aboutsummaryrefslogtreecommitdiff
path: root/hw
AgeCommit message (Collapse)Author
2014-09-26Merge remote-tracking branch 'remotes/bonzini/tags/for-upstream' into stagingPeter Maydell
Usual mix of patches, the most important being Alex and Marcelo's kvmclock fix. This was reverted last minute for 2.1, but it is now back with the problematic case fixed. Note: I will soon switch to a subkey for signing purposes. To verify future signed pull requests from me, please update my key with "gpg --recv-keys 9B4D86F2". You should see 3 new subkeys---the one for signing will be a 2048-bit RSA key, 4E6B09D7. # gpg: Signature made Fri 26 Sep 2014 15:34:44 BST using RSA key ID 9B4D86F2 # gpg: Good signature from "Paolo Bonzini <pbonzini@redhat.com>" # gpg: aka "Paolo Bonzini <bonzini@gnu.org>" * remotes/bonzini/tags/for-upstream: kvm/valgrind: don't mark memory as initialized po: fix conflict with %.mo rule in rules.mak kvmvapic: fix migration when VM paused and when not running Windows serial: check if backed by a physical serial port at realize time serial: reset state at startup target-i386: update fp status fix hw/dma/i8257: Silence phony error message kvmclock: Ensure time in migration never goes backward kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation Introduce cpu_clean_all_dirty pit: fix pit interrupt can't inject into vm after migration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-26kvmvapic: fix migration when VM paused and when not running WindowsPavel Dovgalyuk
This patch fixes migration by extending do_vapic_enable function. This function called vapic_enable which read cpu number from the guest memory. When cpu number could not be read, vapic was not enabled while loading the VM state. This patch adds required code for cpu_number=0 to do_vapic_enable function, because it is called only when cpu_number=0. Signed-off-by: Pavel Dovgalyuk <Pavel.Dovgaluk@ispras.ru> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2014-09-26ohci: drop computed flags from trace eventsAlex Bennée
This exceeded the trace argument limit for LTTNG UST and wasn't really needed as the flags value is stored anyway. Dropping this fixes the compile failure for UST. It can probably be merged with the previous trace shortening patch. Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-26ohci: Split long traces to smaller onesAlexey Kardashevskiy
Recent traces rework introduced 2 tracepoints with 13 and 20 arguments. When dtrace backend is selected (--enable-trace-backend=dtrace), compile fails as sys/sdt.h defines DTRACE_PROBE up to DTRACE_PROBE12 only. This splits long tracepoints. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-24Merge remote-tracking branch 'remotes/mcayland/tags/qemu-sparc-signed' into ↵Peter Maydell
staging tcx: Implement hardware acceleration # gpg: Signature made Tue 23 Sep 2014 22:52:34 BST using RSA key ID AE0F321F # gpg: Can't check signature: public key not found * remotes/mcayland/tags/qemu-sparc-signed: tcx: Implement hardware acceleration Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-24Merge remote-tracking branch ↵Peter Maydell
'remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0' into staging Endian updates to re-fix cross endian host and guest and enable the same for ROM loading (Alexey) # gpg: Signature made Tue 23 Sep 2014 18:03:03 BST using RSA key ID 3BB08B22 # gpg: Can't check signature: public key not found * remotes/awilliam/tags/vfio-pci-for-qemu-20140923.0: vfio: make rom read endian sensitive Revert "vfio: Make BARs native endian" Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-23tcx: Implement hardware accelerationMark Cave-Ayland
The S24/TCX framebuffer is a mildly accelerated video card with blitter, stippler and hardware cursor. * Solaris and NetBSD 6.x use all the hardware acceleration features * The Xorg driver (used by Linux) can use the hardware cursor only This patch implements hardware acceleration in both 8 bit and 24 bit modes. It is based on the NetBSD driver sources and from tests with Solaris. Signed-off-by: Olivier Danet <odanet@caramail.com> Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
2014-09-23Merge remote-tracking branch 'remotes/kraxel/tags/pull-usb-20140923-1' into ↵Peter Maydell
