--- a/source.c
+++ b/source.c
@@ -43,9 +43,9 @@
         ehci_set_state(q->ehci, async, EST_ADVANCEQUEUE);

         again = 1;
+
+    }
+
+    return again;
+
 }

static int ehci_state_writeback(EHCIQueue *q, int async)

{

    int again = 0;

    /*  Write back the QTD from the QH area */

    ehci_trace_qtd(q, NLPTR_GET(q->qtdaddr), (EHCIqtd*) &q->qh.next_qtd);

    put_dwords(NLPTR_GET(q->qtdaddr),(uint32_t *) &q->qh.next_qtd,

                sizeof(EHCIqtd) >> 2);

    /*

     * EHCI specs say go horizontal here.

     *

     * We can also advance the queue here for performance reasons.  We

     * need to take care to only take that shortcut in case we've

     * processed the qtd just written back without errors, i.e. halt

     * bit is clear.

     */

    if (q->qh.token & QTD_TOKEN_HALT) {

        ehci_set_state(q->ehci, async, EST_HORIZONTALQH);

        again = 1;

    } else {

        ehci_set_state(q->ehci, async, EST_ADVANCEQUEUE);

        again = 1;

    }

    return again;

}


--- a/source.c
+++ b/source.c
@@ -2,11 +2,11 @@

 {

+    pl061_state *s = (pl061_state *)opaque;
+
+
+
+    qemu_put_be32(f, s->locked);

     qemu_put_be32(f, s->data);

static void pl061_save(QEMUFile *f, void *opaque)

{

    pl061_state *s = (pl061_state *)opaque;

    qemu_put_be32(f, s->locked);

    qemu_put_be32(f, s->data);

    qemu_put_be32(f, s->old_data);

    qemu_put_be32(f, s->dir);

    qemu_put_be32(f, s->isense);

    qemu_put_be32(f, s->ibe);

    qemu_put_be32(f, s->iev);

    qemu_put_be32(f, s->im);

    qemu_put_be32(f, s->istate);

    qemu_put_be32(f, s->afsel);

    qemu_put_be32(f, s->dr2r);

    qemu_put_be32(f, s->dr4r);

    qemu_put_be32(f, s->dr8r);

    qemu_put_be32(f, s->odr);

    qemu_put_be32(f, s->pur);

    qemu_put_be32(f, s->pdr);

    qemu_put_be32(f, s->slr);

    qemu_put_be32(f, s->den);

    qemu_put_be32(f, s->cr);

    qemu_put_be32(f, s->float_high);

}


--- a/source.c
+++ b/source.c
@@ -23,11 +23,11 @@
             fprintf(stderr, "rdma migration: complete polling error!\n");

             return -EIO;
+
+        }
+
+    }
+

     qemu_rdma_unregister_waiting(rdma);

static int qemu_rdma_drain_cq(QEMUFile *f, RDMAContext *rdma)

{

    int ret;

    if (qemu_rdma_write_flush(f, rdma) < 0) {

        return -EIO;

    }

    while (rdma->nb_sent) {

        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE);

        if (ret < 0) {

            fprintf(stderr, "rdma migration: complete polling error!\n");

            return -EIO;

        }

    }

    qemu_rdma_unregister_waiting(rdma);

    return 0;

}


--- a/source.c
+++ b/source.c
@@ -1,5 +1,5 @@
 void do_store_601_batu (int nr)
+
 {

     do_store_ibatu(env, nr, T0);

void do_store_601_batu (int nr)

{

    do_store_ibatu(env, nr, T0);

    env->DBAT[0][nr] = env->IBAT[0][nr];

    env->DBAT[1][nr] = env->IBAT[1][nr];

}


static void xenstore_record_dm_state(struct xs_handle *xs, const char *state)

{

    char path[50];

    if (xs == NULL) {

        fprintf(stderr, "xenstore connection not initialized\n");

        exit(1);

    }

    snprintf(path, sizeof (path), "/local/domain/0/device-model/%u/state", xen_domid);

    if (!xs_write(xs, XBT_NULL, path, state, strlen(state))) {

        fprintf(stderr, "error recording dm state\n");

        exit(1);

    }

}


--- a/source.c
+++ b/source.c
@@ -1,8 +1,8 @@
+void bdrv_io_unplugged_begin(BlockDriverState *bs)
+
+{
+
+    BdrvChild *child;

void bdrv_io_unplugged_begin(BlockDriverState *bs)

