[PATCH v2] cpufreq: schedutil: Serialize start against rate limit updates

[PATCH v2] cpufreq: schedutil: Serialize start against rate limit updates

[Hui Su]

rate_limit_us_store() is called with the governor attribute set
update_lock held, but sugov_start() updates freq_update_delay_ns from
the same tunable without taking that lock.

This allows the two paths to interleave as follows:

        sugov_start()             rate_limit_us_store()

        read old rate_limit_us
                                  write new rate_limit_us
                                  publish the new delay
        publish the old delay

The sysfs tunable then contains the new value while
freq_update_delay_ns contains the old one. Unlike a transient torn
read, the stale delay remains in effect until another rate limit update
or governor restart.

Serialize sugov_start() against sysfs stores by taking the existing
governor attribute set lock around sugov_update_rate_limit_us(). Use
gov_attr_set_lock() and gov_attr_set_unlock() to keep locking details
within the attribute set interface. This keeps the fix off the scheduler
hot path.

Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Signed-off-by: Hui Su <sh_def@163.com>
---
Changes in v2:
- Wrap governor attribute set locking in helpers as suggested by
  Zhongqiu Han.

v1: https://lore.kernel.org/lkml/20260929103635.3780346-1-sh_def@163.com/

 include/linux/cpufreq.h          | 10 ++++++++++
 kernel/sched/cpufreq_schedutil.c |  4 ++++
 2 files changed, 14 insertions(+)

diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 35ce665edfd8..5448eb0a0885 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -694,6 +694,16 @@ static inline struct gov_attr_set *to_gov_attr_set(struct kobject *kobj)
 	return container_of(kobj, struct gov_attr_set, kobj);
 }
 
+static inline void gov_attr_set_lock(struct gov_attr_set *attr_set)
+{
+	mutex_lock(&attr_set->update_lock);
+}
+
+static inline void gov_attr_set_unlock(struct gov_attr_set *attr_set)
+{
+	mutex_unlock(&attr_set->update_lock);
+}
+
 void gov_attr_set_init(struct gov_attr_set *attr_set, struct list_head *list_node);
 void gov_attr_set_get(struct gov_attr_set *attr_set, struct list_head *list_node);
 unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *list_node);
diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
index 49ccd6f1c185..b847311c307d 100644
--- a/kernel/sched/cpufreq_schedutil.c
+++ b/kernel/sched/cpufreq_schedutil.c
@@ -861,7 +861,11 @@ static int sugov_start(struct cpufreq_policy *policy)
 	void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
 	unsigned int cpu;
 
+	/* Serialize against rate_limit_us_store(). */
+	gov_attr_set_lock(&sg_policy->tunables->attr_set);
 	sugov_update_rate_limit_us(sg_policy);
+	gov_attr_set_unlock(&sg_policy->tunables->attr_set);
+
 	sg_policy->last_freq_update_time	= 0;
 	sg_policy->next_freq			= 0;
 	sg_policy->work_in_progress		= false;

base-commit: 63de2367f6d280904a9c5e5bbc7c75bb91c5b3d8

Re: [PATCH v2] cpufreq: schedutil: Serialize start against rate limit updates

[Rafael J. Wysocki (Intel)]

On Wed, Oct 7, 2026 at 5:59 PM Hui Su <sh_def@163.com> wrote:
>
> rate_limit_us_store() is called with the governor attribute set
> update_lock held, but sugov_start() updates freq_update_delay_ns from
> the same tunable without taking that lock.
>
> This allows the two paths to interleave as follows:
>
>         sugov_start()             rate_limit_us_store()
>
>         read old rate_limit_us
>                                   write new rate_limit_us
>                                   publish the new delay
>         publish the old delay
>
> The sysfs tunable then contains the new value while
> freq_update_delay_ns contains the old one. Unlike a transient torn
> read, the stale delay remains in effect until another rate limit update
> or governor restart.
>
> Serialize sugov_start() against sysfs stores by taking the existing
> governor attribute set lock around sugov_update_rate_limit_us(). Use
> gov_attr_set_lock() and gov_attr_set_unlock() to keep locking details
> within the attribute set interface. This keeps the fix off the scheduler
> hot path.
>
> Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> Signed-off-by: Hui Su <sh_def@163.com>
> ---
> Changes in v2:
> - Wrap governor attribute set locking in helpers as suggested by
>   Zhongqiu Han.
>
> v1: https://lore.kernel.org/lkml/20260929103635.3780346-1-sh_def@163.com/
>
>  include/linux/cpufreq.h          | 10 ++++++++++
>  kernel/sched/cpufreq_schedutil.c |  4 ++++
>  2 files changed, 14 insertions(+)
>
> diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
> index 35ce665edfd8..5448eb0a0885 100644
> --- a/include/linux/cpufreq.h
> +++ b/include/linux/cpufreq.h
> @@ -694,6 +694,16 @@ static inline struct gov_attr_set *to_gov_attr_set(struct kobject *kobj)
>         return container_of(kobj, struct gov_attr_set, kobj);
>  }
>
> +static inline void gov_attr_set_lock(struct gov_attr_set *attr_set)
> +{
> +       mutex_lock(&attr_set->update_lock);
> +}
> +
> +static inline void gov_attr_set_unlock(struct gov_attr_set *attr_set)
> +{
> +       mutex_unlock(&attr_set->update_lock);
> +}

I'd rather not do this.

