CNTHCTL

Controls the generation of an event stream from the physical counter, and access from EL1 to the physical counter and the EL1 physical timer.

Configuration

AArch64 System register CNTHCTL_EL2 bits [31:0] are architecturally mapped to AArch32 System register CNTHCTL[31:0].

This register has no effect if EL2 is not enabled in the current Security state.

Attributes

Field descriptions

When the Effective value of HCR_EL2.E2H is 1:

Bits [63:20]

CNTPMASK, bit [19]
When FEAT_RME is implemented:

CNTPMASK	Meaning
0b0	This control has no effect on CNTP_CTL_EL0.IMASK.
0b1	CNTP_CTL_EL0.IMASK behaves as if set to 1 for all purposes other than a direct read of the field.

This bit is RES0 in Non-secure and Secure state.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

CNTVMASK, bit [18]
When FEAT_RME is implemented:

CNTVMASK	Meaning
0b0	This control has no effect on CNTV_CTL_EL0.IMASK.
0b1	CNTV_CTL_EL0.IMASK behaves as if set to 1 for all purposes other than a direct read of the field.

This bit is RES0 in Non-secure and Secure state.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EVNTIS, bit [17]
When FEAT_ECV is implemented:

Controls the scale of the generation of the event stream.

EVNTIS	Meaning
0b0	The CNTHCTL_EL2.EVNTI field applies to CNTPCT_EL0[15:0].
0b1	The CNTHCTL_EL2.EVNTI field applies to CNTPCT_EL0[23:8].

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1NVVCT, bit [16]
When FEAT_ECV is implemented:

When HCR_EL2.TGE is 0 and the Effective value of HCR_EL2.{NV2, NV1, NV} is {1, 0, 1}, traps EL1 accesses to the specified EL1 virtual timer registers using the EL02 descriptors to EL2 as follows:

Accesses to CNTV_CTL_EL02 and CNTV_CVAL_EL02 are trapped to EL2 and reported with EC syndrome value 0x18.

EL1NVVCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 accesses to the specified registers are trapped to EL2.

If HCR_EL2.TGE is 1 or the Effective value of HCR_EL2.{NV2, NV1, NV} is not {1, 0, 1}, this control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1NVPCT, bit [15]
When FEAT_ECV is implemented:

When HCR_EL2.TGE is 0 and the Effective value of HCR_EL2.{NV2, NV1, NV} is {1, 0, 1}, traps EL1 accesses to the specified EL1 physical timer registers using the EL02 descriptors to EL2 as follows:

Accesses to CNTP_CTL_EL02 and CNTP_CVAL_EL02 are trapped to EL2 and reported with EC syndrome value 0x18.

EL1NVPCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 accesses to the specified registers are trapped to EL2.

If HCR_EL2.TGE is 1 or the Effective value of HCR_EL2.{NV2, NV1, NV} is not {1, 0, 1}, this control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1TVCT, bit [14]
When FEAT_ECV is implemented:

Traps EL0 and EL1 accesses to the EL1 virtual counter registers to EL2 when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to CNTVCT_EL0 and CNTVCTSS_EL0 are trapped to EL2 and reported using EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0VCTEN.
In AArch32 state, accesses to CNTVCT are trapped to EL2 and reported with EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0VCTEN or CNTKCTL.PL0VCTEN.

EL1TVCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

If HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1TVT, bit [13]
When FEAT_ECV is implemented:

When the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, traps EL0 and EL1 accesses to the EL1 virtual timer registers to EL2, when EL2 is enabled for the current Security state, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0VTEN:
In AArch32 state, MRC and MCR accesses to the following registers are trapped to EL2 and reported using EC syndrome value 0x03, and MCRR and MRRC accesses are trapped to EL2 and reported using EC syndrome 0x04, unless they are trapped by CNTKCTL_EL1.EL0VTEN or CNTKCTL.PL0VTEN:
- CNTV_CTL.
- CNTV_CVAL.
- CNTV_TVAL.

EL1TVT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

If HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

ECV, bit [12]
When FEAT_ECV is implemented:

Enables the Enhanced Counter Virtualization functionality registers.

