← Home

PMBSR_EL1

Profiling Buffer Status/syndrome Register (EL1)

Provides syndrome information to software for a Profiling Buffer management event.

Configuration

This register is present only when FEAT_SPE is implemented. Otherwise, direct accesses to PMBSR_EL1 are UNDEFINED.

Attributes

PMBSR_EL1 is a 64-bit register.

Field descriptions

6362616059585756555453525150494847464544434241403938373635343332
313029282726252423222120191817161514131211109876543210
RES0MSS2
ECRES0DLEASCOLLMSS

Bits [63:56]:

Reserved, RES0.

MSS2, bits [55:32]:

Management event Specific Syndrome 2. Contains syndrome specific to the management event.

The syndrome contents for each management event are described in the following sections.

MSS2 encoding for other Profiling Buffer management events

23222120191817161514131211109876543210
RES0

Bits [23:0]:

Reserved, RES0.

MSS2 encoding for stage 1 or stage 2 Data Aborts on write to Profiling Buffer

23222120191817161514131211109876543210
RES0TopLevelAssuredOnlyOverlayDirtyBitRES0

Bits [23:9]:

Reserved, RES0.

TopLevel, bit [8] when FEAT_THE is implemented:

TopLevel. Indicates if the fault was due to TopLevel.

TopLevelMeaning
0b0

Fault is not due to TopLevel.

0b1

Fault is due to TopLevel.

Otherwise:

Reserved, RES0.

AssuredOnly, bit [7] when FEAT_THE is implemented, PMBSR_EL1.EC == '100101', and GetPMBSR_EL1_FSC() IN {'0011xx'}:

AssuredOnly flag. If a memory access generates a stage 2 Data Abort, then this field holds information about the fault.

AssuredOnlyMeaning
0b0

Data Abort is not due to AssuredOnly.

0b1

Data Abort is due to AssuredOnly.

Otherwise:

Reserved, RES0.

Overlay, bit [6] when (FEAT_S1POE is implemented or FEAT_S2POE is implemented) and GetPMBSR_EL1_FSC() IN {'0011xx'}:

Overlay flag. If a memory access generates a Data Abort for a Permission fault, then this field holds information about the fault.

OverlayMeaning
0b0

Data Abort is not due to Overlay Permissions.

0b1

Data Abort is due to Overlay Permissions.

Otherwise:

Reserved, RES0.

DirtyBit, bit [5] when (FEAT_S1PIE is implemented or FEAT_S2PIE is implemented) and GetPMBSR_EL1_FSC() IN {'0011xx'}:

DirtyBit flag. If a write access to memory generates a Data Abort for a Permission fault using Indirect Permission, then this field holds information about the fault.

DirtyBitMeaning
0b0

Permission Fault is not due to dirty state.

0b1

Permission Fault is due to dirty state.

Otherwise:

Reserved, RES0.

Bits [4:0]:

Reserved, RES0.

MSS2 encoding for Granule Protection Check faults on write to Profiling Buffer

23222120191817161514131211109876543210
RES0

Bits [23:0]:

Reserved, RES0.

MSS2 encoding for Profiling Buffer management event for an IMPLEMENTATION DEFINED reason

23222120191817161514131211109876543210
IMPLEMENTATION DEFINED

IMPLEMENTATION DEFINED, bits [23:0]:

IMPLEMENTATION DEFINED.

EC, bits [31:26]:

Event class. Top-level description of the cause of the Profiling Buffer management event.

ECMeaningMSSMSS2Applies when
0b000000

Other Profiling Buffer management event. All Profiling Buffer management events other than those described by the other defined Event class codes.

MSS encoding for other Profiling Buffer management eventsMSS2 encoding for other Profiling Buffer management events
0b011110

Granule Protection Check fault on write to Profiling Buffer, other than Granule Protection Fault (GPF). That is, any of the following:

  • Granule Protection Table (GPT) address size fault.
  • GPT walk fault.
  • External abort on GPT fetch.

A GPF on translation table walk or update is reported as either a Stage 1 or Stage 2 Data Abort, as appropriate. Other GPFs are reported as a Stage 1 Data Abort.

MSS encoding for Granule Protection Check faults on write to Profiling BufferMSS2 encoding for Granule Protection Check faults on write to Profiling BufferWhen FEAT_RME is implemented
0b011111

Profiling Buffer management event for an IMPLEMENTATION DEFINED reason.

MSS encoding for Profiling Buffer management event for an IMPLEMENTATION DEFINED reasonMSS2 encoding for Profiling Buffer management event for an IMPLEMENTATION DEFINED reason
0b100100

Stage 1 Data Abort on write to Profiling Buffer.

MSS encoding for stage 1 or stage 2 Data Aborts on write to Profiling BufferMSS2 encoding for stage 1 or stage 2 Data Aborts on write to Profiling Buffer
0b100101

Stage 2 Data Abort on write to Profiling Buffer.

MSS encoding for stage 1 or stage 2 Data Aborts on write to Profiling BufferMSS2 encoding for stage 1 or stage 2 Data Aborts on write to Profiling Buffer

All other values are reserved.

The reset behavior of this field is:

Bits [25:20]:

Reserved, RES0.

DL, bit [19]:

Partial record lost. Following a buffer management event, indicates whether the last record written to the Profiling Buffer is complete. PMBSR_EL1.DL is also set to 1 when an asynchronous External abort is reported to the SPU.

DLMeaning
0b0

PMBPTR_EL1 points to the first byte after the last complete record written to the Profiling Buffer by the SPU, and no asynchronous External abort has been reported to the SPU.

0b1

Part of a record was lost because of a Profiling Buffer management event, or an asynchronous External abort has been reported to the SPU. PMBPTR_EL1 might not be the address of the first byte after the last complete sample record written to the Profiling Buffer by the SPU.

When the SPU sets this bit to 1, software must not assume that there is any valid data between the end of the last complete record and PMBPTR_EL1. If software restarts profiling from the saved PMBPTR_EL1 value, then this might result in buffer contents that software cannot parse. If PMBSR_EL1.EA is also set to 1 by the SPU, then software must not assume that any valid data has been written to the Profiling Buffer.

This bit is RES0 if there are no circumstances when the PE would ever set this bit to 1 as a result of a Profiling Buffer management event.

The reset behavior of this field is:

EA, bit [18] when the PE sets this bit as the result of an External abort:

External abort.

EAMeaning
0b0

An External abort has not been asserted.

0b1

An External abort has been asserted and detected by the Statistical Profiling Unit.

It is IMPLEMENTATION DEFINED whether this field is set to 1 or is unchanged by the PE when a write by the Statistical Profiling Unit generates an External abort on a translation table walk, translation table update, or GPT walk that is reported as an MMU fault. When FEAT_SPEv1p3 is implemented, this field is not set to 1 by the PE for any other Profiling Buffer management event.

The reset behavior of this field is:

Otherwise:

Reserved, RES0.

S, bit [17]:

Service. Indicates that a Profiling Buffer management event has been recorded.

SMeaning
0b0

No Profiling Buffer management event for EL1 has been recorded.

0b1

A Profiling Buffer management event for EL1 has been recorded.

When FEAT_SPE_EXC is implemented, this field indicates a management event for EL1.

If FEAT_SPE_EXC is implemented and the SPE Profiling exception for EL1 is enabled, then when this field is 1, an SPE Profiling exception for EL1 is pending

If FEAT_SPE_EXC is not implemented or the SPE Profiling exception for EL1 is disabled, then this field drives the PMBIRQ Profiling Buffer interrupt request signal.

The reset behavior of this field is:

COLL, bit [16]:

Collision detected.

COLLMeaning
0b0

No collision events detected.

0b1

At least one collision event was recorded.

The reset behavior of this field is:

MSS, bits [15:0]:

Management Event Specific Syndrome. Contains syndrome specific to the Profiling Buffer management event.

The syndrome contents for each Profiling Buffer management event are described in the following sections.

MSS encoding for other Profiling Buffer management events

1514131211109876543210
RES0BSC

Bits [15:6]:

Reserved, RES0.

BSC, bits [5:0]:

Profiling Buffer status code

BSCMeaning
0b000000

Collection not stopped, or access not allowed.

0b000001

Profiling Buffer filled.

0b000100

Buffer size. The requested Profiling Buffer size was too large.

All other values are reserved.

MSS encoding for stage 1 or stage 2 Data Aborts on write to Profiling Buffer

1514131211109876543210
RES0S1PTWRES0FSC

Bits [15:8]:

Reserved, RES0.

S1PTW, bit [7] when FEAT_SPE_EXC is implemented:

For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 translation table walk.

S1PTWMeaning
0b0

Fault not on a stage 2 translation for a stage 1 translation walk.

0b1

Fault on the stage 2 translation of an access for a stage 1 translation walk.

For any abort other than a stage 2 fault this bit is RES0.

Otherwise:

Reserved, RES0.

Bit [6]:

Reserved, RES0.

FSC, bits [5:0]:

Fault status code

FSCMeaningApplies when
0b000000

Address size fault, level 0 of translation or translation table base register.

0b000001

Address size fault, level 1.

0b000010

Address size fault, level 2.

0b000011

Address size fault, level 3.

0b000100

Translation fault, level 0.

0b000101

Translation fault, level 1.

0b000110

Translation fault, level 2.

0b000111

Translation fault, level 3.

0b001001

Access flag fault, level 1.

0b001010

Access flag fault, level 2.

0b001011

Access flag fault, level 3.

0b001000

Access flag fault, level 0.

When FEAT_LPA2 is implemented
0b001100

Permission fault, level 0.

When FEAT_LPA2 is implemented
0b001101

Permission fault, level 1.

0b001110

Permission fault, level 2.

0b001111

Permission fault, level 3.

0b010000

Synchronous External abort, not on translation table walk or hardware update of translation table.

0b010001

Asynchronous External abort.

0b010010

Synchronous External abort on translation table walk or hardware update of translation table, level -2.

When FEAT_D128 is implemented
0b010011

Synchronous External abort on translation table walk or hardware update of translation table, level -1.

When FEAT_LPA2 is implemented
0b010100

Synchronous External abort on translation table walk or hardware update of translation table, level 0.

0b010101

Synchronous External abort on translation table walk or hardware update of translation table, level 1.

0b010110

Synchronous External abort on translation table walk or hardware update of translation table, level 2.

0b010111

Synchronous External abort on translation table walk or hardware update of translation table, level 3.

0b011011

Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level -1.

When FEAT_LPA2 is implemented and FEAT_RAS is not implemented
0b100001

Alignment fault.

0b100010

Granule Protection Fault on translation table walk or hardware update of translation table, level -2.

When FEAT_D128 is implemented and FEAT_RME is implemented
0b100011

Granule Protection Fault on translation table walk or hardware update of translation table, level -1.

When FEAT_RME is implemented and FEAT_LPA2 is implemented
0b100100

Granule Protection Fault on translation table walk or hardware update of translation table, level 0.

When FEAT_RME is implemented
0b100101

Granule Protection Fault on translation table walk or hardware update of translation table, level 1.

When FEAT_RME is implemented
0b100110

Granule Protection Fault on translation table walk or hardware update of translation table, level 2.

When FEAT_RME is implemented
0b100111

Granule Protection Fault on translation table walk or hardware update of translation table, level 3.

When FEAT_RME is implemented
0b101000

Granule Protection Fault, not on translation table walk or hardware update of translation table.

When FEAT_RME is implemented
0b101001

Address size fault, level -1.

When FEAT_LPA2 is implemented
0b101010

Translation fault, level -2.

When FEAT_D128 is implemented
0b101011

Translation fault, level -1.

When FEAT_LPA2 is implemented
0b101100

Address Size fault, level -2.

When FEAT_D128 is implemented
0b110000

TLB conflict abort.

0b110001

Unsupported atomic hardware update fault.

When FEAT_HAF is implemented

All other values are reserved.

It is IMPLEMENTATION DEFINED whether each of the Access Flag fault, asynchronous External abort and synchronous External abort, Alignment fault, and TLB Conflict abort values can be generated by the PE. For more information see 'Faults and Watchpoints'.

The reset behavior of this field is:

  • On a Warm reset, this field resets to an architecturally UNKNOWN value.

MSS encoding for Granule Protection Check faults on write to Profiling Buffer

1514131211109876543210
RES0

Bits [15:0]:

Reserved, RES0.

MSS encoding for Profiling Buffer management event for an IMPLEMENTATION DEFINED reason

1514131211109876543210
IMPLEMENTATION DEFINED

IMPLEMENTATION DEFINED, bits [15:0]:

IMPLEMENTATION DEFINED.

Access Instructions

When the Effective value of HCR_EL2.E2H is 1 and FEAT_SPE_EXC is implemented, without explicit synchronization, accesses from EL3 using the accessor name PMBSR_EL1 or PMBSR_EL12 are not guaranteed to be ordered with respect to accesses using the other accessor name.

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, PMBSR_EL1

(op0 = 0b11, op1 = 0b000, CRn = 0b1001, CRm = 0b1010, op2 = 0b011)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && !(EffectivelyAtEL0InHost() || EffectivelyAtEL0NotInHost() || PSTATE.EL == EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGRTR_EL2().PMBSR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().E2PB IN {'x0'} then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'1x1'} && (EffectivePMSCR_EL2_EE() == '00' || PMSCR_EL1().EE == '00' || EffectiveHCR_EL2_NVx() == '111') then X{64}(t) = NVMem(0x820); else X{64}(t) = PMBSR_EL1(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectivePMSCR_EL2_EE() != '00' && ELIsInHost(EL2) then X{64}(t) = PMBSR_EL2(); else X{64}(t) = PMBSR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = PMBSR_EL1(); end;

MSR PMBSR_EL1, <Xt>

(op0 = 0b11, op1 = 0b000, CRn = 0b1001, CRm = 0b1010, op2 = 0b011)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && !(EffectivelyAtEL0InHost() || EffectivelyAtEL0NotInHost() || PSTATE.EL == EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGWTR_EL2().PMBSR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().E2PB IN {'x0'} then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'1x1'} && (EffectivePMSCR_EL2_EE() == '00' || PMSCR_EL1().EE == '00' || EffectiveHCR_EL2_NVx() == '111') then NVMem(0x820) = X{64}(t); else PMBSR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectivePMSCR_EL2_EE() != '00' && ELIsInHost(EL2) then PMBSR_EL2() = X{64}(t); else PMBSR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then PMBSR_EL1() = X{64}(t); end;

When FEAT_SPE_EXC is implemented and FEAT_VHE is implemented:

MRS <Xt>, PMBSR_EL12

(op0 = 0b11, op1 = 0b101, CRn = 0b1001, CRm = 0b1010, op2 = 0b011)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && PSTATE.EL == EL2 && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then X{64}(t) = NVMem(0x820); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else X{64}(t) = PMBSR_EL1(); end; else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then X{64}(t) = PMBSR_EL1(); else Undefined(); end; end;

When FEAT_SPE_EXC is implemented and FEAT_VHE is implemented:

MSR PMBSR_EL12, <Xt>

(op0 = 0b11, op1 = 0b101, CRn = 0b1001, CRm = 0b1010, op2 = 0b011)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && PSTATE.EL == EL2 && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() == '101' then NVMem(0x820) = X{64}(t); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else PMBSR_EL1() = X{64}(t); end; else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then PMBSR_EL1() = X{64}(t); else Undefined(); end; end;

Version 2026.06 — Copyright © 2010-2026 Arm Limited or its affiliates.

This site is provided as a community resource and is NOT affiliated with nor endorsed by Arm Limited.