Re: [PATCH v2 4/6] hw/cxl: free in-flight sanitize state on reset

Hi,

On 23/7/26 03:16, Junjie Cao wrote:
> Per CXL r4.0 Section 8.2.9.4, "Background commands do not continue to
> execute across Conventional Resets."  If a sanitize or media operation
> is in progress when the device is reset, the background timer is already
> cancelled and freed via cxl_destroy_cci(), but the per-operation state
> (media_op_sanitize) is heap-allocated separately and would otherwise be
> leaked.
> 
> Free it unconditionally at the end of the reset hold phase.  The timer
> that advances the operation lives in the CCI that was just destroyed and
> re-initialized, so the operation can never complete after a reset of any
> type; preserving the heap state across reset has no benefit and would
> leak it the next time media_op_sanitize is assigned.
> 
> Note that Section 8.2.10.9.5.1 additionally requires a device whose
> Sanitize was interrupted by reset to remain in the Media Disabled state
> until a successful Sanitize completes.  That latch is not modelled here
> (reset re-enables media via memdev_reg_init_common()) and is left for
> future work; this patch only addresses the resource leak.
> 
> Signed-off-by: Junjie Cao <[email protected]>
> ---
>   hw/mem/cxl_type3.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
> index b842e71c66..a5e6df3033 100644
> --- a/hw/mem/cxl_type3.c
> +++ b/hw/mem/cxl_type3.c
> @@ -1361,6 +1361,16 @@ static void ct3d_reset_hold(Object *obj, ResetType type)
>       }
>       cxl_initialize_t3_ld_cci(&ct3d->ld0_cci, DEVICE(ct3d), DEVICE(ct3d),
>                                512); /* Max payload made up */
> +
> +    /*
> +     * Free any in-flight sanitize state unconditionally.  The background
> +     * timer that would advance it lives in the CCI just torn down and
> +     * re-initialized above, so the operation can never complete after this
> +     * point regardless of the reset type; keeping the heap state would only
> +     * leak it on the next allocation.
> +     */
> +    g_free(ct3d->media_op_sanitize);
> +    ct3d->media_op_sanitize = NULL;

Maybe we could add as cxl_cancel_media_sanitize() helper in
hw/cxl/cxl-mailbox-utils.c and re-use in __do_sanitize()?

Actually, I wonder if this shouldn't be cxl_destroy_mailbox_t3()
to match cxl_initialize_mailbox_t3(). And if so, then also call
in ct3_exit().

>   }
>   
>   static const Property ct3_props[] = {