ESR_EL2 Exception Syndrome Register (EL2) when FEAT_AA64 is implemented HSR Architectural AArch32 31 0 31 0 31 0 31 0 Holds syndrome information for an exception taken to EL2. Virt Exception If EL2 is not implemented, this register is RES0 from EL3. This register has no effect if EL2 is not enabled in the current Security state. ESR_EL2 is a 64-bit register. ESR_EL2 is made UNKNOWN as a result of an exception return from EL2. When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL2, the value of ESR_EL2 is UNKNOWN. The value written to ESR_EL2 must be consistent with a value that could be created as a result of an exception from the same Exception level that generated the exception as a result of a situation that is not UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation. 63 56 63:56 Reserved, RES0. ISS2 55 32 55:32 ISS2 encoding for an exception, the bit assignments are: an exception from a Data Abort 23 12 23:12 Reserved, RES0. HDBSSF 11 11 0 When DFSC indicates a stage 2 Permission fault, this field indicates whether that fault was caused because HDBSS cannot have data appended, because the HDBSS is either full or in an error state. When DFSC indicates a synchronous External abort on translation table walk or hardware update of translation table, this field indicates whether the fault was caused by a write to the HDBSS. When DFSC indicates a Granule Protection Fault on translation table walk or hardware update of translation table, this field indicates whether the fault was caused by a write to the HDBSS. For any other fault, this field is RES0. 0b0 Fault was not caused by HDBSS. 0b1 Fault was caused by HDBSS. AU When FEAT_HDBSS is implemented, IsSecondStage(Fault), and GetESR_ELx_DFSC(EL2) IN {'0011xx', '01001x', '0101xx', '10001x', '1001xx'} 11 11 11 Reserved, RES0. Otherwise TnD 10 10 0 Tag not Data. If a memory access generates a Data Abort for a stage 1 Permission fault, this field indicates whether the fault is due to an Allocation Tag access. For any other fault, this field is RES0. 0b0 Permission fault is not due to a write of an Allocation Tag to Canonically Tagged memory. 0b1 Permission fault is due to a write of an Allocation Tag to Canonically Tagged memory. AU When FEAT_MTE_CANONICAL_TAGS is implemented 10 10 10 Reserved, RES0. Otherwise TagAccess 9 9 0 NoTagAccess fault. If a memory access generates a Data Abort for a Permission fault, this field indicates whether the fault is due to the NoTagAccess memory attribute. For any other fault, this field is RES0. 0b0 Permission fault is not due to the NoTagAccess memory attribute, and not due to an access using a Tag VA. 0b1 Permission fault is due to the NoTagAccess memory attribute. AU When FEAT_MTE_PERM is implemented 9 9 9 Reserved, RES0. Otherwise GCS 8 8 0 Guarded Control Stack data access. If a memory access generates a Data Abort, this field indicates whether the fault is due to a Guarded Control Stack data access. 0b0 The Data Abort is not due to a Guarded control stack data access. 0b1 The Data Abort is due to a Guarded control stack data access. The ISV field is 0. AU When FEAT_GCS is implemented 8 8 8 Reserved, RES0. Otherwise AssuredOnly 7 7 0 AssuredOnly flag. If a memory access generates a Data Abort for a stage 2 Permission fault, this field holds information about the fault. If this field is 1 and ESR_EL2.GCS is 1, then the AssuredOnly check might have been the result of VTCR_EL2.GCSH configuration. For any other fault, this field is RES0. 0b0 The Data Abort is not due to AssuredOnly. 0b1 The Data Abort is due to AssuredOnly. AU When FEAT_THE is implemented 7 7 7 Reserved, RES0. Otherwise Overlay 6 6 0 Overlay flag. If a memory access generates a Data Abort for a Permission fault, this field holds information about the fault. For any other fault, this field is RES0. 0b0 The Data Abort is not due to Overlay Permissions. 0b1 The Data Abort is due to Overlay Permissions. AU When FEAT_S1POE is implemented or FEAT_S2POE is implemented 6 6 6 Reserved, RES0. Otherwise DirtyBit 5 5 0 DirtyBit flag. If a write access to memory generates a Data Abort for a Permission fault using Indirect Permission, this field holds information about the fault. For any other fault or Access, this field is RES0. 0b0 Permission Fault is not due to dirty state. 0b1 Permission Fault is due to dirty state. AU When FEAT_S1PIE is implemented or FEAT_S2PIE is implemented 5 5 5 Reserved, RES0. Otherwise Xs 4 0 4:0 When FEAT_LS64_V is implemented, if a memory access generated by an ST64BV instruction generates a Data Abort exception reported with ISV=1, then this field holds register specifier, Xs. When FEAT_LS64_ACCDATA is implemented, if a memory access generated by an ST64BV0 instruction generates a Data Abort exception reported with ISV=1, then this field holds register specifier, Xs. Otherwise, this field is RES0. When FEAT_LS64 is implemented 4 0 4:0 Reserved, RES0. Otherwise an exception from an Instruction Abort 23 12 23:12 Reserved, RES0. HDBSSF 11 11 0 Indicates that the fault was caused by the HDBSS. When IFSC indicates a stage 2 Permission fault, this field indicates whether that fault was caused because HDBSS cannot have data appended, because the HDBSS is either full or in an error state. When IFSC indicates a synchronous External abort on translation table walk or hardware update of translation table, this field indicates whether the fault was caused by a write to the HDBSS. When IFSC indicates a Granule Protection Fault on translation table walk or hardware update of translation table, this field indicates whether the fault was caused by a write to the HDBSS. This field only applies for stage 2 Permission faults. For any other fault, this field is RES0. 0b0 Fault was not caused by HDBSS. 0b1 Fault was caused by HDBSS. AU When FEAT_HDBSS is implemented 11 11 11 Reserved, RES0. Otherwise 10 8 10:8 Reserved, RES0. AssuredOnly 7 7 0 AssuredOnly flag. If a memory access generates a Instruction Abort for a Permission fault, then this field holds information about the fault. For any other fault, this field is RES0. 0b0 Instruction Abort is not due to AssuredOnly. 0b1 Instruction Abort is due to stage 2 AssuredOnly attribute. AU When FEAT_THE is implemented 7 7 7 Reserved, RES0. Otherwise Overlay 6 6 0 Overlay flag. If a memory access generates a Instruction Abort for a Permission fault, then this field holds information about the fault. For any other fault, this field is RES0. 0b0 Instruction Abort is not due to Overlay Permissions. 0b1 Instruction Abort is due to Overlay Permissions. AU When FEAT_S1POE is implemented or FEAT_S2POE is implemented 6 6 6 Reserved, RES0. Otherwise DirtyBit 5 5 0 DirtyBit flag. If a write access to memory generates an Instruction Abort for a Permission fault using Indirect Permission, this field holds information about the fault. For any other fault or Access, this field is RES0. 0b0 Permission Fault is not due to dirty state. 0b1 Permission Fault is due to dirty state. AU When FEAT_S2PIE is implemented 5 5 5 Reserved, RES0. Otherwise 4 0 4:0 Reserved, RES0. an exception from a Watchpoint exception 23 9 23:9 Reserved, RES0. GCS 8 8 0 Guarded control stack data access. Indicates that the Watchpoint exception is due to a Guarded control stack data access. 0b0 The Watchpoint exception is not due to a Guarded control stack data access. 0b1 The Watchpoint exception is due to a Guarded control stack data access. AU When FEAT_GCS is implemented 8 8 8 Reserved, RES0. Otherwise 7 0 7:0 Reserved, RES0. all other exceptions 23 0 23:0 Reserved, RES0. EC 31 26 31:26 Exception Class. Indicates the reason for the exception that this register holds information about. For each EC value, the table references a subsection that gives information about: The cause of the exception, for example the configuration required to enable the trap. The encoding of the associated ISS. Possible values of the EC field are: All other EC values are reserved by Arm, and: Unused values in the range 0b000000 - 0b101100 (0x00 - 0x2C) are reserved for future use for synchronous exceptions. Unused values in the range 0b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and might be used for synchronous or asynchronous exceptions. The effect of programming this field to a reserved value is that behavior is CONSTRAINED UNPREDICTABLE. 0b000000 Unknown reason. 0b000001 Trapped WF* instruction execution. Conditional WF* instructions that fail their condition code check do not cause an exception. 0b000011 Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC value 0b000000. When FEAT_AA32 is implemented 0b000100 Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC value 0b000000. When FEAT_AA32 is implemented 0b000101 Trapped MCR or MRC access with (coproc==0b1110). When FEAT_AA32 is implemented 0b000110 Trapped LDC or STC access. The only architected uses of these instruction are: An STC to write data to memory from DBGDTRRXint. An LDC to read data from memory to DBGDTRTXint. When FEAT_AA32 is implemented 0b000111 Access to SME, SVE, Advanced SIMD or floating-point functionality trapped by CPACR_EL1.FPEN, CPTR_EL2.FPEN, CPTR_EL2.TFP, or CPTR_EL3.TFP control. Excludes exceptions resulting from CPACR_EL1 when the value of HCR_EL2.TGE is 1, or because SVE or Advanced SIMD and floating-point are not implemented. These are reported with EC value 0b000000. 0b001000 Trapped VMRS access, from ID group trap, that is not reported using EC value 0b000111. When FEAT_AA32 is implemented 0b001001 Trapped use of a Pointer authentication instruction. When FEAT_PAuth is implemented 0b001010 Trapped execution of any instruction not covered by other EC values. When FEAT_LS64 is implemented, or FEAT_SPEv1p5 is implemented, or FEAT_TRBEv1p1 is implemented 0b001100 Trapped MRRC access with (coproc==0b1110). When FEAT_AA32 is implemented 0b001101 Branch Target Exception. When FEAT_BTI is implemented 0b001110 Illegal Execution state. 0b010001 SVC instruction execution in AArch32 state. This is reported in ESR_EL2 only when the exception is generated because the value of HCR_EL2.TGE is 1. When FEAT_AA32 is implemented 0b010010 HVC instruction execution in AArch32 state, when HVC is not disabled. When FEAT_AA32 is implemented 0b010011 SMC instruction execution in AArch32 state, when SMC is not disabled. This is reported in ESR_EL2 only when the exception is generated because the value of HCR_EL2.TSC is 1. When FEAT_AA32 is implemented 0b010100 Trapped MSRR, MRRS or System instruction execution in AArch64 state, that is not reported using EC value 0b000000. When FEAT_SYSREG128 is implemented or FEAT_SYSINSTR128 is implemented 0b010101 SVC instruction execution in AArch64 state. When FEAT_AA64 is implemented 0b010110 HVC instruction execution in AArch64 state, when HVC is not disabled. When FEAT_AA64 is implemented 0b010111 SMC instruction execution in AArch64 state, when SMC is not disabled. This is reported in ESR_EL2 only when the exception is generated because the value of HCR_EL2.TSC is 1. When FEAT_AA64 is implemented 0b011000 Trapped MSR, MRS or System instruction execution in AArch64 state, that is not reported using EC values 0b000000, 0b000001 or 0b000111. This includes all instructions that cause exceptions that are part of the encoding space defined in 'System instruction class encoding overview', except for those exceptions reported using EC values 0b000000, 0b000001, or 0b000111. When FEAT_AA64 is implemented 0b011001 Access to SVE functionality trapped as a result of CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ, that is not reported using EC value 0b000000. When FEAT_SVE is implemented 0b011010 Trapped ERET, ERETAA, or ERETAB instruction execution. When FEAT_FGT is implemented or FEAT_NV is implemented 0b011100 Exception from a PAC Fail When FEAT_FPAC is implemented 0b011101 Access to SME functionality trapped as a result of CPACR_EL1.SMEN, CPTR_EL2.SMEN, CPTR_EL2.TSM, CPTR_EL3.ESM, or an attempted execution of an instruction that is illegal because of the value of PSTATE.SM or PSTATE.ZA, that is not reported using EC value 0b000000. When FEAT_SME is implemented 0b100000 Instruction Abort from a lower Exception level. Used for MMU faults generated by instruction accesses and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug-related exceptions. 