← Home

PMSCR_EL2

Statistical Profiling Control Register (EL2)

Provides EL2 controls for Statistical Profiling.

Configuration

This register is present only when FEAT_SPE is implemented. Otherwise, direct accesses to PMSCR_EL2 are UNDEFINED.

If EL2 is not implemented, this register is RES0 from EL3.

Attributes

PMSCR_EL2 is a 64-bit register.

Field descriptions

6362616059585756555453525150494847464544434241403938373635343332
313029282726252423222120191817161514131211109876543210
RES0
RES0EnVMKEEEPCTTSPACXRES0E2SPEE0HSPE

Bits [63:12]:

Reserved, RES0.

EnVM, bit [11] when FEAT_SPE_nVM is implemented:

Enable use of physical address Profiling Buffer pointers.

EnVMMeaning
0b0

Use of physical address Profiling Buffer pointers is disabled. The PE behaves as if PMBLIMITR_EL1.nVM is 0.

0b1

Use of physical address Profiling Buffer pointers is permitted.

If EL2 is disabled in the owning Security state, or the Profiling Buffer owning Exception level is EL2, then the Effective value of this field is 1.

The reset behavior of this field is:

Otherwise:

Reserved, RES0.

KE, bit [10] when FEAT_SPE_EXC is implemented:

Kernel exception enable for SPE Profiling exceptions taken to EL2.

KEMeaning
0b0

SPE Profiling exceptions taken to EL2 are always masked at EL2.

0b1

Enabled SPE Profiling exceptions taken to EL2 are masked at EL2 when PSTATE.PM is 1 and unmasked when PSTATE.PM is 0.

The reset behavior of this field is:

Otherwise:

Reserved, RES0.

EE, bits [9:8] when FEAT_SPE_EXC is implemented:

Exception Enable.

EEMeaning
0b00

Disabled. SPE Profiling exceptions for EL2 and EL1 are disabled. All of the following apply:

  • No Profiling Buffer management events are recorded in PMBSR_EL2.
  • Unless enabled by a higher Exception level, SPE Profiling exceptions are not generated.
  • PMBSR_EL1.S drives the interrupt request signal PMBIRQ.
  • Accesses to PMBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to PMBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H.
0b01

Delegated. SPE Profiling exceptions for EL2 are disabled, but might be enabled for EL1 by PMSCR_EL1.EE. All of the following apply:

  • No Profiling Buffer management events are recorded in PMBSR_EL2.
  • PMBSR_EL2.S is ignored and SPE Profiling exceptions are not taken to EL2, other than for the case when the Effective value of HCR_EL2.TGE is 1.
0b10

Enabled. SPE Profiling exceptions for EL2 are enabled for Profiling Buffer management events targeting EL2, as follows:

  • Profiling Buffer management events due to a fault on a write to the Profiling Buffer that would generate a Data Abort exception taken to EL2 if generated by a store instruction executed at the owning Exception level are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE. If the Profiling Buffer owning Exception level is EL2, then this means any fault on a write to the Profiling Buffer. If the Profiling Buffer owning Exception level is EL1, then this means any of the following faults on a write to the Profiling Buffer:
    • Stage 2 faults.
    • If HCR_EL2.TEA is 1, synchronous External aborts.
    • If HCR_EL2.GPF is 1, Granule Protection Faults (GPFs).
  • Profiling Buffer management events due to Granule Protection Check faults other than GPFs on a write to the Profiling Buffer are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE.
  • SPE Profiling exceptions are generated and taken to EL2 when unmasked and PMBSR_EL2.S is 1.
0b11

Trap all. SPE Profiling exceptions for EL2 are enabled for all Profiling Buffer management events, as follows:

  • All Profiling Buffer management events are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE.
  • SPE Profiling exceptions are generated and taken to EL2 when unmasked and PMBSR_EL2.S is 1.

If the Effective value of MDCR_EL3.PMSEE is 0b00, then the Effective value of PMSCR_EL2.EE is 0b00. Otherwise, if EL2 is not implemented or the Effective value of SCR_EL3.{NS, EEL2} is {0, 0}, then the Effective value of PMSCR_EL2.EE is 0b01.

The reset behavior of this field is:

Otherwise:

Reserved, RES0.

PCT, bits [7:6]:

Physical Timestamp. If timestamp sampling is enabled, determines which counter is collected. The behavior depends on the Profiling Buffer owning Exception level.

If FEAT_ECV is implemented, this is a two-bit field as shown. Otherwise, bit[7] is RES0.

PCTMeaningApplies when
0b00

Virtual timestamp. The collected timestamp is the physical counter minus a virtual offset.

If the Profiling Buffer owning Exception level is EL2 and any of the following are true, then the virtual offset is zero:

  • The sampled operation executed at EL2 and the Effective value of HCR_EL2.E2H is 1.
  • The sampled operation executed at EL0 and the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}.

Otherwise, the virtual offset is the value of CNTVOFF_EL2.

0b01

If the Profiling Buffer owning Exception level is EL1, then the timestamp value is selected by PMSCR_EL1.PCT.

Otherwise, physical timestamp. The collected timestamp is the physical counter.

0b11

If the Profiling Buffer owning Exception level is EL1 and PMSCR_EL1.PCT is 0b00, then guest virtual timestamp. The collected timestamp is the physical counter minus the value of CNTVOFF_EL2.

Otherwise, guest physical timestamp. The collected timestamp is the physical counter minus a physical offset. If any of the following are true, then the physical offset is zero, otherwise the physical offset is the value of CNTPOFF_EL2:

When FEAT_ECV is implemented

All other values are reserved.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b01, other than for a direct read of the register.

The reset behavior of this field is:

TS, bit [5]:

Timestamp packet sample enable. Enables recording of Timestamp packets when the Profiling Buffer owning Exception level is EL2.

TSMeaning
0b0

Timestamp packet recording disabled.

0b1

Timestamp packet recording enabled.

If the Profiling Buffer owning Exception level is EL1, then this field is ignored by the PE. For more information, see Controlling the data that is collected.

When Timestamp packet recording is enabled, recording of End packets is disabled.

The reset behavior of this field is:

PA, bit [4]:

Physical Address packet sample enable. Enables recording of Physical Address packets when the Profiling Buffer owning Exception level is EL2.

PAMeaning
0b0

Physical Address packet recording disabled.

0b1

Physical Address packet recording is not disabled by this control.

If the Profiling Buffer owning Exception level is EL2, then this field determines whether Physical Address packets are recorded.

If the Profiling Buffer owning Exception level is EL1, and EL2 is enabled in the owning Security state, then this field is combined with PMSCR_EL1.PA to determine whether Physical Address packets are recorded.

If EL2 is not implemented or EL2 is disabled in the owning Security state, then the Effective value of this field is 1.

For more information, see Controlling the data that is collected.

The reset behavior of this field is:

CX, bit [3]:

CONTEXTIDR_EL2 Context packet sample enable. Enables recording of Context packets containing the value of CONTEXTIDR_EL2.

CXMeaning
0b0

CONTEXTIDR_EL2 Context packet recording disabled.

0b1

CONTEXTIDR_EL2 Context packet recording enabled.

The PE ignores the value of this field and CONTEXTIDR_EL2 Context packets are not recorded when EL2 is not implemented or EL2 is disabled in the current Security state.

For more information, see Controlling the data that is collected.

The reset behavior of this field is:

Bit [2]:

Reserved, RES0.

E2SPE, bit [1]:

EL2 Statistical Profiling Enable.

E2SPEMeaning
0b0

Sampling disabled at EL2.

0b1

Sampling enabled at EL2.

The reset behavior of this field is:

Accessing this field has the following behavior:

E0HSPE, bit [0]:

EL0 Statistical Profiling Enable.

E0HSPEMeaning
0b0

Sampling disabled at EL0.

0b1

Sampling enabled at EL0.

If the Effective value of HCR_EL2.TGE is 0, then this field is ignored by the PE.

The reset behavior of this field is:

Accessing this field has the following behavior:

Access Instructions

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, PMSCR_EL2

(op0 = 0b11, op1 = 0b100, CRn = 0b1001, CRm = 0b1001, op2 = 0b000)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && PSTATE.EL == EL2 && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else X{64}(t) = PMSCR_EL2(); end; elsif PSTATE.EL == EL3 then X{64}(t) = PMSCR_EL2(); end;

MSR PMSCR_EL2, <Xt>

(op0 = 0b11, op1 = 0b100, CRn = 0b1001, CRm = 0b1001, op2 = 0b000)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && PSTATE.EL == EL2 && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else PMSCR_EL2() = X{64}(t); end; elsif PSTATE.EL == EL3 then PMSCR_EL2() = X{64}(t); end;

MRS <Xt>, PMSCR_EL1

(op0 = 0b11, op1 = 0b000, CRn = 0b1001, CRm = 0b1001, op2 = 0b000)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && !(EffectivelyAtEL0InHost() || EffectivelyAtEL0NotInHost() || PSTATE.EL == EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGRTR_EL2().PMSCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().TPMS == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'111'} then X{64}(t) = NVMem(0x828); else X{64}(t) = PMSCR_EL1(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif ELIsInHost(EL2) then X{64}(t) = PMSCR_EL2(); else X{64}(t) = PMSCR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = PMSCR_EL1(); end;

MSR PMSCR_EL1, <Xt>

(op0 = 0b11, op1 = 0b000, CRn = 0b1001, CRm = 0b1001, op2 = 0b000)

if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif HaveEL(EL3) && !(EffectivelyAtEL0InHost() || EffectivelyAtEL0NotInHost() || PSTATE.EL == EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGWTR_EL2().PMSCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().TPMS == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem(0x828) = X{64}(t); else PMSCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif ELIsInHost(EL2) then PMSCR_EL2() = X{64}(t); else PMSCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then PMSCR_EL1() = X{64}(t); end;

Version 2026.06 — Copyright © 2010-2026 Arm Limited or its affiliates.

This site is provided as a community resource and is NOT affiliated with nor endorsed by Arm Limited.