cpu_x86_find_by_name() uses strtosz_suffix_unit(), but screws up the error checking. It detects some failures, but not all. Undetected failures result in a zero tsc_khz value (error value -1 divided by 1000), which means "no tsc_freq set".
To reproduce, try "-cpu qemu64,tsc_freq=9999999T". strtosz_suffix_unit() fails, because the value overflows int64_t, Signed-off-by: Markus Armbruster <arm...@redhat.com> --- target-i386/cpuid.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/target-i386/cpuid.c b/target-i386/cpuid.c index 21e5896..56c7671 100644 --- a/target-i386/cpuid.c +++ b/target-i386/cpuid.c @@ -692,7 +692,7 @@ static int cpu_x86_find_by_name(x86_def_t *x86_cpu_def, const char *cpu_model) tsc_freq = strtosz_suffix_unit(val, &err, STRTOSZ_DEFSUFFIX_B, 1000); - if (!*val || *err) { + if (tsc_freq < 0 || *err) { fprintf(stderr, "bad numerical value %s\n", val); goto error; } -- 1.7.6.4