PMSCR_EL2 Statistical Profiling Control Register (EL2) when FEAT_SPE is implemented Provides EL2 controls for Statistical Profiling. SPE If EL2 is not implemented, this register is RES0 from EL3. PMSCR_EL2 is a 64-bit register. 63 12 63:12 Reserved, RES0. EnVM 11 11 0 Enable use of physical address Profiling Buffer pointers. If EL2 is disabled in the owning Security state, or the Profiling Buffer owning Exception level is EL2, then the Effective value of this field is 1. 0b0 Use of physical address Profiling Buffer pointers is disabled. The PE behaves as if PMBLIMITR_EL1.nVM is 0. 0b1 Use of physical address Profiling Buffer pointers is permitted. AU When FEAT_SPE_nVM is implemented 11 11 11 Reserved, RES0. Otherwise KE 10 10 0 Kernel exception enable for SPE Profiling exceptions taken to EL2. 0b0 SPE Profiling exceptions taken to EL2 are always masked at EL2. 0b1 Enabled SPE Profiling exceptions taken to EL2 are masked at EL2 when PSTATE.PM is 1 and unmasked when PSTATE.PM is 0. AU When FEAT_SPE_EXC is implemented 10 10 10 Reserved, RES0. Otherwise EE 9 8 1:0 Exception Enable. If the Effective value of MDCR_EL3.PMSEE is 0b00, then the Effective value of PMSCR_EL2.EE is 0b00. Otherwise, if EL2 is not implemented or the Effective value of SCR_EL3.{NS, EEL2} is {0, 0}, then the Effective value of PMSCR_EL2.EE is 0b01. 0b00 Disabled. SPE Profiling exceptions for EL2 and EL1 are disabled. All of the following apply: No Profiling Buffer management events are recorded in PMBSR_EL2. Unless enabled by a higher Exception level, SPE Profiling exceptions are not generated. PMBSR_EL1.S drives the interrupt request signal PMBIRQ. Accesses to PMBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to PMBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H. 0b01 Delegated. SPE Profiling exceptions for EL2 are disabled, but might be enabled for EL1 by PMSCR_EL1.EE. All of the following apply: No Profiling Buffer management events are recorded in PMBSR_EL2. PMBSR_EL2.S is ignored and SPE Profiling exceptions are not taken to EL2, other than for the case when the Effective value of HCR_EL2.TGE is 1. 0b10 Enabled. SPE Profiling exceptions for EL2 are enabled for Profiling Buffer management events targeting EL2, as follows: Profiling Buffer management events due to a fault on a write to the Profiling Buffer that would generate a Data Abort exception taken to EL2 if generated by a store instruction executed at the owning Exception level are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE. If the Profiling Buffer owning Exception level is EL2, then this means any fault on a write to the Profiling Buffer. If the Profiling Buffer owning Exception level is EL1, then this means any of the following faults on a write to the Profiling Buffer: Stage 2 faults. If HCR_EL2.TEA is 1, synchronous External aborts. If HCR_EL2.GPF is 1, Granule Protection Faults (GPFs). Profiling Buffer management events due to Granule Protection Check faults other than GPFs on a write to the Profiling Buffer are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE. SPE Profiling exceptions are generated and taken to EL2 when unmasked and PMBSR_EL2.S is 1. 0b11 Trap all. SPE Profiling exceptions for EL2 are enabled for all Profiling Buffer management events, as follows: All Profiling Buffer management events are recorded in PMBSR_EL2, unless they are configured to be recorded in PMBSR_EL3 by MDCR_EL3.PMSEE. SPE Profiling exceptions are generated and taken to EL2 when unmasked and PMBSR_EL2.S is 1. '00' AU When FEAT_SPE_EXC is implemented 9 8 9:8 Reserved, RES0. Otherwise PCT 7 6 7:6 Physical Timestamp. If timestamp sampling is enabled, determines which counter is collected. The behavior depends on the Profiling Buffer owning Exception level. If FEAT_ECV is implemented, this is a two-bit field as shown. Otherwise, bit[7] is RES0. All other values are reserved. If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b01, other than for a direct read of the register. 0b00 Virtual timestamp. The collected timestamp is the physical counter minus a virtual offset. If the Profiling Buffer owning Exception level is EL2 and any of the following are true, then the virtual offset is zero: The sampled operation executed at EL2 and the Effective value of HCR_EL2.E2H is 1. The sampled operation executed at EL0 and the Effective value of HCR_EL2.