The proper way to convert from (abstract) QObject to a (concrete)
subtype is qobject_to().  Look for offenders that type cast instead:

    $ git-grep '(Q[A-Z][a-z]* \*)'
    hmp.c:    qmp_device_add((QDict *)qdict, NULL, &err);
    include/qapi/qmp/qobject.h:        return (QObject *)obj;
    qobject/qobject.c:static void (*qdestroy[QTYPE__MAX])(QObject *) = {
    tests/check-qdict.c:    dst = (QDict *)qdict_crumple(src, &error_abort);

The first two cast away const, the third isn't a type cast.  Fix the
fourth.
Signed-off-by: NMarkus Armbruster <armbru@redhat.com>
Message-Id: <20180426152805.8469-1-armbru@redhat.com>
Reviewed-by: NEric Blake <eblake@redhat.com>
Reviewed-by: NMarc-André Lureau <marcandre.lureau@redhat.com>

Queued TCG patches

# gpg: Signature made Wed 02 May 2018 18:43:33 BST
# gpg:                using RSA key 64DF38E8AF7E215F
# gpg: Good signature from "Richard Henderson <richard.henderson@linaro.org>"
# Primary key fingerprint: 7A48 1E78 868B 4DB6 A85A  05C0 64DF 38E8 AF7E 215F

* remotes/rth/tags/pull-tcg-20180502:
  tcg: workaround branch instruction overflow in tcg_out_qemu_ld/st
  tcg: Improve TCGv_ptr support
  tcg: Allow wider vectors for cmp and mul
  tcg/arm: Fix memory barrier encoding
  tcg: Document INDEX_mul[us]h_*
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Just one trace

# gpg: Signature made Wed 02 May 2018 07:59:38 BST
# gpg:                using RSA key 71D4D5E5822F73D6
# gpg: Good signature from "Greg Kurz <groug@kaod.org>"
# gpg:                 aka "Gregory Kurz <gregory.kurz@free.fr>"
# gpg:                 aka "[jpeg image of size 3330]"
# Primary key fingerprint: B482 8BAF 9431 40CE F2A3  4910 71D4 D5E5 822F 73D6

* remotes/gkurz/tags/for-upstream:
  9p: add trace event for v9fs_setattr()
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Don't print the tv_nsec part of atime and mtime, to stay below the 10
argument limit of trace events.
Signed-off-by: NGreg Kurz <groug@kaod.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>

ppc64 uses a BC instruction to call the tcg_out_qemu_ld/st
slow path. BC instruction uses a relative address encoded
on 14 bits.

The slow path functions are added at the end of the generated
instructions buffer, in the reverse order of the callers.
So more we have slow path functions more the distance between
the caller (BC) and the function increases.

This patch changes the behavior to generate the functions in
the same order of the callers.

Cc: qemu-stable@nongnu.org
Fixes: 15fa08f8 ("tcg: Dynamically allocate TCGOps")
Signed-off-by: NLaurent Vivier <lvivier@redhat.com>
Message-Id: <20180429235840.16659-1-lvivier@redhat.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Drop TCGV_PTR_TO_NAT and TCGV_NAT_TO_PTR internal macros.

Add tcg_temp_local_new_ptr, tcg_gen_brcondi_ptr, tcg_gen_ext_i32_ptr,
tcg_gen_trunc_i64_ptr, tcg_gen_extu_ptr_i64, tcg_gen_trunc_ptr_i32.

Use inlines instead of macros where possible.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

In db432672, we allow wide inputs for operations such as add.
However, in 212be173 and 3774030a we didn't do the same for
compare and multiply.
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

I found with qemu 2.11.x or newer that I would get an illegal instruction
error running some Intel binaries on my ARM chromebook.  On investigation,
I found it was quitting on memory barriers.

qemu instruction:
mb $0x31
was translating as:
0x604050cc:  5bf07ff5  blpl     #0x600250a8

After patch it gives:
0x604050cc:  f57ff05b  dmb      ish

In short, I found INSN_DMB_ISH (memory barrier for ARMv7) appeared to be
correct based on online docs, but due to some endian-related shenanigans it
had to be byte-swapped to suit qemu; it appears INSN_DMB_MCR (memory
barrier for ARMv6) also should be byte swapped  (and this patch does so).
I have not checked for correctness of aarch64's barrier instruction.

