[PATCH v3 0/3] riscv: fix timer update hazards on RV32

[PATCH v3 0/3] riscv: fix timer update hazards on RV32

[Naohiko Shimizu]

This patch series fixes timer register update hazards on RV32 for
clocksource, KVM, and suspend/resume paths by adopting the 3-step
update sequence recommended by the RISC-V Privileged Specification.

Changes in v3:
- Dropped redundant subject line from commit descriptions.
- Added Fixes tags for all patches.
- Moved Signed-off-by tags to the end of commit messages.

Changes in v2:
- Added detailed architectural background to commit messages.
- Added KVM and suspend/resume cases.

Naohiko Shimizu (3):
  riscv: clocksource: Fix stimecmp update hazard on RV32
  riscv: kvm: Fix vstimecmp update hazard on RV32
  riscv: suspend: Fix stimecmp update hazard on RV32

 arch/riscv/kernel/suspend.c       | 3 ++-
 arch/riscv/kvm/vcpu_timer.c       | 6 ++++--
 drivers/clocksource/timer-riscv.c | 3 ++-
 3 files changed, 8 insertions(+), 4 deletions(-)

-- 
2.39.5

[PATCH v3 1/3] riscv: clocksource: Fix stimecmp update hazard on RV32

[Naohiko Shimizu]

On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
separate 32-bit writes. A race condition exists if the timer triggers
during these two writes.

The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
recommends a specific 3-step sequence to avoid spurious interrupts
when updating 64-bit comparison registers on 32-bit systems:

1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
2. Set the high-order bits (stimecmph) to the desired value.
3. Set the low-order bits (stimecmp) to the desired value.

Current implementation writes the LSB first without ensuring a future
value, which may lead to a transient state where the 64-bit comparison
is incorrectly evaluated as "expired" by the hardware. This results in
spurious timer interrupts.

This patch adopts the spec-recommended 3-step sequence to ensure the
intermediate 64-bit state is never smaller than the current time.

Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available")
Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>
---
 drivers/clocksource/timer-riscv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
index 4d7cf338824a..cfc4d83c42c0 100644
--- a/drivers/clocksource/timer-riscv.c
+++ b/drivers/clocksource/timer-riscv.c
@@ -50,8 +50,9 @@ static int riscv_clock_next_event(unsigned long delta,
 
 	if (static_branch_likely(&riscv_sstc_available)) {
 #if defined(CONFIG_32BIT)
-		csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
+		csr_write(CSR_STIMECMP, ULONG_MAX);
 		csr_write(CSR_STIMECMPH, next_tval >> 32);
+		csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
 #else
 		csr_write(CSR_STIMECMP, next_tval);
 #endif
-- 
2.39.5

Re: [PATCH v3 1/3] riscv: clocksource: Fix stimecmp update hazard on RV32

[Anup Patel]

On Sun, Jan 4, 2026 at 7:30 PM Naohiko Shimizu
<naohiko.shimizu@gmail.com> wrote:
>
> On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
> separate 32-bit writes. A race condition exists if the timer triggers
> during these two writes.
>
> The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
> recommends a specific 3-step sequence to avoid spurious interrupts
> when updating 64-bit comparison registers on 32-bit systems:
>
> 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
> 2. Set the high-order bits (stimecmph) to the desired value.
> 3. Set the low-order bits (stimecmp) to the desired value.
>
> Current implementation writes the LSB first without ensuring a future
> value, which may lead to a transient state where the 64-bit comparison
> is incorrectly evaluated as "expired" by the hardware. This results in
> spurious timer interrupts.
>
> This patch adopts the spec-recommended 3-step sequence to ensure the
> intermediate 64-bit state is never smaller than the current time.
>
> Fixes: 9f7a8ff6391f ("RISC-V: Prefer sstc extension if available")
> Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Regards,
Anup


