[PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Marc Zyngier]

It appears that the bcm2712 SoC found in the relatively popular
RPi5 has a broken EL2 virtual timer.

We do not know the reason why the timer isn't working (the timer
is ticking, but the interrupt never fires), and the SoC vendor
doesn't communicate on the reason why this isn't working, leaving
users and maintainers in the dark.

Paper over the issue by detecting the broken HW, falling back to
the physical timer instead, and let the user know about it.
Also taint the kernel as the machine is definitely not compliant
with the spec, and we don't know what else is wrong with it.

Reported-by: John <therealgraysky@proton.me>
Reported-by: Daniel Drake <dan@reactivated.net>
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Cc: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Mark Rutland <mark.rutland@arm.com>
---
 drivers/clocksource/arm_arch_timer.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 4adf756423de9..7b4a98df6962b 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -1090,6 +1090,27 @@ static int __init arch_timer_common_init(void)
 	return arch_timer_arch_init();
 }
 
+static bool __init has_broken_el2_vtimer(void)
+{
+	/*
+	 * SoCs described here have been found to be broken, though no
+	 * explanation has been volunteered by the vendor. Let the user know
+	 * we're papering over the vendor's lack of communication.
+	 */
+	static const char * const broken_el2_vtimer[] __initconst = {
+		"brcm,bcm2712",
+		NULL
+	};
+
+	if (of_machine_compatible_match(broken_el2_vtimer)) {
+		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
+		pr_warn_once(HW_ERR "Known broken EL2 virtual timer, ignoring it\n");
+		return true;
+	}
+
+	return false;
+}
+
 /**
  * arch_timer_select_ppi() - Select suitable PPI for the current system.
  *
@@ -1115,7 +1136,8 @@ static int __init arch_timer_common_init(void)
 static enum arch_timer_ppi_nr __init arch_timer_select_ppi(void)
 {
 	if (is_kernel_in_hyp_mode()) {
-		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI])
+		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI] &&
+		    !has_broken_el2_vtimer())
 			return ARCH_TIMER_HYP_VIRT_PPI;
 
 		pr_warn_once(FW_BUG "VHE-capable CPU without EL2 virtual timer interrupt\n");
-- 
2.47.3

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Florian Fainelli]

On 7/10/26 01:09, Marc Zyngier wrote:
> It appears that the bcm2712 SoC found in the relatively popular
> RPi5 has a broken EL2 virtual timer.
> 
> We do not know the reason why the timer isn't working (the timer
> is ticking, but the interrupt never fires), and the SoC vendor
> doesn't communicate on the reason why this isn't working, leaving
> users and maintainers in the dark.
> 
> Paper over the issue by detecting the broken HW, falling back to
> the physical timer instead, and let the user know about it.
> Also taint the kernel as the machine is definitely not compliant
> with the spec, and we don't know what else is wrong with it.
> 
> Reported-by: John <therealgraysky@proton.me>
> Reported-by: Daniel Drake <dan@reactivated.net>
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> Cc: Florian Fainelli <florian.fainelli@broadcom.com>
> Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Mark Rutland <mark.rutland@arm.com>

Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>

We know why now: the virtual interrupt timer line was never connected in 
the first place because it was not clarified that it was a requirement. 
I will also take the DTS patch through the Broadcom ARM SoC tree.

Thanks!
-- 
Florian

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Marc Zyngier]

On Mon, 13 Jul 2026 17:15:35 +0100,
Florian Fainelli <florian.fainelli@broadcom.com> wrote:
> 
> On 7/10/26 01:09, Marc Zyngier wrote:
> > It appears that the bcm2712 SoC found in the relatively popular
> > RPi5 has a broken EL2 virtual timer.
> > 
> > We do not know the reason why the timer isn't working (the timer
> > is ticking, but the interrupt never fires), and the SoC vendor
> > doesn't communicate on the reason why this isn't working, leaving
> > users and maintainers in the dark.
> > 
> > Paper over the issue by detecting the broken HW, falling back to
> > the physical timer instead, and let the user know about it.
> > Also taint the kernel as the machine is definitely not compliant
> > with the spec, and we don't know what else is wrong with it.
> > 
> > Reported-by: John <therealgraysky@proton.me>
> > Reported-by: Daniel Drake <dan@reactivated.net>
> > Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> > Signed-off-by: Marc Zyngier <maz@kernel.org>
> > Cc: Florian Fainelli <florian.fainelli@broadcom.com>
> > Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Mark Rutland <mark.rutland@arm.com>
> 
> Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
> 
> We know why now: the virtual interrupt timer line was never connected
> in the first place because it was not clarified that it was a
> requirement.

