Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into staging

* serial port fixes (Paolo)
* Q35 modeling improvements (Paolo, Vasily)
* chardev cleanup improvements (Marc-André)
* iscsi bugfix (Peter L.)
* cpu_exec patch from multi-arch patches (Peter C.)
* pci-assign tweak (Lin Ma)

# gpg: Signature made Wed 29 Jun 2016 15:56:30 BST
# gpg:                using RSA key 0xBFFBD25F78C7AE83
# gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>"
# gpg:                 aka "Paolo Bonzini <pbonzini@redhat.com>"
# Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4  E2F7 7E15 100C CD36 69B1
#      Subkey fingerprint: F133 3857 4B66 2389 866C  7682 BFFB D25F 78C7 AE83

* remotes/bonzini/tags/for-upstream: (35 commits)
  socket: unlink unix socket on remove
  socket: add listen feature
  char: clean up remaining chardevs when leaving
  vhost-user: disable chardev handlers on close
  vhost-user-test: fix g_cond_wait_until compat implementation
  vl: smp_parse: fix regression
  ich9: implement SCI_IRQ_SEL register
  ich9: implement ACPI_EN register
  serial: reinstate watch after migration
  serial: remove watch on reset
  char: change qemu_chr_fe_add_watch to return unsigned
  serial: separate serial_xmit and serial_watch_cb
  serial: simplify tsr_retry reset
  serial: make tsr_retry unsigned
  iscsi: fix assertion in is_sector_request_lun_aligned
  target-*: Don't redefine cpu_exec()
  pci-assign: Move "Invalid ROM" error message to pci-assign-load-rom.c
  vnc: generalize "VNC server running on ..." message
  scsi: esp: fix migration
  MC146818 RTC: add GPIO access to output IRQ
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

diff --cc hw/char/cadence_uart.c
index 844542fd5ab573c3a213690c7a75fcc3c11bd093,65179fa5004dc5fb7a1f4e742cdf3412b4043f79..e3bc52f7dffd5e1a414e4866c1c2202c58739f24
--- 1/hw/char/cadence_uart.c
--- 2/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@@ -288,16 -288,16 +288,19 @@@ static gboolean cadence_uart_xmit(GIOCh
      }
  
      ret = qemu_chr_fe_write(s->chr, s->tx_fifo, s->tx_count);
 -    s->tx_count -= ret;
 -    memmove(s->tx_fifo, s->tx_fifo + ret, s->tx_count);
 +
 +    if (ret >= 0) {
 +        s->tx_count -= ret;
 +        memmove(s->tx_fifo, s->tx_fifo + ret, s->tx_count);
 +    }
  
      if (s->tx_count) {
-         int r = qemu_chr_fe_add_watch(s->chr, G_IO_OUT|G_IO_HUP,
-                                       cadence_uart_xmit, s);
-         assert(r);
+         guint r = qemu_chr_fe_add_watch(s->chr, G_IO_OUT|G_IO_HUP,
+                                         cadence_uart_xmit, s);
+         if (!r) {
+             s->tx_count = 0;
+             return FALSE;
+         }
      }
  
      uart_update_status(s);

diff --cc include/qemu/sockets.h
index 3a1a8873afb0d5585176ebda48f099a633b357b7,5dd264816949d898521d3e2d3e6037c77baf04cc..462033a4def2d6359ba3b1b0056a40b5b739a7b0
--- 1/include/qemu/sockets.h
--- 2/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@@ -110,18 -111,4 +111,18 @@@ SocketAddress *socket_remote_address(in
  void qapi_copy_SocketAddress(SocketAddress **p_dest,
                               SocketAddress *src);
  
- #endif /* QEMU_SOCKET_H */
 +/**
 + * socket_address_to_string:
 + * @addr: the socket address struct
 + * @errp: pointer to uninitialized error object
 + *
 + * Get the string representation of the socket
 + * address. A pointer to the char array containing
 + * string format will be returned, the caller is
 + * required to release the returned value when no
 + * longer required with g_free.
 + *
 + * Returns: the socket address in string format, or NULL on error
 + */
 +char *socket_address_to_string(struct SocketAddress *addr, Error **errp);
+ #endif /* QEMU_SOCKET_H */

diff --cc linux-user/main.c
Simple merge

diff --cc target-mips/cpu.h
Simple merge

diff --cc util/qemu-sockets.c
Simple merge

diff --cc vl.c
Simple merge