0b100001 Instruction Abort taken without a change in Exception level. Used for MMU faults generated by instruction accesses and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug-related exceptions. 0b100010 PC alignment fault exception. 0b100100 Data Abort exception from a lower Exception level, excluding Data Abort exceptions taken to EL2 as a result of accesses generated associated with VNCR_EL2 as part of nested virtualization support. These Data Abort exceptions might be generated from Exception levels in any Execution state. Used for MMU faults generated by data accesses, alignment faults other than those caused by Stack Pointer misalignment, and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug-related exceptions. 0b100101 Data Abort exception without a change in Exception level, or Data Abort exceptions taken to EL2 as a result of accesses generated associated with VNCR_EL2 as part of nested virtualization support. Used for MMU faults generated by data accesses, alignment faults other than those caused by Stack Pointer misalignment, and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug-related exceptions. 0b100110 SP alignment fault exception. 0b100111 Memory Operation Exception. When FEAT_MOPS is implemented 0b101000 Trapped floating-point exception taken from AArch32 state. This EC value is valid if the implementation supports trapping of floating-point exceptions, otherwise it is reserved. Whether a floating-point implementation supports trapping of floating-point exceptions is IMPLEMENTATION DEFINED. When FEAT_AA32 is implemented 0b101100 Trapped floating-point exception taken from AArch64 state. This EC value is valid if the implementation supports trapping of floating-point exceptions, otherwise it is reserved. Whether a floating-point implementation supports trapping of floating-point exceptions is IMPLEMENTATION DEFINED. When FEAT_AA64 is implemented 0b101101 GCS exception. When FEAT_GCS is implemented 0b101111 SError exception. 0b110000 Breakpoint exception from a lower Exception level. 0b110001 Breakpoint exception taken without a change in Exception level. 0b110010 Software Step exception from a lower Exception level. 0b110011 Software Step exception taken without a change in Exception level. 0b110100 Watchpoint from a lower Exception level, excluding Watchpoint Exceptions taken to EL2 as a result of accesses generated associated with VNCR_EL2 as part of nested virtualization support. These Watchpoint Exceptions might be generated from Exception levels using any Execution state. 0b110101 Watchpoint exceptions without a change in Exception level, or Watchpoint exceptions taken to EL2 as a result of accesses generated associated with VNCR_EL2 as part of nested virtualization support. 0b111000 BKPT instruction execution in AArch32 state. When FEAT_AA32 is implemented 0b111010 Vector Catch exception from AArch32 state. The only case where a Vector Catch exception is taken to an Exception level that is using AArch64 is when the exception is routed to EL2 and EL2 is using AArch64. When FEAT_AA32 is implemented 0b111100 BRK instruction execution in AArch64 state. When FEAT_AA64 is implemented 0b111101 Profiling exception When FEAT_EBEP is implemented, or FEAT_SPE_EXC is implemented, or FEAT_TRBE_EXC is implemented AU IL 25 25 25 Instruction Length for synchronous exceptions. Possible values of this bit are: 0b0 16-bit instruction trapped. 0b1 32-bit instruction trapped. This value is also used when the exception is one of the following: An SError exception. An Instruction Abort exception. A PC alignment fault exception. An SP alignment fault exception. A Data Abort exception for which the value of the ISV bit is 0. An Illegal Execution state exception. Any debug exception except for Breakpoint instruction exceptions. For Breakpoint instruction exceptions, this bit has its standard meaning: '0': 16-bit T32 BKPT instruction. '1': 32-bit A32 BKPT instruction or A64 BRK instruction. An exception reported using EC value 0b000000. AU ISS 24 0 24:0 Instruction Specific Syndrome. Architecturally, this field can be defined independently for each defined Exception class. However, in practice, some ISS encodings are used for more than one Exception class. Typically, an ISS encoding has a number of subfields. When an ISS subfield holds a register number, the value returned in that field is the AArch64 view of the register number. For an exception taken from AArch32 state, see 'Mapping of the general-purpose registers between the Execution states'. If the AArch32 register descriptor is 0b1111, then: If the instruction that generated the exception was not UNPREDICTABLE, the field takes the value 0b11111. If the instruction that generated the exception was UNPREDICTABLE, the field takes an UNKNOWN value that must be either: The AArch64 view of the register number of a register that might have been used at the Exception level from which the exception was taken. The value 0b11111. exceptions with an unknown reason 24 0 24:0 Reserved, RES0. When an exception is reported using this EC value, the IL field is set to 1. This EC value is used for all exceptions that are not covered by any other EC value. This includes exceptions that are generated in the following situations: The attempted execution of an instruction bit pattern that has no allocated instruction or that is not accessible at the current Exception level and Security state, including: A read access using a System register pattern that is not allocated for reads or that does not permit reads at the current Exception level and Security state. A write access using a System register pattern that is not allocated for writes or that does not permit writes at the current Exception level and Security state. Instruction encodings that are unallocated. Instruction encodings for instructions or System registers that are not implemented in the implementation. In Debug state, the attempted execution of an instruction bit pattern that is not accessible in Debug state. In Non-debug state, the attempted execution of an instruction bit pattern that is not accessible in Non-debug state. In AArch32 state, attempted execution of a short vector floating-point instruction. In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted access to Advanced SIMD or floating-point functionality under conditions where that access would be permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers. An exception generated because of the value of one of the SCTLR_EL1.{ITD, SED, CP15BEN} control bits. Attempted execution of: An HVC instruction when disabled by HCR_EL2.HCD or SCR_EL3.HCE. An SMC instruction when disabled by SCR_EL3.SMD. An HLT instruction when disabled by EDSCR.HDE. Attempted execution of an MSR or MRS instruction to access SP_EL0 when the value of SPSel.SP is 0. Attempted execution of an MSR or MRS instruction using a _EL12 register name when the Effective value of HCR_EL2.E2H is not 1. Attempted execution, in Debug state, of: A DCPS1 instruction when the value of HCR_EL2.TGE is 1 and EL2 is disabled or not implemented in the current Security state. A DCPS2 instruction from EL1 or EL0 when EL2 is disabled or not implemented in the current Security state. A DCPS3 instruction when the value of EDSCR.SDD is 1, or when EL3 is not implemented. When EL3 is using AArch64, attempted execution from Secure EL1 of an SRS instruction using R13_mon. In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, and EL0 of an instruction that is configured to trap to EL3. In AArch32 state, the attempted execution of an MRS (banked register) or an MSR (banked register) instruction to SPSR_mon, SP_mon, or LR_mon. An exception that is taken to EL2 because the value of HCR_EL2.TGE is 1. If the value of HCR_EL2.TGE is 0, this exception is reported using an ESR_EL2.EC value of 0b000111. If FEAT_UINJ is implemented, an Undefined exception caused by attempting to execute any instruction when PSTATE.UINJ is 1. an exception from a WF* instruction CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. AU 19 10 19:10 Reserved, RES0. RN 9 5 4:0 Register Number. Indicates the register number supplied for a WFET or WFIT instruction. AU When FEAT_WFxT is implemented 9 5 9:5 Reserved, RES0. Otherwise 4 3 4:3 Reserved, RES0. RV 2 2 0 Register field Valid. If TI[1] == 1, then this field indicates whether RN holds a valid register number for the register argument to the trapped WFET or WFIT instruction. If TI[1] == 0, then this field is RES0. This field is set to 1 on a trap on WFET or WFIT. 0b0 Register field invalid. 0b1 Register field valid. AU When FEAT_WFxT is implemented 2 2 2 Reserved, RES0. Otherwise TI 1 0 1:0 Trapped instruction. Possible values of this bit are: When FEAT_WFxT is implemented, this is a two bit field as shown. Otherwise, bit[1] is RES0. 0b00 WFI trapped. 0b01 WFE trapped. 0b10 WFIT trapped. When FEAT_WFxT is implemented 0b11 WFET trapped. When FEAT_WFxT is implemented AU The following fields describe configuration settings for generating this exception: HCR.{TWE, TWI}. SCTLR_EL1.{nTWE, nTWI}. SCTLR_EL2.{nTWE, nTWI}. HCR_EL2.{TWE, TWI}. SCR_EL3.{TWE, TWI}. When FEAT_AA32 is implemented an exception from an MCR or MRC access CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. AU Opc2 19 17 19:17 The Opc2 value from the issued instruction. For a trapped VMRS access, holds the value 0b000. AU Opc1 16 14 16:14 The Opc1 value from the issued instruction. For a trapped VMRS access, holds the value 0b111. AU CRn 13 10 13:10 The CRn value from the issued instruction. For a trapped VMRS access, holds the reg field from the VMRS instruction encoding. AU Rt 9 5 9:5 The Rt value from the issued instruction, the general-purpose register used for the transfer. If the Rt value is not 0b1111, then the reported value gives the AArch64 view of the register. Otherwise, if the Rt value is 0b1111: If the instruction that generated the exception is not UNPREDICTABLE, then the register specifier takes the value 0b11111. If the instruction that generated the exception is UNPREDICTABLE, then the register specifier takes an UNKNOWN value, which is restricted to either: The AArch64 view of one of the registers that could have been used in AArch32 state at the Exception level that the instruction was executed at. The value 0b11111. See 'Mapping of the general-purpose registers between the Execution states'. AU CRm 4 1 4:1 The CRm value from the issued instruction. For a trapped VMRS access, holds the value 0b0000. AU Direction 0 0 0 Indicates the direction of the trapped instruction. 0b0 Write to System register space. MCR instruction. 0b1 Read from System register space. MRC or VMRS instruction. AU The following fields describe configuration settings for generating exceptions from an MCR or MRC access using coproc 0b1111, that are reported using EC value 0b000011: If FEAT_TIDCP1 is implemented, SCTLR_EL1.TIDCP, for EL0 accesses to IMPLEMENTATION DEFINED functionality using AArch32 state, trapped to EL1. CNTKCTL_EL1.{EL0PTEN, EL0VTEN, EL0PCTEN, EL0VCTEN}, for accesses to the Generic Timer Registers from EL0 using AArch32 state, trapped to EL2 or EL1. PMUSERENR_EL0.{ER, CR, SW, EN}, for accesses to Performance Monitor registers from EL0 using AArch32 state, trapped to EL2 or EL1. AMUSERENR_EL0.EN, for accesses to Activity Monitors System registers from EL0 using AArch32 state, trapped to EL2 or EL1. HCR.