staging usb: enable hotplug, switch to realize, ohci tracing, misc fixes. # gpg: Signature made Tue 23 Sep 2014 12:42:29 BST using RSA key ID D3E87138 # gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" # gpg: aka "Gerd Hoffmann <gerd@kraxel.org>" # gpg: aka "Gerd Hoffmann (private) <kraxel@gmail.com>" * remotes/kraxel/tags/pull-usb-20140923-1: (26 commits) usb: tag standalone ehci as hotpluggable usb: tag standalone uhci as hotpluggable usb: tag xhci as hotpluggable usb-serial: only check speed once at realize time usb-bus: introduce a wrapper function to check speed usb-bus: remove "init" from USBDeviceClass struct usb-mtp: convert init to realize usb-redir: convert init to realize usb-audio: convert init to realize dev-wacom: convert init to realize dev-hid: convert init to realize usb-ccid: convert init to realize dev-serial: convert init to realize dev-bluetooth: convert init to realize dev-uas: using error_report instead of fprintf dev-uas: convert init to realize dev-storage: usring error_report instead of fprintf/printf dev-storage: convert init to realize usb-hub: convert init to realize libusb: using error_report instead of fprintf ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-23Merge remote-tracking branch 'remotes/borntraeger/tags/s390x-20140923' into ↵Peter Maydell
staging s390x/kvm: some fixes and cleanups 1. sclp: get of of duplicate defines 2. ccw: implement and fix handling of some special cases # gpg: Signature made Tue 23 Sep 2014 13:10:47 BST using RSA key ID B5A61C7C # gpg: Can't check signature: public key not found * remotes/borntraeger/tags/s390x-20140923: s390x/css: catch ccw sequence errors s390x/css: support format-0 ccws s390x: remove duplicate defines in SCLP code Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-23s390x/css: catch ccw sequence errorsCornelia Huck
We must not allow chains of more than 255 ccws without data transfer. Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-09-23s390x/css: support format-0 ccwsCornelia Huck
Add support for format-0 ccws in channel programs. As a format-1 ccw contains the same information as format-0 ccws, only supporting larger addresses, simply convert every ccw to format-1 as we walk the chain. Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com> Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com> Signed-off-by: Jens Freimann <jfrei@linux.vnet.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
2014-09-23Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into ↵Peter Maydell
staging # gpg: Signature made Mon 22 Sep 2014 12:41:59 BST using RSA key ID 81AB73C8 # gpg: Good signature from "Stefan Hajnoczi <stefanha@redhat.com>" # gpg: aka "Stefan Hajnoczi <stefanha@gmail.com>" * remotes/stefanha/tags/block-pull-request: (59 commits) block: Always compile virtio-blk dataplane vring: Better error handling if num is too large virtio: Import virtio_vring.h async: aio_context_new(): Handle event_notifier_init failure block: vhdx - fix reading beyond pointer during image creation block: delete cow block driver block/archipelago: Fix typo in qemu_archipelago_truncate() ahci: Add test_identify case to ahci-test. ahci: Add test_hba_enable to ahci-test. ahci: Add test_hba_spec to ahci-test. ahci: properly shadow the TFD register ahci: add test_pci_enable to ahci-test. ahci: Add test_pci_spec to ahci-test. ahci: MSI capability should be at 0x80, not 0x50. ahci: Adding basic functionality qtest. layout: Add generators for refcount table and blocks fuzz: Add fuzzing functions for entries of refcount table and blocks docs: List all image elements currently supported by the fuzzer qapi/block-core: Add "new" qcow2 options qcow2: Add overlap-check.template option ... Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
2014-09-23usb: tag standalone ehci as hotpluggableGerd Hoffmann
Add a flag to EHCIPCIInfo saying whenever the controller supports companions or not. Make sure we only allow registering companions for ehci versions supporting that. Enable pci hotplug for the ehci variants not supporting companions. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb: tag standalone uhci as hotpluggableGerd Hoffmann
uhci hostadapters in companion setups can't be hotplugged. So leave hotplug disabled for all ich9 variants (which are already tagged with unplug = true in the info struct). For the other variants we'll enable hotplug and remove the companion setup properties. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb: tag xhci as hotpluggableGerd Hoffmann
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-serial: only check speed once at realize timeGonglei
Whatever the chardev is open or not, we should assure the speed is matched each other. So, call usb_check_attach() check speed. And then pass &error_abort at all calls to usb_device_attach(). Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-bus: introduce a wrapper function to check speedGonglei
In this way, we can check speed directly, don't need call usb_device_attach(), which has other conditions, such as checking the chardev is open. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-bus: remove "init" from USBDeviceClass structGonglei
