtc_init(s);

    register_savevm("pxa2xx_rtc", 0, 0, pxa2xx_rtc_save, pxa2xx_rtc_load, s);

    /* Note that PM registers are in the same page with PWRI2C registers.

     * As a workaround we don't map PWRI2C into memory and we expect

     * PM handlers to call PWRI2C handlers when appropriate.  */

    s->i2c[0] = pxa2xx_i2c_init(0x40301600, s->pic[PXA2XX_PIC_I2C], 1);

    s->i2c[1] = pxa2xx_i2c_init(0x40f00100, s->pic[PXA2XX_PIC_PWRI2C], 0);

    s->pm_base = 0x40f00000;

    iomemtype = cpu_register_io_memory(0, pxa2xx_pm_readfn,

                    pxa2xx_pm_writefn, s);

    cpu_register_physical_memory(s->pm_base, 0xfff, iomemtype);

    register_savevm("pxa2xx_pm", 0, 0, pxa2xx_pm_save, pxa2xx_pm_load, s);

    s->i2s = pxa2xx_i2s_init(0x40400000, s->pic[PXA2XX_PIC_I2S], s->dma);

    /* GPIO1 resets the processor */

    /* The handler can be overriden by board-specific code */

    pxa2xx_gpio_handler_set(s->gpio, 1, pxa2xx_reset, s);

    return s;

}


void stq_le_phys(target_phys_addr_t addr, uint64_t val)

{

    val = cpu_to_le64(val);

    cpu_physical_memory_write(addr, &val, 8);

}


static int arm946_prbs_write(CPUARMState *env, const ARMCPRegInfo *ri,

                             uint64_t value)

{

    if (ri->crm >= 8) {

        return EXCP_UDEF;

    }

    env->cp15.c6_region[ri->crm] = value;

    return 0;

}


static int64_t get_clock(void)

{

#if defined(__linux__) || (defined(__FreeBSD__) && __FreeBSD_version >= 500000) \

	|| defined(__DragonFly__)

    if (use_rt_clock) {

        struct timespec ts;

        clock_gettime(CLOCK_MONOTONIC, &ts);

        return ts.tv_sec * 1000000000LL + ts.tv_nsec;

    } else

#endif

    {

        /* XXX: using gettimeofday leads to problems if the date

           changes, so it should be avoided. */

        struct timeval tv;

        gettimeofday(&tv, NULL);

        return tv.tv_sec * 1000000000LL + (tv.tv_usec * 1000);

    }

}


static void setup_frame(int sig, struct emulated_sigaction * ka,

                        target_sigset_t *set, CPUState *regs)

{

    struct sigframe *frame;

    abi_ulong frame_addr;

    int i;

    frame_addr = get_sigframe(ka, regs, sizeof(*frame));

    if (!lock_user_struct(VERIFY_WRITE, frame, frame_addr, 0))

	goto give_sigsegv;

    install_sigtramp(frame->sf_code, TARGET_NR_sigreturn);

    if(setup_sigcontext(regs, &frame->sf_sc))

	goto give_sigsegv;

    for(i = 0; i < TARGET_NSIG_WORDS; i++) {

	if(__put_user(set->sig[i], &frame->sf_mask.sig[i]))

	    goto give_sigsegv;

    }

    /*

    * Arguments to signal handler:

    *

    *   a0 = signal number

    *   a1 = 0 (should be cause)

    *   a2 = pointer to struct sigcontext

    *

    * $25 and PC point to the signal handler, $29 points to the

    * struct sigframe.

    */

    regs->gpr[ 4][regs->current_tc] = sig;

    regs->gpr[ 5][regs->current_tc] = 0;

    regs->gpr[ 6][regs->current_tc] = h2g(&frame->sf_sc);

    regs->gpr[29][regs->current_tc] = h2g(frame);

    regs->gpr[31][regs->current_tc] = h2g(frame->sf_code);

    /* The original kernel code sets CP0_EPC to the handler

    * since it returns to userland using eret

    * we cannot do this here, and we must set PC directly */

    regs->PC[regs->current_tc] = regs->gpr[25][regs->current_tc] = ka->sa._sa_handler;

    unlock_user_struct(frame, frame_addr, 1);

    return;

give_sigsegv:

    unlock_user_struct(frame, frame_addr, 1);

    force_sig(TARGET_SIGSEGV/*, current*/);

    return;

}


static void vmsvga_text_update(void *opaque, console_ch_t *chardata)

{

    struct vmsvga_state_s *s = opaque;

    if (s->vga.text_update)

        s->vga.text_update(&s->vga, chardata);

}


static int send_response(GAState *s, QObject *payload)

{

    const char *buf;

    QString *payload_qstr;

    GIOStatus status;

    g_assert(payload && s->channel);

    payload_qstr = qobject_to_json(payload);

    if (!payload_qstr) {

        return -EINVAL;

    }

    qstring_append_chr(payload_qstr, '\n');

    buf = qstring_get_str(payload_qstr);

    status = ga_channel_write_all(s->channel, buf, strlen(buf));

    QDECREF(payload_qstr);

    if (status != G_IO_STATUS_NORMAL) {

        return -EIO;

    }

    return 0;

}


float64 HELPER(ucf64_addd)(float64 a, float64 b, CPUUniCore32State *env)

{

    return float64_add(a, b, &env->ucf64.fp_status);

}


static void term_exit(void)

{

    tcsetattr (0, TCSANOW, &oldtty);

}


void timer_mod_ns(QEMUTimer *ts, int64_t expire_time)

{

    QEMUTimerList *timer_list = ts->timer_list;

    bool rearm;

    qemu_mutex_lock(&timer_list->active_timers_lock);

    timer_del_locked(timer_list, ts);

    rearm = timer_mod_ns_locked(timer_list, ts, expire_time);

    qemu_mutex_unlock(&timer_list->active_timers_lock);

    if (rearm) {

        timerlist_rearm(timer_list);