> ---
>  drivers/clocksource/timer-riscv.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/clocksource/timer-riscv.c b/drivers/clocksource/timer-riscv.c
> index 4d7cf338824a..cfc4d83c42c0 100644
> --- a/drivers/clocksource/timer-riscv.c
> +++ b/drivers/clocksource/timer-riscv.c
> @@ -50,8 +50,9 @@ static int riscv_clock_next_event(unsigned long delta,
>
>         if (static_branch_likely(&riscv_sstc_available)) {
>  #if defined(CONFIG_32BIT)
> -               csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
> +               csr_write(CSR_STIMECMP, ULONG_MAX);
>                 csr_write(CSR_STIMECMPH, next_tval >> 32);
> +               csr_write(CSR_STIMECMP, next_tval & 0xFFFFFFFF);
>  #else
>                 csr_write(CSR_STIMECMP, next_tval);
>  #endif
> --
> 2.39.5
>

[PATCH v3 2/3] riscv: kvm: Fix vstimecmp update hazard on RV32

[Naohiko Shimizu]

On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
separate 32-bit writes. A race condition exists if the timer triggers
during these two writes.

The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
recommends a specific 3-step sequence to avoid spurious interrupts
when updating 64-bit comparison registers on 32-bit systems:

1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
2. Set the high-order bits (stimecmph) to the desired value.
3. Set the low-order bits (stimecmp) to the desired value.

Current implementation writes the LSB first without ensuring a future
value, which may lead to a transient state where the 64-bit comparison
is incorrectly evaluated as "expired" by the hardware. This results in
spurious timer interrupts.

This patch adopts the spec-recommended 3-step sequence to ensure the
intermediate 64-bit state is never smaller than the current time.

Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension")
Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>
---
 arch/riscv/kvm/vcpu_timer.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c
index 85a7262115e1..f36247e4c783 100644
--- a/arch/riscv/kvm/vcpu_timer.c
+++ b/arch/riscv/kvm/vcpu_timer.c
@@ -72,8 +72,9 @@ static int kvm_riscv_vcpu_timer_cancel(struct kvm_vcpu_timer *t)
 static int kvm_riscv_vcpu_update_vstimecmp(struct kvm_vcpu *vcpu, u64 ncycles)
 {
 #if defined(CONFIG_32BIT)
-	ncsr_write(CSR_VSTIMECMP, ncycles & 0xFFFFFFFF);
+	ncsr_write(CSR_VSTIMECMP,  ULONG_MAX);
 	ncsr_write(CSR_VSTIMECMPH, ncycles >> 32);
+	ncsr_write(CSR_VSTIMECMP, (u32)ncycles);
 #else
 	ncsr_write(CSR_VSTIMECMP, ncycles);
 #endif
@@ -307,8 +308,9 @@ void kvm_riscv_vcpu_timer_restore(struct kvm_vcpu *vcpu)
 		return;
 
 #if defined(CONFIG_32BIT)
-	ncsr_write(CSR_VSTIMECMP, (u32)t->next_cycles);
+	ncsr_write(CSR_VSTIMECMP, ULONG_MAX);
 	ncsr_write(CSR_VSTIMECMPH, (u32)(t->next_cycles >> 32));
+	ncsr_write(CSR_VSTIMECMP, (u32)(t->next_cycles));
 #else
 	ncsr_write(CSR_VSTIMECMP, t->next_cycles);
 #endif
-- 
2.39.5

Re: [PATCH v3 2/3] riscv: kvm: Fix vstimecmp update hazard on RV32

[Anup Patel]

On Sun, Jan 4, 2026 at 7:30 PM Naohiko Shimizu
<naohiko.shimizu@gmail.com> wrote:
>
> On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
> separate 32-bit writes. A race condition exists if the timer triggers
> during these two writes.
>
> The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
> recommends a specific 3-step sequence to avoid spurious interrupts
> when updating 64-bit comparison registers on 32-bit systems:
>
> 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
> 2. Set the high-order bits (stimecmph) to the desired value.
> 3. Set the low-order bits (stimecmp) to the desired value.
>
> Current implementation writes the LSB first without ensuring a future
> value, which may lead to a transient state where the 64-bit comparison
> is incorrectly evaluated as "expired" by the hardware. This results in
> spurious timer interrupts.
>
> This patch adopts the spec-recommended 3-step sequence to ensure the
> intermediate 64-bit state is never smaller than the current time.
>
> Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension")
> Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Queued this as fixes for Linux-6.19.