All usb-bus devices are realized by realize(), remove init callback function from USBDeviceClass struct. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-mtp: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-redir: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of qerror_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-audio: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-wacom: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-hid: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of error_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-ccid: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-serial: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of error_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-bluetooth: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-uas: using error_report instead of fprintfGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-uas: convert init to realizeGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-storage: usring error_report instead of fprintf/printfGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23dev-storage: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of error_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-hub: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of error_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23libusb: using error_report instead of fprintfGonglei
Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23libusb: convert init to realizeGonglei
In this way, all the implementations now use error_setg instead of error_report for reporting error. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-net: convert init to realizeGonglei
meanwhile, qerror_report_err() is a transitional interface to help with converting existing HMP commands to QMP. It should not be used elsewhere. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-bus: convert USBDeviceClass init to realizeGonglei
Add "realize/unrealize" in USBDeviceClass, which has errp as a parameter. So all the implementations now use error_setg instead of error_report for reporting error. Note: this patch still keep "init" in USBDeviceClass, and call kclass->init in usb_device_realize(), avoid breaking git bisect. After realize all usb devices, will be removed. Signed-off-by: Gonglei <arei.gonglei@huawei.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23ohci: Convert fprint/DPRINTF/print to tracesAlexey Kardashevskiy
This converts many kinds of debug prints to traces. This implements packets logging to avoid unnecessary calculations if usb_ohci_td_pkt_short/usb_ohci_td_pkt_long is not enabled. This makes OHCI errors (such as "DMA error") invisible by default. Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-23usb-storage: fix possible memory leak and missing error messageGonglei
When scsi_bus_legacy_add_drive() return NULL, meanwhile err will be not NULL, which will casue memory leak and missing error message. Cc: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gonglei <arei.gonglei@huawei.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
2014-09-22vfio: make rom read endian sensitiveNikunj A Dadhania
All memory regions used by VFIO are LITTLE_ENDIAN and they already take care of endiannes when accessing real device BARs except ROM - it was broken on BE hosts. This fixes endiannes for ROM BARs the same way as it is done for other BARs. This has been tested on PPC64 BE/LE host/guest in all possible combinations including TCG. Signed-off-by: Nikunj A Dadhania <nikunj@linux.vnet.ibm.com> [aik: added commit log] Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-09-22Revert "vfio: Make BARs native endian"Alexey Kardashevskiy
This reverts commit c40708176a6b52b73bec14796b7c71b882ceb102. The resulting code wrongly assumed target and host endianness are the same which is not always the case for PPC64. [aw: or potentially any host supporting VFIO and TCG] Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
2014-09-22block: Always compile virtio-blk dataplaneFam Zheng
Dataplane doesn't depend on linux-aio any more, so we don't need the compiling condition now. Configure options are kept but just print a message. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1410329871-28885-4-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22vring: Better error handling if num is too largeFam Zheng
To be more consistent inside this function. Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1410329871-28885-3-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22virtio: Import virtio_vring.hFam Zheng
This header has no further dependencies. It only has some stable data types and primitive functions, so we can copy it to include/hw/virtio in order to allow vring code (and its user virtio-blk dataplane) to be built unconditionally, even for cross compiling. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Message-id: 1410329871-28885-2-git-send-email-famz@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22ahci: properly shadow the TFD registerJohn Snow