    }

}


static int convert_do_copy(ImgConvertState *s)

{

    uint8_t *buf = NULL;

    int64_t sector_num, allocated_done;

    int ret;

    int n;

    /* Check whether we have zero initialisation or can get it efficiently */

    s->has_zero_init = s->min_sparse && !s->target_has_backing

                     ? bdrv_has_zero_init(blk_bs(s->target))

                     : false;

    if (!s->has_zero_init && !s->target_has_backing &&

        bdrv_can_write_zeroes_with_unmap(blk_bs(s->target)))

    {

        ret = bdrv_make_zero(blk_bs(s->target), BDRV_REQ_MAY_UNMAP);

        if (ret == 0) {

            s->has_zero_init = true;

        }

    }

    /* Allocate buffer for copied data. For compressed images, only one cluster

     * can be copied at a time. */

    if (s->compressed) {

        if (s->cluster_sectors <= 0 || s->cluster_sectors > s->buf_sectors) {

            error_report("invalid cluster size");

            ret = -EINVAL;

            goto fail;

        }

        s->buf_sectors = s->cluster_sectors;

    }

    buf = blk_blockalign(s->target, s->buf_sectors * BDRV_SECTOR_SIZE);

    /* Calculate allocated sectors for progress */

    s->allocated_sectors = 0;

    sector_num = 0;

    while (sector_num < s->total_sectors) {

        n = convert_iteration_sectors(s, sector_num);

        if (n < 0) {

            ret = n;

            goto fail;

        }

        if (s->status == BLK_DATA) {

            s->allocated_sectors += n;

        }

        sector_num += n;

    }

    /* Do the copy */

    s->src_cur = 0;

    s->src_cur_offset = 0;

    s->sector_next_status = 0;

    sector_num = 0;

    allocated_done = 0;

    while (sector_num < s->total_sectors) {

        n = convert_iteration_sectors(s, sector_num);

        if (n < 0) {

            ret = n;

            goto fail;

        }

        if (s->status == BLK_DATA) {

            allocated_done += n;

            qemu_progress_print(100.0 * allocated_done / s->allocated_sectors,

                                0);

        }

        ret = convert_read(s, sector_num, n, buf);

        if (ret < 0) {

            error_report("error while reading sector %" PRId64

                         ": %s", sector_num, strerror(-ret));

            goto fail;

        }

        ret = convert_write(s, sector_num, n, buf);

        if (ret < 0) {

            error_report("error while writing sector %" PRId64

                         ": %s", sector_num, strerror(-ret));

            goto fail;

        }

        sector_num += n;

    }

    if (s->compressed) {

        /* signal EOF to align */

        ret = blk_write_compressed(s->target, 0, NULL, 0);

        if (ret < 0) {

            goto fail;

        }

    }

    ret = 0;

fail:

    qemu_vfree(buf);

    return ret;

}


static void test_visitor_in_native_list_uint16(TestInputVisitorData *data,

                                               const void *unused)

{

    test_native_list_integer_helper(data, unused,

                                    USER_DEF_NATIVE_LIST_UNION_KIND_U16);

}


static void validate_bootdevices(char *devices)

{

    /* We just do some generic consistency checks */

    const char *p;

    int bitmap = 0;

    for (p = devices; *p != '\0'; p++) {

        /* Allowed boot devices are:

         * a-b: floppy disk drives

         * c-f: IDE disk drives

         * g-m: machine implementation dependent drives

         * n-p: network devices

         * It's up to each machine implementation to check if the given boot

         * devices match the actual hardware implementation and firmware

         * features.

         */

        if (*p < 'a' || *p > 'p') {

            fprintf(stderr, "Invalid boot device '%c'\n", *p);

            exit(1);

        }

        if (bitmap & (1 << (*p - 'a'))) {

            fprintf(stderr, "Boot device '%c' was given twice\n", *p);

            exit(1);

        }

        bitmap |= 1 << (*p - 'a');

    }

}


void s390_add_running_cpu(S390CPU *cpu)

{

    CPUState *cs = CPU(cpu);

    if (cs->halted) {

        s390_running_cpus++;

        cs->halted = 0;

        cs->exception_index = -1;

    }

}


static int usb_audio_handle_data(USBDevice *dev, USBPacket *p)

{

    USBAudioState *s = (USBAudioState *) dev;

    int ret = 0;

    switch (p->pid) {

    case USB_TOKEN_OUT:

        switch (p->devep) {

        case 1:

            ret = usb_audio_handle_dataout(s, p);

            break;

        default:

            goto fail;

        }

        break;

    default:

fail:

        ret = USB_RET_STALL;

        break;

    }

    if (ret == USB_RET_STALL && s->debug) {

        fprintf(stderr, "usb-audio: failed data transaction: "

                        "pid 0x%x ep 0x%x len 0x%zx\n",

                        p->pid, p->devep, p->iov.size);

    }

    return ret;

}


int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,

                             int cpuid, void *opaque)

{

    struct arm_note note;

    CPUARMState *env = &ARM_CPU(cs)->env;

    DumpState *s = opaque;

    int ret, i;

    arm_note_init(&note, s, "CORE", 5, NT_PRSTATUS, sizeof(note.prstatus));

    note.prstatus.pr_pid = cpu_to_dump32(s, cpuid);

    for (i = 0; i < 16; ++i) {

        note.prstatus.pr_reg.regs[i] = cpu_to_dump32(s, env->regs[i]);

    }

    note.prstatus.pr_reg.regs[16] = cpu_to_dump32(s, cpsr_read(env));

    ret = f(&note, ARM_PRSTATUS_NOTE_SIZE, s);

    if (ret < 0) {

        return -1;