Thanks,
Anup

> ---
>  arch/riscv/kvm/vcpu_timer.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c
> index 85a7262115e1..f36247e4c783 100644
> --- a/arch/riscv/kvm/vcpu_timer.c
> +++ b/arch/riscv/kvm/vcpu_timer.c
> @@ -72,8 +72,9 @@ static int kvm_riscv_vcpu_timer_cancel(struct kvm_vcpu_timer *t)
>  static int kvm_riscv_vcpu_update_vstimecmp(struct kvm_vcpu *vcpu, u64 ncycles)
>  {
>  #if defined(CONFIG_32BIT)
> -       ncsr_write(CSR_VSTIMECMP, ncycles & 0xFFFFFFFF);
> +       ncsr_write(CSR_VSTIMECMP,  ULONG_MAX);
>         ncsr_write(CSR_VSTIMECMPH, ncycles >> 32);
> +       ncsr_write(CSR_VSTIMECMP, (u32)ncycles);
>  #else
>         ncsr_write(CSR_VSTIMECMP, ncycles);
>  #endif
> @@ -307,8 +308,9 @@ void kvm_riscv_vcpu_timer_restore(struct kvm_vcpu *vcpu)
>                 return;
>
>  #if defined(CONFIG_32BIT)
> -       ncsr_write(CSR_VSTIMECMP, (u32)t->next_cycles);
> +       ncsr_write(CSR_VSTIMECMP, ULONG_MAX);
>         ncsr_write(CSR_VSTIMECMPH, (u32)(t->next_cycles >> 32));
> +       ncsr_write(CSR_VSTIMECMP, (u32)(t->next_cycles));
>  #else
>         ncsr_write(CSR_VSTIMECMP, t->next_cycles);
>  #endif
> --
> 2.39.5
>

Re: [PATCH v3 2/3] riscv: kvm: Fix vstimecmp update hazard on RV32

[Naohiko Shimizu]

Thank you very much, Anup.
I appreciate your review and queuing this as fixes for v6.19.

Naohiko


On Mon, Jan 5, 2026 at 1:31 PM Anup Patel <anup@brainfault.org> wrote:
>
> On Sun, Jan 4, 2026 at 7:30 PM Naohiko Shimizu
> <naohiko.shimizu@gmail.com> wrote:
> >
> > On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
> > separate 32-bit writes. A race condition exists if the timer triggers
> > during these two writes.
> >
> > The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
> > recommends a specific 3-step sequence to avoid spurious interrupts
> > when updating 64-bit comparison registers on 32-bit systems:
> >
> > 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
> > 2. Set the high-order bits (stimecmph) to the desired value.
> > 3. Set the low-order bits (stimecmp) to the desired value.
> >
> > Current implementation writes the LSB first without ensuring a future
> > value, which may lead to a transient state where the 64-bit comparison
> > is incorrectly evaluated as "expired" by the hardware. This results in
> > spurious timer interrupts.
> >
> > This patch adopts the spec-recommended 3-step sequence to ensure the
> > intermediate 64-bit state is never smaller than the current time.
> >
> > Fixes: 8f5cb44b1bae ("RISC-V: KVM: Support sstc extension")
> > Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>
>
> LGTM.
>
> Reviewed-by: Anup Patel <anup@brainfault.org>
>
> Queued this as fixes for Linux-6.19.
>
> Thanks,
> Anup
>
> > ---
> >  arch/riscv/kvm/vcpu_timer.c | 6 ++++--
> >  1 file changed, 4 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/riscv/kvm/vcpu_timer.c b/arch/riscv/kvm/vcpu_timer.c
> > index 85a7262115e1..f36247e4c783 100644
> > --- a/arch/riscv/kvm/vcpu_timer.c
> > +++ b/arch/riscv/kvm/vcpu_timer.c
> > @@ -72,8 +72,9 @@ static int kvm_riscv_vcpu_timer_cancel(struct kvm_vcpu_timer *t)
> >  static int kvm_riscv_vcpu_update_vstimecmp(struct kvm_vcpu *vcpu, u64 ncycles)
> >  {
> >  #if defined(CONFIG_32BIT)
> > -       ncsr_write(CSR_VSTIMECMP, ncycles & 0xFFFFFFFF);
> > +       ncsr_write(CSR_VSTIMECMP,  ULONG_MAX);
> >         ncsr_write(CSR_VSTIMECMPH, ncycles >> 32);
> > +       ncsr_write(CSR_VSTIMECMP, (u32)ncycles);
> >  #else
> >         ncsr_write(CSR_VSTIMECMP, ncycles);
> >  #endif
> > @@ -307,8 +308,9 @@ void kvm_riscv_vcpu_timer_restore(struct kvm_vcpu *vcpu)
> >                 return;
> >
> >  #if defined(CONFIG_32BIT)
> > -       ncsr_write(CSR_VSTIMECMP, (u32)t->next_cycles);
> > +       ncsr_write(CSR_VSTIMECMP, ULONG_MAX);
> >         ncsr_write(CSR_VSTIMECMPH, (u32)(t->next_cycles >> 32));
> > +       ncsr_write(CSR_VSTIMECMP, (u32)(t->next_cycles));
> >  #else
> >         ncsr_write(CSR_VSTIMECMP, t->next_cycles);
> >  #endif
> > --
> > 2.39.5
> >

