From mboxrd@z Thu Jan  1 00:00:00 1970
From: Claude Code Review Bot <claude-review@example.com>
To: dri-devel-reviews@example.com
Subject: Claude review: net: wwan: Hold runtime PM during active data path operations
Date: Mon, 25 May 2026 19:03:04 +1000
Message-ID: <review-patch5-20260522-mhi_runtimepm-v2-5-fbebf41a82bb@oss.qualcomm.com>
In-Reply-To: <20260522-mhi_runtimepm-v2-5-fbebf41a82bb@oss.qualcomm.com>
References: <20260522-mhi_runtimepm-v2-0-fbebf41a82bb@oss.qualcomm.com> <20260522-mhi_runtimepm-v2-5-fbebf41a82bb@oss.qualcomm.com>
X-Mailer: Claude Code Patch Reviewer
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0

Patch Review

**Issue 1 - Inconsistent PM API usage between the two drivers in the same patch:**

`mhi_wwan_ctrl` uses `pm_runtime_resume_and_get` (synchronous, proper error returns) throughout:
```c
+	ret = pm_runtime_resume_and_get(&mhi_dev->dev);
+	if (ret) {
```

But `mhi_wwan_mbim` uses raw `pm_runtime_get` (async) in several places:
```c
+	err = pm_runtime_get(&mhi_dev->dev);
+	if (err < 0 && err != -EINPROGRESS) {
```

This inconsistency within a single patch is concerning. The `mhi_wwan_ctrl` approach is generally more correct for non-atomic contexts like probe, remove, and workqueues. The xmit path is the only place where async `pm_runtime_get` is justified (because xmit might be in atomic context).

**Issue 2 - mhi_wwan_mbim rx_refill_work missing error handling:**

```c
+	err = pm_runtime_get(&mdev->dev);
+	if (err < 0 && err != -EINPROGRESS)
+		dev_err(&mdev->dev, "pm_runtime_get Failed %d\n", err);
+
 	while (!mhi_queue_is_full(mdev, DMA_FROM_DEVICE)) {
```

On PM failure, it logs an error but **proceeds into the loop anyway**, queueing buffers on a potentially suspended device. Compare with `mhi_wwan_ctrl_refill_work` which properly returns on error. This is a bug.

**Issue 3 - mhi_mbim_remove unconditional pm_runtime_put:**

```c
+	err = pm_runtime_get(&mhi_dev->dev);
+	if (err < 0 && err != -EINPROGRESS)
+		dev_err(...);
     ...
+	pm_runtime_put(&mhi_dev->dev);
```

The `pm_runtime_put` is called unconditionally, even if `pm_runtime_get` failed. Compare with `mhi_wwan_ctrl_stop` which conditionally puts only on success. If `pm_runtime_get` returned an error other than `-EINPROGRESS`, calling `pm_runtime_put` would decrement the usage count below zero.

**Issue 4 - mhi_mbim_probe leaks `mbim` allocation on PM failure:**

```c
 	mbim = kzalloc(sizeof(*mbim), GFP_KERNEL);
 	if (!mbim)
 		return -ENOMEM;
 
+	pm_runtime_no_callbacks(&mhi_dev->dev);
+	err = devm_pm_runtime_set_active_enabled(&mhi_dev->dev);
+	if (err)
+		return err;
```

If `devm_pm_runtime_set_active_enabled` fails, `mbim` is leaked (no `kfree`). The `mhi_wwan_ctrl` side handles this correctly by calling `kfree(mhiwwan)` on failure.

---
Generated by Claude Code Patch Reviewer