    }

    return 0;

}


static int write_manifest(AVFormatContext *s, int final)

{

    DASHContext *c = s->priv_data;

    AVIOContext *out;

    char temp_filename[1024];

    int ret, i;

    const char *proto = avio_find_protocol_name(s->filename);

    int use_rename = proto && !strcmp(proto, "file");

    static unsigned int warned_non_file = 0;

    AVDictionaryEntry *title = av_dict_get(s->metadata, "title", NULL, 0);

    if (!use_rename && !warned_non_file++)

        av_log(s, AV_LOG_ERROR, "Cannot use rename on non file protocol, this may lead to races and temporary partial files\n");

    snprintf(temp_filename, sizeof(temp_filename), use_rename ? "%s.tmp" : "%s", s->filename);

    ret = s->io_open(s, &out, temp_filename, AVIO_FLAG_WRITE, NULL);

    if (ret < 0) {

        av_log(s, AV_LOG_ERROR, "Unable to open %s for writing\n", temp_filename);

        return ret;

    }

    avio_printf(out, "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n");

    avio_printf(out, "<MPD xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n"

                "\txmlns=\"urn:mpeg:dash:schema:mpd:2011\"\n"

                "\txmlns:xlink=\"http://www.w3.org/1999/xlink\"\n"

                "\txsi:schemaLocation=\"urn:mpeg:DASH:schema:MPD:2011 http://standards.iso.org/ittf/PubliclyAvailableStandards/MPEG-DASH_schema_files/DASH-MPD.xsd\"\n"

                "\tprofiles=\"urn:mpeg:dash:profile:isoff-live:2011\"\n"

                "\ttype=\"%s\"\n", final ? "static" : "dynamic");

    if (final) {

        avio_printf(out, "\tmediaPresentationDuration=\"");

        write_time(out, c->total_duration);

        avio_printf(out, "\"\n");

    } else {

        int64_t update_period = c->last_duration / AV_TIME_BASE;

        char now_str[100];

        if (c->use_template && !c->use_timeline)

            update_period = 500;

        avio_printf(out, "\tminimumUpdatePeriod=\"PT%"PRId64"S\"\n", update_period);

        avio_printf(out, "\tsuggestedPresentationDelay=\"PT%"PRId64"S\"\n", c->last_duration / AV_TIME_BASE);

        if (!c->availability_start_time[0] && s->nb_streams > 0 && c->streams[0].nb_segments > 0) {

            format_date_now(c->availability_start_time, sizeof(c->availability_start_time));

        }

        if (c->availability_start_time[0])

            avio_printf(out, "\tavailabilityStartTime=\"%s\"\n", c->availability_start_time);

        format_date_now(now_str, sizeof(now_str));

        if (now_str[0])

            avio_printf(out, "\tpublishTime=\"%s\"\n", now_str);

        if (c->window_size && c->use_template) {

            avio_printf(out, "\ttimeShiftBufferDepth=\"");

            write_time(out, c->last_duration * c->window_size);

            avio_printf(out, "\"\n");

        }

    }

    avio_printf(out, "\tminBufferTime=\"");

    write_time(out, c->last_duration * 2);

    avio_printf(out, "\">\n");

    avio_printf(out, "\t<ProgramInformation>\n");

    if (title) {

        char *escaped = xmlescape(title->value);

        avio_printf(out, "\t\t<Title>%s</Title>\n", escaped);

        av_free(escaped);

    }

    avio_printf(out, "\t</ProgramInformation>\n");

    if (c->window_size && s->nb_streams > 0 && c->streams[0].nb_segments > 0 && !c->use_template) {

        OutputStream *os = &c->streams[0];

        int start_index = FFMAX(os->nb_segments - c->window_size, 0);

        int64_t start_time = av_rescale_q(os->segments[start_index]->time, s->streams[0]->time_base, AV_TIME_BASE_Q);

        avio_printf(out, "\t<Period id=\"0\" start=\"");

        write_time(out, start_time);

        avio_printf(out, "\">\n");

    } else {

        avio_printf(out, "\t<Period id=\"0\" start=\"PT0.0S\">\n");

    }

    for (i = 0; i < c->nb_as; i++) {

        if ((ret = write_adaptation_set(s, out, i)) < 0)

            return ret;

    }

    avio_printf(out, "\t</Period>\n");

    if (c->utc_timing_url)

        avio_printf(out, "\t<UTCTiming schemeIdUri=\"urn:mpeg:dash:utc:http-xsdate:2014\" value=\"%s\"/>\n", c->utc_timing_url);

    avio_printf(out, "</MPD>\n");

    avio_flush(out);

    ff_format_io_close(s, &out);

    if (use_rename)

        return avpriv_io_move(temp_filename, s->filename);

    return 0;

}


static void curl_close(BlockDriverState *bs)

{

    BDRVCURLState *s = bs->opaque;

    int i;

    DPRINTF("CURL: Close\n");

    for (i=0; i<CURL_NUM_STATES; i++) {

        if (s->states[i].in_use)

            curl_clean_state(&s->states[i]);

        if (s->states[i].curl) {

            curl_easy_cleanup(s->states[i].curl);

            s->states[i].curl = NULL;

        }

        if (s->states[i].orig_buf) {

            g_free(s->states[i].orig_buf);

            s->states[i].orig_buf = NULL;

        }

    }

    if (s->multi)

        curl_multi_cleanup(s->multi);

    timer_del(&s->timer);

    g_free(s->url);

}


if_output(struct socket *so, struct mbuf *ifm)

{

	struct mbuf *ifq;

	int on_fastq = 1;

	DEBUG_CALL("if_output");

	DEBUG_ARG("so = %lx", (long)so);

	DEBUG_ARG("ifm = %lx", (long)ifm);

	/*

	 * First remove the mbuf from m_usedlist,

	 * since we're gonna use m_next and m_prev ourselves

	 * XXX Shouldn't need this, gotta change dtom() etc.

