diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index 198b6b8..2fdab58 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -215,6 +215,9 @@ typedef struct CPUARMState {
         uint32_t c15_diagnostic; /* diagnostic register */
         uint32_t c15_power_diagnostic;
         uint32_t c15_power_control; /* power control */
+        /* If the counter is enabled, this stores the last time the counter
+         * was reset. Otherwise it stores the counter value */
+        uint32_t c15_ccnt;
     } cp15;
 
     /* System registers (AArch64) */
diff --git a/target-arm/helper.c b/target-arm/helper.c
index c708f15..ad87136 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -13,6 +13,12 @@ static inline int get_phys_addr(CPUARMState *env, uint32_t address,
                                 target_ulong *page_size);
 #endif
 
+/* Definitions for the PMCCNTR and PMCR registers */
+#define PMCRDP  0x20
+#define PMCRD   0x8
+#define PMCRC   0x4
+#define PMCRE   0x1
+
 static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     int nregs;
@@ -502,12 +508,44 @@ static int pmreg_read(CPUARMState *env, const ARMCPRegInfo *ri,
 static int pmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                       uint64_t value)
 {
+    uint32_t temp_ticks, diff;
+
     if (arm_current_pl(env) == 0 && !env->cp15.c9_pmuserenr) {
         return EXCP_UDEF;
     }
+
+    temp_ticks = (uint32_t) ((((qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) *
+                                   get_ticks_per_sec())/1000000000) >> 8) &
+                                   0xFFFFFFFF);
+
+    /* This assumes that non-invasive debugging is not permitted */
+    if (!(env->cp15.c9_pmcr & PMCRDP) ||
+        env->cp15.c9_pmcr & PMCRE) {
+        /* If the counter is enabled */
+        env->cp15.c15_ccnt = temp_ticks - env->cp15.c15_ccnt;
+    }
+
+    if (value & PMCRC) {
+        /* The counter has been reset */
+        env->cp15.c15_ccnt = 0;
+    }
+
     /* only the DP, X, D and E bits are writable */
     env->cp15.c9_pmcr &= ~0x39;
     env->cp15.c9_pmcr |= (value & 0x39);
+
+    /* This assumes that non-invasive debugging is not permitted */
+    if (!(env->cp15.c9_pmcr & PMCRDP) ||
+        env->cp15.c9_pmcr & PMCRE) {
+        if (env->cp15.c9_pmcr & PMCRDP) {
+            /* Increment once every 64 processor clock cycles */
+            diff = (temp_ticks/64) - env->cp15.c15_ccnt;
+        } else {
+            diff = temp_ticks - env->cp15.c15_ccnt;
+        }
+        env->cp15.c15_ccnt += diff;
+    }
+
     return 0;
 }
 
@@ -584,6 +622,33 @@ static int vbar_write(CPUARMState *env, const ARMCPRegInfo *ri,
     return 0;
 }
 
+static int pmccntr_read(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t *value)
+{
+    uint32_t total_ticks;
+
+    /* This assumes that non-invasive debugging is not permitted */
+    if (env->cp15.c9_pmcr & PMCRDP ||
+        !(env->cp15.c9_pmcr & PMCRE)) {
+        /* Counter is disabled, do not change value */
+        *value = env->cp15.c15_ccnt;
+        return 0;
+    }
+
+    total_ticks = (uint32_t) ((((qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) *
+                                 get_ticks_per_sec())/1000000000) >> 8) &
+                                 0xFFFFFFFF);
+
+    if (env->cp15.c9_pmcr & PMCRDP) {
+        /* Increment once every 64 processor clock cycles */
+        *value = (total_ticks/64) - env->cp15.c15_ccnt;
+    } else {
+        *value = total_ticks - env->cp15.c15_ccnt;
+    }
+
+    return 0;
+}
+
 static int ccsidr_read(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t *value)
 {
@@ -644,9 +709,10 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
      */
     { .name = "PMSELR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 5,
       .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    /* Unimplemented, RAZ/WI. XXX PMUSERENR */
     { .name = "PMCCNTR", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 0,
-      .access = PL0_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+      .access = PL1_RW, .readfn = pmccntr_read,
+      .fieldoffset = offsetof(CPUARMState, cp15.c15_ccnt),
+      .resetvalue = 0, .type = ARM_CP_IO },
     { .name = "PMXEVTYPER", .cp = 15, .crn = 9, .crm = 13, .opc1 = 0, .opc2 = 1,
       .access = PL0_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.c9_pmxevtyper),