{TRVM, TVM} and HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, trapped to EL2. HCR.TTLB and HCR_EL2.TTLB, for execution of TLB maintenance instructions at EL1 using AArch32 state, trapped to EL2. HCR.{TSW, TPC, TPU} and HCR_EL2.{TSW, TPC, TPU} for execution of cache maintenance instructions at EL0 and EL1 using AArch32 state, trapped to EL2. HCR.TAC and HCR_EL2.TACR, for accesses to the Auxiliary Control Register at EL1 using AArch32 state, trapped to EL2. HCR.TIDCP and HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations at EL0 and EL1 using AArch32 state, trapped to EL2. If FEAT_TIDCP1 is implemented, SCTLR_EL2.TIDCP, for EL0 accesses to IMPLEMENTATION DEFINED functionality using AArch32 state, trapped to EL2. HCR.{TID1, TID2, TID3} and HCR_EL2.{TID1, TID2, TID3}, for accesses to ID registers at EL0 and EL1 using AArch32 state, trapped to EL2. HCR2.TERR, for Non-secure accesses to error record registers at EL1 using AArch32 state, trapped to EL2. HCPTR.TCPAC and CPTR_EL2.TCPAC, for accesses to CPACR_EL1 or CPACR using AArch32 state, trapped to EL2. HSTR.T<n> and HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, trapped to EL2. CNTHCTL.PL1PCEN and CNTHCTL_EL2.EL1PCEN, for accesses to the Generic Timer registers from EL0 and EL1 using AArch32 state, trapped to EL2. HDCR.TTRF, for Non-secure accesses to trace filter control registers from system registers using AArch32 state, trapped to EL2. HDCR.{TPM, TPMCR} and MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from EL0 and EL1 using AArch32 state, trapped to EL2. HCPTR.TAM and CPTR_EL2.TAM, for accesses to Activity Monitors System registers from EL0 and EL1 using AArch32 state, trapped to EL2. CPTR_EL3.TCPAC, for accesses to CPACR from EL1 and EL2, and accesses to HCPTR from EL2 using AArch32 state, trapped to EL3. MDCR_EL3.TPM, for accesses to Performance Monitor registers from EL0, EL1 and EL2 using AArch32 state, trapped to EL3. CPTR_EL3.TAM, for accesses to Activity Monitors System registers from EL0, EL1 and EL2 using AArch32 state, trapped to EL3. If FEAT_FGT is implemented, access to some registers at EL0, trapped to EL2. The following fields describe configuration settings for generating exceptions from an MCR or MRC access using coproc 0b1110, that are reported using EC value 0b000101: CPACR_EL1.TTA for accesses to trace System registers, trapped to EL2 or EL1. MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers at EL0 and EL1 using AArch32 state, trapped to EL2 or EL1. If FEAT_FGT is implemented, MDCR_EL2.TDCC for accesses to the DCC System registers at EL0 and EL1 trapped to EL2, and MDCR_EL3.TDCC for accesses to the DCC System registers at EL0, EL1, and EL2 trapped to EL3. HCR.TID0 and HCR_EL2.TID0, for accesses to the JIDR register in the ID group 0 at EL0 and EL1 using AArch32, trapped to EL2. HCPTR.TTA and CPTR_EL2.TTA, for accesses to trace System registers using AArch32, trapped to EL2. HDCR.TDRA and MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and DBGDSAR using AArch32, trapped to EL2. HDCR.TDOSA and MDCR_EL2.TDOSA, for accesses to powerdown debug System registers, using AArch32 state, trapped to EL2. HDCR.TDA and MDCR_EL2.TDA, for accesses to other debug System registers, using AArch32 state, trapped to EL2. CPTR_EL3.TTA, for accesses to trace System registers using AArch32, trapped to EL3. MDCR_EL3.TDOSA, for accesses to powerdown debug System registers using AArch32, trapped to EL3. MDCR_EL3.TDA, for accesses to other debug System registers, using AArch32, trapped to EL3. The following fields describe configuration settings for generating exceptions from a VMSR or VMRS access, that are reported using EC value 0b001000: HCR.TID0 and HCR_EL2.TID0, for accesses to the FPSID register in ID group 0 at EL1 using AArch32 state, VMRS access trapped to EL2. HCR.TID3 and HCR_EL2.TID3, for accesses to registers in ID group 3 including MVFR0, MVFR1 and MVFR2, VMRS access trapped to EL2. HCPTR.{TCP10, TCP11}, for Non-secure accesses to FPSCR, FPSID, FPEXC, MVFR0, MVFR1, and MVFR2, trapped to EL2. When FEAT_AA32 is implemented When FEAT_LS64 is implemented or (EL2 == EL2 and (FEAT_SPEv1p5 is implemented or FEAT_TRBEv1p1 is implemented)) an exception from any other instruction ISS 24 0 24:0 All other values are reserved. 0b0000000000000000000000000 ST64BV instruction trapped. When FEAT_LS64_V is implemented 0b0000000000000000000000001 ST64BV0 instruction trapped. When FEAT_LS64_ACCDATA is implemented 0b0000000000000000000000010 LD64B or ST64B instruction trapped. When FEAT_LS64 is implemented 0b0000000000000000000000011 PSB CSYNC instruction trapped. When FEAT_SPEv1p5 is implemented 0b0000000000000000000000100 TSB CSYNC instruction trapped. When FEAT_TRBEv1p1 is implemented When FEAT_LS64 is implemented or (EL2 == EL2 and (FEAT_SPEv1p5 is implemented or FEAT_TRBEv1p1 is implemented)) When FEAT_AA32 is implemented an exception from an MCRR or MRRC access CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. AU Opc1 19 16 19:16 The Opc1 value from the issued instruction. AU 15 15 15 Reserved, RES0. Rt2 14 10 14:10 The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. If the Rt2 value is not 0b1111, then the reported value gives the AArch64 view of the register. Otherwise, if the Rt2 value is 0b1111: If the instruction that generated the exception is not UNPREDICTABLE, then the register specifier takes the value 0b11111. If the instruction that generated the exception is UNPREDICTABLE, then the register specifier takes an UNKNOWN value, which is restricted to either: The AArch64 view of one of the registers that could have been used in AArch32 state at the Exception level that the instruction was executed at. The value 0b11111. See 'Mapping of the general-purpose registers between the Execution states'. AU Rt 9 5 9:5 The Rt value from the issued instruction, the first general-purpose register used for the transfer. If the Rt value is not 0b1111, then the reported value gives the AArch64 view of the register. Otherwise, if the Rt value is 0b1111: If the instruction that generated the exception is not UNPREDICTABLE, then the register specifier takes the value 0b11111. If the instruction that generated the exception is UNPREDICTABLE, then the register specifier takes an UNKNOWN value, which is restricted to either: The AArch64 view of one of the registers that could have been used in AArch32 state at the Exception level that the instruction was executed at. The value 0b11111. See 'Mapping of the general-purpose registers between the Execution states'. AU CRm 4 1 4:1 The CRm value from the issued instruction. AU Direction 0 0 0 Indicates the direction of the trapped instruction. 0b0 Write to System register space. MCRR instruction. 0b1 Read from System register space. MRRC instruction. AU The following fields describe configuration settings for generating exceptions from an MCRR or MRRC access using coproc 0b1111, that are reported using EC value 0b000100: CNTKCTL_EL1.{EL0PTEN, EL0VTEN, EL0PCTEN, EL0VCTEN}, for accesses to the Generic Timer Registers from EL0 using AArch32 state, trapped to EL2 or EL1. PMUSERENR_EL0.{CR, EN}, for accesses to Performance Monitor registers from EL0 using AArch32 state, trapped to EL2 or EL1. AMUSERENR_EL0.{EN}, for accesses to Activity Monitors System registers AMEVCNTR0<n> and AMEVCNTR1<n> from EL0 using AArch32 state, trapped to EL2 or EL1. HCR.{TRVM, TVM} and HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers from EL1 using AArch32 state, trapped to EL2. HCR2.TERR, for Non-secure accesses to error record registers at EL1 using AArch32 state, trapped to EL2. HSTR.T<n> and HSTR_EL2.T<n>, for accesses to System registers using AArch32 state, trapped to EL2. CNTHCTL.{PL1PCEN, PL1PCTEN} and CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers from EL0 and EL1 using AArch32 state, trapped to EL2. HDCR.TPM and MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers from EL0 and EL1 using AArch32 state, trapped to EL2. HCPTR.TAM and CPTR_EL2.TAM, for accesses to Activity Monitors System registers AMEVCNTR0<n> and AMEVCNTR1<n> from EL0 and EL1 using AArch32 state, trapped to EL2. MDCR_EL3.TPM, for accesses to Performance Monitor registers from EL0, EL1 and EL2 using AArch32 state, trapped to EL3. CPTR_EL3.TAM, for accesses to Activity Monitors System registers from EL0, EL1 and EL2 using AArch32 state, trapped to EL3. If FEAT_FGT is implemented, HDFGRTR_EL2.PMCCNTR_EL0 for MRRC access and HDFGWTR_EL2.PMCCNTR_EL0 for MCRR access to PMCCNTR at EL0, trapped to EL2. The following fields describe configuration settings for generating exceptions from an MCRR or MRRC access using coproc 0b1110, that are reported using EC value 0b001100: MDSCR_EL1.TDCC, for accesses to the Debug ROM registers DBGDSAR and DBGDRAR at EL0 using AArch32 state, trapped to EL2 or EL1. HDCR.TDRA and MDCR_EL2.TDRA, for accesses to Debug ROM registers DBGDRAR and DBGDSAR using AArch32, trapped to EL2. MDCR_EL3.TDA, for accesses to debug System registers, using AArch32, trapped to EL3. CPACR_EL1.TTA for accesses to trace System registers using AArch32, trapped to EL1 or EL2. HCPTR.TTA and CPTR_EL2.TTA, for accesses to trace System registers using AArch32, trapped to EL2. CPTR_EL3.TTA, for accesses to trace System registers using AArch32, trapped to EL3. If FEAT_ETMv4 or FEAT_ETE are implemented, MCRR and MRRC accesses to trace System registers are UNDEFINED and the resulting exception is higher priority than an exception due to these traps. When FEAT_AA32 is implemented an exception from an LDC or STC instruction CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. AU imm8 19 12 19:12 The immediate value from the issued instruction. AU 11 10 11:10 Reserved, RES0. Rn 9 5 9:5 The Rn value from the issued instruction, the general-purpose register used for the transfer. If the Rn value is not 0b1111, then the reported value gives the AArch64 view of the register. Otherwise, if the Rn value is 0b1111: If the instruction that generated the exception is not UNPREDICTABLE, then the register specifier takes the value 0b11111. If the instruction that generated the exception is UNPREDICTABLE, then the register specifier takes an UNKNOWN value, which is restricted to either: The AArch64 view of one of the registers that could have been used in AArch32 state at the Exception level that the instruction was executed at. The value 0b11111. See 'Mapping of the general-purpose registers between the Execution states'. This field is valid only when AM[2] is 0, indicating an immediate form of the LDC or STC instruction. When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is UNKNOWN. AU Offset 4 4 4 Indicates whether the offset is added or subtracted: This bit corresponds to the U bit in the instruction encoding. 0b0 Subtract offset. 0b1 Add offset. AU AM 3 1 3:1 Addressing mode. The permitted values of this field are: The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in System and memory-mapped registers and translation table entries'. Bit [2] in this subfield indicates the instruction form, immediate or literal. Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding. 0b000 Immediate unindexed. 0b001 Immediate post-indexed. 0b010 Immediate offset. 0b011 Immediate pre-indexed. 0b100 For a trapped STC instruction or a trapped T32 LDC instruction this encoding is reserved. 0b110 For a trapped STC instruction, this encoding is reserved. AU Direction 0 0 0 Indicates the direction of the trapped instruction. 0b0 Write to memory. STC instruction. 