AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# CNTHCTL_EL2, Counter-timer Hypervisor Control register

The CNTHCTL_EL2 characteristics are:

## Purpose

Controls the generation of an event stream from the physical counter, and access from EL1 to the physical counter and the EL1 physical timer.

## Configuration

AArch64 System register CNTHCTL_EL2 bits [31:0] are architecturally mapped to AArch32 System register CNTHCTL[31:0] .

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

Some or all RW fields of this register have defined reset values. These apply only if the PE resets into an Exception level that is using AArch64. Otherwise, RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

CNTHCTL_EL2 is a 64-bit register.

## Field descriptions

The CNTHCTL_EL2 bit assignments are:

### When HCR_EL2.E2H == 0:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES0 | EVNTI | EVNTDIR | EVNTEN | EL1PCEN | EL1PCTEN
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

This format applies in all Armv8.0 implementations, and it also contains a description of the behavior when EL3 is implemented and EL2 is not implemented.

#### Bits [63:8]

Reserved, RES0.

#### EVNTI, bits [7:4]

Selects which bit (0 to 15) of the counter register CNTPCT_EL0 is the trigger for the event stream generated from that counter, when that stream is enabled.

This field resets to an architecturally UNKNOWN value.

#### EVNTDIR, bit [3]

Controls which transition of the counter register CNTPCT_EL0 trigger bit, defined by EVNTI, generates an event when the event stream is enabled:

EVNTDIR | Meaning
--- | ---
0b0 | A 0 to 1 transition of the trigger bit triggers an event.
0b1 | A 1 to 0 transition of the trigger bit triggers an event.

This field resets to an architecturally UNKNOWN value.

#### EVNTEN, bit [2]

Enables the generation of an event stream from the counter register CNTPCT_EL0:

EVNTEN | Meaning
--- | ---
0b0 | Disables the event stream.
0b1 | Enables the event stream.

This field resets to 0.

#### EL1PCEN, bit [1]

Traps EL0 and EL1 accesses to the EL1 physical timer registers to EL2 when EL2 is enabled in the current Security state.

EL1PCEN | Meaning
--- | ---
0b0 | From AArch64 state: EL0 and EL1 accesses to the CNTP_CTL_EL0, CNTP_CVAL_EL0, and CNTP_TVAL_EL0 are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PTEN. From AArch32 state: EL0 and EL1 accesses to the CNTP_CTL, CNTP_CVAL, and CNTP_TVAL are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PTEN or CNTKCTL.PL0PTEN.
0b1 | This control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the purpose of a direct read.

This field resets to an architecturally UNKNOWN value.

#### EL1PCTEN, bit [0]

Traps EL0 and EL1 accesses to the EL1 physical counter register to EL2 when EL2 is enabled in the current Security state.

EL1PCTEN | Meaning
--- | ---
0b0 | From AArch64 state: EL0 and EL1 accesses to the CNTPCT_EL0 are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PCTEN. From AArch32 state: EL0 and EL1 accesses to the CNTPCT are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PCTEN or CNTKCTL.PL0PCTEN.
0b1 | This control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the purpose of a direct read.

This field resets to an architecturally UNKNOWN value.

### When HCR_EL2.E2H == 1:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES0 | EL1PTEN | EL1PCTEN | EL0PTEN | EL0VTEN | EVNTI | EVNTDIR | EVNTEN | EL0VCTEN | EL0PCTEN
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

#### Bits [63:12]

Reserved, RES0.

#### EL1PTEN, bit [11]
From Armv8.1:

When HCR_EL2.TGE is 0, traps EL0 and EL1 accesses to the E1 physical timer registers to EL2 when EL2 is enabled in the current Security state.

EL1PTEN | Meaning
--- | ---
0b0 | From AArch64 state: EL0 and EL1 accesses to the CNTP_CTL_EL0, CNTP_CVAL_EL0, and CNTP_TVAL_EL0 are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PTEN. From AArch32 state: EL0 and EL1 accesses to the CNTP_CTL, CNTP_CVAL, and CNTP_TVAL are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PTEN or CNTKCTL.PL0PTEN.
0b1 | This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EL1PCTEN, bit [10]
From Armv8.1:

When HCR_EL2.TGE is 0, traps EL0 and EL1 accesses to the EL1 physical counter register to EL2 when EL2 is enabled in the current Security state.

EL1PCTEN | Meaning
--- | ---
0b0 | From AArch64 state: EL0 and EL1 accesses to the CNTPCT_EL0 are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PCTEN. From AArch32 state: EL0 and EL1 accesses to the CNTPCT are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by CNTKCTL_EL1.EL0PCTEN or CNTKCTL.PL0PCTEN.
0b1 | This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EL0PTEN, bit [9]
From Armv8.1:

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, traps EL0 accesses to the physical timer registers to EL2.