Dangling wires coming out of the CPUs don't ring any alarm bell at
integration time? Amazing. Makes you wonder what else they forgot to
connect...

Is there an erratum number that we can refer to for documentation
purposes?

	M.

-- 
Jazz isn't dead. It just smells funny.

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Florian Fainelli]

On 7/13/26 13:23, Marc Zyngier wrote:
> On Mon, 13 Jul 2026 17:15:35 +0100,
> Florian Fainelli <florian.fainelli@broadcom.com> wrote:
>>
>> On 7/10/26 01:09, Marc Zyngier wrote:
>>> It appears that the bcm2712 SoC found in the relatively popular
>>> RPi5 has a broken EL2 virtual timer.
>>>
>>> We do not know the reason why the timer isn't working (the timer
>>> is ticking, but the interrupt never fires), and the SoC vendor
>>> doesn't communicate on the reason why this isn't working, leaving
>>> users and maintainers in the dark.
>>>
>>> Paper over the issue by detecting the broken HW, falling back to
>>> the physical timer instead, and let the user know about it.
>>> Also taint the kernel as the machine is definitely not compliant
>>> with the spec, and we don't know what else is wrong with it.
>>>
>>> Reported-by: John <therealgraysky@proton.me>
>>> Reported-by: Daniel Drake <dan@reactivated.net>
>>> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
>>> Signed-off-by: Marc Zyngier <maz@kernel.org>
>>> Cc: Florian Fainelli <florian.fainelli@broadcom.com>
>>> Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
>>> Cc: Thomas Gleixner <tglx@linutronix.de>
>>> Cc: Mark Rutland <mark.rutland@arm.com>
>>
>> Acked-by: Florian Fainelli <florian.fainelli@broadcom.com>
>>
>> We know why now: the virtual interrupt timer line was never connected
>> in the first place because it was not clarified that it was a
>> requirement.
> 
> Dangling wires coming out of the CPUs don't ring any alarm bell at
> integration time? Amazing. Makes you wonder what else they forgot to
> connect...
> 
> Is there an erratum number that we can refer to for documentation
> purposes?

There is not one, we only have an internal bug tracker entry for this issue.
-- 
Florian

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Gary Guo]

On Fri Jul 10, 2026 at 9:09 AM BST, Marc Zyngier wrote:
> It appears that the bcm2712 SoC found in the relatively popular
> RPi5 has a broken EL2 virtual timer.
>
> We do not know the reason why the timer isn't working (the timer
> is ticking, but the interrupt never fires), and the SoC vendor
> doesn't communicate on the reason why this isn't working, leaving
> users and maintainers in the dark.
>
> Paper over the issue by detecting the broken HW, falling back to
> the physical timer instead, and let the user know about it.
> Also taint the kernel as the machine is definitely not compliant
> with the spec, and we don't know what else is wrong with it.
>
> Reported-by: John <therealgraysky@proton.me>
> Reported-by: Daniel Drake <dan@reactivated.net>
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> Cc: Florian Fainelli <florian.fainelli@broadcom.com>
> Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Mark Rutland <mark.rutland@arm.com>

