[PATCH] target/arm: Fix CNTPCT_EL0 trapping from EL0 when HCR_EL2.E2H is 0

[Michal Orzel]

On an attempt to access CNTPCT_EL0 from EL0 using a guest running on top
of Xen, a trap from EL2 was observed which is something not reproducible
on HW (also, Xen does not trap accesses to physical counter).

This is because gt_counter_access() checks for an incorrect bit (1
instead of 0) of CNTHCTL_EL2 if HCR_EL2.E2H is 0 and access is made to
physical counter. Refer ARM ARM DDI 0487J.a, D19.12.2:
When HCR_EL2.E2H is 0:
 - EL1PCTEN, bit [0]: refers to physical counter
 - EL1PCEN, bit [1]: refers to physical timer registers

Fix it by checking for the right bit (i.e. 0) and update the comment
referring to incorrect bit name.

Fixes: 5bc8437136fb ("target/arm: Update timer access for VHE")
Signed-off-by: Michal Orzel <michal.or...@amd.com>
---
This is now in conformance to ARM ARM CNTPCT_EL0 pseudocode:
if PSTATE.EL == EL0 then
...
    elif EL2Enabled() && HCR_EL2.E2H == '0' && CNTHCTL_EL2.EL1PCTEN == '0' then
        AArch64.SystemAccessTrap(EL2, 0x18);
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3b22596eabf3..3a2d77b3f81e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2483,9 +2483,9 @@ static CPAccessResult gt_counter_access(CPUARMState *env, 
int timeridx,
                 return CP_ACCESS_TRAP_EL2;
             }
         } else {
-            /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
+            /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCTEN. */
             if (has_el2 && timeridx == GTIMER_PHYS &&
-                !extract32(env->cp15.cnthctl_el2, 1, 1)) {
+                !extract32(env->cp15.cnthctl_el2, 0, 1)) {
                 return CP_ACCESS_TRAP_EL2;
             }
         }
-- 
2.25.1