When SCR_EL3.NS or SCR_EL3.EEL2 are 1, and the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, then Enhanced Counter Virtualization functionality is enabled when EL2 is enabled for the current Security state, as follows:

An MRS to CNTPCT_EL0 from either EL0 or EL1 that is not trapped will return the value (PCount<63:0> - CNTPOFF_EL2<63:0>).
The EL1 physical timer interrupt is triggered when ((PCount<63:0> - CNTPOFF_EL2<63:0>) - PCVal<63:0>) is greater than or equal to 0. PCount<63:0> is the physical count returned when CNTPCT_EL0 is read from EL2 or EL3. PCVal<63:0> is the EL1 physical timer compare value for this timer.

ECV	Meaning
0b0	Enhanced Counter Virtualization functionality is disabled.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

When HCR_EL2.TGE is 1 or SCR_EL3.{NS, EEL2} is {0, 0}, then Enhanced Counter Virtualization functionality is disabled.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1PTEN, bit [11]

When HCR_EL2.TGE is 0, traps EL0 and EL1 accesses to the EL1 physical timer registers to EL2 when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0PTEN:
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0PTEN or CNTKCTL.PL0PTEN:
- CNTP_CTL.
- CNTP_CVAL.
- CNTP_TVAL.

EL1PTEN	Meaning
0b0	EL0 and EL1 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL1PCTEN, bit [10]

When HCR_EL2.TGE is 0, traps EL0 and EL1 accesses to the EL1 physical counter registers to EL2 when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to CNTPCT_EL0 and CNTPCTSS_EL0 are trapped to EL2 and reported with EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0PCTEN.
In AArch32 state, MRRC or MCRR accesses to CNTPCT are trapped to EL2 and reported with EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0PCTEN or CNTKCTL.PL0PCTEN.

EL1PCTEN	Meaning
0b0	EL0 and EL1 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 1, this control does not cause any instructions to be trapped.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL0PTEN, bit [9]

When HCR_EL2.TGE is 1, traps EL0 accesses to the physical timer registers to EL2, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18:
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04:
- CNTP_CTL.
- CNTP_CVAL.
- CNTP_TVAL.

EL0PTEN	Meaning
0b0	EL0 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL0VTEN, bit [8]

When HCR_EL2.TGE is 1, traps EL0 accesses to the virtual timer registers to EL2 as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18:
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04:
- CNTV_CTL.
- CNTV_CVAL.
- CNTV_TVAL.

EL0VTEN	Meaning
0b0	EL0 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

When HCR_EL2.TGE is 0, this control does not cause any instructions to be trapped.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EVNTI, bits [7:4]

Selects which bit of CNTPCT_EL0, as seen from EL2, is the trigger for the event stream generated from that counter when that stream is enabled.

If FEAT_ECV is implemented, and CNTHCTL_EL2.EVNTIS is 1, this field selects a trigger bit in the range 8 to 23 of CNTPCT_EL0.

Otherwise, this field selects a trigger bit in the range 0 to 15 of CNTPCT_EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EVNTDIR, bit [3]

Controls which transition of the CNTPCT_EL0 trigger bit, as seen from EL2 and defined by EVNTI, generates an event when the event stream is enabled.

EVNTDIR	Meaning
0b0	A 0 to 1 transition of the trigger bit triggers an event.
0b1	A 1 to 0 transition of the trigger bit triggers an event.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EVNTEN, bit [2]

Enables the generation of an event stream from CNTPCT_EL0 as seen from EL2.

EVNTEN	Meaning
0b0	Disables the event stream.
0b1	Enables the event stream.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL0VCTEN, bit [1]

When HCR_EL2.TGE is 1, traps EL0 accesses to the frequency register and virtual counter registers to EL2, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18:
- CNTVCT_EL0.
- CNTVCTSS_EL0.
- CNTFRQ_EL0 if CNTHCTL_EL2.EL0PCTEN is 0.
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04:
- CNTVCT and if CNTHCTL.EL0PCTEN is 0, CNTFRQ.

EL0VCTEN	Meaning
0b0	EL0 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

If HCR_EL2.TGE is 0, the field is ignored for all purposes other than direct reads and writes of the register.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL0PCTEN, bit [0]

Traps EL0 accesses to the frequency register and physical counter registers to EL2, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18:
- CNTPCT_EL0.
- CNTPCTSS_EL0.
- CNTFRQ_EL0 if CNTHCTL_EL2.EL0VCTEN is 0.
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04:
- CNTPCT and if CNTHCTL_EL2.EL0VCTEN is 0, CNTFRQ.