{E2H, TGE} is {1, 1}. Otherwise, the virtual offset is the value of CNTVOFF_EL2. 0b01 If the Profiling Buffer owning Exception level is EL1, then the timestamp value is selected by PMSCR_EL1.PCT. Otherwise, physical timestamp. The collected timestamp is the physical counter. 0b11 If the Profiling Buffer owning Exception level is EL1 and PMSCR_EL1.PCT is 0b00, then guest virtual timestamp. The collected timestamp is the physical counter minus the value of CNTVOFF_EL2. Otherwise, guest physical timestamp. The collected timestamp is the physical counter minus a physical offset. If any of the following are true, then the physical offset is zero, otherwise the physical offset is the value of CNTPOFF_EL2: SCR_EL3.ECVEn is 0. CNTHCTL_EL2.ECV is 0. FEAT_ECV_POFF is not implemented. When FEAT_ECV is implemented AU TS 5 5 5 Timestamp sample enable. Enables recording of a Timestamp packet when the owning Exception level is EL2. If the Profiling Buffer owning Exception level is EL1, then this field is ignored by the PE. For more information, see 'Controlling the data that is collected'. 0b0 Timestamp packet recording disabled. 0b1 Timestamp packet recording enabled. AU PA 4 4 4 Physical Address Sample Enable. If the Profiling Buffer owning Exception level is EL2, then this field determines whether physical addresses are collected. If the Profiling Buffer owning Exception level is EL1, and EL2 is enabled in the owning Security state, then this field is combined with PMSCR_EL1.PA to determine whether physical addresses are collected. If EL2 is not implemented or EL2 is disabled in the owning Security state, then the Effective value of this field is 1. For more information, see 'Controlling the data that is collected'. 0b0 Physical addresses are not collected. 0b1 Physical addresses are collected. AU CX 3 3 3 CONTEXTIDR_EL2 sample enable. Enables recording of a Context packet containing the value of CONTEXTIDR_EL2. The PE ignores the value of this field and CONTEXTIDR_EL2 is not recorded when EL2 is not implemented or EL2 is disabled in the current Security state. For more information, see 'Controlling the data that is collected'. 0b0 CONTEXTIDR_EL2 recording disabled. 0b1 CONTEXTIDR_EL2 recording enabled. AU 2 2 2 Reserved, RES0. E2SPE 1 1 1 EL2 Statistical Profiling Enable. 0b0 Sampling disabled at EL2. 0b1 Sampling enabled at EL2. AU When MDCR_EL2.E2PB != '00' RES0 RW E0HSPE 0 0 0 EL0 Statistical Profiling Enable. If the Effective value of HCR_EL2.TGE is 0, then this field is ignored by the PE. 0b0 Sampling disabled at EL0. 0b1 Sampling enabled at EL0. AU When MDCR_EL2.E2PB != '00' RES0 RW MRS <Xt>, PMSCR_EL2 if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else X{64}(t) = PMSCR_EL2(); end; elsif PSTATE.EL == EL3 then X{64}(t) = PMSCR_EL2(); end; MSR PMSCR_EL2, <Xt> if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; else PMSCR_EL2() = X{64}(t); end; elsif PSTATE.EL == EL3 then PMSCR_EL2() = X{64}(t); end; MRS <Xt>, PMSCR_EL1 if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGRTR_EL2().PMSCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().TPMS == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'111'} then X{64}(t) = NVMem(0x828); else X{64}(t) = PMSCR_EL1(); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif ELIsInHost(EL2) then X{64}(t) = PMSCR_EL2(); else X{64}(t) = PMSCR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = PMSCR_EL1(); end; MSR PMSCR_EL1, <Xt> if !IsFeatureImplemented(FEAT_SPE) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HDFGWTR_EL2().PMSCR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && MDCR_EL2().TPMS == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem(0x828) = X{64}(t); else PMSCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && CheckMDCR_EL3_NSPBTrap() then Undefined(); elsif HaveEL(EL3) && CheckMDCR_EL3_NSPBTrap() then if EL3SDDUndef() then Undefined(); else AArch64_SystemAccessTrap(EL3, 0x18); end; elsif ELIsInHost(EL2) then PMSCR_EL2() = X{64}(t); else PMSCR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then PMSCR_EL1() = X{64}(t); end; 2026-03-26 20:27:25 2026-03_rel