	 */

	if (ifm->m_flags & M_USEDLIST) {

		remque(ifm);

		ifm->m_flags &= ~M_USEDLIST;

	}

	/*

	 * See if there's already a batchq list for this session.

	 * This can include an interactive session, which should go on fastq,

	 * but gets too greedy... hence it'll be downgraded from fastq to batchq.

	 * We mustn't put this packet back on the fastq (or we'll send it out of order)

	 * XXX add cache here?

	 */

	for (ifq = if_batchq.ifq_prev; ifq != &if_batchq; ifq = ifq->ifq_prev) {

		if (so == ifq->ifq_so) {

			/* A match! */

			ifm->ifq_so = so;

			ifs_insque(ifm, ifq->ifs_prev);

			goto diddit;

		}

	}

	/* No match, check which queue to put it on */

	if (so && (so->so_iptos & IPTOS_LOWDELAY)) {

		ifq = if_fastq.ifq_prev;

		on_fastq = 1;

		/*

		 * Check if this packet is a part of the last

		 * packet's session

		 */

		if (ifq->ifq_so == so) {

			ifm->ifq_so = so;

			ifs_insque(ifm, ifq->ifs_prev);

			goto diddit;

		}

	} else

		ifq = if_batchq.ifq_prev;

	/* Create a new doubly linked list for this session */

	ifm->ifq_so = so;

	ifs_init(ifm);

	insque(ifm, ifq);

diddit:

	++if_queued;

	if (so) {

		/* Update *_queued */

		so->so_queued++;

		so->so_nqueued++;

		/*

		 * Check if the interactive session should be downgraded to

		 * the batchq.  A session is downgraded if it has queued 6

		 * packets without pausing, and at least 3 of those packets

		 * have been sent over the link

		 * (XXX These are arbitrary numbers, probably not optimal..)

		 */

		if (on_fastq && ((so->so_nqueued >= 6) &&

				 (so->so_nqueued - so->so_queued) >= 3)) {

			/* Remove from current queue... */

			remque(ifm->ifs_next);

			/* ...And insert in the new.  That'll teach ya! */

			insque(ifm->ifs_next, &if_batchq);

		}

	}

#ifndef FULL_BOLT

	/*

	 * This prevents us from malloc()ing too many mbufs

	 */

	if (link_up) {

		/* if_start will check towrite */

		if_start();

	}

#endif

}


static int ne2000_can_receive(void *opaque)

{

    NE2000State *s = opaque;

    if (s->cmd & E8390_STOP)

        return 1;

    return !ne2000_buffer_full(s);

}


static void *bochs_bios_init(void)

{

    void *fw_cfg;

    uint8_t *smbios_table;

    size_t smbios_len;

    uint64_t *numa_fw_cfg;

    int i, j;

    register_ioport_write(0x400, 1, 2, bochs_bios_write, NULL);

    register_ioport_write(0x401, 1, 2, bochs_bios_write, NULL);

    register_ioport_write(0x402, 1, 1, bochs_bios_write, NULL);

    register_ioport_write(0x403, 1, 1, bochs_bios_write, NULL);

    register_ioport_write(0x8900, 1, 1, bochs_bios_write, NULL);

    register_ioport_write(0x501, 1, 1, bochs_bios_write, NULL);

    register_ioport_write(0x501, 1, 2, bochs_bios_write, NULL);

    register_ioport_write(0x502, 1, 2, bochs_bios_write, NULL);

    register_ioport_write(0x500, 1, 1, bochs_bios_write, NULL);

    register_ioport_write(0x503, 1, 1, bochs_bios_write, NULL);

    fw_cfg = fw_cfg_init(BIOS_CFG_IOPORT, BIOS_CFG_IOPORT + 1, 0, 0);

    fw_cfg_add_i32(fw_cfg, FW_CFG_ID, 1);

    fw_cfg_add_i64(fw_cfg, FW_CFG_RAM_SIZE, (uint64_t)ram_size);

    fw_cfg_add_bytes(fw_cfg, FW_CFG_ACPI_TABLES, (uint8_t *)acpi_tables,

                     acpi_tables_len);

    fw_cfg_add_bytes(fw_cfg, FW_CFG_IRQ0_OVERRIDE, &irq0override, 1);

    smbios_table = smbios_get_table(&smbios_len);

    if (smbios_table)

        fw_cfg_add_bytes(fw_cfg, FW_CFG_SMBIOS_ENTRIES,

                         smbios_table, smbios_len);

    fw_cfg_add_bytes(fw_cfg, FW_CFG_E820_TABLE, (uint8_t *)&e820_table,

                     sizeof(struct e820_table));

    fw_cfg_add_bytes(fw_cfg, FW_CFG_HPET, (uint8_t *)&hpet_cfg,

                     sizeof(struct hpet_fw_config));

    /* allocate memory for the NUMA channel: one (64bit) word for the number

     * of nodes, one word for each VCPU->node and one word for each node to

     * hold the amount of memory.