Tested on my RPi 5 and this does make it boot again

Tested-by: Gary Guo <gary@garyguo.net>

Best,
Gary

> ---
>  drivers/clocksource/arm_arch_timer.c | 24 +++++++++++++++++++++++-
>  1 file changed, 23 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
> index 4adf756423de9..7b4a98df6962b 100644
> --- a/drivers/clocksource/arm_arch_timer.c
> +++ b/drivers/clocksource/arm_arch_timer.c
> @@ -1090,6 +1090,27 @@ static int __init arch_timer_common_init(void)
>  	return arch_timer_arch_init();
>  }
>  
> +static bool __init has_broken_el2_vtimer(void)
> +{
> +	/*
> +	 * SoCs described here have been found to be broken, though no
> +	 * explanation has been volunteered by the vendor. Let the user know
> +	 * we're papering over the vendor's lack of communication.
> +	 */
> +	static const char * const broken_el2_vtimer[] __initconst = {
> +		"brcm,bcm2712",
> +		NULL
> +	};
> +
> +	if (of_machine_compatible_match(broken_el2_vtimer)) {
> +		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
> +		pr_warn_once(HW_ERR "Known broken EL2 virtual timer, ignoring it\n");
> +		return true;
> +	}
> +
> +	return false;
> +}
> +
>  /**
>   * arch_timer_select_ppi() - Select suitable PPI for the current system.
>   *
> @@ -1115,7 +1136,8 @@ static int __init arch_timer_common_init(void)
>  static enum arch_timer_ppi_nr __init arch_timer_select_ppi(void)
>  {
>  	if (is_kernel_in_hyp_mode()) {
> -		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI])
> +		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI] &&
> +		    !has_broken_el2_vtimer())
>  			return ARCH_TIMER_HYP_VIRT_PPI;
>  
>  		pr_warn_once(FW_BUG "VHE-capable CPU without EL2 virtual timer interrupt\n");

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Jon Hunter]

On 10/07/2026 09:09, Marc Zyngier wrote:
> It appears that the bcm2712 SoC found in the relatively popular
> RPi5 has a broken EL2 virtual timer.
> 
> We do not know the reason why the timer isn't working (the timer
> is ticking, but the interrupt never fires), and the SoC vendor
> doesn't communicate on the reason why this isn't working, leaving
> users and maintainers in the dark.
> 
> Paper over the issue by detecting the broken HW, falling back to
> the physical timer instead, and let the user know about it.
> Also taint the kernel as the machine is definitely not compliant
> with the spec, and we don't know what else is wrong with it.
> 
> Reported-by: John <therealgraysky@proton.me>
> Reported-by: Daniel Drake <dan@reactivated.net>
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> Cc: Florian Fainelli <florian.fainelli@broadcom.com>
> Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
> Cc: Thomas Gleixner <tglx@linutronix.de>
> Cc: Mark Rutland <mark.rutland@arm.com>
> ---
>   drivers/clocksource/arm_arch_timer.c | 24 +++++++++++++++++++++++-
>   1 file changed, 23 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
> index 4adf756423de9..7b4a98df6962b 100644
> --- a/drivers/clocksource/arm_arch_timer.c
> +++ b/drivers/clocksource/arm_arch_timer.c
> @@ -1090,6 +1090,27 @@ static int __init arch_timer_common_init(void)
>   	return arch_timer_arch_init();
>   }
>   
> +static bool __init has_broken_el2_vtimer(void)
> +{
> +	/*
> +	 * SoCs described here have been found to be broken, though no
> +	 * explanation has been volunteered by the vendor. Let the user know
> +	 * we're papering over the vendor's lack of communication.
> +	 */
> +	static const char * const broken_el2_vtimer[] __initconst = {
> +		"brcm,bcm2712",
> +		NULL
> +	};
> +
> +	if (of_machine_compatible_match(broken_el2_vtimer)) {
> +		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
> +		pr_warn_once(HW_ERR "Known broken EL2 virtual timer, ignoring it\n");

After this change you will now get two warnings; the above and the 
below. Is this what you want?

> +		return true;
> +	}
> +
> +	return false;
> +}
> +
>   /**
>    * arch_timer_select_ppi() - Select suitable PPI for the current system.
>    *
> @@ -1115,7 +1136,8 @@ static int __init arch_timer_common_init(void)
>   static enum arch_timer_ppi_nr __init arch_timer_select_ppi(void)
>   {
>   	if (is_kernel_in_hyp_mode()) {
> -		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI])
> +		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI] &&
> +		    !has_broken_el2_vtimer())
>   			return ARCH_TIMER_HYP_VIRT_PPI;
>   
>   		pr_warn_once(FW_BUG "VHE-capable CPU without EL2 virtual timer interrupt\n");


I have posted something similar for Tegra [0], but because this is not 
expected to work, I wanted to avoid the warnings here. We test for 
kernel warnings and ideally we would not warn if is known not to work. 
We could always display an info level print if it is needed.

