CNTKCTL_EL1 Counter-timer Kernel Control Register when FEAT_AA64 is implemented CNTKCTL Architectural AArch32 31 0 31 0 31 0 31 0 When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this register does not cause any event stream from the virtual counter to be generated, and does not control access to the counters and timers. The access to counters and timers at EL0 is controlled by CNTHCTL_EL2. When FEAT_VHE is not implemented, or when the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, this register controls the generation of an event stream from the virtual counter, and access from EL0 to the physical counter, virtual counter, EL1 physical timers, and the virtual timer. Timer CNTKCTL_EL1 is a 64-bit register. 63 20 63:20 Reserved, RES0. CNTPMASK 19 19 0 Reserved for software use in nested virtualization. AU When FEAT_RME is implemented and FEAT_NV2p1 is implemented 19 19 19 Reserved, RES0. Otherwise CNTVMASK 18 18 0 Reserved for software use in nested virtualization. AU When FEAT_RME is implemented and FEAT_NV2p1 is implemented 18 18 18 Reserved, RES0. Otherwise EVNTIS 17 17 0 Controls the scale of the generation of the event stream. This control applies regardless of the value of the CNTHCTL_EL2.ECV bit. 0b0 The CNTKCTL_EL1.EVNTI field applies to CNTVCT_EL0[15:0]. 0b1 The CNTKCTL_EL1.EVNTI field applies to CNTVCT_EL0[23:8]. AU When FEAT_ECV is implemented 17 17 17 Reserved, RES0. Otherwise EL1NVVCT 16 16 0 Reserved for software use in nested virtualization. AU When FEAT_ECV is implemented and FEAT_NV2p1 is implemented 16 16 16 Reserved, RES0. Otherwise EL1NVPCT 15 15 0 Reserved for software use in nested virtualization. AU When FEAT_ECV is implemented and FEAT_NV2p1 is implemented 15 15 15 Reserved, RES0. Otherwise EL1TVCT 14 14 0 Reserved for software use in nested virtualization. AU When FEAT_ECV is implemented and FEAT_NV2p1 is implemented 14 14 14 Reserved, RES0. Otherwise EL1TVT 13 13 0 Reserved for software use in nested virtualization. AU When FEAT_ECV is implemented and FEAT_NV2p1 is implemented 13 13 13 Reserved, RES0. Otherwise ECV 12 12 0 Reserved for software use in nested virtualization. AU When FEAT_ECV is implemented and FEAT_NV2p1 is implemented 12 12 12 Reserved, RES0. Otherwise EL1PTEN 11 11 0 Reserved for software use in nested virtualization. AU When FEAT_NV2p1 is implemented 11 11 11 Reserved, RES0. Otherwise EL1PCTEN 10 10 0 Reserved for software use in nested virtualization. AU When FEAT_NV2p1 is implemented 10 10 10 Reserved, RES0. Otherwise EL0PTEN 9 9 9 Traps EL0 accesses to the physical timer registers to EL1, or to EL2 when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: In AArch64 state, the following registers are trapped and reported using EC syndrome value 0x18: CNTP_CTL_EL0, CNTP_CVAL_EL0, and CNTP_TVAL_EL0. In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04: CNTP_CTL, CNTP_CVAL, CNTP_TVAL. When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this control does not cause any instructions to be trapped. 0b0 EL0 accesses to the physical timer registers are trapped to EL1. 0b1 This control does not cause any instructions to be trapped. AU EL0VTEN 8 8 8 Traps EL0 accesses to the virtual timer registers to EL1, or to EL2 when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: In AArch64 state, accesses to the following registers are trapped and reported using EC syndrome value 0x18: CNTV_CTL_EL0, CNTV_CVAL_EL0, and CNTV_TVAL_EL0. In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped using EC syndrome value 0x04: CNTV_CTL, CNTV_CVAL, and CNTV_TVAL. When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this control does not cause any instructions to be trapped. 0b0 EL0 accesses to the virtual timer registers are trapped. 