     */

    numa_fw_cfg = g_malloc0((1 + max_cpus + nb_numa_nodes) * 8);

    numa_fw_cfg[0] = cpu_to_le64(nb_numa_nodes);

    for (i = 0; i < max_cpus; i++) {

        for (j = 0; j < nb_numa_nodes; j++) {

            if (node_cpumask[j] & (1 << i)) {

                numa_fw_cfg[i + 1] = cpu_to_le64(j);

                break;

            }

        }

    }

    for (i = 0; i < nb_numa_nodes; i++) {

        numa_fw_cfg[max_cpus + 1 + i] = cpu_to_le64(node_mem[i]);

    }

    fw_cfg_add_bytes(fw_cfg, FW_CFG_NUMA, (uint8_t *)numa_fw_cfg,

                     (1 + max_cpus + nb_numa_nodes) * 8);

    return fw_cfg;

}


static int xen_pt_word_reg_read(XenPCIPassthroughState *s, XenPTReg *cfg_entry,

                                uint16_t *value, uint16_t valid_mask)

{

    XenPTRegInfo *reg = cfg_entry->reg;

    uint16_t valid_emu_mask = 0;

    /* emulate word register */

    valid_emu_mask = reg->emu_mask & valid_mask;

    *value = XEN_PT_MERGE_VALUE(*value, cfg_entry->data, ~valid_emu_mask);

    return 0;

}


static int img_rebase(int argc, char **argv)

{

    BlockDriverState *bs, *bs_old_backing = NULL, *bs_new_backing = NULL;

    BlockDriver *old_backing_drv, *new_backing_drv;

    char *filename;

    const char *fmt, *cache, *out_basefmt, *out_baseimg;

    int c, flags, ret;

    int unsafe = 0;

    int progress = 0;

    /* Parse commandline parameters */

    fmt = NULL;

    cache = BDRV_DEFAULT_CACHE;

    out_baseimg = NULL;

    out_basefmt = NULL;

    for(;;) {

        c = getopt(argc, argv, "uhf:F:b:pt:");

        if (c == -1) {

            break;

        }

        switch(c) {

        case '?':

        case 'h':

            help();

            return 0;

        case 'f':

            fmt = optarg;

            break;

        case 'F':

            out_basefmt = optarg;

            break;

        case 'b':

            out_baseimg = optarg;

            break;

        case 'u':

            unsafe = 1;

            break;

        case 'p':

            progress = 1;

            break;

        case 't':

            cache = optarg;

            break;

        }

    }

    if ((optind >= argc) || (!unsafe && !out_baseimg)) {

        help();

    }

    filename = argv[optind++];

    qemu_progress_init(progress, 2.0);

    qemu_progress_print(0, 100);

    flags = BDRV_O_RDWR | (unsafe ? BDRV_O_NO_BACKING : 0);

    ret = bdrv_parse_cache_flags(cache, &flags);

    if (ret < 0) {

        error_report("Invalid cache option: %s", cache);

        return -1;

    }

    /*

     * Open the images.

     *

     * Ignore the old backing file for unsafe rebase in case we want to correct

     * the reference to a renamed or moved backing file.

     */

    bs = bdrv_new_open(filename, fmt, flags);

    if (!bs) {

        return 1;

    }

    /* Find the right drivers for the backing files */

    old_backing_drv = NULL;

    new_backing_drv = NULL;

    if (!unsafe && bs->backing_format[0] != '\0') {

        old_backing_drv = bdrv_find_format(bs->backing_format);

        if (old_backing_drv == NULL) {

            error_report("Invalid format name: '%s'", bs->backing_format);

            ret = -1;

            goto out;

        }

    }

    if (out_basefmt != NULL) {

        new_backing_drv = bdrv_find_format(out_basefmt);

        if (new_backing_drv == NULL) {

            error_report("Invalid format name: '%s'", out_basefmt);

            ret = -1;

            goto out;

        }

    }

    /* For safe rebasing we need to compare old and new backing file */

    if (unsafe) {

        /* Make the compiler happy */

        bs_old_backing = NULL;

        bs_new_backing = NULL;

    } else {

        char backing_name[1024];

        bs_old_backing = bdrv_new("old_backing");

        bdrv_get_backing_filename(bs, backing_name, sizeof(backing_name));

        ret = bdrv_open(bs_old_backing, backing_name, BDRV_O_FLAGS,

                        old_backing_drv);

        if (ret) {

            error_report("Could not open old backing file '%s'", backing_name);

            goto out;

        }

        bs_new_backing = bdrv_new("new_backing");

        ret = bdrv_open(bs_new_backing, out_baseimg, BDRV_O_FLAGS,

                        new_backing_drv);

        if (ret) {

            error_report("Could not open new backing file '%s'", out_baseimg);

            goto out;

        }

    }

    /*

     * Check each unallocated cluster in the COW file. If it is unallocated,

     * accesses go to the backing file. We must therefore compare this cluster

     * in the old and new backing file, and if they differ we need to copy it

     * from the old backing file into the COW file.

     *

     * If qemu-img crashes during this step, no harm is done. The content of

     * the image is the same as the original one at any time.

     */

    if (!unsafe) {

        uint64_t num_sectors;

        uint64_t old_backing_num_sectors;

        uint64_t new_backing_num_sectors;

        uint64_t sector;

        int n;

        uint8_t * buf_old;

        uint8_t * buf_new;

        float local_progress;

        buf_old = qemu_blockalign(bs, IO_BUF_SIZE);

        buf_new = qemu_blockalign(bs, IO_BUF_SIZE);

        bdrv_get_geometry(bs, &num_sectors);

        bdrv_get_geometry(bs_old_backing, &old_backing_num_sectors);

        bdrv_get_geometry(bs_new_backing, &new_backing_num_sectors);

        local_progress = (float)100 /

            (num_sectors / MIN(num_sectors, IO_BUF_SIZE / 512));

        for (sector = 0; sector < num_sectors; sector += n) {

            /* How many sectors can we handle with the next read? */

            if (sector + (IO_BUF_SIZE / 512) <= num_sectors) {

                n = (IO_BUF_SIZE / 512);

            } else {

                n = num_sectors - sector;

            }

            /* If the cluster is allocated, we don't need to take action */

            ret = bdrv_is_allocated(bs, sector, n, &n);

            if (ret) {

                continue;

            }

            /*

             * Read old and new backing file and take into consideration that

             * backing files may be smaller than the COW image.