[PATCH v3 3/3] riscv: suspend: Fix stimecmp update hazard on RV32

[Naohiko Shimizu]

On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
separate 32-bit writes. A race condition exists if the timer triggers
during these two writes.

The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
recommends a specific 3-step sequence to avoid spurious interrupts
when updating 64-bit comparison registers on 32-bit systems:

1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
2. Set the high-order bits (stimecmph) to the desired value.
3. Set the low-order bits (stimecmp) to the desired value.

Current implementation writes the LSB first without ensuring a future
value, which may lead to a transient state where the 64-bit comparison
is incorrectly evaluated as "expired" by the hardware. This results in
spurious timer interrupts.

This patch adopts the spec-recommended 3-step sequence to ensure the
intermediate 64-bit state is never smaller than the current time.

Fixes: ffef54ad4110 ("riscv: Add stimecmp save and restore")
Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>
---
 arch/riscv/kernel/suspend.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/riscv/kernel/suspend.c b/arch/riscv/kernel/suspend.c
index 24b3f57d467f..aff93090c4ef 100644
--- a/arch/riscv/kernel/suspend.c
+++ b/arch/riscv/kernel/suspend.c
@@ -51,10 +51,11 @@ void suspend_restore_csrs(struct suspend_context *context)
 
 #ifdef CONFIG_MMU
 	if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SSTC)) {
-		csr_write(CSR_STIMECMP, context->stimecmp);
 #if __riscv_xlen < 64
+		csr_write(CSR_STIMECMP, ULONG_MAX);
 		csr_write(CSR_STIMECMPH, context->stimecmph);
 #endif
+		csr_write(CSR_STIMECMP, context->stimecmp);
 	}
 
 	csr_write(CSR_SATP, context->satp);
-- 
2.39.5

Re: [PATCH v3 3/3] riscv: suspend: Fix stimecmp update hazard on RV32

[Anup Patel]

On Sun, Jan 4, 2026 at 7:30 PM Naohiko Shimizu
<naohiko.shimizu@gmail.com> wrote:
>
> On RV32, updating the 64-bit stimecmp (or vstimecmp) CSR requires two
> separate 32-bit writes. A race condition exists if the timer triggers
> during these two writes.
>
> The RISC-V Privileged Specification (e.g., Section 3.2.1 for mtimecmp)
> recommends a specific 3-step sequence to avoid spurious interrupts
> when updating 64-bit comparison registers on 32-bit systems:
>
> 1. Set the low-order bits (stimecmp) to all ones (ULONG_MAX).
> 2. Set the high-order bits (stimecmph) to the desired value.
> 3. Set the low-order bits (stimecmp) to the desired value.
>
> Current implementation writes the LSB first without ensuring a future
> value, which may lead to a transient state where the 64-bit comparison
> is incorrectly evaluated as "expired" by the hardware. This results in
> spurious timer interrupts.
>
> This patch adopts the spec-recommended 3-step sequence to ensure the
> intermediate 64-bit state is never smaller than the current time.
>
> Fixes: ffef54ad4110 ("riscv: Add stimecmp save and restore")
> Signed-off-by: Naohiko Shimizu <naohiko.shimizu@gmail.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Regards,
Anup