Jon

[0] 
https://lore.kernel.org/linux-tegra/20260722-cordial-zippy-oxpecker-dcdabb@sudeepholla/T/#m0c203a9b743500f0d1e728e80d1385d829844e3f
-- 
nvpublic

Re: [PATCH] clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer

[Marc Zyngier]

On Wed, 22 Jul 2026 15:14:39 +0100,
Jon Hunter <jonathanh@nvidia.com> wrote:
> 
> 
> On 10/07/2026 09:09, Marc Zyngier wrote:
> > It appears that the bcm2712 SoC found in the relatively popular
> > RPi5 has a broken EL2 virtual timer.
> > 
> > We do not know the reason why the timer isn't working (the timer
> > is ticking, but the interrupt never fires), and the SoC vendor
> > doesn't communicate on the reason why this isn't working, leaving
> > users and maintainers in the dark.
> > 
> > Paper over the issue by detecting the broken HW, falling back to
> > the physical timer instead, and let the user know about it.
> > Also taint the kernel as the machine is definitely not compliant
> > with the spec, and we don't know what else is wrong with it.
> > 
> > Reported-by: John <therealgraysky@proton.me>
> > Reported-by: Daniel Drake <dan@reactivated.net>
> > Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> > Signed-off-by: Marc Zyngier <maz@kernel.org>
> > Cc: Florian Fainelli <florian.fainelli@broadcom.com>
> > Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Cc: Mark Rutland <mark.rutland@arm.com>
> > ---
> >   drivers/clocksource/arm_arch_timer.c | 24 +++++++++++++++++++++++-
> >   1 file changed, 23 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
> > index 4adf756423de9..7b4a98df6962b 100644
> > --- a/drivers/clocksource/arm_arch_timer.c
> > +++ b/drivers/clocksource/arm_arch_timer.c
> > @@ -1090,6 +1090,27 @@ static int __init arch_timer_common_init(void)
> >   	return arch_timer_arch_init();
> >   }
> >   +static bool __init has_broken_el2_vtimer(void)
> > +{
> > +	/*
> > +	 * SoCs described here have been found to be broken, though no
> > +	 * explanation has been volunteered by the vendor. Let the user know
> > +	 * we're papering over the vendor's lack of communication.
> > +	 */
> > +	static const char * const broken_el2_vtimer[] __initconst = {
> > +		"brcm,bcm2712",
> > +		NULL
> > +	};
> > +
> > +	if (of_machine_compatible_match(broken_el2_vtimer)) {
> > +		add_taint(TAINT_CPU_OUT_OF_SPEC, LOCKDEP_STILL_OK);
> > +		pr_warn_once(HW_ERR "Known broken EL2 virtual timer, ignoring it\n");
> 
> After this change you will now get two warnings; the above and the
> below. Is this what you want?

Absolutely.

> 
> > +		return true;
> > +	}
> > +
> > +	return false;
> > +}
> > +
> >   /**
> >    * arch_timer_select_ppi() - Select suitable PPI for the current system.
> >    *
> > @@ -1115,7 +1136,8 @@ static int __init arch_timer_common_init(void)
> >   static enum arch_timer_ppi_nr __init arch_timer_select_ppi(void)
> >   {
> >   	if (is_kernel_in_hyp_mode()) {
> > -		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI])
> > +		if (arch_timer_ppi[ARCH_TIMER_HYP_VIRT_PPI] &&
> > +		    !has_broken_el2_vtimer())
> >   			return ARCH_TIMER_HYP_VIRT_PPI;
> >     		pr_warn_once(FW_BUG "VHE-capable CPU without EL2
> > virtual timer interrupt\n");
> 
> 
> I have posted something similar for Tegra [0], but because this is not
> expected to work, I wanted to avoid the warnings here. We test for

"not expected to work"? In which parallel universe is that a thing?

> kernel warnings and ideally we would not warn if is known not to
> work. We could always display an info level print if it is needed.

No. These warnings are required because the HW is broken, and violates
the basics of the architecture, which the kernel relies on. That's
important information that needs to be captured, and that's why the
kernel also gets tainted.

This applies to any implementation that hasn't been bothered to follow
the spec. Don't worry, you're in good company.

	M.

-- 
Jazz isn't dead. It just smells funny.