Merge commit '299e0bc52a5d56ff89ad8d7d09c82233cd8ccb6a' into stable-0.12-merge

* commit '299e0bc52a5d56ff89ad8d7d09c82233cd8ccb6a':
  cirrus: Properly re-register cirrus_linear_io_addr on vram unmap
  qcow2: Don't ignore qcow2_alloc_clusters return value
  qcow2: Don't ignore update_refcount return value
  qcow2: Allow updating no refcounts
  qcow2: Improve error handling in update_refcount
  qcow2: Fix error handling in grow_refcount_table
  block: Return original error codes in bdrv_pread/write
  qcow2: Return 0/-errno in qcow2_alloc_cluster_offset
  qcow2: Return 0/-errno in get_cluster_table
  qcow2: Fix error handling in qcow_save_vmstate
  qcow2: Fix error handling in qcow2_grow_l1_table
  win32/sdl: Fix toggle full screen
  win32: pair qemu_memalign() with qemu_vfree()
  vnc_refresh: calling vnc_update_client might free vs
  Musicpal: Fix descriptor walk in eth_send
  Musicpal: Fix wm8750 I2C address
  fix savevm command without id or tag
  reduce number of reinjects on ACK
  QMP: Fix asynchronous events delivery

Conflicts:
	hw/cirrus_vga.c

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

4 files changed, 10 insertions, 9 deletions

diff --git a/hw/cirrus_vga.c b/hw/cirrus_vga.c
index 25c68b1d9..571044f64 100644
--- a/hw/cirrus_vga.c
+++ b/hw/cirrus_vga.c
@@ -2595,9 +2595,11 @@ static void map_linear_vram(CirrusVGAState *s)
 static void unmap_linear_vram(CirrusVGAState *s)
 {
     vga_dirty_log_stop(&s->vga);
-    if (s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end)
+    if (s->vga.map_addr && s->vga.lfb_addr && s->vga.lfb_end) {
         s->vga.map_addr = s->vga.map_end = 0;
-
+         cpu_register_physical_memory(s->vga.lfb_addr, s->vga.vram_size,
+                                      s->cirrus_linear_io_addr);
+    }
     cpu_register_physical_memory(isa_mem_base + 0xa0000, 0x20000,
                                  s->vga.vga_io_memory);
 
diff --git a/hw/mc146818rtc.c b/hw/mc146818rtc.c
index e4d55c7c7..2616d0d7e 100644
--- a/hw/mc146818rtc.c
+++ b/hw/mc146818rtc.c
@@ -30,7 +30,7 @@
 
 //#define DEBUG_CMOS
 
-#define RTC_REINJECT_ON_ACK_COUNT 1000
+#define RTC_REINJECT_ON_ACK_COUNT 20
 
 #define RTC_SECONDS             0
 #define RTC_SECONDS_ALARM       1
diff --git a/hw/musicpal.c b/hw/musicpal.c
index 4a33e28bc..b8af15ed5 100644
--- a/hw/musicpal.c
+++ b/hw/musicpal.c
@@ -67,7 +67,7 @@
 #define MP_AUDIO_IRQ            30
 
 /* Wolfson 8750 I2C address */
-#define MP_WM_ADDR              0x34
+#define MP_WM_ADDR              0x1A
 
 /* Ethernet register offsets */
 #define MP_ETH_SMIR             0x010
@@ -238,14 +238,13 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
 {
     uint32_t desc_addr = s->tx_queue[queue_index];
     mv88w8618_tx_desc desc;
+    uint32_t next_desc;
     uint8_t buf[2048];
     int len;
 
-    if (!desc_addr) {
-        return;
-    }
     do {
         eth_tx_desc_get(desc_addr, &desc);
+        next_desc = desc.next;
         if (desc.cmdstat & MP_ETH_TX_OWN) {
             len = desc.bytes;
             if (len < 2048) {
@@ -256,7 +255,7 @@ static void eth_send(mv88w8618_eth_state *s, int queue_index)
             s->icr |= 1 << (MP_ETH_IRQ_TXLO_BIT - queue_index);
             eth_tx_desc_put(desc_addr, &desc);
         }
-        desc_addr = desc.next;
+        desc_addr = next_desc;
     } while (desc_addr != s->tx_queue[queue_index]);
 }
 
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index e3924dec9..b34fbaa67 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -81,7 +81,7 @@ static SCSIDiskReq *scsi_new_request(SCSIDevice *d, uint32_t tag, uint32_t lun)
 
 static void scsi_remove_request(SCSIDiskReq *r)
 {
-    qemu_free(r->iov.iov_base);
+    qemu_vfree(r->iov.iov_base);
     scsi_req_free(&r->req);
 }