> ---
>  arch/riscv/kernel/suspend.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kernel/suspend.c b/arch/riscv/kernel/suspend.c
> index 24b3f57d467f..aff93090c4ef 100644
> --- a/arch/riscv/kernel/suspend.c
> +++ b/arch/riscv/kernel/suspend.c
> @@ -51,10 +51,11 @@ void suspend_restore_csrs(struct suspend_context *context)
>
>  #ifdef CONFIG_MMU
>         if (riscv_has_extension_unlikely(RISCV_ISA_EXT_SSTC)) {
> -               csr_write(CSR_STIMECMP, context->stimecmp);
>  #if __riscv_xlen < 64
> +               csr_write(CSR_STIMECMP, ULONG_MAX);
>                 csr_write(CSR_STIMECMPH, context->stimecmph);
>  #endif
> +               csr_write(CSR_STIMECMP, context->stimecmp);
>         }
>
>         csr_write(CSR_SATP, context->satp);
> --
> 2.39.5
>

Re: [PATCH v3 0/3] riscv: fix timer update hazards on RV32

[Paul Walmsley]

On Sun, 4 Jan 2026, Naohiko Shimizu wrote:

> This patch series fixes timer register update hazards on RV32 for
> clocksource, KVM, and suspend/resume paths by adopting the 3-step
> update sequence recommended by the RISC-V Privileged Specification.
> 
> Changes in v3:
> - Dropped redundant subject line from commit descriptions.
> - Added Fixes tags for all patches.
> - Moved Signed-off-by tags to the end of commit messages.
> 
> Changes in v2:
> - Added detailed architectural background to commit messages.
> - Added KVM and suspend/resume cases.
> 
> Naohiko Shimizu (3):
>   riscv: clocksource: Fix stimecmp update hazard on RV32
>   riscv: kvm: Fix vstimecmp update hazard on RV32
>   riscv: suspend: Fix stimecmp update hazard on RV32
> 
>  arch/riscv/kernel/suspend.c       | 3 ++-
>  arch/riscv/kvm/vcpu_timer.c       | 6 ++++--
>  drivers/clocksource/timer-riscv.c | 3 ++-
>  3 files changed, 8 insertions(+), 4 deletions(-)

Thanks, queued for v6.19-rc. 


- Paul

Re: [PATCH v3 0/3] riscv: fix timer update hazards on RV32

[Naohiko Shimizu]

Thank you very much, Paul.
I really appreciate your quick handling.

Naohiko

On Thu, Jan 15, 2026 at 9:39 AM Paul Walmsley <pjw@kernel.org> wrote:
>
> On Sun, 4 Jan 2026, Naohiko Shimizu wrote:
>
> > This patch series fixes timer register update hazards on RV32 for
> > clocksource, KVM, and suspend/resume paths by adopting the 3-step
> > update sequence recommended by the RISC-V Privileged Specification.
> >
> > Changes in v3:
> > - Dropped redundant subject line from commit descriptions.
> > - Added Fixes tags for all patches.
> > - Moved Signed-off-by tags to the end of commit messages.
> >
> > Changes in v2:
> > - Added detailed architectural background to commit messages.
> > - Added KVM and suspend/resume cases.
> >
> > Naohiko Shimizu (3):
> >   riscv: clocksource: Fix stimecmp update hazard on RV32
> >   riscv: kvm: Fix vstimecmp update hazard on RV32
> >   riscv: suspend: Fix stimecmp update hazard on RV32
> >
> >  arch/riscv/kernel/suspend.c       | 3 ++-
> >  arch/riscv/kvm/vcpu_timer.c       | 6 ++++--
> >  drivers/clocksource/timer-riscv.c | 3 ++-
> >  3 files changed, 8 insertions(+), 4 deletions(-)
>
> Thanks, queued for v6.19-rc.
>
>
> - Paul