0b1 Read from memory. LDC instruction. AU The following fields describe the configuration settings from an LDC or STC access for the traps that are reported using EC value 0b000110: MDSCR_EL1.TDCC, for accesses to DBGDTRTXint and DBGDTRRXint, using AArch32 state, trapped to EL2 or EL1. HDCR.TDA and MDCR_EL2.TDA, for accesses to DBGDTRTXint and DBGDTRRXint, using AArch32 state, trapped to EL2. MDCR_EL3.TDA, for accesses to DBGDTRTXint and DBGDTRRXint, using AArch32 state, trapped to EL3. If FEAT_FGT is implemented, MDCR_EL2.TDCC for accesses to the DCC System registers at EL0 and EL1 trapped to EL2, and MDCR_EL3.TDCC for accesses to the DCC System registers at EL0, EL1, and EL2 trapped to EL3. an exception from an access to a register or instruction resulting from the FPEN and TFP traps The accesses covered by this trap include: Execution of Advanced SIMD and floating-point instructions. Accesses to the Advanced SIMD and floating-point System registers. Execution of SVE instructions. Execution of SME instructions. For an implementation that does not include either SVE or support for Advanced SIMD and floating-point, the exception is reported using the EC value 0b000000. CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. AU 19 0 19:0 Reserved, RES0. The following fields describe the configuration settings for the traps that are reported using EC value 0b000111: HCPTR.{TCP10, TCP11}, for Non-secure accesses to Advanced SIMD and floating-point registers and instructions, trapped to EL2. HCPTR.TASE, for Non-secure accesses to Advanced SIMD functionality, trapped to EL2. CPACR_EL1.FPEN, for accesses to SIMD and floating-point registers trapped to EL1. CPTR_EL2.FPEN and CPTR_EL2.TFP, for accesses to SIMD and floating-point registers trapped to EL2. CPTR_EL3.TFP, for accesses to SIMD and floating-point registers trapped to EL3. When FEAT_SVE is implemented an exception from an access to SVE functionality, resulting from CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ The accesses covered by this trap include: Execution of SVE instructions when the PE is not in Streaming SVE mode. Accesses to the SVE System registers, ZCR_ELx. For an implementation that does not include SVE, the exception is reported using the EC value 0b000000. 24 0 24:0 Reserved, RES0. The following fields describe the configuration settings for the traps that are reported using EC value 0b011001: CPACR_EL1.ZEN, for execution of SVE instructions and accesses to SVE registers at EL1 or EL0, trapped to EL1. CPTR_EL2.ZEN and CPTR_EL2.TZ, for execution of SVE instructions and accesses to SVE registers at EL0, EL1, or EL2, trapped to EL2. CPTR_EL3.EZ, for execution of SVE instructions and accesses to SVE registers from all Exception levels, trapped to EL3. When FEAT_SVE is implemented When FEAT_EBEP is implemented, or FEAT_SPE_EXC is implemented, or FEAT_TRBE_EXC is implemented a Profiling exception 24 6 24:6 Reserved, RES0. FSC 5 1 5:1 Indicates why the Profiling exception was generated. 0b00000 PMU Profiling exception. The exception was generated because at least one PMU counter overflow status flag was 1. When FEAT_EBEP is implemented 0b00001 Profiling Buffer management event. The exception was generated because PMBSR_EL2.S was 1. When FEAT_SPE_EXC is implemented 0b00010 Trace buffer management event. The exception was generated because TRBSR_EL2.IRQ was 1. When FEAT_TRBE_EXC is implemented AU 0 0 0 Reserved, RES0. When FEAT_EBEP is implemented, or FEAT_SPE_EXC is implemented, or FEAT_TRBE_EXC is implemented an exception from an Illegal Execution state, or a PC or SP alignment fault 24 0 24:0 Reserved, RES0. There are no configuration settings for generating Illegal Execution state exceptions and PC alignment fault exceptions. For more information about PC alignment fault exceptions, see 'PC alignment checking'. 'SP alignment checking' describes the configuration settings for generating SP alignment fault exceptions. When FEAT_MOPS is implemented an exception from the Memory Copy and Memory Set instructions MemInst 24 24 24 Indicates the memory instruction class causing the exception. 0b0 CPYFE*, CPYFM*, CPYE*, and CPYM* instructions. 0b1 The instruction that caused the exception is in one of the following instruction classes: SETE*, SETM*. SETGE*, SETGM*. AU isSETG 23 23 23 Indicates whether the instruction belongs to one of the following instruction classes: SETGE*, SETGM*. 0b0 The instruction that caused the exception is not in one of the specified classes. 0b1 The instruction that caused the exception is in one of the specified classes. AU Options 22 19 22:19 Options : the Options field of the instruction. For Memory Copy instructions, bits[22:19] forms the Options field, which holds the bits[15:12] of the instruction. For Memory Set instructions: Bits[22:21] are RES0. Bits[20:19] form the Options field, which holds the bits[13:12] of the instruction. AU FromEpilogue 18 18 18 Indicates whether the instruction belongs to one of the following epilogue classes of Memory Copy or Memory Set instructions: CPYE*, CPYFE*. SETE*, SETGE*. 0b0 The instruction that caused the exception is not in one of the specified classes. 0b1 The instruction that caused the exception is in one of the specified classes. AU FormatOption 17 16 17:16 Reports the Option used to encode the initial Xs, Xd, and Xn register values provided to the instruction that generated the exception. For more information, see Memory Copy and Memory Set exceptions. This field was previously presented as two separate bits, WrongOption, bit[17] and OptionA, bit [16], which were already expected to be used together and not individually. 0b00 Option B. 0b01 Option A. 0b10 Option A. 0b11 Option B. AU 15 15 15 Reserved, RES0. destreg 14 10 14:10 The destination register value from the issued instruction, containing the destination address. AU srcreg 9 5 9:5 The source register value from the issued instruction, containing either the source address or the source data. AU sizereg 4 0 4:0 The size register value from the issued instruction, containing the number of bytes to be transferred or set. AU When FEAT_MOPS is implemented an exception from HVC or SVC instruction execution 24 16 24:16 Reserved, RES0. imm16 15 0 15:0 The value of the immediate field from the HVC or SVC instruction. For an HVC instruction, and for an A64 SVC instruction, this is the value of the imm16 field of the issued instruction. For an A32 or T32 SVC instruction: If the instruction is unconditional, then: For the T32 instruction, this field is zero-extended from the imm8 field of the instruction. For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the instruction. If the instruction is conditional, this field is UNKNOWN. AU In AArch32 state, the HVC instruction is unconditional, and a conditional SVC instruction generates an exception only if it passes its condition code check. Therefore, the syndrome information for these exceptions does not require conditionality information. For T32 and A32 instructions, see 'SVC' and 'HVC'. For A64 instructions, see 'SVC' and 'HVC'. If FEAT_FGT is implemented, HFGITR_EL2.{SVC_EL1, SVC_EL0} control fine-grained traps on SVC execution. an exception from SMC instruction execution in AArch32 state For an SMC instruction that completes normally and generates an exception that is taken to EL3, the ISS encoding is RES0. For an SMC instruction that is trapped to EL2 from EL1 because HCR_EL2.TSC is 1, the ISS encoding is as shown in the diagram. CV 24 24 24 Condition code valid. For exceptions taken from AArch64, CV is set to 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information. This field is valid only if CCKNOWNPASS is 1, otherwise it is RES0. 0b0 The COND field is not valid. 0b1 The COND field is valid. AU COND 23 20 23:20 For exceptions taken from AArch64, this field is set to 0b1110. The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1. For exceptions taken from AArch32: When an A32 instruction is trapped, CV is set to 1 and: If the instruction is conditional, COND is set to the condition code field value from the instruction. If the instruction is unconditional, COND is set to 0b1110. A conditional A32 instruction that is known to pass its condition code check can be presented either: With COND set to 0b1110, the value for unconditional. With the COND value held in the instruction. When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether: CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction. CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction. For an implementation that, for both T32 and A32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction. This field is valid only if CCKNOWNPASS is 1, otherwise it is RES0. AU CCKNOWNPASS 19 19 19 Indicates whether the instruction might have failed its condition code check. In an implementation in which an SMC instruction that fails it code check is not trapped, this field can always return the value 0. 0b0 The instruction was unconditional, or was conditional and passed its condition code check. 0b1 The instruction was conditional, and might have failed its condition code check. AU 18 0 18:0 Reserved, RES0. HCR.TSC describes the configuration settings for trapping SMC instructions to EL2. HCR_EL2.TSC describes the configuration settings for trapping SMC instructions to EL2. an exception from SMC instruction execution in AArch64 state 24 16 24:16 Reserved, RES0. imm16 15 0 15:0 The value of the immediate field from the issued SMC instruction. AU The value of ISS[24:0] described here is used both: When an SMC instruction is trapped from EL1 modes. When an SMC instruction is not trapped, so completes normally and generates an exception that is taken to EL3. HCR_EL2.TSC describes the configuration settings for trapping SMC from EL1 modes. an exception from MSR, MRS, or System instruction execution in AArch64 state 24 22 24:22 Reserved, RES0. Op0 21 20 21:20 The Op0 value from the issued instruction. AU Op2 19 17 19:17 The Op2 value from the issued instruction. AU Op1 16 14 16:14 The Op1 value from the issued instruction. AU CRn 13 10 13:10 The CRn value from the issued instruction. AU Rt 9 5 9:5 The Rt value from the issued instruction, the general-purpose register used for the transfer. For system instructions which require that the opcode Rt field is set to 0b11111, but where the trapped instruction has a different value of Rt, an implementation is permitted to return the value 0b11111, instead of the value of Rt from the trapped instruction. AU CRm 4 1 4:1 The CRm value from the issued instruction. AU Direction 0 0 0 Indicates the direction of the trapped instruction. 0b0 Write access, including MSR instructions. 0b1 Read access, including MRS instructions. AU For exceptions caused by System instructions, see 'System instructions' subsection of 'Branches, exception generating and System instructions' for the encoding values returned by an instruction. The following fields describe configuration settings for generating the exception that is reported using EC value 0b011000: If FEAT_TIDCP1 is implemented, SCTLR_EL1.TIDCP, for EL0 accesses to IMPLEMENTATION DEFINED functionality using AArch64 state, MSR or MRS access trapped to EL1. SCTLR_EL1.UCI, for execution of cache maintenance instructions using AArch64 state, execution is trapped to EL2 or EL1. SCTLR_EL1.UCT, for accesses to CTR_EL0 using AArch64 state, MSR or MRS access trapped to EL2 or EL1. SCTLR_EL1.DZE, for execution of DC ZVA instructions using AArch64 state, execution is trapped to EL2 or EL1. SCTLR_EL1.UMA, for accesses to the PSTATE interrupt masks using AArch64 state, MSR or MRS access trapped to EL2 or EL1. CPACR_EL1.TTA, for accesses to the trace System registers using AArch64 state, MSR or MRS access trapped to EL2 or EL1. MDSCR_EL1.TDCC, for accesses to the Debug Communications Channel (DCC) registers using AArch64 state, MSR or MRS access trapped to EL2 or EL1. If FEAT_FGT is implemented, MDCR_EL2.TDCC for accesses to the DCC registers at EL0 and EL1 trapped to EL2, and MDCR_EL3.TDCC for accesses to the DCC registers at EL0, EL1, and EL2 trapped to EL3. CNTKCTL_EL1.