> +
>  void gov_attr_set_init(struct gov_attr_set *attr_set, struct list_head *list_node);
>  void gov_attr_set_get(struct gov_attr_set *attr_set, struct list_head *list_node);
>  unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *list_node);
> diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
> index 49ccd6f1c185..b847311c307d 100644
> --- a/kernel/sched/cpufreq_schedutil.c
> +++ b/kernel/sched/cpufreq_schedutil.c
> @@ -861,7 +861,11 @@ static int sugov_start(struct cpufreq_policy *policy)
>         void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
>         unsigned int cpu;
>
> +       /* Serialize against rate_limit_us_store(). */
> +       gov_attr_set_lock(&sg_policy->tunables->attr_set);
>         sugov_update_rate_limit_us(sg_policy);
> +       gov_attr_set_unlock(&sg_policy->tunables->attr_set);

But instead, I'd add a wrapper around sugov_update_rate_limit_us() that would do

    guard(mutex)(&sg_policy->tunables->attr_set->update_lock);

before calling it and I'd invoke that wrapper from here.

Also, the comment should explain why the locking is needed which it
doesn't do now.

> +
>         sg_policy->last_freq_update_time        = 0;
>         sg_policy->next_freq                    = 0;
>         sg_policy->work_in_progress             = false;
>

Re: [PATCH v2] cpufreq: schedutil: Serialize start against rate limit updates

[Hui Su]

> But instead, I'd add a wrapper around sugov_update_rate_limit_us() that would do
>
>     guard(mutex)(&sg_policy->tunables->attr_set->update_lock);
>
> before calling it and I'd invoke that wrapper from here.
>
> Also, the comment should explain why the locking is needed which it
> doesn't do now.

Agreed. I removed the generic gov_attr_set lock helpers and added a
schedutil-local wrapper using guard(mutex) around the raw update helper.

The comment now explains how an unsynchronized start can overwrite the
cached delay with a value derived from a stale rate_limit_us value.
rate_limit_us_store() continues to call the raw helper while holding
update_lock.

I'll send v3 separately.

Thanks,
Hui

Re: [PATCH v2] cpufreq: schedutil: Serialize start against rate limit updates

[Nirjhar Roy]

On Thu, Oct 08, 2026 at 12:58:20AM +0900, Hui Su wrote:
> rate_limit_us_store() is called with the governor attribute set
> update_lock held, but sugov_start() updates freq_update_delay_ns from
> the same tunable without taking that lock.
> 
> This allows the two paths to interleave as follows:
> 
>         sugov_start()             rate_limit_us_store()
> 
>         read old rate_limit_us
>                                   write new rate_limit_us
>                                   publish the new delay
>         publish the old delay
> 
> The sysfs tunable then contains the new value while
> freq_update_delay_ns contains the old one. Unlike a transient torn
> read, the stale delay remains in effect until another rate limit update
> or governor restart.
> 
> Serialize sugov_start() against sysfs stores by taking the existing
> governor attribute set lock around sugov_update_rate_limit_us(). Use
> gov_attr_set_lock() and gov_attr_set_unlock() to keep locking details
> within the attribute set interface. This keeps the fix off the scheduler
> hot path.
> 
> Fixes: 9bdcb44e391d ("cpufreq: schedutil: New governor based on scheduler utilization data")
> Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
> Signed-off-by: Hui Su <sh_def@163.com>
> ---
> Changes in v2:
> - Wrap governor attribute set locking in helpers as suggested by
>   Zhongqiu Han.
> 
> v1: https://lore.kernel.org/lkml/20260929103635.3780346-1-sh_def@163.com/
> 
>  include/linux/cpufreq.h          | 10 ++++++++++
>  kernel/sched/cpufreq_schedutil.c |  4 ++++
>  2 files changed, 14 insertions(+)
> 
> diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
> index 35ce665edfd8..5448eb0a0885 100644
> --- a/include/linux/cpufreq.h
> +++ b/include/linux/cpufreq.h
> @@ -694,6 +694,16 @@ static inline struct gov_attr_set *to_gov_attr_set(struct kobject *kobj)
>  	return container_of(kobj, struct gov_attr_set, kobj);
>  }
>  
> +static inline void gov_attr_set_lock(struct gov_attr_set *attr_set)
> +{
> +	mutex_lock(&attr_set->update_lock);
> +}
> +
> +static inline void gov_attr_set_unlock(struct gov_attr_set *attr_set)
> +{
> +	mutex_unlock(&attr_set->update_lock);
> +}
> +

Can use the above wrappers in governor_store()? Right now it directly calls mutex_{lock, unlock}(&attr_set->update_lock) ?
--NR
 

>  void gov_attr_set_init(struct gov_attr_set *attr_set, struct list_head *list_node);
>  void gov_attr_set_get(struct gov_attr_set *attr_set, struct list_head *list_node);
>  unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *list_node);
> diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c
> index 49ccd6f1c185..b847311c307d 100644
> --- a/kernel/sched/cpufreq_schedutil.c
> +++ b/kernel/sched/cpufreq_schedutil.c
> @@ -861,7 +861,11 @@ static int sugov_start(struct cpufreq_policy *policy)
>  	void (*uu)(struct update_util_data *data, u64 time, unsigned int flags);
>  	unsigned int cpu;
>  
> +	/* Serialize against rate_limit_us_store(). */
> +	gov_attr_set_lock(&sg_policy->tunables->attr_set);
>  	sugov_update_rate_limit_us(sg_policy);
> +	gov_attr_set_unlock(&sg_policy->tunables->attr_set);
> +
>  	sg_policy->last_freq_update_time	= 0;
>  	sg_policy->next_freq			= 0;
>  	sg_policy->work_in_progress		= false;
> 
> base-commit: 63de2367f6d280904a9c5e5bbc7c75bb91c5b3d8
>