Cc: qemu-stable@nongnu.org
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: NHenry Wertz <hwertz10@gmail.com>
Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

Signed-off-by: NRichard Henderson <richard.henderson@linaro.org>

# gpg: Signature made Tue 01 May 2018 14:53:58 BST
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier/tags/m68k-for-2.13-pull-request:
  hw/m68k/mcf5208: Fix trivial typo in board description
  m68k: remove dead code (Coverity CID1390617)
  m68k: Fix floatx80_lognp1 (Coverity CID1390587)
  m68k: fix subx mem, mem instruction
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

It's the MCF5208 evaluation board, not the MCF5206 eval board.
Signed-off-by: NThomas Huth <huth@tuxfamily.org>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-Id: <20180429094002.3293c9de@thl530.multi.box>
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>

floatx80_sin() and floatx80_cos() are derived from one
sincos() function. They have both unused code coming from
their common origin. Remove it.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-Id: <20180430170156.1860-2-laurent@vivier.eu>

return the result of packFloatx80() instead of
dropping it.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180430170156.1860-1-laurent@vivier.eu>

Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-04-30.for-upstream' into staging

edgar/xilinx-next-2018-01.for-upstream

# gpg: Signature made Mon 30 Apr 2018 15:52:35 BST
# gpg:                using RSA key 29C596780F6BCA83
# gpg: Good signature from "Edgar E. Iglesias (Xilinx key) <edgar.iglesias@xilinx.com>"
# gpg:                 aka "Edgar E. Iglesias <edgar.iglesias@gmail.com>"
# Primary key fingerprint: AC44 FEDC 14F7 F1EB EDBF  4151 29C5 9678 0F6B CA83

* remotes/edgar/tags/edgar/xilinx-next-2018-04-30.for-upstream:
  target-microblaze: mmu: Make the TLBX MISS bit read-only
  target-microblaze: mmu: Make TLBSX write-only
  target-microblaze: Don't clobber the IMM reg for ld/st reversed
  target-microblaze: Fix trap checks for FPU insns
  target-microblaze: Respect MSR.PVR as read-only
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Make the TLBX MISS bit read-only.
Reviewed-by: NAlistair Francis <alistair.francis@wdc.com>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

Make TLBSX write-only and guest-error log reads from it.
Reviewed-by: NAlistair Francis <alistair.francis@wdc.com>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

Do not clobber the IMM register on reversed load/stores.
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

Fix trap checks for FPU insns when extended FPU insns are enabled.
Reviewed-by: NAlistair Francis <alistair.francis@wdc.com>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

Respect MSR.PVR as read-only. We were wrongly overwriting the PVR bit.
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Signed-off-by: NEdgar E. Iglesias <edgar.iglesias@xilinx.com>

This patch fixes decrement of the pointers for subx mem, mem instructions.
Without the patch pointers are decremented by OS_* constant value instead of
retrieving the corresponding data size and using it as a decrement.
Signed-off-by: NPavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru>
Reviewed-by: NLaurent Vivier <laurent@vivier.eu>
Message-Id: <20180418064152.24606.71975.stgit@pasha-VirtualBox>
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>

# gpg: Signature made Mon 30 Apr 2018 10:05:56 BST
# gpg:                using RSA key F30C38BD3F2FBE3C
# gpg: Good signature from "Laurent Vivier <lvivier@redhat.com>"
# gpg:                 aka "Laurent Vivier <laurent@vivier.eu>"
# gpg:                 aka "Laurent Vivier (Red Hat) <lvivier@redhat.com>"
# Primary key fingerprint: CD2F 75DD C8E3 A4DC 2E4F  5173 F30C 38BD 3F2F BE3C