{EL0PTEN, EL0VTEN, EL0PCTEN, EL0VCTEN} accesses to the Generic Timer registers using AArch64 state, MSR or MRS access trapped to EL2 or EL1. PMUSERENR_EL0, for accesses to the Performance Monitor registers using AArch64 state, MSR or MRS access trapped to EL2 or EL1. AMUSERENR_EL0.EN, for accesses to Activity Monitors System registers using AArch64 state, MSR or MRS access trapped to EL2 or EL1. HCR_EL2.{TRVM, TVM}, for accesses to virtual memory control registers using AArch64 state, MSR or MRS access trapped to EL2. HCR_EL2.TDZ, for execution of DC ZVA instructions using AArch64 state, execution is trapped to EL2. HCR_EL2.TTLB, for execution of TLB maintenance instructions using AArch64 state, execution is trapped to EL2. If FEAT_EVT is implemented, the following registers control traps for EL1 and EL0 registers and instructions that use this EC value: HCR_EL2.{TICAB, TOCU, TID4}. HCR2.{TICAB, TOCU, TID4}. If FEAT_EVT2 is implemented, the following registers control traps for EL1 and EL0 instructions that use this EC value: HCR_EL2.{TTLBOS, TTLBIS}. If FEAT_EVT2 is implemented, HCR2.TTLBIS controls traps for EL1 and EL0 instructions using AArch32 state that use this EC value. HCR_EL2.{TSW, TPC, TPU}, for execution of cache maintenance instructions using AArch64 state, execution is trapped to EL2. HCR_EL2.TACR, for accesses to the Auxiliary Control Register, ACTLR_EL1, using AArch64 state, MSR or MRS access trapped to EL2. HCR_EL2.TIDCP, for accesses to lockdown, DMA, and TCM operations using AArch64 state, MSR or MRS access trapped to EL2. If FEAT_TIDCP1 is implemented, SCTLR_EL2.TIDCP, for EL0 accesses to IMPLEMENTATION DEFINED functionality using AArch64 state, MSR or MRS access trapped to EL2. HCR_EL2.{TID1, TID2, TID3}, for accesses to ID group 1, ID group 2 or ID group 3 registers, using AArch64 state, MSR or MRS access trapped to EL2. If FEAT_MTE2 is implemented, HCR_EL2.TID5, for accesses to GMID_EL1, using AArch64 state, MRS or MSR access at EL1, trapped to EL2. If FEAT_IDTE3 is implemented, SCR_EL3.TID3, for accesses to ID group 3 registers using AArch64 state, at EL1 and EL2, trapped to EL3. CPTR_EL2.TCPAC, for accesses to CPACR_EL1, using AArch64 state, MSR or MRS access trapped to EL2. CPTR_EL2.TTA, for accesses to the trace System registers, using AArch64 state, MSR or MRS access trapped to EL2. MDCR_EL2.TTRF, for accesses to the trace filter control register, TRFCR_EL1, using AArch64 state, MSR or MRS access trapped to EL2. MDCR_EL2.TDRA, for accesses to Debug ROM registers, using AArch64 state, MSR or MRS access trapped to EL2. MDCR_EL2.TDOSA, for accesses to powerdown debug System registers using AArch64 state, MSR or MRS access trapped to EL2. CNTHCTL_EL2.{EL1PCEN, EL1PCTEN}, for accesses to the Generic Timer registers using AArch64 state, MSR or MRS access trapped to EL2. MDCR_EL2.TDA, for accesses to debug System registers using AArch64 state, MSR or MRS access trapped to EL2. MDCR_EL2.{TPM, TPMCR}, for accesses to Performance Monitor registers, using AArch64 state, MSR or MRS access trapped to EL2. CPTR_EL2.TAM, for accesses to Activity Monitors System registers, using AArch64 state, MSR or MRS access trapped to EL2. HCR_EL2.APK, for accesses to Pointer authentication key registers, using AArch64 state, MSR or MRS access trapped to EL2. HCR_EL2.{NV, NV1}, for Nested virtualization register access, using AArch64 state, MSR or MRS access, trapped to EL2. HCR_EL2.AT, for execution of AT S1E* instructions, using AArch64 state, execution is trapped to EL2. HCR_EL2.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access, trapped to EL2. SCR_EL3.APK, for accesses to Pointer authentication key registers, using AArch64 state, MSR or MRS access trapped to EL3. SCR_EL3.ST, for accesses to the Counter-timer Physical Secure timer registers, using AArch64 state, MSR or MRS access trapped to EL3. SCR_EL3.{TERR, FIEN}, for accesses to RAS registers, using AArch64 state, MSR or MRS access trapped to EL3. CPTR_EL3.TCPAC, for accesses to CPTR_EL2 and CPACR_EL1 using AArch64 state, MSR or MRS access trapped to EL3. CPTR_EL3.TTA, for accesses to the trace System registers, using AArch64 state, MSR or MRS access trapped to EL3. MDCR_EL3.TTRF, for accesses to the trace filter control registers, TRFCR_EL1 and TRFCR_EL2, using AArch64 state, MSR or MRS access trapped to EL3. MDCR_EL3.TDA, for accesses to debug System registers, using AArch64 state, MSR or MRS access trapped to EL3. MDCR_EL3.TDOSA, for accesses to powerdown debug System registers, using AArch64 state, MSR or MRS access trapped to EL3. MDCR_EL3.TPM, for accesses to Performance Monitor registers, using AArch64 state, MSR or MRS access trapped to EL3. If FEAT_SPE is implemented: MDCR_EL3.NSPB for accesses to Statistical Profiling and Profiling Buffer control registers, using AArch64 state, MSR or MRS access at EL1 and EL2 trapped to EL3. MDCR_EL2.TPMS for accesses to SPE registers, using AArch64 state, MSR or MRS access at EL1 trapped to EL2. CPTR_EL3.TAM, for accesses to Activity Monitors System registers, using AArch64 state, MSR or MRS access, trapped to EL3. If FEAT_FGT is implemented: SCR_EL3.FGTEn, for accesses to the fine-grained trap registers, MSR or MRS access at EL2 trapped to EL3. HFGRTR_EL2 for reads and HFGWTR_EL2 for writes of registers, using AArch64 state, MSR or MRS access at EL0 and EL1 trapped to EL2. HFGITR_EL2 for execution of system instructions trapped to EL2. HDFGRTR_EL2 for reads and HDFGWTR_EL2 for writes of registers, using AArch64 state, MSR or MRS access at EL0 and EL1 state trapped to EL2. HAFGRTR_EL2 for reads of Activity Monitor counters, using AArch64 state, MRS access at EL0 and EL1 trapped to EL2. If FEAT_RNG_TRAP is implemented, SCR_EL3.TRNDR for reads of RNDR and RNDRRS using AArch64 state, MRS access trapped to EL3. If FEAT_SME is implemented: CPTR_EL3.ESM, for MSR or MRS accesses to SMPRI_EL1 at EL1, EL2, and EL3, trapped to EL3. CPTR_EL3.ESM, for MSR or MRS accesses to SMPRIMAP_EL2 at EL2 and EL3, trapped to EL3. SCTLR_EL1.EnTP2, for MSR or MRS accesses to TPIDR2_EL0 at EL0, trapped to EL2 or EL1. SCTLR_EL2.EnTP2, for MSR or MRS accesses to TPIDR2_EL0 at EL0, trapped to EL2. SCR_EL3.EnTP2, for MSR or MRS accesses to TPIDR2_EL0 at EL0, EL1, and EL2, trapped to EL3. If FEAT_FPMR is implemented: SCTLR_EL1.EnFPM, for accesses to FPMR at EL0, trapped to EL2 or EL1. SCTLR_EL2.EnFPM, for accesses to FPMR at EL0, trapped to EL2. HCRX_EL2.EnFPM, for accesses to FPMR at EL0 and EL1, trapped to EL2. SCR_EL3.EnFPM, for accesses to FPMR at EL0, EL1, and EL2, trapped to EL3. If FEAT_NMI is implemented, HCRX_EL2.TALLINT, for MSR writes of ALLINT at EL1, trapped to EL2. If FEAT_FGT2 is implemented: SCR_EL3.FGTEn2, for accesses to the fine-grained trap registers, MSR or MRS access at EL2 trapped to EL3. HFGRTR2_EL2 for reads and HFGWTR2_EL2 for writes of registers, using AArch64 state, using MSR or MRS access at EL1 trapped to EL2. HDFGRTR2_EL2 for reads and HDFGWTR2_EL2 for writes of registers, using AArch64 state, using MSR or MRS access at EL0 and EL1 trapped to EL2. HFGITR2_EL2 for execution of system instructions trapped to EL2. If FEAT_ITE is implemented, MDCR_EL3.EnITE, for accesses to Instrumentation trace System registers, using AArch64 state, MSR or MRS access, trapped to EL3. If FEAT_MEC is implemented, SCR_EL3.MECEn, for accesses to MECID registers at EL2, trapped to EL3. If FEAT_SPE_FDS is implemented, MDCR_EL3.EnPMS3 for accesses to SPE registers, using AArch64 state, MSR or MRS access at EL1 and EL2 trapped to EL3. If FEAT_SPE_nVM is implemented, MDCR_EL3.EnPMS4 for accesses to SPE registers, using AArch64 state, MSR or MRS access at EL1 and EL2 trapped to EL3. If FEAT_RASv2 is implemented, SCR_EL3.TWERR, for accesses to Error Record registers, MSR access at EL1 and EL2 trapped to EL3. If FEAT_Debugv8p9 is implemented, MDCR_EL3.EBWE for accesses of MDSELR_EL1, using AArch64 state, MRS or MSR access at EL2 and EL1 trapped to EL3. If FEAT_PMUv3p9, FEAT_SPMU, FEAT_EBEP, or FEAT_PMUv3_SS is implemented, MDCR_EL3.EnPM2, for accesses to PMU registers, using AArch64 state, MSR or MRS access at EL2, EL1, and EL0, trapped to EL3. If FEAT_PMUv3_SS is implemented, MDCR_EL3.EnPMSS, for accesses to PMU Snapshot registers, using AArch64 state, MSR or MRS access at EL2 and EL1 trapped to EL3. If FEAT_THE is implemented, SCR_EL3.RCWMASKEn for accesses to RCWMASK_EL1 and RCWSMASK_EL1, using AArch64 state, MSR or MRS access at EL2 and EL1 trapped to EL3. If FEAT_AIE is implemented, SCR_EL3.AIEn for accesses to Extended Memory Attribute registers, MSR or MRS access at EL2 and EL1 trapped to EL3. If FEAT_S1PIE, FEAT_S2PIE, FEAT_S1POE, or FEAT_S2POE is implemented, SCR_EL3.PIEn for accesses to Permission Indirection, Overlay registers, MSR or MRS access at EL2, EL1 and EL0 trapped to EL3. If FEAT_MPAM_PE_BW_CTRL is implemented, MPAMBW2_EL2.{nTRAP_MPAMBWIDR_EL1, nTRAP_MPAMBW0_EL1, nTRAP_MPAMBW1_EL1} for accesses to MPAMBWn_EL1 registers, using AArch64 state, MRS or MSR access at EL1, trapped to EL2. If FEAT_MPAM_PE_BW_CTRL and FEAT_SME are implemented, MPAMBW2_EL2.nTRAP_MPAMBWSM_EL1, for accesses to MPAMBWSM_EL1, using AArch64 state, MRS or MSR access at EL1, trapped to EL2. If FEAT_MPAM_PE_BW_CTRL is implemented, MPAMBW3_EL3.nTRAPLOWER, for accesses to MPAMBW2_EL2 and MPAMBWn_EL1 registers, using AArch64 state, MRS or MSR access at EL1, trapped to EL3. If FEAT_HACDBS is implemented, SCR_EL3.HACDBSEn, for accesses to HACDBSBR_EL2 and HACDBSCONS_EL2, using AArch64 state, MRS or MSR access at EL2, trapped to EL3. If FEAT_HDBSS is implemented, SCR_EL3.HDBSSEn, for accesses to HDBSSBR_EL2 and HDBSSPROD_EL2, using AArch64 state, MRS or MSR access at EL2, trapped to EL3. If FEAT_SRMASK is implemented, SCR_EL3.SRMASKEn, for MSR or MRS accesses at EL2 or EL1 to the MASK registers using AArch64 state, trapped to EL3. an exception from MSRR, MRRS, or 128-bit System instruction execution in AArch64 state 24 22 24:22 Reserved, RES0. Op0 21 20 21:20 The Op0 value from the issued instruction. AU Op2 19 17 19:17 The Op2 value from the issued instruction. AU Op1 16 14 16:14 The Op1 value from the issued instruction. AU CRn 13 10 13:10 The CRn value from the issued instruction. AU Rt 9 6 9:6 The Rt value from the issued instruction, the general-purpose register used for the transfer. This value represents register pair of X[Rt:0], X[Rt:1]. AU 5 5 5 Reserved, RES0. CRm 4 1 4:1 The CRm value from the issued instruction. AU Direction 0 0 0 Indicates the direction of the trapped instruction. 0b0 Write access, MSRR instructions. 0b1 Read access, MRRS instructions. AU The following fields describe configuration settings for generating exceptions from an MSRR or MRRS access that are reported using EC value 0b010100: If FEAT_FGT is implemented: HFGRTR_EL2 for reads and HFGWTR_EL2 for writes of registers, using AArch64 state, accesses at EL1 trapped to EL2. If FEAT_FGT2 is implemented: HFGRTR2_EL2.nRCWSMASK_EL1 for reads and HFGWTR2_EL2.nRCWSMASK_EL1 for writes of RCWSMASK_EL1, using AArch64 state, accesses at EL1 trapped to EL2. If FEAT_SYSREG128 is implemented: SCTLR2_EL1.EnIDCP128 for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL0 trapped to EL1. SCTLR2_EL2.EnIDCP128 for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL0 trapped to EL2. HCRX_EL2.EnIDCP128 for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL1 and EL0 trapped to EL2. SCR_EL3.EnIDCP128 for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL2, EL1, and EL0 trapped to EL3. If FEAT_D128 is implemented: HCR_EL2.{TRVM, TVM} for accesses to TTBR0_EL1 and TTBR1_EL1, accesses at EL1 and EL0 trapped to EL2. HCRX_EL2.D128En for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL1 trapped to EL2. HFGITR_EL2 for execution of TLBIP system instructions trapped to EL2. HCR_EL2.