From: Jaidev Shastri <jaidevshastri@vt.edu>

qcom_cpufreq_hw_driver_probe() stores xo_rate, cpu_hw_rate,
qcom_cpufreq.soc_data and the per-domain qcom_cpufreq.data[] array with
plain stores and then calls cpufreq_register_driver(). The cpufreq core
invokes qcom_cpufreq_hw_cpu_init() for every policy, on other CPUs, and
that function reads all of them with plain loads.

Order the stores before the registration with smp_wmb() and add the
matching smp_rmb() in qcom_cpufreq_hw_cpu_init().

Found with MBCheck, a static herd7-based memory consistency checker.

Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
---
 drivers/cpufreq/qcom-cpufreq-hw.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
index 874ff3fb9..62cc1f403 100644
--- a/drivers/cpufreq/qcom-cpufreq-hw.c
+++ b/drivers/cpufreq/qcom-cpufreq-hw.c
@@ -554,6 +554,8 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy)
 		return ret;
 
 	index = args.args[0];
+	/* Pairs with the smp_wmb() before cpufreq_register_driver() in probe. */
+	smp_rmb();
 	data = &qcom_cpufreq.data[index];
 
 	/* HW should be in enabled state to proceed */
@@ -738,6 +740,13 @@ static int qcom_cpufreq_hw_driver_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	/*
+	 * qcom_cpufreq_hw_cpu_init() runs on other CPUs through the cpufreq
+	 * core once the driver is registered and reads xo_rate, cpu_hw_rate,
+	 * qcom_cpufreq.soc_data and qcom_cpufreq.data[]. Order those stores
+	 * before the registration. Pairs with the smp_rmb() in cpu_init.
+	 */
+	smp_wmb();
 	ret = cpufreq_register_driver(&cpufreq_qcom_hw_driver);
 	if (ret)
 		dev_err(dev, "CPUFreq HW driver failed to register\n");

---
base-commit: 93f51579e7df248780214094418f205253383cc5
change-id: 20260921-mb-qcom-cpufreq-42f15afbfa4f

Best regards,
--  
Jaidev Shastri <jaidevshastri@vt.edu>

Hi Jaidev,

On 9/22/2026 9:11 AM, Jaidev Shastri via B4 Relay wrote:
> From: Jaidev Shastri <jaidevshastri@vt.edu>
> 
> qcom_cpufreq_hw_driver_probe() stores xo_rate, cpu_hw_rate,
> qcom_cpufreq.soc_data and the per-domain qcom_cpufreq.data[] array with
> plain stores and then calls cpufreq_register_driver(). The cpufreq core
> invokes qcom_cpufreq_hw_cpu_init() for every policy, on other CPUs, and
> that function reads all of them with plain loads.

It should be not. This all runs in the context of the same thread(no
other workqueue, kthread, or IPI), so I don't see a need for cross-CPU
memory barriers here. Even in the CPU hotplug case, the relevant path is
already serialized by locks(cpu_hotplug_lock).

> 
> Order the stores before the registration with smp_wmb() and add the
> matching smp_rmb() in qcom_cpufreq_hw_cpu_init().
> 
> Found with MBCheck, a static herd7-based memory consistency checker.
> 
> Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
> ---
>   drivers/cpufreq/qcom-cpufreq-hw.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/cpufreq/qcom-cpufreq-hw.c b/drivers/cpufreq/qcom-cpufreq-hw.c
> index 874ff3fb9..62cc1f403 100644
> --- a/drivers/cpufreq/qcom-cpufreq-hw.c
> +++ b/drivers/cpufreq/qcom-cpufreq-hw.c
> @@ -554,6 +554,8 @@ static int qcom_cpufreq_hw_cpu_init(struct cpufreq_policy *policy)
>   		return ret;
>   
>   	index = args.args[0];
> +	/* Pairs with the smp_wmb() before cpufreq_register_driver() in probe. */
> +	smp_rmb();
>   	data = &qcom_cpufreq.data[index];
>   
>   	/* HW should be in enabled state to proceed */
> @@ -738,6 +740,13 @@ static int qcom_cpufreq_hw_driver_probe(struct platform_device *pdev)
>   		return ret;
>   	}
>   
> +	/*
> +	 * qcom_cpufreq_hw_cpu_init() runs on other CPUs through the cpufreq
> +	 * core once the driver is registered and reads xo_rate, cpu_hw_rate,
> +	 * qcom_cpufreq.soc_data and qcom_cpufreq.data[]. Order those stores
> +	 * before the registration. Pairs with the smp_rmb() in cpu_init.
> +	 */
> +	smp_wmb();
>   	ret = cpufreq_register_driver(&cpufreq_qcom_hw_driver);
>   	if (ret)
>   		dev_err(dev, "CPUFreq HW driver failed to register\n");
> 
> ---
> base-commit: 93f51579e7df248780214094418f205253383cc5
> change-id: 20260921-mb-qcom-cpufreq-42f15afbfa4f
> 
> Best regards,
> --
> Jaidev Shastri <jaidevshastri@vt.edu>
> 
> 
> 


-- 
Thx and BRs,
Zhongqiu Han