mhi_pci_probe() drops the runtime PM reference taken by local_pci_probe()
only when the device supports both PME from D3hot and M3, but
mhi_pci_remove() re-takes it based on PME capability alone, without
checking no_m3.

For a device that is PME capable and has no_m3 set, probe therefore never
drops the reference while remove takes an extra one, leaving the runtime
PM usage count one higher after every bind/unbind cycle.  That is benign
for the device being removed, since the PCI core resumes it to D0 on
unbind regardless, but the struct device outlives the binding, so the
count accumulates across repeated cycles and can end up preventing
runtime suspend altogether.

Cache no_m3 in the driver's private data, as is already done for
reset_on_remove, and gate the removal side on it as well.  Unlike
reset_on_remove it is cached for virtual functions too, because the probe
side gate tests info->no_m3 for physical and virtual functions alike.

QDU100 is currently the only device that sets no_m3.

Fixes: 0494cf9793b7 ("bus: mhi: host: pci_generic: Disable runtime PM for QDU100")
Assisted-by: Cursor:claude-opus-5
Signed-off-by: Alexandra Lu <alexandra.lu@nokia.com>
---
 drivers/bus/mhi/host/pci_generic.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/mhi/host/pci_generic.c b/drivers/bus/mhi/host/pci_generic.c
index b636e2c23b4d..eda00a2e242c 100644
--- a/drivers/bus/mhi/host/pci_generic.c
+++ b/drivers/bus/mhi/host/pci_generic.c
@@ -1097,6 +1097,7 @@ struct mhi_pci_device {
 	struct work_struct recovery_work;
 	struct timer_list health_check_timer;
 	unsigned long status;
+	bool no_m3;
 	bool reset_on_remove;
 };
 
@@ -1409,6 +1410,8 @@ static int mhi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	mhi_cntrl->mru = info->mru_default;
 	mhi_cntrl->name = info->name;
 
+	mhi_pdev->no_m3 = info->no_m3;
+
 	if (!pdev->is_virtfn)
 		mhi_pdev->reset_on_remove = info->reset_on_remove;
 
@@ -1497,7 +1500,7 @@ static void mhi_pci_remove(struct pci_dev *pdev)
 	}
 
 	/* balancing probe put_noidle */
-	if (pci_pme_capable(pdev, PCI_D3hot))
+	if (pci_pme_capable(pdev, PCI_D3hot) && !mhi_pdev->no_m3)
 		pm_runtime_get_noresume(&pdev->dev);
 
 	if (mhi_pdev->reset_on_remove)
-- 
2.43.0

On Fri, 07 Aug 2026 14:33:53 +0000, Alexandra Lu wrote:
> mhi_pci_probe() drops the runtime PM reference taken by local_pci_probe()
> only when the device supports both PME from D3hot and M3, but
> mhi_pci_remove() re-takes it based on PME capability alone, without
> checking no_m3.
> 
> For a device that is PME capable and has no_m3 set, probe therefore never
> drops the reference while remove takes an extra one, leaving the runtime
> PM usage count one higher after every bind/unbind cycle.  That is benign
> for the device being removed, since the PCI core resumes it to D0 on
> unbind regardless, but the struct device outlives the binding, so the
> count accumulates across repeated cycles and can end up preventing
> runtime suspend altogether.
> 
> [...]

Applied, thanks!

[1/1] bus: mhi: host: pci_generic: Fix runtime PM imbalance for no_m3 devices
      commit: 95601e9948b42f82600ff2d9e0c2f699a067d561

Best regards,
-- 
மணிவண்ணன் சதாசிவம்

On Fri, Aug 07, 2026 at 02:33:53PM +0000, Alexandra Lu wrote:
> mhi_pci_probe() drops the runtime PM reference taken by local_pci_probe()
> only when the device supports both PME from D3hot and M3, but
> mhi_pci_remove() re-takes it based on PME capability alone, without
> checking no_m3.
> 
> For a device that is PME capable and has no_m3 set, probe therefore never
> drops the reference while remove takes an extra one, leaving the runtime
> PM usage count one higher after every bind/unbind cycle.  That is benign
> for the device being removed, since the PCI core resumes it to D0 on
> unbind regardless, but the struct device outlives the binding, so the
> count accumulates across repeated cycles and can end up preventing
> runtime suspend altogether.
> 
> Cache no_m3 in the driver's private data, as is already done for
> reset_on_remove, and gate the removal side on it as well.  Unlike
> reset_on_remove it is cached for virtual functions too, because the probe
> side gate tests info->no_m3 for physical and virtual functions alike.
> 
> QDU100 is currently the only device that sets no_m3.
> 
> Fixes: 0494cf9793b7 ("bus: mhi: host: pci_generic: Disable runtime PM for QDU100")
> Assisted-by: Cursor:claude-opus-5
> Signed-off-by: Alexandra Lu <alexandra.lu@nokia.com>

LGTM! But since the MHI tree is closed for v7.3, this patch will get applied
only when v7.3-rc1 is released.

- Mani

-- 
மணிவண்ணன் சதாசிவம்

On 8/7/2026 8:33 AM, Alexandra Lu wrote:
> mhi_pci_probe() drops the runtime PM reference taken by local_pci_probe()
> only when the device supports both PME from D3hot and M3, but
> mhi_pci_remove() re-takes it based on PME capability alone, without
> checking no_m3.
> 
> For a device that is PME capable and has no_m3 set, probe therefore never
> drops the reference while remove takes an extra one, leaving the runtime
> PM usage count one higher after every bind/unbind cycle.  That is benign
> for the device being removed, since the PCI core resumes it to D0 on
> unbind regardless, but the struct device outlives the binding, so the
> count accumulates across repeated cycles and can end up preventing
> runtime suspend altogether.
> 
> Cache no_m3 in the driver's private data, as is already done for
> reset_on_remove, and gate the removal side on it as well.  Unlike
> reset_on_remove it is cached for virtual functions too, because the probe
> side gate tests info->no_m3 for physical and virtual functions alike.
> 
> QDU100 is currently the only device that sets no_m3.
> 
> Fixes: 0494cf9793b7 ("bus: mhi: host: pci_generic: Disable runtime PM for QDU100")
> Assisted-by: Cursor:claude-opus-5
> Signed-off-by: Alexandra Lu <alexandra.lu@nokia.com>

Seems sane to me.

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>