Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging

Block layer patches:

- mirror: Fix early return from drain (could cause deadlocks)
- vmdk: Fixed probing for version 3 images
- vl: Fix to create migration object before block backends again (fixes
  segfault for block drivers that set migration blockers)
- Several minor fixes, documentation and test case improvements

# gpg: Signature made Tue 19 Mar 2019 14:59:17 GMT
# gpg:                using RSA key 7F09B272C88F2FD6
# gpg: Good signature from "Kevin Wolf <kwolf@redhat.com>" [full]
# Primary key fingerprint: DC3D EB15 9A9A F95D 3D74  56FE 7F09 B272 C88F 2FD6

* remotes/kevin/tags/for-upstream:
  qemu-iotests: Treat custom TEST_DIR in 051
  blockdev: Check @replaces in blockdev_mirror_common
  block: Make bdrv_{copy_on_read,crypto_luks,replication} static
  blockjob: fix user pause in block_job_error_action
  qemu-iotests: Fix 232 for non-qcow2
  vl: Fix to create migration object before block backends again
  iotests: 153: Wait for an answer to QMP commands
  block: Silence Coverity in bdrv_drop_intermediate()
  vmdk: Support version=3 in VMDK descriptor files
  qapi: fix block-latency-histogram-set description and examples
  qcow2: Fix data file error condition in qcow2_co_create()
  mirror: Confirm we're quiesced only if the job is paused or cancelled

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
diff --git a/hw/i386/xen/xen-mapcache.c b/hw/i386/xen/xen-mapcache.c
index 349f72d..254759f 100644
--- a/hw/i386/xen/xen-mapcache.c
+++ b/hw/i386/xen/xen-mapcache.c
@@ -184,9 +184,14 @@
         pfns[i] = (address_index << (MCACHE_BUCKET_SHIFT-XC_PAGE_SHIFT)) + i;
     }
 
+    /*
+     * If the caller has requested the mapping at a specific address use
+     * MAP_FIXED to make sure it's honored.
+     */
     if (!dummy) {
         vaddr_base = xenforeignmemory_map2(xen_fmem, xen_domid, vaddr,
-                                           PROT_READ | PROT_WRITE, 0,
+                                           PROT_READ | PROT_WRITE,
+                                           vaddr ? MAP_FIXED : 0,
                                            nb_pfn, pfns, err);
         if (vaddr_base == NULL) {
             perror("xenforeignmemory_map2");
@@ -198,7 +203,8 @@
          * mapping immediately due to certain circumstances (i.e. on resume now)
          */
         vaddr_base = mmap(vaddr, size, PROT_READ | PROT_WRITE,
-                          MAP_ANON | MAP_SHARED, -1, 0);
+                          MAP_ANON | MAP_SHARED | (vaddr ? MAP_FIXED : 0),
+                          -1, 0);
         if (vaddr_base == MAP_FAILED) {
             perror("mmap");
             exit(-1);