diff --git a/sys/arm64/arm64/locore.S b/sys/arm64/arm64/locore.S
--- a/sys/arm64/arm64/locore.S
+++ b/sys/arm64/arm64/locore.S
@@ -370,8 +370,10 @@
 	msr	hstr_el2, xzr
 
 	/* Enable access to the physical timers at EL1 */
-	mrs	x2, cnthctl_el2
-	orr	x2, x2, #(CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN)
+	tst	x4, #HCR_E2H
+	ldr	x3, =(CNTHCTL_EL1PCTEN | CNTHCTL_EL1PCEN)
+	ldr	x5, =(CNTHCTL_E2H_EL1PCTEN | CNTHCTL_E2H_EL1PTEN)
+	csel	x2, x3, x5, eq
 	msr	cnthctl_el2, x2
 
 	/* Set the counter offset to a known value */
diff --git a/sys/arm64/include/hypervisor.h b/sys/arm64/include/hypervisor.h
--- a/sys/arm64/include/hypervisor.h
+++ b/sys/arm64/include/hypervisor.h
@@ -37,10 +37,15 @@
 
 /* CNTHCTL_EL2 - Counter-timer Hypervisor Control register */
 #define	CNTHCTL_EVNTI_MASK	(0xf << 4) /* Bit to trigger event stream */
+/* Valid if HCR_EL2.E2H == 0 */
+#define	CNTHCTL_EL1PCTEN	(1 << 0) /* Allow physical counter access */
+#define	CNTHCTL_EL1PCEN		(1 << 1) /* Allow physical timer access */
+/* Valid if HCR_EL2.E2H == 1 */
+#define	CNTHCTL_E2H_EL1PCTEN	(1 << 10) /* Allow physical counter access */
+#define	CNTHCTL_E2H_EL1PTEN	(1 << 11) /* Allow physical timer access */
+/* Unconditionally valid */
 #define	CNTHCTL_EVNTDIR		(1 << 3) /* Control transition trigger bit */
 #define	CNTHCTL_EVNTEN		(1 << 2) /* Enable event stream */
-#define	CNTHCTL_EL1PCEN		(1 << 1) /* Allow EL0/1 physical timer access */
-#define	CNTHCTL_EL1PCTEN	(1 << 0) /*Allow EL0/1 physical counter access*/
 
 /* CPTR_EL2 - Architecture feature trap register */
 /* Valid if HCR_EL2.E2H == 0 */