* remotes/vivier2/tags/linux-user-for-2.13-pull-request: (42 commits)
  linux-user: Add ARM get_tls syscall support
  linux-user: move xtensa cpu loop to xtensa directory
  linux-user: move hppa cpu loop to hppa directory
  linux-user: move riscv cpu loop to riscv directory
  linux-user: move tilegx cpu loop to tilegx directory
  linux-user: move s390x cpu loop to s390x directory
  linux-user: move alpha cpu loop to alpha directory
  linux-user: move m68k cpu loop to m68k directory
  linux-user: move microblaze cpu loop to microblaze directory
  linux-user: move cris cpu loop to cris directory
  linux-user: move sh4 cpu loop to sh4 directory
  linux-user: move openrisc cpu loop to openrisc directory
  linux-user: move nios2 cpu loop to nios2 directory
  linux-user: move mips/mips64 cpu loop to mips directory
  linux-user: move ppc/ppc64 cpu loop to ppc directory
  linux-user: move sparc/sparc64 cpu loop to sparc directory
  linux-user: move arm cpu loop to arm directory
  linux-user: move aarch64 cpu loop to aarch64 directory
  linux-user: move i386/x86_64 cpu loop to i386 directory
  linux-user: create a dummy per arch cpu_loop.c
  ...
Signed-off-by: NPeter Maydell <peter.maydell@linaro.org>

Co-Authored-By: NMickaël Guêné <mickael.guene@st.com>
Signed-off-by: NChristophe Lyon <christophe.lyon@st.com>
Reviewed-by: NPeter Maydell <peter.maydell@linaro.org>
Message-Id: <20180416091845.7315-1-christophe.lyon@st.com>
[lv: moved the change to linux-user/arm/cpu_loop.c]
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>

No code change, only move code from main.c to
xtensa/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-20-laurent@vivier.eu>

No code change, only move code from main.c to
hppa/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-19-laurent@vivier.eu>

No code change, only move code from main.c to
riscv/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NMichael Clark <mjc@sifive.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-18-laurent@vivier.eu>

No code change, only move code from main.c to
tilegx/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-17-laurent@vivier.eu>

No code change, only move code from main.c to
s390x/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Acked-by: NCornelia Huck <cohuck@redhat.com>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-16-laurent@vivier.eu>

No code change, only move code from main.c to
alpha/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-15-laurent@vivier.eu>

No code change, only move code from main.c to
m68k/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-14-laurent@vivier.eu>

No code change, only move code from main.c to
microblaze/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-13-laurent@vivier.eu>

No code change, only move code from main.c to
cris/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-12-laurent@vivier.eu>

No code change, only move code from main.c to
sh4/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-11-laurent@vivier.eu>

No code change, only move code from main.c to
openrisc/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-10-laurent@vivier.eu>

No code change, only move code from main.c to
nios2/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-9-laurent@vivier.eu>

No code change, only move code from main.c to
mips/cpu_loop.c.

Include mips/cpu_loop.c in mips64/cpu_loop.c
to avoid to duplicate code.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-8-laurent@vivier.eu>

No code change, only move code from main.c to
ppc/cpu_loop.c.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-7-laurent@vivier.eu>

No code change, only move code from main.c to
sparc/cpu_loop.c.

Include sparc/cpu_loop.c in sparc64/cpu_loop.c
to avoid to duplicate code.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Reviewed-by: NPhilippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20180411185651.21351-6-laurent@vivier.eu>

No code change, only move code from main.c to
arm/cpu_loop.c and duplicate some macro
defined for both arm and aarch64.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-5-laurent@vivier.eu>

No code change, only move code from main.c to
aarch64/cpu_loop.c and duplicate some macro
defined for both arm and aarch64.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-4-laurent@vivier.eu>

No code change, only move code from main.c to
i386/cpu_loop.c.

Include i386/cpu_loop.c in x86_64/cpu_loop.c
to avoid to duplicate code.
Signed-off-by: NLaurent Vivier <laurent@vivier.eu>
Reviewed-by: NRichard Henderson <richard.henderson@linaro.org>
Message-Id: <20180411185651.21351-3-laurent@vivier.eu>