             */

            if (sector >= old_backing_num_sectors) {

                memset(buf_old, 0, n * BDRV_SECTOR_SIZE);

            } else {

                if (sector + n > old_backing_num_sectors) {

                    n = old_backing_num_sectors - sector;

                }

                ret = bdrv_read(bs_old_backing, sector, buf_old, n);

                if (ret < 0) {

                    error_report("error while reading from old backing file");

                    goto out;

                }

            }

            if (sector >= new_backing_num_sectors) {

                memset(buf_new, 0, n * BDRV_SECTOR_SIZE);

            } else {

                if (sector + n > new_backing_num_sectors) {

                    n = new_backing_num_sectors - sector;

                }

                ret = bdrv_read(bs_new_backing, sector, buf_new, n);

                if (ret < 0) {

                    error_report("error while reading from new backing file");

                    goto out;

                }

            }

            /* If they differ, we need to write to the COW file */

            uint64_t written = 0;

            while (written < n) {

                int pnum;

                if (compare_sectors(buf_old + written * 512,

                    buf_new + written * 512, n - written, &pnum))

                {

                    ret = bdrv_write(bs, sector + written,

                        buf_old + written * 512, pnum);

                    if (ret < 0) {

                        error_report("Error while writing to COW image: %s",

                            strerror(-ret));

                        goto out;

                    }

                }

                written += pnum;

            }

            qemu_progress_print(local_progress, 100);

        }

        qemu_vfree(buf_old);

        qemu_vfree(buf_new);

    }

    /*

     * Change the backing file. All clusters that are different from the old

     * backing file are overwritten in the COW file now, so the visible content

     * doesn't change when we switch the backing file.

     */

    ret = bdrv_change_backing_file(bs, out_baseimg, out_basefmt);

    if (ret == -ENOSPC) {

        error_report("Could not change the backing file to '%s': No "

                     "space left in the file header", out_baseimg);

    } else if (ret < 0) {

        error_report("Could not change the backing file to '%s': %s",

            out_baseimg, strerror(-ret));

    }

    qemu_progress_print(100, 0);

    /*

     * TODO At this point it is possible to check if any clusters that are

     * allocated in the COW file are the same in the backing file. If so, they

     * could be dropped from the COW file. Don't do this before switching the

     * backing file, in case of a crash this would lead to corruption.

     */

out:

    qemu_progress_end();

    /* Cleanup */

    if (!unsafe) {

        if (bs_old_backing != NULL) {

            bdrv_delete(bs_old_backing);

        }

        if (bs_new_backing != NULL) {

            bdrv_delete(bs_new_backing);

        }

    }

    bdrv_delete(bs);

    if (ret) {

        return 1;

    }

    return 0;

}


int get_buffer(ByteIOContext *s, unsigned char *buf, int size)

{

    int len, size1;

    size1 = size;

    while (size > 0) {

        len = s->buf_end - s->buf_ptr;

        if (len > size)

            len = size;

        if (len == 0) {

            fill_buffer(s);

            len = s->buf_end - s->buf_ptr;

            if (len == 0)

                break;

        } else {

            memcpy(buf, s->buf_ptr, len);

            buf += len;

            s->buf_ptr += len;

            size -= len;

        }

    }

    return size1 - size;

}


AVFilterFormats *ff_make_format_list(const int *fmts)

{

    AVFilterFormats *formats;

    int count;

    for (count = 0; fmts[count] != -1; count++)

        ;

    formats               = av_mallocz(sizeof(*formats));

    if (count)

        formats->formats  = av_malloc(sizeof(*formats->formats) * count);

    formats->nb_formats = count;

    memcpy(formats->formats, fmts, sizeof(*formats->formats) * count);

    return formats;

}


void qemu_cond_destroy(QemuCond *cond)

{

    BOOL result;

    result = CloseHandle(cond->continue_event);

    if (!result) {

        error_exit(GetLastError(), __func__);

    }

    cond->continue_event = 0;

    result = CloseHandle(cond->sema);

    if (!result) {

        error_exit(GetLastError(), __func__);

    }

    cond->sema = 0;

}


static inline void gen_intermediate_code_internal(CPUARMState *env,

                                                  TranslationBlock *tb,

                                                  int search_pc)

{

    DisasContext dc1, *dc = &dc1;

    CPUBreakpoint *bp;

    uint16_t *gen_opc_end;

    int j, lj;

    target_ulong pc_start;

    uint32_t next_page_start;

    int num_insns;

    int max_insns;

    /* generate intermediate code */

    pc_start = tb->pc;

    dc->tb = tb;

    gen_opc_end = gen_opc_buf + OPC_MAX_SIZE;

    dc->is_jmp = DISAS_NEXT;

    dc->pc = pc_start;

    dc->singlestep_enabled = env->singlestep_enabled;

    dc->condjmp = 0;

    dc->thumb = ARM_TBFLAG_THUMB(tb->flags);

    dc->condexec_mask = (ARM_TBFLAG_CONDEXEC(tb->flags) & 0xf) << 1;

    dc->condexec_cond = ARM_TBFLAG_CONDEXEC(tb->flags) >> 4;

#if !defined(CONFIG_USER_ONLY)

    dc->user = (ARM_TBFLAG_PRIV(tb->flags) == 0);

#endif

    dc->vfp_enabled = ARM_TBFLAG_VFPEN(tb->flags);

    dc->vec_len = ARM_TBFLAG_VECLEN(tb->flags);

    dc->vec_stride = ARM_TBFLAG_VECSTRIDE(tb->flags);

    cpu_F0s = tcg_temp_new_i32();

    cpu_F1s = tcg_temp_new_i32();

    cpu_F0d = tcg_temp_new_i64();

    cpu_F1d = tcg_temp_new_i64();

    cpu_V0 = cpu_F0d;

    cpu_V1 = cpu_F1d;

