From: Michal Orzel <michal.or...@amd.com> On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top of Xen, a trap from EL2 was observed which is something not reproducible on HW (also, Xen does not trap accesses to physical counter).
This is because gt_counter_access() checks for an incorrect bit (1 instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2: When HCR_EL2.E2H is 0: - EL1PCTEN, bit [0]: refers to physical counter - EL1PCEN, bit [1]: refers to physical timer registers Drop entire block "if (hcr & HCR_E2H) {...} else {...}" from EL0 case and fall through to EL1 case, given that after fixing checking for the correct bit, the handling is the same. Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE") Signed-off-by: Michal Orzel <michal.or...@amd.com> Tested-by: Oleksandr Tyshchenko <oleksandr_tyshche...@epam.com> Message-id: 20230928094404.20802-1-michal.or...@amd.com Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> (cherry picked from commit d01448c79d89cfdc86228081b1dd1dfaf85fb4c3) Signed-off-by: Michael Tokarev <m...@tls.msk.ru> diff --git a/target/arm/helper.c b/target/arm/helper.c index 50f61e42ca..f66b610bdd 100644 --- a/target/arm/helper.c +++ b/target/arm/helper.c @@ -2475,22 +2475,7 @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx, if (!extract32(env->cp15.c14_cntkctl, timeridx, 1)) { return CP_ACCESS_TRAP; } - - /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PCTEN. */ - if (hcr & HCR_E2H) { - if (timeridx == GTIMER_PHYS && - !extract32(env->cp15.cnthctl_el2, 10, 1)) { - return CP_ACCESS_TRAP_EL2; - } - } else { - /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */ - if (has_el2 && timeridx == GTIMER_PHYS && - !extract32(env->cp15.cnthctl_el2, 1, 1)) { - return CP_ACCESS_TRAP_EL2; - } - } - break; - + /* fall through */ case 1: /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */ if (has_el2 && timeridx == GTIMER_PHYS && -- 2.39.2