{TTLB, TTLBOS, TTLBIS}, for execution of TLBIP instructions using AArch64 state, execution is trapped to EL2. SCR_EL3.D128En for accesses to 128-bit IMPLEMENTATION DEFINED System registers, accesses at EL2 and EL1 trapped to EL3. If FEAT_THE is implemented, SCR_EL3.RCWMASKEn for accesses to RCWMASK_EL1 and RCWSMASK_EL1, using AArch64 state, accesses at EL2 and EL1 trapped to EL3. an exception from an Instruction Abort The ISS2 encoding for an exception from an Instruction Abort includes further information about the exception if any of the following are true: FEAT_THE is implemented and memory access generates an Instruction Abort for AssuredOnly. FEAT_S1POE or FEAT_S2POE is implemented and a memory access generates an Instruction Abort due to a Permission fault. FEAT_HDBSS. FEAT_S2PIE. 24 22 24:22 Reserved, RES0. TopLevel 21 21 0 Indicates if the fault was due to TopLevel. 0b0 Fault is not due to TopLevel. 0b1 Fault is due to TopLevel. AU When FEAT_THE is implemented 21 21 21 Reserved, RES0. Otherwise 20 15 20:15 Reserved, RES0. PFV 14 14 0 PFAR Valid. Describes whether the PFAR_EL2 register is valid. This field is valid only if the IFSC code is 0b10000, 0b01001x, or 0b0101xx. 0b0 PFAR_EL2 is UNKNOWN. 0b1 PFAR_EL2 is valid. AU When FEAT_PFAR is implemented 14 14 14 Reserved, RES0. Otherwise 13 13 13 Reserved, RES0. SET 12 11 1:0 Synchronous Error Type. When IFSC is 0b010000, describes the PE error state after taking the Instruction Abort exception. All other values are reserved. Software can use this information to determine what recovery might be possible. Taking a synchronous External abort exception might result in a PE state that is not recoverable. 0b00 Recoverable state (UER). 0b10 Uncontainable (UC). When FEAT_RASv2 is not implemented 0b11 Restartable state (UEO). AU When FEAT_RAS is implemented and GetESR_ELx_IFSC(EL2) == '010000' 12 11 12:11 Reserved, RES0. Otherwise FnV 10 10 0 FAR not Valid, for a synchronous External abort other than a synchronous External abort on a translation table walk. 0b0 FAR is valid. 0b1 FAR is not valid, and holds an UNKNOWN value. AU When GetESR_ELx_IFSC(EL2) == '010000' 10 10 10 Reserved, RES0. Otherwise EA 9 9 9 External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External aborts. For any abort other than an External abort this bit returns a value of 0. AU 8 8 8 Reserved, RES0. S1PTW 7 7 7 For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 translation table walk: For any abort other than a stage 2 fault this bit is RES0. 0b0 Fault not on a stage 2 translation for a stage 1 translation table walk. 0b1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. AU 6 6 6 Reserved, RES0. IFSC 5 0 5:0 Instruction Fault Status Code. All other values are reserved. For more information about the lookup level associated with a fault, see 'The lookup level associated with MMU faults'. If the S1PTW bit is set, then the level refers the level of the stage2 translation that is translating a stage 1 translation walk. 0b000000 Address size fault, level 0 of translation or translation table base register. 0b000001 Address size fault, level 1. 0b000010 Address size fault, level 2. 0b000011 Address size fault, level 3. 0b000100 Translation fault, level 0. 0b000101 Translation fault, level 1. 0b000110 Translation fault, level 2. 0b000111 Translation fault, level 3. 0b001001 Access flag fault, level 1. 0b001010 Access flag fault, level 2. 0b001011 Access flag fault, level 3. 0b001000 Access flag fault, level 0. When FEAT_LPA2 is implemented 0b001100 Permission fault, level 0. When FEAT_LPA2 is implemented 0b001101 Permission fault, level 1. 0b001110 Permission fault, level 2. 0b001111 Permission fault, level 3. 0b010000 Synchronous External abort, not on translation table walk or hardware update of translation table. 0b010010 Synchronous External abort on translation table walk or hardware update of translation table, level -2. When FEAT_D128 is implemented 0b010011 Synchronous External abort on translation table walk or hardware update of translation table, level -1. When FEAT_LPA2 is implemented 0b010100 Synchronous External abort on translation table walk or hardware update of translation table, level 0. 0b010101 Synchronous External abort on translation table walk or hardware update of translation table, level 1. 0b010110 Synchronous External abort on translation table walk or hardware update of translation table, level 2. 0b010111 Synchronous External abort on translation table walk or hardware update of translation table, level 3. 0b011000 Synchronous parity or ECC error on memory access, not on translation table walk. When FEAT_RAS is not implemented 0b011011 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level -1. When FEAT_LPA2 is implemented and FEAT_RAS is not implemented 0b011100 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 0. When FEAT_RAS is not implemented 0b011101 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 1. When FEAT_RAS is not implemented 0b011110 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 2. When FEAT_RAS is not implemented 0b011111 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 3. When FEAT_RAS is not implemented 0b100010 Granule Protection Fault on translation table walk or hardware update of translation table, level -2. When FEAT_D128 is implemented and FEAT_RME is implemented 0b100011 Granule Protection Fault on translation table walk or hardware update of translation table, level -1. When FEAT_RME is implemented and FEAT_LPA2 is implemented 0b100100 Granule Protection Fault on translation table walk or hardware update of translation table, level 0. When FEAT_RME is implemented 0b100101 Granule Protection Fault on translation table walk or hardware update of translation table, level 1. When FEAT_RME is implemented 0b100110 Granule Protection Fault on translation table walk or hardware update of translation table, level 2. When FEAT_RME is implemented 0b100111 Granule Protection Fault on translation table walk or hardware update of translation table, level 3. When FEAT_RME is implemented 0b101000 Granule Protection Fault, not on translation table walk or hardware update of translation table. When FEAT_RME is implemented 0b101001 Address size fault, level -1. When FEAT_LPA2 is implemented 0b101010 Translation fault, level -2. When FEAT_D128 is implemented 0b101011 Translation fault, level -1. When FEAT_LPA2 is implemented 0b101100 Address Size fault, level -2. When FEAT_D128 is implemented 0b110000 TLB conflict abort. 0b110001 Unsupported atomic hardware update fault. When FEAT_HAF is implemented AU When FEAT_SME is implemented an exception due to SME functionality The accesses covered by this trap include: Execution of SME instructions. Execution of SVE and Advanced SIMD instructions, when the PE is in Streaming SVE mode. Direct accesses of SVCR, SMCR_EL1, SMCR_EL2, SMCR_EL3. 24 3 24:3 Reserved, RES0. SMTC 2 0 2:0 SME Trap Code. Identifies the reason for instruction trapping. All other values are reserved. 0b000 Access to SME functionality trapped as a result of CPACR_EL1.SMEN, CPTR_EL2.SMEN, CPTR_EL2.TSM, or CPTR_EL3.ESM, that is not reported using EC value 0b000000. 0b001 Advanced SIMD, SVE, or SVE2 instruction trapped because PSTATE.SM is 1. 0b010 SME instruction trapped because PSTATE.SM is 0. 0b011 SME instruction trapped because PSTATE.ZA is 0. 0b100 Access to the SME2 ZT0 register trapped as a result of SMCR_EL1.EZT0, SMCR_EL2.EZT0, or SMCR_EL3.EZT0. When FEAT_SME2 is implemented The following fields describe the configuration settings for the traps that are reported using the EC value 0b011101: CPACR_EL1.SMEN, for execution of SME instructions, SVE instructions when the PE is in Streaming SVE mode, and instructions that directly access SVCR and SMCR_EL1 System registers at EL1 and EL0, trapped to EL2 or EL1. CPTR_EL2.SMEN and CPTR_EL2.TSM, for execution of SME instructions, SVE instructions when the PE is in Streaming SVE mode, and instructions that directly access SVCR, SMCR_EL1, SMCR_EL2 at EL2, EL1, and EL0, trapped to EL2. CPTR_EL3.ESM, for execution of SME instructions, SVE instructions when the PE is in Streaming SVE mode, and instructions that directly access SVCR, SMCR_EL1, SMCR_EL2, SMCR_EL3 from all Exception levels and any Security state, trapped to EL3. If FEAT_SME2 is implemented: SMCR_EL1.EZT0, for accesses to ZT0 at EL1 and EL0, trapped to EL2 or EL1. SMCR_EL2.EZT0, for accesses to ZT0 at EL2, EL1, and EL0, trapped to EL2. SMCR_EL3.EZT0, for accesses to ZT0 at any Exception level, trapped to EL3. When FEAT_SME is implemented an exception from a Data Abort The ISS2 encoding for an exception from a Data Abort includes further information about the exception when any of the following features are implemented: FEAT_LS64_V. FEAT_LS64_ACCDATA. FEAT_THE. FEAT_S1POE or FEAT_S2POE. FEAT_S1PIE or FEAT_S2PIE. FEAT_GCS. FEAT_MTE_CANONICAL_TAGS. FEAT_MTE_PERM. FEAT_HDBSS. ISV 24 24 24 Instruction Syndrome Valid. Indicates whether the syndrome information in ISS[23:14] represents the instruction syndrome fields {SAS, SSE, SRT, SF, AR}. The ISV field is only relevant for the following instructions: An AArch64 load or store of a single general-purpose register (including the register specified with 0b11111, including those with Acquire/Release semantics, but excluding Load Exclusive or Store Exclusive and excluding those with writeback). An AArch32 instruction LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, LDRSB, LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, STRB, STLB, or STRBT, where both of the following apply: It is not performing register writeback. It is not using R15 as a source or destination register. If FEAT_LS64 is implemented, an LD64B or ST64B instruction. If FEAT_LS64_V is implemented, an ST64BV instruction. If FEAT_LS64_ACCDATA is implemented, an ST64BV0 instruction. The ISV field is 1 if all of the following apply: The fault was not a stage 2 fault on a stage 1 translation table walk. If FEAT_RAS is implemented, the fault was not any kind of synchronous External abort. Any of the following apply: The fault was generated by one of the described AArch64 load or store instructions that transfer a single general-purpose register, and any of the following apply: The fault was a stage 2 fault. The fault was generated by one of the described AArch32 instructions and any of the following apply: The fault was a stage 2 fault. The fault was generated by one of the FEAT_LS64, FEAT_LS64_V or FEAT_LS64_ACCDATA instructions and the fault was a Translation fault, Access flag fault or Permission fault. One of the following applies: The address reported in FAR_EL2 is the lowest address accessed by the instruction. The address reported in FAR_EL2 is not the lowest address accessed by the instruction, and the implementation reports ISV as 1 in this case. Arm recommends against this behavior. Otherwise the value of this field is 0. The value of this field is 0 if any of the following apply:FEAT_MOPS is implemented and the fault was for a memory access generated by a Memory Copy and Memory Set instruction.FEAT_MTE is implemented and the fault was for a direct access to Allocation Tags.FEAT_GCS is implemented and the fault was for a Guarded control stack data access.FEAT_NV2 is implemented and the fault was for a system register access that was transformed to a load or store relative to VNCR_EL2.FEAT_LSE is implemented and the fault was for an atomic instruction.The value of this field is UNKNOWN when the following occurs:Stage 2 faults when the exception was generated in Debug state, in memory access mode.When FEAT_RAS is not implemented, it is IMPLEMENTATION DEFINED whether ISV is set to 1 or 0 on a synchronous External abort on a stage 2 translation table walk. 0b0 No valid instruction syndrome. ISS[23:14] do not represent an instruction syndrome. 