    /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */

    cpu_M0 = tcg_temp_new_i64();

    next_page_start = (pc_start & TARGET_PAGE_MASK) + TARGET_PAGE_SIZE;

    lj = -1;

    num_insns = 0;

    max_insns = tb->cflags & CF_COUNT_MASK;

    if (max_insns == 0)

        max_insns = CF_COUNT_MASK;

    gen_icount_start();

    tcg_clear_temp_count();

    /* A note on handling of the condexec (IT) bits:

     *

     * We want to avoid the overhead of having to write the updated condexec

     * bits back to the CPUARMState for every instruction in an IT block. So:

     * (1) if the condexec bits are not already zero then we write

     * zero back into the CPUARMState now. This avoids complications trying

     * to do it at the end of the block. (For example if we don't do this

     * it's hard to identify whether we can safely skip writing condexec

     * at the end of the TB, which we definitely want to do for the case

     * where a TB doesn't do anything with the IT state at all.)

     * (2) if we are going to leave the TB then we call gen_set_condexec()

     * which will write the correct value into CPUARMState if zero is wrong.

     * This is done both for leaving the TB at the end, and for leaving

     * it because of an exception we know will happen, which is done in

     * gen_exception_insn(). The latter is necessary because we need to

     * leave the TB with the PC/IT state just prior to execution of the

     * instruction which caused the exception.

     * (3) if we leave the TB unexpectedly (eg a data abort on a load)

     * then the CPUARMState will be wrong and we need to reset it.

     * This is handled in the same way as restoration of the

     * PC in these situations: we will be called again with search_pc=1

     * and generate a mapping of the condexec bits for each PC in

     * gen_opc_condexec_bits[]. restore_state_to_opc() then uses

     * this to restore the condexec bits.

     *

     * Note that there are no instructions which can read the condexec

     * bits, and none which can write non-static values to them, so

     * we don't need to care about whether CPUARMState is correct in the

     * middle of a TB.

     */

    /* Reset the conditional execution bits immediately. This avoids

       complications trying to do it at the end of the block.  */

    if (dc->condexec_mask || dc->condexec_cond)

      {

        TCGv tmp = tcg_temp_new_i32();

        tcg_gen_movi_i32(tmp, 0);

        store_cpu_field(tmp, condexec_bits);

      }

    do {

#ifdef CONFIG_USER_ONLY

        /* Intercept jump to the magic kernel page.  */

        if (dc->pc >= 0xffff0000) {

            /* We always get here via a jump, so know we are not in a

               conditional execution block.  */

            gen_exception(EXCP_KERNEL_TRAP);

            dc->is_jmp = DISAS_UPDATE;

            break;

        }

#else

        if (dc->pc >= 0xfffffff0 && IS_M(env)) {

            /* We always get here via a jump, so know we are not in a

               conditional execution block.  */

            gen_exception(EXCP_EXCEPTION_EXIT);

            dc->is_jmp = DISAS_UPDATE;

            break;

        }

#endif

        if (unlikely(!QTAILQ_EMPTY(&env->breakpoints))) {

            QTAILQ_FOREACH(bp, &env->breakpoints, entry) {

                if (bp->pc == dc->pc) {

                    gen_exception_insn(dc, 0, EXCP_DEBUG);

                    /* Advance PC so that clearing the breakpoint will

                       invalidate this TB.  */

                    dc->pc += 2;

                    goto done_generating;

                    break;

                }

            }

        }

        if (search_pc) {

            j = gen_opc_ptr - gen_opc_buf;

            if (lj < j) {

                lj++;

                while (lj < j)

                    gen_opc_instr_start[lj++] = 0;

            }

            gen_opc_pc[lj] = dc->pc;

            gen_opc_condexec_bits[lj] = (dc->condexec_cond << 4) | (dc->condexec_mask >> 1);

            gen_opc_instr_start[lj] = 1;

            gen_opc_icount[lj] = num_insns;

        }

        if (num_insns + 1 == max_insns && (tb->cflags & CF_LAST_IO))

            gen_io_start();

        if (unlikely(qemu_loglevel_mask(CPU_LOG_TB_OP))) {

            tcg_gen_debug_insn_start(dc->pc);

        }

        if (dc->thumb) {

            disas_thumb_insn(env, dc);

            if (dc->condexec_mask) {

                dc->condexec_cond = (dc->condexec_cond & 0xe)

                                   | ((dc->condexec_mask >> 4) & 1);

                dc->condexec_mask = (dc->condexec_mask << 1) & 0x1f;

                if (dc->condexec_mask == 0) {

                    dc->condexec_cond = 0;

                }

            }

        } else {

            disas_arm_insn(env, dc);

        }

        if (dc->condjmp && !dc->is_jmp) {

            gen_set_label(dc->condlabel);

            dc->condjmp = 0;

        }

        if (tcg_check_temp_count()) {

            fprintf(stderr, "TCG temporary leak before %08x\n", dc->pc);

        }

        /* Translation stops when a conditional branch is encountered.

         * Otherwise the subsequent code could get translated several times.