{

    BdrvChild *child;

    if (bs->io_plug_disabled++ == 0 && bs->io_plugged > 0) {

        BlockDriver *drv = bs->drv;

        if (drv && drv->bdrv_io_unplug) {

            drv->bdrv_io_unplug(bs);

        }

    }

    QLIST_FOREACH(child, &bs->children, next) {

        bdrv_io_unplugged_begin(child->bs);

    }

}


--- a/source.c
+++ b/source.c
@@ -1,4 +1,4 @@
+static const unsigned char *seq_decode_op1(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)

 {

@@ -6,7 +6,7 @@

     int b, i, len, bits;

+    GetBitContext gb;

     unsigned char block[8 * 8];

@@ -23,7 +23,7 @@
             src = seq_unpack_rle_block(src, block, sizeof(block));

             for (b = 0; b < 8; b++) {
+
                 memcpy(dst, &block[b * 8], 8);

                 dst += seq->frame.linesize[0];

static const unsigned char *seq_decode_op1(SeqVideoContext *seq, const unsigned char *src, unsigned char *dst)

{

    const unsigned char *color_table;

    int b, i, len, bits;

    GetBitContext gb;

    unsigned char block[8 * 8];

    len = *src++;

    if (len & 0x80) {

        switch (len & 3) {

        case 1:

            src = seq_unpack_rle_block(src, block, sizeof(block));

            for (b = 0; b < 8; b++) {

                memcpy(dst, &block[b * 8], 8);

                dst += seq->frame.linesize[0];

            }

            break;

        case 2:

            src = seq_unpack_rle_block(src, block, sizeof(block));

            for (i = 0; i < 8; i++) {

                for (b = 0; b < 8; b++)

                    dst[b * seq->frame.linesize[0]] = block[i * 8 + b];

                ++dst;

            }

            break;

        }

    } else {

        color_table = src;

        src += len;

        bits = ff_log2_tab[len - 1] + 1;

        init_get_bits(&gb, src, bits * 8 * 8); src += bits * 8;

        for (b = 0; b < 8; b++) {

            for (i = 0; i < 8; i++)

                dst[i] = color_table[get_bits(&gb, bits)];

            dst += seq->frame.linesize[0];

        }

    }

    return src;

}


--- a/source.c
+++ b/source.c
@@ -4,7 +4,7 @@

     EHCIPacket *p = QTAILQ_FIRST(&q->packets);

+    int again = 0;

static int ehci_state_writeback(EHCIQueue *q)

{

    EHCIPacket *p = QTAILQ_FIRST(&q->packets);

    int again = 0;

    /*  Write back the QTD from the QH area */

    assert(p != NULL);

    assert(p->qtdaddr == q->qtdaddr);

    ehci_trace_qtd(q, NLPTR_GET(p->qtdaddr), (EHCIqtd *) &q->qh.next_qtd);

    put_dwords(q->ehci, NLPTR_GET(p->qtdaddr), (uint32_t *) &q->qh.next_qtd,

               sizeof(EHCIqtd) >> 2);

    ehci_free_packet(p);

    /*

     * EHCI specs say go horizontal here.

     *

     * We can also advance the queue here for performance reasons.  We

     * need to take care to only take that shortcut in case we've

     * processed the qtd just written back without errors, i.e. halt

     * bit is clear.

     */

    if (q->qh.token & QTD_TOKEN_HALT) {

        ehci_set_state(q->ehci, q->async, EST_HORIZONTALQH);

        again = 1;

    } else {

        ehci_set_state(q->ehci, q->async, EST_ADVANCEQUEUE);

        again = 1;

    }

    return again;

}


--- a/source.c
+++ b/source.c
@@ -39,11 +39,11 @@
         break;

+
+    default:
+
+        VTD_DPRINTF(GENERAL,
+
                     "error: wrong context-cache invalidation granularity");

         caig = 0;

static uint64_t vtd_context_cache_invalidate(IntelIOMMUState *s, uint64_t val)

{

    uint64_t caig;

    uint64_t type = val & VTD_CCMD_CIRG_MASK;

    switch (type) {

    case VTD_CCMD_GLOBAL_INVL:

        VTD_DPRINTF(INV, "Global invalidation request");

        caig = VTD_CCMD_GLOBAL_INVL_A;

        break;

    case VTD_CCMD_DOMAIN_INVL:

        VTD_DPRINTF(INV, "Domain-selective invalidation request");

        caig = VTD_CCMD_DOMAIN_INVL_A;

        break;

    case VTD_CCMD_DEVICE_INVL:

        VTD_DPRINTF(INV, "Domain-selective invalidation request");

        caig = VTD_CCMD_DEVICE_INVL_A;

        break;

    default:

        VTD_DPRINTF(GENERAL,

                    "error: wrong context-cache invalidation granularity");

        caig = 0;

    }

    return caig;

}


--- a/source.c
+++ b/source.c
@@ -1,17 +1,17 @@
 static void rc4030_realize(DeviceState *dev, Error **errp)

 {
+
     rc4030State *s = RC4030(dev);

     Object *o = OBJECT(dev);
+
+    int i;
+
+
+
+    s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+
                                      rc4030_periodic_timer, s);

static void rc4030_realize(DeviceState *dev, Error **errp)

{

    rc4030State *s = RC4030(dev);

    Object *o = OBJECT(dev);

    int i;

    s->periodic_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,

                                     rc4030_periodic_timer, s);

    memory_region_init_io(&s->iomem_chipset, NULL, &rc4030_ops, s,

                          "rc4030.chipset", 0x300);

    memory_region_init_io(&s->iomem_jazzio, NULL, &jazzio_ops, s,

                          "rc4030.jazzio", 0x00001000);

    memory_region_init_rom_device(&s->dma_tt, o,

                                  &rc4030_dma_tt_ops, s, "dma-table",

                                  MAX_TL_ENTRIES * sizeof(dma_pagetable_entry),

                                  NULL);

    memory_region_init(&s->dma_tt_alias, o, "dma-table-alias", 0);

    memory_region_init(&s->dma_mr, o, "dma", INT32_MAX);

    for (i = 0; i < MAX_TL_ENTRIES; ++i) {

        memory_region_init_alias(&s->dma_mrs[i], o, "dma-alias",

                                 get_system_memory(), 0, DMA_PAGESIZE);

        memory_region_set_enabled(&s->dma_mrs[i], false);

        memory_region_add_subregion(&s->dma_mr, i * DMA_PAGESIZE,

                                    &s->dma_mrs[i]);

    }

    address_space_init(&s->dma_as, &s->dma_mr, "rc4030-dma");

}


--- a/source.c
+++ b/source.c
@@ -1,4 +1,4 @@
+static float get_band_cost_NONE_mips(struct AACEncContext *s,

                                      PutBitContext *pb, const float *in,

static float get_band_cost_NONE_mips(struct AACEncContext *s,

                                     PutBitContext *pb, const float *in,

                                     const float *scaled, int size, int scale_idx,

                                     int cb, const float lambda, const float uplim,

                                     int *bits)

{

    av_assert0(0);

    return 0;

}


--- a/source.c
+++ b/source.c
@@ -1,9 +1,9 @@
 static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,
+                                  int *got_frame, uint8_t *data_start,
+                                  unsigned int data_size)
+{
+    WebPContext *s = avctx->priv_data;
+    AVPacket pkt;
     int ret;
     if (!s->initialized) {
         ff_vp8_decode_init(avctx);

static int vp8_lossy_decode_frame(AVCodecContext *avctx, AVFrame *p,
                                  int *got_frame, uint8_t *data_start,
                                  unsigned int data_size)
{
    WebPContext *s = avctx->priv_data;
    AVPacket pkt;
    int ret;
    if (!s->initialized) {
        ff_vp8_decode_init(avctx);
        s->initialized = 1;
    }
    avctx->pix_fmt = s->has_alpha ? AV_PIX_FMT_YUVA420P : AV_PIX_FMT_YUV420P;
    s->lossless = 0;
    if (data_size > INT_MAX) {
        av_log(avctx, AV_LOG_ERROR, "unsupported chunk size\n");
        return AVERROR_PATCHWELCOME;
    }
    av_init_packet(&pkt);
    pkt.data = data_start;
    pkt.size = data_size;
    ret = ff_vp8_decode_frame(avctx, p, got_frame, &pkt);
    if (ret < 0)
        return ret;
    update_canvas_size(avctx, avctx->width, avctx->height);
    if (s->has_alpha) {
        ret = vp8_lossy_decode_alpha(avctx, p, s->alpha_data,
                                     s->alpha_data_size);
        if (ret < 0)
            return ret;
    }
    return ret;
}


--- a/source.c
+++ b/source.c
@@ -1,5 +1,5 @@
 static void emulated_push_type(EmulatedState *card, uint32_t type)
+
 {

     EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));

static void emulated_push_type(EmulatedState *card, uint32_t type)