0b1 ISS[23:14] hold a valid instruction syndrome. AU SAS 23 22 1:0 Syndrome Access Size. Indicates the size of the access attempted by the faulting operation. When FEAT_LS64 is implemented, if a memory access generated by an LD64B or ST64B instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0b11. When FEAT_LS64_V is implemented, if a memory access generated by an ST64BV instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0b11. When FEAT_LS64_ACCDATA is implemented, if a memory access generated by an ST64BV0 instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0b11. This field is UNKNOWN when the value of ISV is UNKNOWN. 0b00 Byte 0b01 Halfword 0b10 Word 0b11 Doubleword AU When ISV == '1' 23 22 23:22 Reserved, RES0. Otherwise SSE 21 21 0 Syndrome Sign Extend. For a byte, halfword, or word load operation, indicates whether the data item must be sign extended. When FEAT_LS64 is implemented, if a memory access generated by an LD64B or ST64B instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. When FEAT_LS64_V is implemented, if a memory access generated by an ST64BV instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. When FEAT_LS64_ACCDATA is implemented, if a memory access generated by an ST64BV0 instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. For all other operations, this field is 0. This field is UNKNOWN when the value of ISV is UNKNOWN. 0b0 Sign-extension not required. 0b1 Data item must be sign-extended. AU When ISV == '1' TopLevel 21 21 0 Indicates if the fault was due to TopLevel. 0b0 Fault is not due to TopLevel. 0b1 Fault is due to TopLevel. AU When ISV == '0' and FEAT_THE is implemented 21 21 21 Reserved, RES0. Otherwise SRT 20 16 4:0 Syndrome Register Transfer. The register number of the Wt/Xt/Rt operand of the faulting instruction. If the exception was taken from an Exception level that is using AArch32, then this is the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states'. This field is UNKNOWN when the value of ISV is UNKNOWN. AU When ISV == '1' 20 16 4:2 Reserved, RES0. When ISV == '0', FEAT_RASv2 is implemented, and GetESR_ELx_DFSC(EL2) IN {'010000', '01001x', '0101xx'} WU 20 16 1:0 Write Update. Describes whether a store instruction that generated an External abort updated the location. In the description of this field, a store instruction is any memory-writing instruction that explicitly performs a store. This includes instructions that both read and write memory. 0b00 Not a store instruction or translation table update, or the location might have been updated. 0b10 Store instruction or translation table update that did not update the location. 0b11 Store instruction or translation table update that updated the location. AU When ISV == '0', FEAT_RASv2 is implemented, and GetESR_ELx_DFSC(EL2) IN {'010000', '01001x', '0101xx'} 20 16 20:16 Reserved, RES0. Otherwise SF 15 15 0 Sixty Four bit general-purpose register transfer. Width of the register accessed by the instruction is 64-bit. This field specifies the register width identified by the instruction, not the Execution state.When FEAT_LS64 is implemented, if a memory access generated by an LD64B or ST64B instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 1. When FEAT_LS64_V is implemented, if a memory access generated by an ST64BV instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 1. When FEAT_LS64_ACCDATA is implemented, if a memory access generated by an ST64BV0 instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 1. This field is UNKNOWN when the value of ISV is UNKNOWN. 0b0 Instruction loads/stores a 32-bit general-purpose register. 0b1 Instruction loads/stores a 64-bit general-purpose register. AU When ISV == '1' FnP 15 15 0 FAR not Precise. 0b0 The FAR holds the faulting virtual address that generated the Data Abort. 0b1 The FAR holds any virtual address within the naturally-aligned granule that contains the faulting virtual address that generated a Data Abort due to an SVE contiguous vector load/store instruction, or an SME load/store instruction. For more information about the naturally-aligned fault granule, see FAR_ELx (for example, FAR_EL1). When FEAT_SME is implemented or FEAT_SVE is implemented AU Otherwise AR 14 14 0 Acquire/Release. When FEAT_LS64 is implemented, if a memory access generated by an LD64B or ST64B instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. When FEAT_LS64_V is implemented, if a memory access generated by an ST64BV instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. When FEAT_LS64_ACCDATA is implemented, if a memory access generated by an ST64BV0 instruction generates a Data Abort for a Translation fault, Access flag fault, or Permission fault, then this field is 0. This field is UNKNOWN when the value of ISV is UNKNOWN. For a load-acquire instruction that does not have acquire semantics as the result of the destination register being ZR, it is IMPLEMENTATION SPECIFIC whether this field is reported as 0 or 1. 0b0 Instruction did not have acquire/release semantics. 0b1 Instruction did have acquire/release semantics. AU When ISV == '1' PFV 14 14 0 PFAR Valid. Describes whether the PFAR_EL2 register is valid. 0b0 PFAR_EL2 is UNKNOWN. 0b1 PFAR_EL2 is valid. AU When FEAT_PFAR is implemented, ISV == '0', and GetESR_ELx_DFSC(EL2) IN {'010000', '01001x', '0101xx'} 14 14 14 Reserved, RES0. Otherwise VNCR 13 13 13 Indicates that the fault came from use of VNCR_EL2 register by EL1 code. 0b0 The fault was not generated by the use of VNCR_EL2 by EL1 code. 0b1 The fault was generated by the use of VNCR_EL2 by EL1 code. When FEAT_NV2 is implemented AU LST 12 11 1:0 Load/Store Type. Used when a Translation fault, Access flag fault, or Permission fault generates a Data Abort reported with ISV=1. 0b00 The instruction that generated the Data Abort is not specified by this field. 0b01 An ST64BV instruction generated the Data Abort. When FEAT_LS64_V is implemented 0b10 An LD64B or ST64B instruction generated the Data Abort. When FEAT_LS64 is implemented 0b11 An ST64BV0 instruction generated the Data Abort. When FEAT_LS64_ACCDATA is implemented AU When GetESR_ELx_DFSC(EL2) IN {'00xxxx', '10101x', '0000xx'} SET 12 11 1:0 Synchronous Error Type. Used when a synchronous External abort, not on a Translation table walk or hardware update of the Translation table, generated the Data Abort. Describes the PE error state after taking the Data Abort exception. Software can use this information to determine what recovery might be possible. Taking a synchronous External abort exception might result in a PE state that is not recoverable. 0b00 Recoverable state (UER). 0b10 Uncontainable (UC). If FEAT_RASv2 is implemented, this value is reserved. When FEAT_RASv2 is implemented 0b11 Restartable state (UEO). AU When FEAT_RAS is implemented and GetESR_ELx_DFSC(EL2) == '010000' 12 11 12:11 Reserved, RES0. Otherwise FnV 10 10 10 FAR not Valid, for a synchronous External abort other than a synchronous External abort on a translation table walk. This field is valid only if the DFSC code is 0b010000. It is RES0 for all other aborts. 0b0 FAR is valid. 0b1 FAR is not valid, and holds an UNKNOWN value. AU EA 9 9 9 External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External aborts. For any abort other than an External abort this bit returns a value of 0. AU CM 8 8 8 Cache maintenance. Indicates whether the Data Abort came from a cache maintenance or address translation instruction: 0b0 The Data Abort was not generated by the execution of one of the System instructions identified in the description of value 1. 0b1 The Data Abort was generated by either the execution of a cache maintenance instruction or by a synchronous fault on the execution of an address translation instruction. The DC ZVA, DC GVA, and DC GZVA instructions are not classified as cache maintenance instructions, and therefore their execution cannot cause this field to be set to 1. AU S1PTW 7 7 7 For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 translation table walk: For any abort other than a stage 2 fault this bit is RES0. 0b0 Fault not on a stage 2 translation for a stage 1 translation table walk. 0b1 Fault on the stage 2 translation of an access for a stage 1 translation table walk. AU WnR 6 6 6 Write not Read. Indicates whether a synchronous abort was caused by an instruction writing to a memory location, or by an instruction reading from a memory location. For faults on cache maintenance and address translation instructions, this bit always returns a value of 1. For faults from an atomic instruction that both reads and writes from a memory location, this bit is set to 0 if a read of the address specified by the instruction would have generated the fault which is being reported, otherwise it is set to 1. The architecture permits, but does not require, a relaxation of this requirement such that for all stage 2 aborts on stage 1 translation table walks for atomic instructions, the WnR bit is always 0. This field is UNKNOWN for: If FEAT_RASv2 is implemented, an External abort on an Atomic access, reported with ESR_EL2.WU set to 0b00. A fault reported using a DFSC value of 0b110101, indicating an unsupported Exclusive or atomic access. A fault reported using a DFSC value of 0b110001, indicating an unsupported atomic hardware update fault. 0b0 Abort caused by an instruction reading from a memory location. 0b1 Abort caused by an instruction writing to a memory location. AU DFSC 5 0 5:0 Data Fault Status Code. All other values are reserved. For more information about the lookup level associated with a fault, see 'The lookup level associated with MMU faults'. If the S1PTW bit is set, then the level refers the level of the stage2 translation that is translating a stage 1 translation walk. 0b000000 Address size fault, level 0 of translation or translation table base register. 0b000001 Address size fault, level 1. 0b000010 Address size fault, level 2. 0b000011 Address size fault, level 3. 0b000100 Translation fault, level 0. 0b000101 Translation fault, level 1. 0b000110 Translation fault, level 2. 0b000111 Translation fault, level 3. 0b001001 Access flag fault, level 1. 0b001010 Access flag fault, level 2. 0b001011 Access flag fault, level 3. 0b001000 Access flag fault, level 0. When FEAT_LPA2 is implemented 0b001100 Permission fault, level 0. When FEAT_LPA2 is implemented 0b001101 Permission fault, level 1. 0b001110 Permission fault, level 2. 0b001111 Permission fault, level 3. 0b010000 Synchronous External abort, not on translation table walk or hardware update of translation table. 0b010001 Synchronous Tag Check Fault. When FEAT_MTE2 is implemented 0b010010 Synchronous External abort on translation table walk or hardware update of translation table, level -2. When FEAT_D128 is implemented 0b010011 Synchronous External abort on translation table walk or hardware update of translation table, level -1. When FEAT_LPA2 is implemented 0b010100 Synchronous External abort on translation table walk or hardware update of translation table, level 0. 0b010101 Synchronous External abort on translation table walk or hardware update of translation table, level 1. 0b010110 Synchronous External abort on translation table walk or hardware update of translation table, level 2. 0b010111 Synchronous External abort on translation table walk or hardware update of translation table, level 3. 