EL0PCTEN	Meaning
0b0	From AArch64 state: EL0 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

If HCR_EL2.TGE is 0, the control does not cause any instructions to be trapped for all purposes other than direct reads and writes of the register.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [63:20]

CNTPMASK, bit [19]
When FEAT_RME is implemented:

CNTPMASK	Meaning
0b0	This control has no effect on CNTP_CTL_EL0.IMASK.
0b1	CNTP_CTL_EL0.IMASK behaves as if set to 1 for all purposes other than a direct read of the field.

This bit is RES0 in Non-secure and Secure state.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

CNTVMASK, bit [18]
When FEAT_RME is implemented:

CNTVMASK	Meaning
0b0	This control has no effect on CNTV_CTL_EL0.IMASK.
0b1	CNTV_CTL_EL0.IMASK behaves as if set to 1 for all purposes other than a direct read of the field.

This bit is RES0 in Non-secure and Secure state.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EVNTIS, bit [17]
When FEAT_ECV is implemented:

Controls the scale of the generation of the event stream.

EVNTIS	Meaning
0b0	The CNTHCTL_EL2.EVNTI field applies to CNTPCT_EL0[15:0].
0b1	The CNTHCTL_EL2.EVNTI field applies to CNTPCT_EL0[23:8].

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1NVVCT, bit [16]
When FEAT_ECV is implemented:

When the Effective value of HCR_EL2.{NV2, NV1, NV} is {1, 0, 1}, traps EL1 accesses to the specified EL1 virtual timer registers using the EL02 descriptors to EL2 as follows:

Accesses to CNTV_CTL_EL02 and CNTV_CVAL_EL02 are trapped to EL2 and reported with EC syndrome value 0x18.

EL1NVVCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 accesses to the specified registers are trapped to EL2.

If the Effective value of HCR_EL2.{NV2, NV1, NV} is not {1, 0, 1}, this control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1NVPCT, bit [15]
When FEAT_ECV is implemented:

When the Effective value of HCR_EL2.{NV2, NV1, NV} is {1, 0, 1}, traps EL1 accesses to the specified EL1 physical timer registers using the EL02 descriptors to EL2 as follows:

Accesses to CNTP_CTL_EL02 and CNTP_CVAL_EL02 are trapped to EL2 and reported with EC syndrome value 0x18.

EL1NVPCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 accesses to the specified registers are trapped to EL2.

If the Effective value of HCR_EL2.{NV2, NV1, NV} is not {1, 0, 1}, this control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1TVCT, bit [14]
When FEAT_ECV is implemented:

Traps EL0 and EL1 accesses to the EL1 virtual counter registers to EL2, when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to CNTVCT_EL0 and CNTVCTSS_EL0 are trapped to EL2 and reported using EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0VCTEN.
In AArch32 state, accesses to CNTVCT are trapped to EL2 and reported using EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0VCTEN or CNTKCTL.PL0VCTEN.

EL1TVCT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EL1TVT, bit [13]
When FEAT_ECV is implemented:

If the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, then traps EL0 and EL1 accesses to the EL1 virtual timer registers to EL2, when EL2 is enabled for the current Security state, as follows:

In AArch64 state, accesses to the following registers are trapped to EL2 and reported with EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0VTEN:
In AArch32 state, MRC and MCR accesses to the following registers are trapped and reported using EC syndrome value 0x03 and MRRC and MCRR accesses are trapped and reported using EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0VTEN or CNTKCTL.PL0VTEN:
- CNTV_CTL.
- CNTV_CVAL.
- CNTV_TVAL.

EL1TVT	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 0 other than for the purpose of a direct read.

This control applies regardless of the value of the CNTHCTL_EL2.ECV bit.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

ECV, bit [12]
When FEAT_ECV is implemented:

Enables the Enhanced Counter Virtualization functionality registers.

When SCR_EL3.NS or SCR_EL3.EEL2 are 1 and the Effective value of HCR_EL2.{E2H, TGE} is not {1, 1}, then Enhanced Counter Virtualization functionality is enabled when EL2 is enabled for the current Security state, as follows:

An MRS to CNTPCT_EL0 from either EL0 or EL1 that is not trapped will return the value (PCount<63:0> - CNTPOFF_EL2<63:0>).
The EL1 physical timer interrupt is triggered when ((PCount<63:0> - CNTPOFF_EL2<63:0>) - PCVal<63:0>) is greater than or equal to 0. PCount is the physical count returned when CNTPCT_EL0 is read from EL2 or EL3. PCVal<63:0> is the EL1 physical timer compare value for this timer.

