From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: net: qrtr: Hold runtime PM during active data path operations
Date: Mon, 25 May 2026 19:03:04 +1000
Message-ID: <review-patch4-20260522-mhi_runtimepm-v2-4-fbebf41a82bb@oss.qualcomm.com>
In-Reply-To: <20260522-mhi_runtimepm-v2-4-fbebf41a82bb@oss.qualcomm.com>
References: <20260522-mhi_runtimepm-v2-0-fbebf41a82bb@oss.qualcomm.com> <20260522-mhi_runtimepm-v2-4-fbebf41a82bb@oss.qualcomm.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

**Issue 1 - devm_kmalloc for RX buffers:**

This isn't introduced by this patch, but the PM changes interact with it: `qcom_mhi_qrtr_queue_dl_buffers` uses `devm_kmalloc` for DL buffers. These persist for the lifetime of the device and are never freed on the error path within this function. The PM wrapping is correct, but the underlying memory management concern remains.

**Issue 2 - PM in DL callback:**

```c
+	rc = pm_runtime_get(&qdev->mhi_dev->dev);
+	if (rc < 0 && rc != -EINPROGRESS) {
+		dev_err(&mhi_dev->dev, "pm_runtime_get failed %d\n", rc);
+		pm_runtime_put_noidle(&qdev->mhi_dev->dev);
+		return;
+	}
+
 	/* Done with the buffer, now recycle it for future use */
 	rc = mhi_queue_buf(mhi_dev, DMA_FROM_DEVICE, ...);
```

The DL callback fires because data was received - meaning the device was necessarily active to deliver the interrupt/data. Taking a PM reference here to requeue the buffer is correct, but returning without requeuing the buffer on PM failure means that buffer is permanently lost from the RX ring. This will eventually starve the RX path. A better approach might be to attempt the requeue regardless (since the device clearly is active if the callback is running).

**Issue 3 - Same probe/remove asymmetry as patch 3.**

---
Generated by Claude Code Patch Reviewer