[PATCH 0/3] hw/cxl: Add fixes in maintenance, PPR and event records

[PATCH 0/3] hw/cxl: Add fixes in maintenance, PPR and event records

[shiju.jose--- via qemu development]

From: Shiju Jose <shiju.jose@huawei.com>

Add few fixes in CXL maintenance, PPR and event records generation.

1. In cxl_create_mem_sparing_event_records(), replace strncpy with memcpy to
solve coverity warning because full size of the array to use as length in
strncpy to copy the entire component id data, which is 16 bytes.

2. In cxl_maintenance_insert(),
 - replace strncpy with memcpy in to copy full data because component id is
   16 bytes data.
 - remove memset which is not required.

3. In cxl_perform_ppr(), remove and free the maintenance entry from QLIST if
match is found and PPR operation is performed.

4. Component id in CXL events is 16 bytes data, but event record generation copy
15 bytes only from the qmp "component-id" field using strncpy.
Replace strncpy with memcpy and change length of data to copy to the size of the
component_id array (16 bytes).

Shiju Jose (3):
  hw/cxl: Add fixes in maintenance and memory sparing
  hw/cxl: Add fixes in Post Package Repair (PPR)
  hw/cxl/events: Fixes for component id in event records generation

 hw/cxl/cxl-mailbox-utils.c |  6 ++++--
 hw/mem/cxl_type3.c         | 13 ++++---------
 2 files changed, 8 insertions(+), 11 deletions(-)

-- 
2.43.0

[PATCH 1/3] hw/cxl: Add fixes in maintenance and memory sparing

[shiju.jose--- via qemu development]

From: Shiju Jose <shiju.jose@huawei.com>

Add following fixes to the commit: hw/cxl: Add support for Maintenance
command and Post Package Repair (PPR).

1. In cxl_create_mem_sparing_event_records(), replace strncpy with memcpy to
solve coverity warning because full size of the array to use as length in
strncpy to copy the entire component id data, which is 16 bytes.

2. In cxl_maintenance_insert(),
 - replace strncpy with memcpy in to copy full data because component id is
   16 bytes data.
 - remove memset which is not required.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
---
 hw/cxl/cxl-mailbox-utils.c | 4 ++--
 hw/mem/cxl_type3.c         | 4 +---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index c83b5f90d4..9c99422cd4 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1994,8 +1994,8 @@ static void cxl_create_mem_sparing_event_records(CXLType3Dev *ct3d,
         stw_le_p(&event_rec.column, ent->column);
         event_rec.sub_channel = ent->sub_channel;
         if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
-            strncpy((char *)event_rec.component_id, (char *)ent->component_id,
-                    sizeof(event_rec.component_id));
+            memcpy(event_rec.component_id, ent->component_id,
+                   sizeof(event_rec.component_id));
         }
     } else if (sparing_pi) {
         event_rec.flags = CXL_MSER_FLAGS_QUERY_RESOURCES;
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 4739239da3..3cb1096e16 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1767,7 +1767,6 @@ static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
         }
     }
     m = g_new0(CXLMaintenance, 1);
-    memset(m, 0, sizeof(*m));
     m->dpa = dpa;
     m->validity_flags = 0;
 
@@ -1804,8 +1803,7 @@ static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
         m->validity_flags |= CXL_MSER_VALID_SUB_CHANNEL;
     }
     if (component_id) {
-        strncpy((char *)m->component_id, component_id,
-                sizeof(m->component_id) - 1);
+        memcpy(m->component_id, component_id, sizeof(m->component_id));
         m->validity_flags |= CXL_MSER_VALID_COMP_ID;
         if (has_comp_id_pldm && is_comp_id_pldm) {
             m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;
-- 
2.43.0

[PATCH 2/3] hw/cxl: Add fixes in Post Package Repair (PPR)

[shiju.jose--- via qemu development]

From: Shiju Jose <shiju.jose@huawei.com>

Add following fixes to the commit: hw/cxl: Add support for Maintenance
command and Post Package Repair (PPR).

In cxl_perform_ppr(), remove and free the maintenance entry from QLIST
if match is found and PPR operation is performed.

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
---
 hw/cxl/cxl-mailbox-utils.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 9c99422cd4..66a58396ee 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -2068,6 +2068,8 @@ static void cxl_perform_ppr(CXLType3Dev *ct3d, uint64_t dpa)
                                 CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING,
                                 ent, NULL);
             }
+            QLIST_REMOVE(ent, node);
+            g_free(ent);
             break;
         }
     }
-- 
2.43.0

[PATCH 3/3] hw/cxl/events: Fixes for component id in event records generation

[shiju.jose--- via qemu development]

From: Shiju Jose <shiju.jose@huawei.com>

Component id in CXL events is 16 bytes data, but event record generation copy
15 bytes only from the qmp "component-id" field using strncpy.
Replace strncpy with memcpy and change length of data to copy to the size of the
component_id array (16 bytes).

Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
---
 hw/mem/cxl_type3.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index 3cb1096e16..03a5d1751f 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -1895,8 +1895,7 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
     }
 
     if (component_id) {
-        strncpy((char *)gem.component_id, component_id,
-                sizeof(gem.component_id) - 1);
+        memcpy(gem.component_id, component_id, sizeof(gem.component_id));
         valid_flags |= CXL_GMER_VALID_COMPONENT;
         if (has_comp_id_pldm && is_comp_id_pldm) {
             valid_flags |= CXL_GMER_VALID_COMPONENT_ID_FORMAT;
@@ -2066,8 +2065,7 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
     }
 
     if (component_id) {
-        strncpy((char *)dram.component_id, component_id,
-                sizeof(dram.component_id) - 1);
+        memcpy(dram.component_id, component_id, sizeof(dram.component_id));
         valid_flags |= CXL_DRAM_VALID_COMPONENT;
         if (has_comp_id_pldm && is_comp_id_pldm) {
             valid_flags |= CXL_DRAM_VALID_COMPONENT_ID_FORMAT;
@@ -2185,8 +2183,7 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
              corrected_persist_error_count);
 
     if (component_id) {
-        strncpy((char *)module.component_id, component_id,
-                sizeof(module.component_id) - 1);
+        memcpy(module.component_id, component_id, sizeof(module.component_id));
         valid_flags |= CXL_MMER_VALID_COMPONENT;
         if (has_comp_id_pldm && is_comp_id_pldm) {
             valid_flags |= CXL_MMER_VALID_COMPONENT_ID_FORMAT;
-- 
2.43.0

Re: [PATCH 1/3] hw/cxl: Add fixes in maintenance and memory sparing

[Jonathan Cameron via qemu development]

On Fri, 27 Feb 2026 22:32:04 +0000
<shiju.jose@huawei.com> wrote:

> From: Shiju Jose <shiju.jose@huawei.com>
Hi Shiju,

Perhaps a more specific title would help people understand quickly what
type of fix this is?

Something like:
hw/cxl: Fix handling of component ID to not assume it is a string.


> 
> Add following fixes to the commit: hw/cxl: Add support for Maintenance
> command and Post Package Repair (PPR).
That just wants to be a reference to the fixes tag.

> 
> 1. In cxl_create_mem_sparing_event_records(), replace strncpy with memcpy to
> solve coverity warning because full size of the array to use as length in
> strncpy to copy the entire component id data, which is 16 bytes.
I wouldn't necessarily focus on the coverity issue bit of this, but rather that
it's not a string so memcpy is the correct function to use.  Then flag it as
as being identified as a result of the coverity warning.
> 
> 2. In cxl_maintenance_insert(),
>  - replace strncpy with memcpy in to copy full data because component id is
>    16 bytes data.
>  - remove memset which is not required.
> 
> Reported-by: Peter Maydell <peter.maydell@linaro.org>

The original patch is upstream, so need a Fixes tag. I can't remember how
we mark coverity issue closures, so look for a similar patch and copy that
style. Maybe just a Closes tag for Peter's email pointing it out.

Code looks good.

> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
> ---
>  hw/cxl/cxl-mailbox-utils.c | 4 ++--
>  hw/mem/cxl_type3.c         | 4 +---
>  2 files changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> index c83b5f90d4..9c99422cd4 100644
> --- a/hw/cxl/cxl-mailbox-utils.c
> +++ b/hw/cxl/cxl-mailbox-utils.c
> @@ -1994,8 +1994,8 @@ static void cxl_create_mem_sparing_event_records(CXLType3Dev *ct3d,
>          stw_le_p(&event_rec.column, ent->column);
>          event_rec.sub_channel = ent->sub_channel;
>          if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
> -            strncpy((char *)event_rec.component_id, (char *)ent->component_id,
> -                    sizeof(event_rec.component_id));
> +            memcpy(event_rec.component_id, ent->component_id,
> +                   sizeof(event_rec.component_id));
>          }
>      } else if (sparing_pi) {
>          event_rec.flags = CXL_MSER_FLAGS_QUERY_RESOURCES;
> diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
> index 4739239da3..3cb1096e16 100644
> --- a/hw/mem/cxl_type3.c
> +++ b/hw/mem/cxl_type3.c
> @@ -1767,7 +1767,6 @@ static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
>          }
>      }
>      m = g_new0(CXLMaintenance, 1);
> -    memset(m, 0, sizeof(*m));
>      m->dpa = dpa;
>      m->validity_flags = 0;
>  
> @@ -1804,8 +1803,7 @@ static void cxl_maintenance_insert(CXLType3Dev *ct3d, uint64_t dpa,
>          m->validity_flags |= CXL_MSER_VALID_SUB_CHANNEL;
>      }
>      if (component_id) {
> -        strncpy((char *)m->component_id, component_id,
> -                sizeof(m->component_id) - 1);
> +        memcpy(m->component_id, component_id, sizeof(m->component_id));
>          m->validity_flags |= CXL_MSER_VALID_COMP_ID;
>          if (has_comp_id_pldm && is_comp_id_pldm) {
>              m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;