{

    EmulEvent *event = (EmulEvent *)g_malloc(sizeof(EmulEvent));

    assert(event);

    event->p.gen.type = type;

    emulated_push_event(card, event);

}


int ff_celp_lp_synthesis_filter(int16_t *out,

                                const int16_t* filter_coeffs,

                                const int16_t* in,

                                int buffer_length,

                                int filter_length,

                                int stop_on_overflow,

                                int rounder)

{

    int i,n;

    // Avoids a +1 in the inner loop.

    filter_length++;

    for (n = 0; n < buffer_length; n++) {

        int sum = rounder;

        for (i = 1; i < filter_length; i++)

            sum -= filter_coeffs[i-1] * out[n-i];

        sum = (sum >> 12) + in[n];

        if (sum + 0x8000 > 0xFFFFU) {

            if (stop_on_overflow)

                return 1;

            sum = (sum >> 31) ^ 32767;

        }

        out[n] = sum;

    }

    return 0;

}


--- a/source.c
+++ b/source.c
@@ -14,11 +14,11 @@

     int i;

+
+
+    for (i = 0; i < ARRAY_SIZE(bad_values) ; i++) {
+
+        err = NULL;

         u.has_enum1 = true;

static void test_visitor_out_struct_errors(TestOutputVisitorData *data,

                                           const void *unused)

{

    EnumOne bad_values[] = { ENUM_ONE_MAX, -1 };

    UserDefZero b;

    UserDefOne u = { .base = &b }, *pu = &u;

    Error *err;

    int i;

    for (i = 0; i < ARRAY_SIZE(bad_values) ; i++) {

        err = NULL;

        u.has_enum1 = true;

        u.enum1 = bad_values[i];

        visit_type_UserDefOne(data->ov, &pu, "unused", &err);

        g_assert(err);

        error_free(err);

    }

}


--- a/source.c
+++ b/source.c
@@ -1,4 +1,4 @@
+static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,

                                           int evpd, int pc)

@@ -14,7 +14,7 @@

         goto fail;

+    }

     full_size = scsi_datain_getfullsize(task);

static struct scsi_task *iscsi_do_inquiry(struct iscsi_context *iscsi, int lun,

                                          int evpd, int pc)

{

    int full_size;

    struct scsi_task *task = NULL;

    task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, 64);

    if (task == NULL || task->status != SCSI_STATUS_GOOD) {

        goto fail;

    }

    full_size = scsi_datain_getfullsize(task);

    if (full_size > task->datain.size) {

        scsi_free_scsi_task(task);

        /* we need more data for the full list */

        task = iscsi_inquiry_sync(iscsi, lun, evpd, pc, full_size);

        if (task == NULL || task->status != SCSI_STATUS_GOOD) {

            goto fail;

        }

    }

    return task;

fail:

    error_report("iSCSI: Inquiry command failed : %s",

                 iscsi_get_error(iscsi));

    if (task) {

        scsi_free_scsi_task(task);

        return NULL;

    }

    return NULL;

}


--- a/source.c
+++ b/source.c
@@ -1,7 +1,7 @@
 static int get_high_utility_cell(elbg_data *elbg)

+{
+
     int i=0;

     /* Using linear search, do binary if it ever turns to be speed critical */

static int get_high_utility_cell(elbg_data *elbg)

{

    int i=0;

    /* Using linear search, do binary if it ever turns to be speed critical */

    int r = av_lfg_get(elbg->rand_state)%elbg->utility_inc[elbg->numCB-1] + 1;

    while (elbg->utility_inc[i] < r)

        i++;

    av_assert2(elbg->cells[i]);

    return i;

}


--- a/source.c
+++ b/source.c
@@ -5,7 +5,7 @@
     PVSCSICmdDescSetupMsgRing *rc =

         (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;
+

     trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");

pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)

{

    PVSCSICmdDescSetupMsgRing *rc =

        (PVSCSICmdDescSetupMsgRing *) s->curr_cmd_data;

    trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_MSG_RING");

    if (!s->use_msg) {

        return PVSCSI_COMMAND_PROCESSING_FAILED;

    }

    if (s->rings_info_valid) {

        pvscsi_ring_init_msg(&s->rings, rc);

        s->msg_ring_info_valid = TRUE;

    }

    return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);

}


static void decode_mb(MadContext *t, int inter)

{

    MpegEncContext *s = &t->s;

    int mv_map = 0;

    int mv_x, mv_y;

    int j;

    if (inter) {

        int v = decode210(&s->gb);

        if (v < 2) {

            mv_map = v ? get_bits(&s->gb, 6) : 63;

            mv_x = decode_motion(&s->gb);

            mv_y = decode_motion(&s->gb);

