Merge tag 'v1.1.2' into stable-1.1

Merge tag 'v1.1.2' into stable-1.1

* tag 'v1.1.2': (74 commits)
  update VERSION for 1.1.2
  console: bounds check whenever changing the cursor due to an escape code
  qemu-timer: properly arm alarm timer for timers set by device initialization
  target-xtensa: return ENOSYS for unimplemented simcalls
  target-xtensa: fix big-endian BBS/BBC implementation
  ehci: Fix NULL ptr deref when unplugging an USB dev with an iso stream active
  msix: make [un]use vectors on reset/load optional
  reset PMBA and PMREGMISC PIIX4 registers.
  qemu_rearm_alarm_timer: do not call rearm if the next deadline is INT64_MAX
  qemu-ga: Fix null pointer passed to unlink in failure branch
  memory: Fix copy&paste mistake in memory_region_iorange_write
  ivshmem: remove redundant ioeventfd configuration
  hw/arm_gic.c: Define .class_size in arm_gic_info TypeInfo
  tcg/mips: fix broken CONFIG_TCG_PASS_AREG0 code
  audio/winwave: previous audio buffer should be flushed
  target-mips: allow microMIPS SWP and SDP to have RD equal to BASE
  target-mips: add privilege level check to several Cop0 instructions
  mips-linux-user: Always support rdhwr.
  target-mips: Streamline indexed cp1 memory addressing.
  Fix order of CVT.PS.S operands
  ...

Signed-off-by: Avi Kivity <avi@redhat.com>