In a real AHCI device, several S/ATA registers are mirrored or shadowed within the AHCI register set. These registers are not updated synchronously for each read access, but are instead updated after a Device-to-Host Register FIS packet is received. The D2H FIS contains the values from these registers on the device. In QEMU, by reaching directly into the device to grab these bits before they are "sent," we may introduce race conditions where unexpected values are present "before they are sent" which could cause issues for some guests, particularly if an attempt is made to read the PxTFD register prior to enabling the port, where incorrect values will be read. This patch also addresses the boot-time values for the PxTFD and PxSIG registers to bring them in line with the AHCI 1.3 specification. Lastly, several fields (PxTFD, PxSIG and PxSACT) are read-only, and any attempts to write to them should be ignored. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1408643079-30675-6-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22ahci: MSI capability should be at 0x80, not 0x50.John Snow
In the Intel ICH9 data sheet, the MSI capability offset in the PCI configuration space for ICH9 AHCI devices is specified to be 0x80. Further, the PCI capability pointer should always point to 0x80 in ICH9 devices, despite the fact that AHCI 1.3 specifies that it should be pointing to PMCAP (Which in this instance would be 0x70) to maintain adherence to the Intel data sheet specifications and real observed behavior. Signed-off-by: John Snow <jsnow@redhat.com> Message-id: 1408643079-30675-3-git-send-email-jsnow@redhat.com Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22block: Rename qemu_aio_release -> qemu_aio_unrefFam Zheng
Suggested-by: Benoît Canet <benoit.canet@irqsave.net> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22ide: Convert trim_aiocb_info.cancel to .cancel_asyncFam Zheng
We know that either bh is scheduled or ide_issue_trim_cb will be called again, so we just set i, j and ret to the right values. In both cases, ide_trim_bh_cb will be called. Also forward the cancellation to the iocb->aiocb which we get from bdrv_aio_discard. Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22ide/ahci: Check for -ECANCELED in aio callbacksFam Zheng
Before, bdrv_aio_cancel will either complete the request (like normal) and call CB with an actual return code, or skip calling the request (for example when the IO req is not submitted by thread pool yet). We will change bdrv_aio_cancel to do it differently: always call CB before return, with either [1] a normal req completion ret code, or [2] ret == -ECANCELED. So the callers' callback must accept both cases. The existing logic works with case [1], but not [2]. The simplest transition of callback code is do nothing in case [2], just as if the CB is not called by the bdrv_aio_cancel() call. Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Fam Zheng <famz@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22ide/atapi: Mark non-data commands as completeJohn Snow
When the command completion code in IDE and AHCI was unified to put all command completion inside of a callback, "cmd_done," we neglected to ensure that all AHCI/ATAPI command paths would eventually register as finished. for the PCI interface to IDE this is not a problem because cmd_done is a nop, but the AHCI implementation needs to send a D2H_REG_FIS and interrupt back to the guest to inform of completion. This patch adds calls to ide_stop_transfer, which calls ide_cmd_done, inside of ide_atapi_cmd_ok and ide_atapi_cmd_error. This fixes regressions observed by trying to boot QEMU with a Fedora 20 live CD under Q35/AHCI, which uses ATAPI command 0x00, which is a status check that may cause a hang because we never complete, and ATAPI command 0x56, which is unsupported by our current implementation and results in an error that we never report back to the guest. Signed-off-by: John Snow <jsnow@redhat.com> Reviewed-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-09-22pc: Add missing 'static' attributeStefan Weil
This fixes a warning from smatch (static code analysis). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
2014-09-22usb-storage: Fix how legacy init handles option ID clashMarkus Armbruster
usb_msd_init() calls qemu_opts_create() with a made-up ID and false fail_if_exists. If the ID already exists, it happily messes up those options, then fails drive_new(), because the BlockDriverState with that ID already exists, too. Reproducer: -drive if=none,id=usb0,format=raw -usbdevice disk:tmp.qcow2 Pass true fail_if_exists to qemu_opts_create(), and if it fails, try the next made-up ID. The reproducer now succeeds, and creates an usb-storage device with ID usb1. Signed-off-by: Markus Armbruster <armbru@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>