Re: [PATCH 3/3] hw/cxl/events: Fixes for component id in event records generation

[Jonathan Cameron via qemu development]

On Fri, 27 Feb 2026 22:32:06 +0000
<shiju.jose@huawei.com> wrote:

> From: Shiju Jose <shiju.jose@huawei.com>

As for patch 1, nice if the title suggests what is being fixed.
With that,
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>

> 
> Component id in CXL events is 16 bytes data, but event record generation copy
> 15 bytes only from the qmp "component-id" field using strncpy.
> Replace strncpy with memcpy and change length of data to copy to the size of the
> component_id array (16 bytes).
> 
> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
> ---
>  hw/mem/cxl_type3.c | 9 +++------
>  1 file changed, 3 insertions(+), 6 deletions(-)
> 
> diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
> index 3cb1096e16..03a5d1751f 100644
> --- a/hw/mem/cxl_type3.c
> +++ b/hw/mem/cxl_type3.c
> @@ -1895,8 +1895,7 @@ void qmp_cxl_inject_general_media_event(const char *path, CxlEventLog log,
>      }
>  
>      if (component_id) {
> -        strncpy((char *)gem.component_id, component_id,
> -                sizeof(gem.component_id) - 1);
> +        memcpy(gem.component_id, component_id, sizeof(gem.component_id));
>          valid_flags |= CXL_GMER_VALID_COMPONENT;
>          if (has_comp_id_pldm && is_comp_id_pldm) {
>              valid_flags |= CXL_GMER_VALID_COMPONENT_ID_FORMAT;
> @@ -2066,8 +2065,7 @@ void qmp_cxl_inject_dram_event(const char *path, CxlEventLog log,
>      }
>  
>      if (component_id) {
> -        strncpy((char *)dram.component_id, component_id,
> -                sizeof(dram.component_id) - 1);
> +        memcpy(dram.component_id, component_id, sizeof(dram.component_id));
>          valid_flags |= CXL_DRAM_VALID_COMPONENT;
>          if (has_comp_id_pldm && is_comp_id_pldm) {
>              valid_flags |= CXL_DRAM_VALID_COMPONENT_ID_FORMAT;
> @@ -2185,8 +2183,7 @@ void qmp_cxl_inject_memory_module_event(const char *path, CxlEventLog log,
>               corrected_persist_error_count);
>  
>      if (component_id) {
> -        strncpy((char *)module.component_id, component_id,
> -                sizeof(module.component_id) - 1);
> +        memcpy(module.component_id, component_id, sizeof(module.component_id));
>          valid_flags |= CXL_MMER_VALID_COMPONENT;
>          if (has_comp_id_pldm && is_comp_id_pldm) {
>              valid_flags |= CXL_MMER_VALID_COMPONENT_ID_FORMAT;

RE: [PATCH 1/3] hw/cxl: Add fixes in maintenance and memory sparing

[Shiju Jose via qemu development]

>-----Original Message-----
>From: Jonathan Cameron <jonathan.cameron@huawei.com>
>Sent: 05 March 2026 10:58
>To: Shiju Jose <shiju.jose@huawei.com>
>Cc: qemu-devel@nongnu.org; linux-cxl@vger.kernel.org; mst@redhat.com;
>peter.maydell@linaro.org; dave@stgolabs.net; Linuxarm
><linuxarm@huawei.com>
>Subject: Re: [PATCH 1/3] hw/cxl: Add fixes in maintenance and memory sparing
>
>On Fri, 27 Feb 2026 22:32:04 +0000
><shiju.jose@huawei.com> wrote:
>
>> From: Shiju Jose <shiju.jose@huawei.com>
>Hi Shiju,
>
>Perhaps a more specific title would help people understand quickly what type of
>fix this is?
>
>Something like:
>hw/cxl: Fix handling of component ID to not assume it is a string.
Hi Jonathan,

Thanks for the feedback. I will change the title and add fixes tag (was not sure
need fixes tag as in kernel).