ECV	Meaning
0b0	Enhanced Counter Virtualization functionality is disabled.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2.

When SCR_EL3.{NS, EEL2} is {0, 0}, then Enhanced Counter Virtualization functionality is disabled.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [11:8]

EVNTI, bits [7:4]

Selects which bit of CNTPCT_EL0, as seen from EL2,is the trigger for the event stream generated from that counter when that stream is enabled.

If FEAT_ECV is implemented, and CNTHCTL_EL2.EVNTIS is 1, this field selects a trigger bit in the range 8 to 23 of CNTPCT_EL0.

Otherwise, this field selects a trigger bit in the range 0 to 15 of CNTPCT_EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EVNTDIR, bit [3]

Controls which transition of the CNTPCT_EL0 trigger bit, as seen from EL2 and defined by EVNTI, generates an event when the event stream is enabled.

EVNTDIR	Meaning
0b0	A 0 to 1 transition of the trigger bit triggers an event.
0b1	A 1 to 0 transition of the trigger bit triggers an event.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EVNTEN, bit [2]

Enables the generation of an event stream from CNTPCT_EL0 as seen from EL2.

EVNTEN	Meaning
0b0	Disables the event stream.
0b1	Enables the event stream.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL1PCEN, bit [1]

Traps EL0 and EL1 accesses to the EL1 physical timer registers to EL2 when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to CNTP_CTL_EL0, CNTP_CVAL_EL0, CNTP_TVAL_EL0 are trapped to EL2, reported using EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0PTEN.
In AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2 and reported using EC syndrome value 0x03, and MRRC and MCRR accesses are trapped to EL2, reported using EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0PTEN or CNTKCTL.PL0PTEN:
- CNTP_CTL, CNTP_CVAL, CNTP_TVAL.

EL1PCEN	Meaning
0b0	EL0 and EL1 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

EL1PCTEN, bit [0]

Traps EL0 and EL1 accesses to the EL1 physical counter registers to EL2 when EL2 is enabled in the current Security state, as follows:

In AArch64 state, accesses to CNTPCT_EL0 and CNTPCTSS_EL0 are trapped to EL2 and reported using EC syndrome value 0x18, unless they are trapped by CNTKCTL_EL1.EL0PCTEN.
In AArch32 state, MRRC or MCRR accesses to CNTPCT are trapped to EL2 and reported using EC syndrome value 0x04, unless they are trapped by CNTKCTL_EL1.EL0PCTEN or CNTKCTL.PL0PCTEN.

EL1PCTEN	Meaning
0b0	EL0 and EL1 accesses to the specified registers are trapped to EL2.
0b1	This control does not cause any instructions to be trapped.

If EL3 is implemented and EL2 is not implemented, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Accessing CNTHCTL_EL2

When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL2 using the accessor name CNTHCTL_EL2 or CNTKCTL_EL1 are not guaranteed to be ordered with respect to accesses using the other accessor name.

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, CNTHCTL_EL2

op0	op1	CRn	CRm	op2
0b11	0b100	0b1110	0b0001	0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then X[t, 64] = CNTHCTL_EL2; elsif PSTATE.EL == EL3 then X[t, 64] = CNTHCTL_EL2;

MSR CNTHCTL_EL2, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b100	0b1110	0b0001	0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then CNTHCTL_EL2 = X[t, 64]; elsif PSTATE.EL == EL3 then CNTHCTL_EL2 = X[t, 64];

When FEAT_VHE is implemented

MRS <Xt>, CNTKCTL_EL1

op0	op1	CRn	CRm	op2
0b11	0b000	0b1110	0b0001	0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then X[t, 64] = CNTKCTL_EL1; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X[t, 64] = CNTHCTL_EL2; else X[t, 64] = CNTKCTL_EL1; elsif PSTATE.EL == EL3 then X[t, 64] = CNTKCTL_EL1;

When FEAT_VHE is implemented

MSR CNTKCTL_EL1, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b000	0b1110	0b0001	0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then CNTKCTL_EL1 = X[t, 64]; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then CNTHCTL_EL2 = X[t, 64]; else CNTKCTL_EL1 = X[t, 64]; elsif PSTATE.EL == EL3 then CNTKCTL_EL1 = X[t, 64];

