[PATCH 0/2] ARMv8 timer fixes for platforms without EL2 configuration

[PATCH 0/2] ARMv8 timer fixes for platforms without EL2 configuration

[Balaji Selvanathan]

This series addresses timer-related issues on ARMv8 platforms where
U-Boot runs at EL1 without a Hypervisor present. This is commonly
encountered when using tools like snagboot for
recovery and development.

On such platforms, U-Boot runs at EL1 but EL2 timer control
registers may not be properly configured as Hypervisor is not present.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
Balaji Selvanathan (2):
      armv8: timer: Add option to use virtual counter at EL1
      snapdragon: Set timer frequency for ARMV8_CNTFRQ_BROKEN platforms

 arch/arm/cpu/armv8/Kconfig         | 19 +++++++++++++++++++
 arch/arm/cpu/armv8/generic_timer.c | 13 +++++++++++++
 arch/arm/mach-snapdragon/board.c   | 17 +++++++++++++++++
 3 files changed, 49 insertions(+)
---
base-commit: 47e064f13171f15817aa1b22b04e309964b15c2c
change-id: 20260406-timer-07c406ca4987

Best regards,
-- 
Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>

[PATCH 1/2] armv8: timer: Add option to use virtual counter at EL1

[Balaji Selvanathan]

Add CONFIG_ARMV8_TIMER_USE_VIRTUAL_COUNTER to allow platforms to use
the virtual counter (CNTVCT_EL0) instead of the physical counter
(CNTPCT_EL0) when running at EL1.

This addresses platforms where the hypervisor or EL2 firmware does
not configure CNTHCTL_EL2.EL1PCTEN, causing EL1 access to CNTPCT_EL0
to trap. The virtual counter is typically accessible without trapping
and provides equivalent functionality when CNTVOFF_EL2 is zero, as is
typical in bootloader environments.

The new Kconfig option is disabled by default to maintain existing
behavior on platforms where physical counter access works correctly.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
 arch/arm/cpu/armv8/Kconfig         | 19 +++++++++++++++++++
 arch/arm/cpu/armv8/generic_timer.c | 13 +++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/arch/arm/cpu/armv8/Kconfig b/arch/arm/cpu/armv8/Kconfig
index dfc4ce851c3..00c7303e09d 100644
--- a/arch/arm/cpu/armv8/Kconfig
+++ b/arch/arm/cpu/armv8/Kconfig
@@ -12,6 +12,25 @@ config ARMV8_CNTFRQ_BROKEN
 	  does not set the CNTFRQ_EL0 frequency, and its not possible to
 	  set it from U-Boot either.
 
+config ARMV8_TIMER_USE_VIRTUAL_COUNTER
+	bool "Use virtual counter (CNTVCT_EL0) at EL1"
+	depends on SYS_ARCH_TIMER
+	help
+	  Say Y here if the platform's hypervisor/EL2 firmware does not
+	  configure CNTHCTL_EL2.EL1PCTEN to allow EL1 access to the physical
+	  counter (CNTPCT_EL0), causing traps when attempting to read it.
+
+	  This option makes the generic timer use the virtual counter
+	  (CNTVCT_EL0) when running at EL1, which is typically accessible
+	  without trapping.
+
+	  This is a workaround for platforms where the EL2 firmware cannot
+	  properly configure CNTHCTL_EL2. In most cases, the
+	  virtual counter provides equivalent functionality since CNTVOFF_EL2
+	  is typically zero in bootloader environments.
+
+	  If unsure, say N.
+
 config ARMV8_SPL_EXCEPTION_VECTORS
 	bool "Install crash dump exception vectors"
 	depends on SPL
diff --git a/arch/arm/cpu/armv8/generic_timer.c b/arch/arm/cpu/armv8/generic_timer.c
index 744ab3b91e5..6dc98874504 100644
--- a/arch/arm/cpu/armv8/generic_timer.c
+++ b/arch/arm/cpu/armv8/generic_timer.c
@@ -86,7 +86,20 @@ unsigned long notrace timer_read_counter(void)
 	unsigned long cntpct;
 
 	isb();
+
+#ifdef CONFIG_ARMV8_TIMER_USE_VIRTUAL_COUNTER
+	/*
+	 * Use virtual counter (CNTVCT_EL0) at EL1 if configured.
+	 * This is a workaround for platforms where the hypervisor/EL2 firmware
+	 * does not configure CNTHCTL_EL2.EL1PCTEN, causing EL1 access to
+	 * CNTPCT_EL0 to trap. The virtual counter is typically accessible
+	 * without trapping and provides equivalent functionality when
+	 * CNTVOFF_EL2 is zero (as is typical in bootloader environments).
+	 */
+	asm volatile("mrs %0, cntvct_el0" : "=r" (cntpct));
+#else
 	asm volatile("mrs %0, cntpct_el0" : "=r" (cntpct));
+#endif
 
 	return cntpct;
 }

-- 
2.34.1

[PATCH 2/2] snapdragon: Set timer frequency for ARMV8_CNTFRQ_BROKEN platforms

[Balaji Selvanathan]

Implement arch_cpu_init() for Snapdragon platforms to initialize the
timer frequency when CONFIG_ARMV8_CNTFRQ_BROKEN is enabled. This is
required for platforms where the firmware does not set CNTFRQ_EL0.

Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
---
 arch/arm/mach-snapdragon/board.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/arch/arm/mach-snapdragon/board.c b/arch/arm/mach-snapdragon/board.c
index 5fb3240acc5..6cc9270cc5a 100644
--- a/arch/arm/mach-snapdragon/board.c
+++ b/arch/arm/mach-snapdragon/board.c
@@ -39,6 +39,23 @@ DECLARE_GLOBAL_DATA_PTR;
 
 enum qcom_boot_source qcom_boot_source __section(".data") = 0;
 
+int arch_cpu_init(void)
+{
+	/* Set timer frequency for CONFIG_ARMV8_CNTFRQ_BROKEN
+	 * Use CONFIG_COUNTER_FREQUENCY if defined, which allows per-platform
+	 * timer frequency configuration via defconfig.
+	 */
+	if (IS_ENABLED(CONFIG_ARMV8_CNTFRQ_BROKEN)) {
+#ifdef CONFIG_COUNTER_FREQUENCY
+		gd->arch.timer_rate_hz = CONFIG_COUNTER_FREQUENCY;
+#else
+		gd->arch.timer_rate_hz = 19200000; /* Default 19.2 MHz for Qualcomm */
+#endif
+	}
+
+	return 0;
+}
+
 static struct mm_region rbx_mem_map[CONFIG_NR_DRAM_BANKS + 2] = { { 0 } };
 
 struct mm_region *mem_map = rbx_mem_map;

-- 
2.34.1

Re: [PATCH 0/2] ARMv8 timer fixes for platforms without EL2 configuration

[Sumit Garg]

Hi Balaji,

On Mon, Apr 06, 2026 at 04:25:35PM +0530, Balaji Selvanathan wrote:
> This series addresses timer-related issues on ARMv8 platforms where
> U-Boot runs at EL1 without a Hypervisor present. This is commonly
> encountered when using tools like snagboot for
> recovery and development.

As discussed offline too, the snagboot flow has to be fixed in this case
since booting in NS EL1 without properly initialized NS EL2 isn't the
right thing to do.

-Sumit

> 
> On such platforms, U-Boot runs at EL1 but EL2 timer control
> registers may not be properly configured as Hypervisor is not present.
> 
> Signed-off-by: Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
> ---
> Balaji Selvanathan (2):
>       armv8: timer: Add option to use virtual counter at EL1
>       snapdragon: Set timer frequency for ARMV8_CNTFRQ_BROKEN platforms
> 
>  arch/arm/cpu/armv8/Kconfig         | 19 +++++++++++++++++++
>  arch/arm/cpu/armv8/generic_timer.c | 13 +++++++++++++
>  arch/arm/mach-snapdragon/board.c   | 17 +++++++++++++++++
>  3 files changed, 49 insertions(+)
> ---
> base-commit: 47e064f13171f15817aa1b22b04e309964b15c2c
> change-id: 20260406-timer-07c406ca4987
> 
> Best regards,
> -- 
> Balaji Selvanathan <balaji.selvanathan@oss.qualcomm.com>
>