mirror of
https://gitlab.com/qemu-project/qemu.git
synced 2026-10-28 14:04:39 +08:00
Junjie Cao
0ddbce88c4
ct3_realize() adds the CDAT DOE at a fixed 0x190. Since8700ee15dethe four DVSECs take 0x90 bytes, which from 0x100 ends exactly at 0x190. With sn= the Device Serial Number capability pushes the block to 0x10c..0x19c, and the DOE, added later, overwrites the last 12 bytes of the Flex Bus Port DVSEC: Capability2, Control2 and Status2. Nothing catches this -- pcie_add_capability() checks bounds, not overlap, and the chain still walks because the DVSEC's next pointer becomes 0x190, inside its own body. Most cxl-type3 examples in docs/system/devices/cxl.rst set sn=. Derive the offset from the DVSEC block instead, as cxl_upstream.c already does. Without sn= the layout is unchanged byte for byte; with sn= the DOE moves to 0x19c, below the AER capability at 0x200. The type 3 device has no VMStateDescription, so its config space never reaches the migration stream. Fixes:8700ee15de("hw/cxl: Standardize all references on CXL r3.1 and minor updates") Signed-off-by: Junjie Cao <junjie.cao@intel.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-ID: <20260831022302.406740-1-junjie.cao@intel.com>