Thanks,
Shiju
>
>
>>
>> Add following fixes to the commit: hw/cxl: Add support for Maintenance
>> command and Post Package Repair (PPR).
>That just wants to be a reference to the fixes tag.
>
>>
>> 1. In cxl_create_mem_sparing_event_records(), replace strncpy with
>> memcpy to solve coverity warning because full size of the array to use
>> as length in strncpy to copy the entire component id data, which is 16 bytes.
>I wouldn't necessarily focus on the coverity issue bit of this, but rather that it's
>not a string so memcpy is the correct function to use.  Then flag it as as being
>identified as a result of the coverity warning.
>>
>> 2. In cxl_maintenance_insert(),
>>  - replace strncpy with memcpy in to copy full data because component id is
>>    16 bytes data.
>>  - remove memset which is not required.
>>
>> Reported-by: Peter Maydell <peter.maydell@linaro.org>
>
>The original patch is upstream, so need a Fixes tag. I can't remember how we
>mark coverity issue closures, so look for a similar patch and copy that style.
>Maybe just a Closes tag for Peter's email pointing it out.
>
>Code looks good.
>
>> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
>> ---
>>  hw/cxl/cxl-mailbox-utils.c | 4 ++--
>>  hw/mem/cxl_type3.c         | 4 +---
>>  2 files changed, 3 insertions(+), 5 deletions(-)
>>
>> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
>> index c83b5f90d4..9c99422cd4 100644
>> --- a/hw/cxl/cxl-mailbox-utils.c
>> +++ b/hw/cxl/cxl-mailbox-utils.c
>> @@ -1994,8 +1994,8 @@ static void
>cxl_create_mem_sparing_event_records(CXLType3Dev *ct3d,
>>          stw_le_p(&event_rec.column, ent->column);
>>          event_rec.sub_channel = ent->sub_channel;
>>          if (ent->validity_flags & CXL_MSER_VALID_COMP_ID) {
>> -            strncpy((char *)event_rec.component_id, (char *)ent->component_id,
>> -                    sizeof(event_rec.component_id));
>> +            memcpy(event_rec.component_id, ent->component_id,
>> +                   sizeof(event_rec.component_id));
>>          }
>>      } else if (sparing_pi) {
>>          event_rec.flags = CXL_MSER_FLAGS_QUERY_RESOURCES; diff --git
>> a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c index
>4739239da3..3cb1096e16
>> 100644
>> --- a/hw/mem/cxl_type3.c
>> +++ b/hw/mem/cxl_type3.c
>> @@ -1767,7 +1767,6 @@ static void cxl_maintenance_insert(CXLType3Dev
>*ct3d, uint64_t dpa,
>>          }
>>      }
>>      m = g_new0(CXLMaintenance, 1);
>> -    memset(m, 0, sizeof(*m));
>>      m->dpa = dpa;
>>      m->validity_flags = 0;
>>
>> @@ -1804,8 +1803,7 @@ static void cxl_maintenance_insert(CXLType3Dev
>*ct3d, uint64_t dpa,
>>          m->validity_flags |= CXL_MSER_VALID_SUB_CHANNEL;
>>      }
>>      if (component_id) {
>> -        strncpy((char *)m->component_id, component_id,
>> -                sizeof(m->component_id) - 1);
>> +        memcpy(m->component_id, component_id,
>> + sizeof(m->component_id));
>>          m->validity_flags |= CXL_MSER_VALID_COMP_ID;
>>          if (has_comp_id_pldm && is_comp_id_pldm) {
>>              m->validity_flags |= CXL_MSER_VALID_COMP_ID_FORMAT;

Re: [PATCH 2/3] hw/cxl: Add fixes in Post Package Repair (PPR)

[Jonathan Cameron via qemu development]

On Fri, 27 Feb 2026 22:32:05 +0000
<shiju.jose@huawei.com> wrote:

> From: Shiju Jose <shiju.jose@huawei.com>
> 
As for other two patches, try to indicate what sort of bug it is in the title.
Something like:
hw/cxl: Fix failure to remove repaired cachelines from 
> Add following fixes to the commit: hw/cxl: Add support for Maintenance
> command and Post Package Repair (PPR).
> 
> In cxl_perform_ppr(), remove and free the maintenance entry from QLIST
> if match is found and PPR operation is performed.

Needs a fixes tag.

> 
> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
> ---
>  hw/cxl/cxl-mailbox-utils.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
> index 9c99422cd4..66a58396ee 100644
> --- a/hw/cxl/cxl-mailbox-utils.c
> +++ b/hw/cxl/cxl-mailbox-utils.c
> @@ -2068,6 +2068,8 @@ static void cxl_perform_ppr(CXLType3Dev *ct3d, uint64_t dpa)
>                                  CXL_MEMDEV_MAINT_SUBCLASS_CACHELINE_SPARING,
>                                  ent, NULL);
>              }
> +            QLIST_REMOVE(ent, node);
> +            g_free(ent);
>              break;
>          }
>      }