         * Also stop translation when a page boundary is reached.  This

         * ensures prefetch aborts occur at the right place.  */

        num_insns ++;

    } while (!dc->is_jmp && gen_opc_ptr < gen_opc_end &&

             !env->singlestep_enabled &&

             !singlestep &&

             dc->pc < next_page_start &&

             num_insns < max_insns);

    if (tb->cflags & CF_LAST_IO) {

        if (dc->condjmp) {

            /* FIXME:  This can theoretically happen with self-modifying

               code.  */

            cpu_abort(env, "IO on conditional branch instruction");

        }

        gen_io_end();

    }

    /* At this stage dc->condjmp will only be set when the skipped

       instruction was a conditional branch or trap, and the PC has

       already been written.  */

    if (unlikely(env->singlestep_enabled)) {

        /* Make sure the pc is updated, and raise a debug exception.  */

        if (dc->condjmp) {

            gen_set_condexec(dc);

            if (dc->is_jmp == DISAS_SWI) {

                gen_exception(EXCP_SWI);

            } else {

                gen_exception(EXCP_DEBUG);

            }

            gen_set_label(dc->condlabel);

        }

        if (dc->condjmp || !dc->is_jmp) {

            gen_set_pc_im(dc->pc);

            dc->condjmp = 0;

        }

        gen_set_condexec(dc);

        if (dc->is_jmp == DISAS_SWI && !dc->condjmp) {

            gen_exception(EXCP_SWI);

        } else {

            /* FIXME: Single stepping a WFI insn will not halt

               the CPU.  */

            gen_exception(EXCP_DEBUG);

        }

    } else {

        /* While branches must always occur at the end of an IT block,

           there are a few other things that can cause us to terminate

           the TB in the middel of an IT block:

            - Exception generating instructions (bkpt, swi, undefined).

            - Page boundaries.

            - Hardware watchpoints.

           Hardware breakpoints have already been handled and skip this code.

         */

        gen_set_condexec(dc);

        switch(dc->is_jmp) {

        case DISAS_NEXT:

            gen_goto_tb(dc, 1, dc->pc);

            break;

        default:

        case DISAS_JUMP:

        case DISAS_UPDATE:

            /* indicate that the hash table must be used to find the next TB */

            tcg_gen_exit_tb(0);

            break;

        case DISAS_TB_JUMP:

            /* nothing more to generate */

            break;

        case DISAS_WFI:

            gen_helper_wfi();

            break;

        case DISAS_SWI:

            gen_exception(EXCP_SWI);

            break;

        }

        if (dc->condjmp) {

            gen_set_label(dc->condlabel);

            gen_set_condexec(dc);

            gen_goto_tb(dc, 1, dc->pc);

            dc->condjmp = 0;

        }

    }

done_generating:

    gen_icount_end(tb, num_insns);

    *gen_opc_ptr = INDEX_op_end;

#ifdef DEBUG_DISAS

    if (qemu_loglevel_mask(CPU_LOG_TB_IN_ASM)) {

        qemu_log("----------------\n");

        qemu_log("IN: %s\n", lookup_symbol(pc_start));

        log_target_disas(pc_start, dc->pc - pc_start, dc->thumb);

        qemu_log("\n");

    }

#endif

    if (search_pc) {

        j = gen_opc_ptr - gen_opc_buf;

        lj++;

        while (lj <= j)

            gen_opc_instr_start[lj++] = 0;

    } else {

        tb->size = dc->pc - pc_start;

        tb->icount = num_insns;

    }

}


static int ram_save_page(RAMState *rs, PageSearchStatus *pss, bool last_stage)

{

    int pages = -1;

    uint64_t bytes_xmit;

    ram_addr_t current_addr;

    uint8_t *p;

    int ret;

    bool send_async = true;

    RAMBlock *block = pss->block;

    ram_addr_t offset = pss->page << TARGET_PAGE_BITS;

    p = block->host + offset;

    trace_ram_save_page(block->idstr, (uint64_t)offset, p);

    /* In doubt sent page as normal */

    bytes_xmit = 0;

    ret = ram_control_save_page(rs->f, block->offset,

                           offset, TARGET_PAGE_SIZE, &bytes_xmit);

    if (bytes_xmit) {

        rs->bytes_transferred += bytes_xmit;

        pages = 1;

    }

    XBZRLE_cache_lock();

    current_addr = block->offset + offset;

    if (ret != RAM_SAVE_CONTROL_NOT_SUPP) {

        if (ret != RAM_SAVE_CONTROL_DELAYED) {

            if (bytes_xmit > 0) {

                rs->norm_pages++;

            } else if (bytes_xmit == 0) {

                rs->zero_pages++;

            }

        }

    } else {

        pages = save_zero_page(rs, block, offset, p);

        if (pages > 0) {

            /* Must let xbzrle know, otherwise a previous (now 0'd) cached

             * page would be stale

             */

            xbzrle_cache_zero_page(rs, current_addr);

            ram_release_pages(block->idstr, offset, pages);

        } else if (!rs->ram_bulk_stage &&

                   !migration_in_postcopy() && migrate_use_xbzrle()) {

            pages = save_xbzrle_page(rs, &p, current_addr, block,

                                     offset, last_stage);

            if (!last_stage) {

                /* Can't send this cached data async, since the cache page

                 * might get updated before it gets to the wire

                 */

                send_async = false;

            }

        }

    }

    /* XBZRLE overflow or normal page */

    if (pages == -1) {

        rs->bytes_transferred += save_page_header(rs, block,

                                                  offset | RAM_SAVE_FLAG_PAGE);

        if (send_async) {

            qemu_put_buffer_async(rs->f, p, TARGET_PAGE_SIZE,

                                  migrate_release_ram() &

                                  migration_in_postcopy());

        } else {

            qemu_put_buffer(rs->f, p, TARGET_PAGE_SIZE);

        }

        rs->bytes_transferred += TARGET_PAGE_SIZE;

        pages = 1;

        rs->norm_pages++;

    }

    XBZRLE_cache_unlock();

    return pages;

}


static inline int vmsvga_fifo_empty(struct vmsvga_state_s *s)

{

    if (!s->config || !s->enable)

        return 1;

    return (s->cmd->next_cmd == s->cmd->stop);

}


static int dnxhd_decode_dct_block_10_444(const DNXHDContext *ctx,

                                         RowContext *row, int n)

{

    return dnxhd_decode_dct_block(ctx, row, n, 6, 32, 6);

}