EL0PTEN | Meaning
--- | ---
0b0 | EL0 using AArch64: EL0 accesses to the CNTP_CTL_EL0, CNTP_CVAL_EL0, and CNTP_TVAL_EL0 registers are trapped to EL2. EL0 using AArch32: EL0 accesses to the CNTP_CTL, CNTP_CVAL and CNTP_TVAL registers are trapped to EL2.
0b1 | This control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EL0VTEN, bit [8]
From Armv8.1:

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, traps EL0 accesses to the virtual timer registers to EL2.

EL0VTEN | Meaning
--- | ---
0b0 | EL0 using AArch64: EL0 accesses to the CNTV_CTL_EL0, CNTV_CVAL_EL0, and CNTV_TVAL_EL0 registers are trapped to EL2. EL0 using AArch32: EL0 accesses to the CNTV_CTL, CNTV_CVAL, and CNTV_TVAL registers are trapped to EL2.
0b1 | This control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EVNTI, bits [7:4]
From Armv8.1:

Selects which bit (0 to 15) of the counter register CNTPCT_EL0 is the trigger for the event stream generated from that counter, when that stream is enabled.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EVNTDIR, bit [3]
From Armv8.1:

Controls which transition of the counter register CNTPCT_EL0 trigger bit, defined by EVNTI, generates an event when the event stream is enabled:

EVNTDIR | Meaning
--- | ---
0b0 | A 0 to 1 transition of the trigger bit triggers an event.
0b1 | A 1 to 0 transition of the trigger bit triggers an event.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EVNTEN, bit [2]
From Armv8.1:

Enables the generation of an event stream from the counter register CNTPCT_EL0:

EVNTEN | Meaning
--- | ---
0b0 | Disables the event stream.
0b1 | Enables the event stream.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EL0VCTEN, bit [1]
From Armv8.1:

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, traps EL0 accesses to the frequency register and virtual counter register to EL2.

EL0VCTEN | Meaning
--- | ---
0b0 | EL0 using AArch64: EL0 accesses to the CNTVCT_EL0 are trapped to EL2. EL0 using AArch64: EL0 accesses to the CNTFRQ_EL0 register are trapped to EL2, if CNTHCTL_EL2.EL0PCTEN is also 0. EL0 using AArch32: EL0 accesses to the CNTVCT are trapped to EL2. EL0 using AArch32: EL0 accesses to the CNTFRQ register are trapped to EL2, if CNTHCTL.EL0PCTEN is also 0.
0b1 | This control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### EL0PCTEN, bit [0]
From Armv8.1:

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, traps EL0 accesses to the frequency register and physical counter register to EL2.

EL0PCTEN | Meaning
--- | ---
0b0 | EL0 using AArch64: EL0 accesses to the CNTPCT_EL0 are trapped to EL2. EL0 using AArch64: EL0 accesses to the CNTFRQ_EL0 register are trapped to EL2, if CNTHCTL_EL2.EL0VCTEN is also 0. EL0 using AArch32: EL0 accesses to the CNTPCT are trapped to EL2. EL0 using AArch32: EL0 accesses to the CNTFRQ and register are trapped to EL2, if CNTHCTL_EL2.EL0VCTEN is also 0.
0b1 | This control does not cause any instructions to be trapped.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

## Accessing the CNTHCTL_EL2

When HCR_EL2.E2H is 1, without explicit synchronization, access from EL2 using the mnemonic CNTHCTL_EL2 or CNTKCTL_EL1 are not guaranteed to be ordered with respect to accesses using the other mnemonic.

Accesses to this register use the following encodings:

#### MRS <Xt>, CNTHCTL_EL2

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b1110 | 0b0001 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then return CNTHCTL_EL2; elsif PSTATE.EL == EL3 then return CNTHCTL_EL2;

#### MSR CNTHCTL_EL2, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b1110 | 0b0001 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then CNTHCTL_EL2 = X[t]; elsif PSTATE.EL == EL3 then CNTHCTL_EL2 = X[t];

#### MRS <Xt>, CNTKCTL_EL1

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b1110 | 0b0001 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then return CNTKCTL_EL1; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then return CNTHCTL_EL2; else return CNTKCTL_EL1; elsif PSTATE.EL == EL3 then return CNTKCTL_EL1;

#### MSR CNTKCTL_EL1, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b1110 | 0b0001 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then CNTKCTL_EL1 = X[t]; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then CNTHCTL_EL2 = X[t]; else CNTKCTL_EL1 = X[t]; elsif PSTATE.EL == EL3 then CNTKCTL_EL1 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

15/04/2019 16:47; 8c23526ba8a13a72aada4137daf3e3977b49036e

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.