        } else {

            mv_map = 0;

        }

    }

    for (j=0; j<6; j++) {

        if (mv_map & (1<<j)) {  // mv_x and mv_y are guarded by mv_map

            int add = 2*decode_motion(&s->gb);

            comp_block(t, s->mb_x, s->mb_y, j, mv_x, mv_y, add);

        } else {

            s->dsp.clear_block(t->block);

            decode_block_intra(t, t->block);

            idct_put(t, t->block, s->mb_x, s->mb_y, j);

        }

    }

}


--- a/source.c
+++ b/source.c
@@ -1,10 +1,10 @@
+void qpci_io_writeq(QPCIDevice *dev, void *data, uint64_t value)
+
+{
+
     uintptr_t addr = (uintptr_t)data;

+

     if (addr < QPCI_PIO_LIMIT) {

void qpci_io_writeq(QPCIDevice *dev, void *data, uint64_t value)

{

    uintptr_t addr = (uintptr_t)data;

    if (addr < QPCI_PIO_LIMIT) {

        dev->bus->pio_writeq(dev->bus, addr, value);

    } else {

        value = cpu_to_le64(value);

        dev->bus->memwrite(dev->bus, addr, &value, sizeof(value));

    }

}


--- a/source.c
+++ b/source.c
@@ -4,8 +4,8 @@

+    register_ioport_write(GPE_BASE, GPE_LEN, 1, gpe_writeb, s);
+
     register_ioport_read(GPE_BASE, GPE_LEN, 1,  gpe_readb, s);

     acpi_gpe_blk(&s->ar, GPE_BASE);

static void piix4_acpi_system_hot_add_init(PCIBus *bus, PIIX4PMState *s)

{

    register_ioport_write(GPE_BASE, GPE_LEN, 1, gpe_writeb, s);

    register_ioport_read(GPE_BASE, GPE_LEN, 1,  gpe_readb, s);

    acpi_gpe_blk(&s->ar, GPE_BASE);

    register_ioport_read(PCI_UP_BASE, 4, 4, pci_up_read, s);

    register_ioport_read(PCI_DOWN_BASE, 4, 4, pci_down_read, s);

    register_ioport_write(PCI_EJ_BASE, 4, 4, pciej_write, bus);

    register_ioport_read(PCI_EJ_BASE, 4, 4,  pciej_read, bus);

    register_ioport_write(PCI_RMV_BASE, 4, 4, pcirmv_write, s);

    register_ioport_read(PCI_RMV_BASE, 4, 4,  pcirmv_read, s);

    pci_bus_hotplug(bus, piix4_device_hotplug, &s->dev.qdev);

}


--- a/source.c
+++ b/source.c
@@ -1,5 +1,5 @@
 static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)

+{

 }

static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)

{

}


--- a/source.c
+++ b/source.c
@@ -9,10 +9,10 @@

     test_share = g_strdup("/tmp/qtest.XXXXXX");
+
+    g_assert_nonnull(mkdtemp(test_share));
+
+

     return qtest_pc_boot(cmd, test_share, mount_tag);

static QOSState *qvirtio_9p_start(void)

{

    const char *cmd = "-fsdev local,id=fsdev0,security_model=none,path=%s "

                      "-device virtio-9p-pci,fsdev=fsdev0,mount_tag=%s";

    test_share = g_strdup("/tmp/qtest.XXXXXX");

    g_assert_nonnull(mkdtemp(test_share));

    return qtest_pc_boot(cmd, test_share, mount_tag);

}


--- a/source.c
+++ b/source.c
@@ -13,9 +13,9 @@
     if (!bs->serialising_in_flight) {

         return;
+
+    }
+

     do {

static void coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)

{

    BlockDriverState *bs = self->bs;

    BdrvTrackedRequest *req;

    bool retry;

    if (!bs->serialising_in_flight) {

        return;

    }

    do {

        retry = false;

        QLIST_FOREACH(req, &bs->tracked_requests, list) {

            if (req == self || (!req->serialising && !self->serialising)) {

                continue;

            }

            if (tracked_request_overlaps(req, self->overlap_offset,

                                         self->overlap_bytes))

            {

                /* Hitting this means there was a reentrant request, for

                 * example, a block driver issuing nested requests.  This must

                 * never happen since it means deadlock.

