Looking more closely at this, I think this is because you've passed QEMU a file which it is treating as a Linux kernel. (-kernel treats raw binaries and uimage files as Linux kernels; it treats ELF files as not being Linux kernels). Linux expects to be started in EL2, so although the emulated CPU has EL3, we start your program in EL2. Your program is therefore not running at the highest available exception level, and can't write to CNTFRQ_EL0.
For "bare metal" images where you want to do things at EL3, it may be better to build them as ELF files which are linked to load at address 0. Note that all four cores will start at address zero simultaneously, so you'll need a bit of "pen code" to sort the secondaries out from the primary. https://github.com/raspberrypi/tools/blob/master/armstubs/armstub8.S might be useful reference. As I understand it, this is how your code would be run on real raspi3 hardware too. -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1771948 Title: aarch64 msr CNTFRQ_EL0 Status in QEMU: New Bug description: Hello, I'm running qemu 2.12 on a raspberry pi 3 with the command: qemu-system-aarch64 -M raspi3 -serial stdio -kernel executable.bin On my start file (right in the beginning with the highest EL), the following instructions: ldr x0 , =19200000 msr CNTFRQ_EL0, x0 and qemu halts on the "msr CNTFRQ_EL0, x0" instruction. I believe this is not a normal behavior. Thank you To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1771948/+subscriptions