63	62	61	60	59	58	57	56	55	54	53	52	51	50	49	48	47	46	45	44	43	42	41	40	39	38	37	36	35	34	33	32
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0
RES0												CNTPMASK	CNTVMASK	EVNTIS	EL1NVVCT	EL1NVPCT	EL1TVCT	EL1TVT	ECV	EL1PTEN	EL1PCTEN	EL0PTEN	EL0VTEN	EVNTI				EVNTDIR	EVNTEN	EL0VCTEN	EL0PCTEN

63	62	61	60	59	58	57	56	55	54	53	52	51	50	49	48	47	46	45	44	43	42	41	40	39	38	37	36	35	34	33	32
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0
RES0												CNTPMASK	CNTVMASK	EVNTIS	EL1NVVCT	EL1NVPCT	EL1TVCT	EL1TVT	ECV	RES0				EVNTI				EVNTDIR	EVNTEN	EL1PCEN	EL1PCTEN

CNTHCTL_EL2, Counter-timer Hypervisor Control Register

Purpose

Configuration

Attributes

Field descriptions

When the Effective value of HCR_EL2.E2H is 1:

Bits [63:20]

CNTPMASK, bit [19]When FEAT_RME is implemented:

Otherwise:

CNTVMASK, bit [18]When FEAT_RME is implemented:

Otherwise:

EVNTIS, bit [17]When FEAT_ECV is implemented:

Otherwise:

EL1NVVCT, bit [16]When FEAT_ECV is implemented:

Otherwise:

EL1NVPCT, bit [15]When FEAT_ECV is implemented:

Otherwise:

EL1TVCT, bit [14]When FEAT_ECV is implemented:

Otherwise:

EL1TVT, bit [13]When FEAT_ECV is implemented:

Otherwise:

ECV, bit [12]When FEAT_ECV is implemented:

Otherwise:

EL1PTEN, bit [11]

EL1PCTEN, bit [10]

EL0PTEN, bit [9]

EL0VTEN, bit [8]

EVNTI, bits [7:4]

EVNTDIR, bit [3]

EVNTEN, bit [2]

EL0VCTEN, bit [1]

EL0PCTEN, bit [0]

Otherwise:

Bits [63:20]

CNTPMASK, bit [19]When FEAT_RME is implemented:

Otherwise:

CNTVMASK, bit [18]When FEAT_RME is implemented:

Otherwise:

EVNTIS, bit [17]When FEAT_ECV is implemented:

Otherwise:

EL1NVVCT, bit [16]When FEAT_ECV is implemented:

Otherwise:

EL1NVPCT, bit [15]When FEAT_ECV is implemented:

Otherwise:

EL1TVCT, bit [14]When FEAT_ECV is implemented:

Otherwise:

EL1TVT, bit [13]When FEAT_ECV is implemented:

Otherwise:

ECV, bit [12]When FEAT_ECV is implemented:

Otherwise:

Bits [11:8]

EVNTI, bits [7:4]

EVNTDIR, bit [3]

EVNTEN, bit [2]

EL1PCEN, bit [1]

EL1PCTEN, bit [0]

Accessing CNTHCTL_EL2

MRS <Xt>, CNTHCTL_EL2

MSR CNTHCTL_EL2, <Xt>

When FEAT_VHE is implemented

MRS <Xt>, CNTKCTL_EL1

When FEAT_VHE is implemented

MSR CNTKCTL_EL1, <Xt>

CNTPMASK, bit [19]
When FEAT_RME is implemented:

CNTVMASK, bit [18]
When FEAT_RME is implemented:

EVNTIS, bit [17]
When FEAT_ECV is implemented:

EL1NVVCT, bit [16]
When FEAT_ECV is implemented:

EL1NVPCT, bit [15]
When FEAT_ECV is implemented:

EL1TVCT, bit [14]
When FEAT_ECV is implemented:

EL1TVT, bit [13]
When FEAT_ECV is implemented:

ECV, bit [12]
When FEAT_ECV is implemented:

CNTPMASK, bit [19]
When FEAT_RME is implemented:

CNTVMASK, bit [18]
When FEAT_RME is implemented:

EVNTIS, bit [17]
When FEAT_ECV is implemented:

EL1NVVCT, bit [16]
When FEAT_ECV is implemented:

EL1NVPCT, bit [15]
When FEAT_ECV is implemented:

EL1TVCT, bit [14]
When FEAT_ECV is implemented:

EL1TVT, bit [13]
When FEAT_ECV is implemented:

ECV, bit [12]
When FEAT_ECV is implemented: