diff options
author | 2023-09-28 11:44:04 +0200 | |
---|---|---|
committer | 2023-10-19 14:32:12 +0100 | |
commit | d01448c79d89cfdc86228081b1dd1dfaf85fb4c3 (patch) | |
tree | 4b1ff488c7d32a6b91c02afc02bec9bb161f1a94 /include/hw/arm/virt.h | |
parent | elf2dmp: check array bounds in pdb_get_file_size (diff) | |
download | qemu-d01448c79d89cfdc86228081b1dd1dfaf85fb4c3.tar.xz qemu-d01448c79d89cfdc86228081b1dd1dfaf85fb4c3.zip |
target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0
On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
of Xen, a trap from EL2 was observed which is something not reproducible
on HW (also, Xen does not trap accesses to physical counter).
This is because gt_counter_access() checks for an incorrect bit (1
instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
When HCR_EL2.E2H is 0:
- EL1PCTEN, bit [0]: refers to physical counter
- EL1PCEN, bit [1]: refers to physical timer registers
Drop entire block "if (hcr & HCR_E2H) {...} else {...}" from EL0 case
and fall through to EL1 case, given that after fixing checking for the
correct bit, the handling is the same.
Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
Signed-off-by: Michal Orzel <michal.orzel@amd.com>
Tested-by: Oleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Message-id: 20230928094404.20802-1-michal.orzel@amd.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'include/hw/arm/virt.h')
0 files changed, 0 insertions, 0 deletions