The guest will be destroyed when hot plug the VF to guest for the second time.

[chao zhou]

Environment:
------------
Host OS (ia32/ia32e/IA64):ia32e
Guest OS (ia32/ia32e/IA64):ia32e
Guest OS Type (Linux/Windows):linux
kvm.git Commit: 6557bada461afeaa920a189fae2cff7c8fdce39f
qemu.kvm Commit: cd2d5541271f1934345d8ca42f5fafff1744eee7
Host Kernel Version:3.19.0-rc3
Hardware:Haswell_EP,Ivytown_EP

Bug detailed description:
--------------------------
create guest , then hot plug the VF to the guest for the second time, the guest will be destroyed.

note:
1. hot plug the device to guest with vfio, the guest works fine
2.this should be a qemu bug:
kvm + qemu = result
6557bada + cd2d5541 = bad
6557bada + a805ca54 = good

Reproduce steps:
----------------
1. qemu-system-x86_64 -enable-kvm -m 2G -net none -monitor pty rhel6u5.qcow
2. echo "device_add pci-assign,host=03:10.1,id=nic" >/dev/pts/2
3. cat /dev/pts/2 &
4. echo "device_del nic" >/dev/pts/2
5. echo "device_add pci-assign,host=03:10.0,id=nic" >/dev/pts/2

Current result:
----------------
guest will be destroyed when hot plug the vf to guest for the second time.

Expected result:
----------------
guest works fine when hot plug the vf to guest for the second time

Basic root-causing log:
----------------------
[root@vt-hsw2 cathy]# qemu-system-x86_64 -enable-kvm -m 2G -net none -monitor pty rhel6u5.qcow
char device redirected to /dev/pts/2 (label compat_monitor0)
Segmentation fault (core dumped)

some dmesg log:

pci-stub 0000:03:10.1: kvm deassign device
pci-stub 0000:03:10.1: enabling device (0000 -> 0002)
qemu-system-x86[9894]: segfault at 0 ip (null) sp 00007fa73df0cae8 error 14
pci-stub 0000:03:10.1: kvm assign device

[chao zhou (chao-zhou)]

the first bad commit is:
commit ec6f25e788ef57ce1e9f734984ef8885172fd9e2
Merge: 007c99f 9ef1473
Author: Peter Maydell <email address hidden>
Date: Tue Feb 3 21:37:16 2015 +0000

    Merge remote-tracking branch 'remotes/rth/tags/pull-tg-s390-20150203' into staging

    s390 translator bug fixes

    # gpg: Signature made Tue 03 Feb 2015 20:39:15 GMT using RSA key ID 4DD0279B
    # gpg: Good signature from "Richard Henderson <email address hidden>"
    # gpg: aka "Richard Henderson <email address hidden>"
    # gpg: aka "Richard Henderson <email address hidden>"

    * remotes/rth/tags/pull-tg-s390-20150203:
      target-s390x: fix and optimize slb* and slbg* computation of carry/borrow flag
      target-s390x: support OC and NC in the EX instruction
      disas/s390.c: Remove unused variables
      target-s390x: Mark check_privileged() as !CONFIG_USER_ONLY
      target-s390: Implement ECAG
      target-s390: Implement LURA, LURAG, STURG
      target-s390: Fix STURA
      target-s390: Fix STIDP
      target-s390: Implement EPSW
      target-s390: Implement SAM specification exception

    Signed-off-by: Peter Maydell <email address hidden>

[chao zhou (chao-zhou)]

please ignore comment 1.

[chao zhou (chao-zhou)]

the first bad commit:

commit 374f2981d1f10bc4307f250f24b2a7ddb9b14be0
Author: Paolo Bonzini <email address hidden>
Date: Fri May 17 12:37:03 2013 +0200

    memory: protect current_map by RCU

    Replace the flat_view_mutex with RCU, avoiding futex contention for
    dataplane on large systems and many iothreads.

    Reviewed-by: Fam Zheng <email address hidden>
    Signed-off-by: Paolo Bonzini <email address hidden>

[chao zhou (chao-zhou)]

kvm.git + qemu.git:4ff6f8e6_3d30395f
host kernel:4.0.0_rc1
test on Haswell_EP
when hot plug the vf to guest for the second time, the guest works fine.