                 */

                assert(qemu_coroutine_self() != req->co);

                qemu_co_queue_wait(&req->wait_queue);

                retry = true;

                break;

            }

        }

    } while (retry);

}


--- a/source.c
+++ b/source.c
@@ -3,11 +3,11 @@
 {

     RTPContext *s = h->priv_data;
+
+    char hostname[256];
+
+    int port;
+

     char buf[1024];

int rtp_set_remote_url(URLContext *h, const char *uri)

{

    RTPContext *s = h->priv_data;

    char hostname[256];

    int port;

    char buf[1024];

    char path[1024];

    url_split(NULL, 0, hostname, sizeof(hostname), &port,

              path, sizeof(path), uri);

    snprintf(buf, sizeof(buf), "udp://%s:%d%s", hostname, port, path);

    udp_set_remote_url(s->rtp_hd, buf);

    snprintf(buf, sizeof(buf), "udp://%s:%d%s", hostname, port + 1, path);

    udp_set_remote_url(s->rtcp_hd, buf);

    return 0;

}


--- a/source.c
+++ b/source.c
@@ -29,11 +29,11 @@
         if (!vmdk_is_cid_valid(bs))

             return -1;
+
+
+
+        /* floor offset to cluster */
+
         offset -= offset % (extent->cluster_sectors * 512);

         ret = bdrv_read(bs->backing_hd, offset >> 9, whole_grain,

static int get_whole_cluster(BlockDriverState *bs,

                VmdkExtent *extent,

                uint64_t cluster_offset,

                uint64_t offset,

                bool allocate)

{

    /* 128 sectors * 512 bytes each = grain size 64KB */

    uint8_t  whole_grain[extent->cluster_sectors * 512];

    /* we will be here if it's first write on non-exist grain(cluster).

     * try to read from parent image, if exist */

    if (bs->backing_hd) {

        int ret;

        if (!vmdk_is_cid_valid(bs))

            return -1;

        /* floor offset to cluster */

        offset -= offset % (extent->cluster_sectors * 512);

        ret = bdrv_read(bs->backing_hd, offset >> 9, whole_grain,

                extent->cluster_sectors);

        if (ret < 0) {

            return -1;

        }

        /* Write grain only into the active image */

        ret = bdrv_write(extent->file, cluster_offset, whole_grain,

                extent->cluster_sectors);

        if (ret < 0) {

            return -1;

        }

    }

    return 0;

}


--- a/source.c
+++ b/source.c
@@ -9,14 +9,14 @@

 #if !defined(CONFIG_USER_ONLY)
+
+    if (ctx->mem_idx == 2)

         read_cb = ctx->spr_cb[sprn].hea_read;

     else if (ctx->mem_idx)
+
+        read_cb = ctx->spr_cb[sprn].oea_read;

     else

static inline void gen_op_mfspr(DisasContext *ctx)

{

    void (*read_cb)(void *opaque, int gprn, int sprn);

    uint32_t sprn = SPR(ctx->opcode);

#if !defined(CONFIG_USER_ONLY)

    if (ctx->mem_idx == 2)

        read_cb = ctx->spr_cb[sprn].hea_read;

    else if (ctx->mem_idx)

        read_cb = ctx->spr_cb[sprn].oea_read;

    else

#endif

        read_cb = ctx->spr_cb[sprn].uea_read;

    if (likely(read_cb != NULL)) {

        if (likely(read_cb != SPR_NOACCESS)) {

            (*read_cb)(ctx, rD(ctx->opcode), sprn);

        } else {

            /* Privilege exception */

            /* This is a hack to avoid warnings when running Linux:

             * this OS breaks the PowerPC virtualisation model,

             * allowing userland application to read the PVR

             */

            if (sprn != SPR_PVR) {

                qemu_log("Trying to read privileged spr %d %03x at "

                         TARGET_FMT_lx "\n", sprn, sprn, ctx->nip);

                printf("Trying to read privileged spr %d %03x at "

                       TARGET_FMT_lx "\n", sprn, sprn, ctx->nip);

            }

            gen_inval_exception(ctx, POWERPC_EXCP_PRIV_REG);

        }

    } else {

        /* Not defined */

        qemu_log("Trying to read invalid spr %d %03x at "

                    TARGET_FMT_lx "\n", sprn, sprn, ctx->nip);

        printf("Trying to read invalid spr %d %03x at " TARGET_FMT_lx "\n",

               sprn, sprn, ctx->nip);

        gen_inval_exception(ctx, POWERPC_EXCP_INVAL_SPR);

    }

}