0b1 This control does not cause any instructions to be trapped. AU EVNTI 7 4 7:4 Selects which bit of CNTVCT_EL0, as seen from EL1, is the trigger for the event stream generated from that counter when that stream is enabled. If FEAT_ECV is implemented, and CNTKCTL_EL1.EVNTIS is 1, this field selects a trigger bit in the range 8 to 23 of CNTVCT_EL0. Otherwise, this field selects a trigger bit in the range 0 to 15 of CNTVCT_EL0. AU EVNTDIR 3 3 3 Controls which transition of the CNTVCT_EL0 trigger bit, as seen from EL1 and defined by EVNTI, generates an event when the event stream is enabled. 0b0 A 0 to 1 transition of the trigger bit triggers an event. 0b1 A 1 to 0 transition of the trigger bit triggers an event. AU EVNTEN 2 2 2 When FEAT_VHE is not implemented, or the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, enables the generation of an event stream from CNTVCT_EL0 as seen from EL1. When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this control does not enable the event stream. 0b0 Disables the event stream. 0b1 Enables the event stream. AU EL0VCTEN 1 1 1 Traps EL0 accesses to the frequency register and virtual counter registers to EL1, or to EL2 when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: In AArch64 state, accesses to the following registers are trapped and reported using EC syndrome value 0x18: CNTVCT_EL0. CNTVCTSS_EL0. If CNTKCTL_EL1.EL0PCTEN is 0, CNTFRQ_EL0. In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03, MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04: CNTVCT and if CNTKCTL_EL1.EL0PCTEN is 0, CNTFRQ. When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this control does not cause any instructions to be trapped. 0b0 EL0 accesses to the frequency register and virtual counter registers are trapped. 0b1 This control does not cause any instructions to be trapped. AU EL0PCTEN 0 0 0 Traps EL0 accesses to the frequency register and physical counter register to EL1, or to EL2 when it is implemented and enabled for the current Security state and HCR_EL2.TGE is 1, as follows: In AArch64 state, the following registers are trapped and reported using EC syndrome value 0x18: CNTPCT_EL0 CNTPCTSS_EL0 If CNTKCTL_EL1.EL0VCTEN is 0, CNTFRQ_EL0. In AArch32 state, MCR or MRC accesses the following registers are trapped and reported using EC syndrome value 0x03, MCRR or MRRC accesses are trapped and reported using EC syndrome value 0x04: CNTPCT and if CNTKCTL_EL1.EL0VCTEN is 0, CNTFRQ. When the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}, this control does not cause any instructions to be trapped. 0b0 EL0 accesses to the frequency register and physical counter register are trapped. 0b1 This control does not cause any instructions to be trapped. AU When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL3 using the accessor name CNTKCTL_EL1 or CNTKCTL_EL12 are not guaranteed to be ordered with respect to accesses using the other accessor name. MRS <Xt>, CNTKCTL_EL1 if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then X{64}(t) = CNTKCTL_EL1(); elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = CNTHCTL_EL2_VHE(CNTHCTL_EL2()); else X{64}(t) = CNTKCTL_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = CNTKCTL_EL1(); end; MSR CNTKCTL_EL1, <Xt> if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then CNTKCTL_EL1() = X{64}(t); elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then CNTHCTL_EL2() = CNTHCTL_EL2_VHE(X{64}(t)); else CNTKCTL_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then CNTKCTL_EL1() = X{64}(t); end; MRS <Xt>, CNTKCTL_EL12 When FEAT_VHE is implemented if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = CNTKCTL_EL1(); else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then X{64}(t) = CNTKCTL_EL1(); else Undefined(); end; end; MSR CNTKCTL_EL12, <Xt> When FEAT_VHE is implemented if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then CNTKCTL_EL1() = X{64}(t); else Undefined(); end; elsif PSTATE.EL == EL3 then if ELIsInHost(EL2) then CNTKCTL_EL1() = X{64}(t); else Undefined(); end; end; 2026-03-26 20:27:25 2026-03_rel