0b011000 Synchronous parity or ECC error on memory access, not on translation table walk. When FEAT_RAS is not implemented 0b011011 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level -1. When FEAT_LPA2 is implemented and FEAT_RAS is not implemented 0b011100 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 0. When FEAT_RAS is not implemented 0b011101 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 1. When FEAT_RAS is not implemented 0b011110 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 2. When FEAT_RAS is not implemented 0b011111 Synchronous parity or ECC error on memory access on translation table walk or hardware update of translation table, level 3. When FEAT_RAS is not implemented 0b100001 Alignment fault. 0b100010 Granule Protection Fault on translation table walk or hardware update of translation table, level -2. When FEAT_D128 is implemented and FEAT_RME is implemented 0b100011 Granule Protection Fault on translation table walk or hardware update of translation table, level -1. When FEAT_RME is implemented and FEAT_LPA2 is implemented 0b100100 Granule Protection Fault on translation table walk or hardware update of translation table, level 0. When FEAT_RME is implemented 0b100101 Granule Protection Fault on translation table walk or hardware update of translation table, level 1. When FEAT_RME is implemented 0b100110 Granule Protection Fault on translation table walk or hardware update of translation table, level 2. When FEAT_RME is implemented 0b100111 Granule Protection Fault on translation table walk or hardware update of translation table, level 3. When FEAT_RME is implemented 0b101000 Granule Protection Fault, not on translation table walk or hardware update of translation table. When FEAT_RME is implemented 0b101001 Address size fault, level -1. When FEAT_LPA2 is implemented 0b101010 Translation fault, level -2. When FEAT_D128 is implemented 0b101011 Translation fault, level -1. When FEAT_LPA2 is implemented 0b101100 Address Size fault, level -2. When FEAT_D128 is implemented 0b110000 TLB conflict abort. 0b110001 Unsupported atomic hardware update fault. When FEAT_HAF is implemented 0b110100 IMPLEMENTATION DEFINED fault (Lockdown). 0b110101 IMPLEMENTATION DEFINED fault (Unsupported Exclusive or Atomic access). AU an exception from a trapped floating-point exception 24 24 24 Reserved, RES0. TFV 23 23 23 Trapped Fault Valid bit. Indicates whether the IDF, IXF, UFF, OFF, DZF, and IOF bits hold valid information about trapped floating-point exceptions. It is IMPLEMENTATION DEFINED whether this field is set to 0 on an exception generated by a trapped floating-point exception from an instruction that is performing floating-point operations on more than one lane of a vector. This is not a requirement. Implementations can set this field to 1 on a trapped floating-point exception from an instruction and return valid information in the {IDF, IXF, UFF, OFF, DZF, IOF} fields. 0b0 The IDF, IXF, UFF, OFF, DZF, and IOF bits do not hold valid information about trapped floating-point exceptions and are UNKNOWN. 0b1 One or more floating-point exceptions occurred during an operation performed while executing the reported instruction. The IDF, IXF, UFF, OFF, DZF, and IOF bits indicate trapped floating-point exceptions that occurred. For more information, see 'Floating-point exceptions and exception traps'. AU 22 11 22:11 Reserved, RES0. VECITR 10 8 10:8 For a trapped floating-point exception from an instruction executed in AArch32 state this field is RES1. For a trapped floating-point exception from an instruction executed in AArch64 state this field is UNKNOWN. AU IDF 7 7 7 Input Denormal floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Input denormal floating-point exception has not occurred. 0b1 Input denormal floating-point exception occurred during execution of the reported instruction. AU 6 5 6:5 Reserved, RES0. IXF 4 4 4 Inexact floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Inexact floating-point exception has not occurred. 0b1 Inexact floating-point exception occurred during execution of the reported instruction. AU UFF 3 3 3 Underflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Underflow floating-point exception has not occurred. 0b1 Underflow floating-point exception occurred during execution of the reported instruction. AU OFF 2 2 2 Overflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Overflow floating-point exception has not occurred. 0b1 Overflow floating-point exception occurred during execution of the reported instruction. AU DZF 1 1 1 Divide by Zero floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Divide by Zero floating-point exception has not occurred. 0b1 Divide by Zero floating-point exception occurred during execution of the reported instruction. AU IOF 0 0 0 Invalid Operation floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are: 0b0 Invalid Operation floating-point exception has not occurred. 0b1 Invalid Operation floating-point exception occurred during execution of the reported instruction. AU In an implementation that supports the trapping of floating-point exceptions: From an Exception level using AArch64, the FPCR.{IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of the floating-point exception traps. From an Exception level using AArch32, the FPSCR.{IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of the floating-point exception traps. When FEAT_GCS is implemented a GCS exception 24 24 24 Reserved, RES0. ExType 23 20 23:20 The first level classification of GCS exceptions. 0b0000 The exception reported is a Guarded Control Stack Data Check Exception. 0b0001 The exception reported is an EXLOCK Exception. 0b0010 The exception reported is a trap exception on GCSSTR or GCSSTTR instruction execution. AU 19 15 19:15 Reserved, RES0. Raddr 14 10 4:0 Indicates the data address register number supplied in the instruction that has been trapped. AU When GetESR_ELx_ExType(EL2) == '0010' 14 10 14:10 Reserved, RES0. Otherwise Rn 9 5 4:0 Indicates a register number used by the instruction that caused the Guarded Control Stack Data Check Exception. For a procedure return instruction reported with ESR_EL2.ISS.IT as 0b00000, contains the register number for the register which contains the target address of the branch. For a GCSPOPM instruction reported with ESR_EL2.ISS.IT as 0b00001, contains the register number for the register which is the destination register of the instruction. For a procedure return instruction reported with ESR_EL2.ISS.IT as 0b00010 or 0b00011, contains the value 0b11110, indicating X30. For a GCSSS1 instruction reported with ESR_EL2.ISS.IT as 0b00100, contains the register number for the register which is the input register of the instruction. If ESR_EL2.ISS.IT is reported as 0b00101 or 0b01000, this field is UNKNOWN If ESR_EL2.ISS.IT is reported as 0b01001, this field is 0b11111 AU When GetESR_ELx_ExType(EL2) == '0000' Rvalue 9 5 4:0 Indicates the data value register number supplied in the instruction that has been trapped. AU When GetESR_ELx_ExType(EL2) == '0010' 9 5 9:5 Reserved, RES0. Otherwise IT 4 0 4:0 Type of the instruction that caused the Guarded Control Stack Data Check Exception. All other values are reserved 0b00000 Guarded Control Stack Data Check Exception is from a procedure return instruction without Pointer authentication. 0b00001 Guarded Control Stack Data Check Exception is from a GCSPOPM instruction. 0b00010 Guarded Control Stack Data Check Exception is from a procedure return instruction with Pointer authentication that uses key A. 0b00011 Guarded Control Stack Data Check Exception is from a procedure return instruction with Pointer authentication that uses key B. 0b00100 Guarded Control Stack Data Check Exception is from a GCSSS1 instruction. 0b00101 Guarded Control Stack Data Check Exception is from a GCSSS2 instruction. 0b01000 Guarded Control Stack Data Check Exception is from a GCSPOPCX instruction. 0b01001 Guarded Control Stack Data Check Exception is from a GCSPOPX instruction. AU When GetESR_ELx_ExType(EL2) == '0000' 4 0 4:0 Reserved, RES0. Otherwise The following fields describe the configuration settings for the traps that are reported using EC value 0b101101 and ExType value 0b0010: GCSCRE0_EL1.STREn GCSCR_EL1.STREn. GCSCR_EL2.STREn. GCSCR_EL3.STREn. HFGITR_EL2.nGCSSTR_EL1. When FEAT_GCS is implemented an SError exception In earlier versions of the architecture, an SError exception is referred to as an SError interrupt or an asynchronous External abort exception. IDS 24 24 24 IMPLEMENTATION DEFINED syndrome. This field was previously called ISV. 0b0 Bits [23:0] of the ISS field holds the fields described in this encoding. If FEAT_RAS is not implemented, bits [23:0] of the ISS field are RES0. 0b1 Bits [23:0] of the ISS field holds IMPLEMENTATION DEFINED syndrome information that can be used to provide additional information about the SError exception. AU 23 19 23:19 Reserved, RES0. ELS 18 18 0 Meaning of ELR_ELx. SError exceptions that report this field is 1 are not required to be precise. The ESR_EL2.AET field describes whether the exception is precise or imprecise. Corrected, Recoverable or Restartable exceptions are precise. Unrecoverable or Uncontainable exceptions are imprecise. 0b0 Asynchronous. Does not indicate the trigger for the exception. 0b1 Synchronous. The exception was triggered by the instruction at ELR_ELx. AU When FEAT_RASv2 is implemented and GetESR_ELx_DFSC(EL2) == '010001' 18 18 18 Reserved, RES0. Otherwise WU 17 16 1:0 Write Update. Describes whether a store instruction that generated an External abort updated the location. In the description of this field, a store instruction is any memory-writing instruction that explicitly performs a store. This includes instructions that both read and write memory. 0b00 Not a store instruction or translation table update, or the location might have been updated. 0b10 Store instruction or translation table update that did not update the location. 0b11 Store instruction or translation table update that updated the location. AU When FEAT_RASv2 is implemented and GetESR_ELx_DFSC(EL2) == '010001' 17 16 17:16 Reserved, RES0. Otherwise VFV 15 15 0 FAR Valid. Indicates the FAR_EL2 register contains a valid virtual address. 0b0 FAR_EL2 is not valid, and holds an UNKNOWN value. 0b1 FAR_EL2 contains a valid virtual address associated with the error. AU When FEAT_RASv2 is implemented and GetESR_ELx_DFSC(EL2) == '010001' 15 15 15 Reserved, RES0. Otherwise PFV 14 14 0 PFAR Valid. Describes whether the PFAR_EL2 register is valid. 0b0 PFAR_EL2 is UNKNOWN. 0b1 PFAR_EL2 is valid. AU When FEAT_PFAR is implemented and GetESR_ELx_DFSC(EL2) == '010001' 14 14 14 Reserved, RES0. Otherwise IESB 13 13 0 Implicit error synchronization event. This field is set to 1 when the SError exception was synchronized by an implicit error synchronization event and taken immediately on exception entry. It this field is set to an IMPLEMENTATION SPECIFIC choice of 0 or 1 when the SError exception was synchronized by an implicit error synchronization event and taken immediately on an exception return. For all other SError exceptions, this field is set to 0. 0b0 The SError exception was either not synchronized by the implicit error synchronization event or not taken immediately. 0b1 The SError exception was synchronized by the implicit error synchronization event and taken immediately. AU When FEAT_IESB is implemented and GetESR_ELx_DFSC(EL2) == '010001' 13 13 13 Reserved, RES0. Otherwise AET 12 10 2:0 Asynchronous Error Type. Describes the PE error state after taking the SError exception. All other values are reserved. If multiple errors are taken as a single SError exception, the overall PE error state is reported. Software can use this information to determine what recovery might be possible. The recovery software must also examine any implemented fault records to determine the location and extent of the error. 0b000 Uncontainable (UC). 0b001 Unrecoverable state (UEU). 0b010 Restartable state (UEO). 0b011 Recoverable state (UER). 0b110 Corrected (CE). AU When FEAT_RAS is implemented and GetESR_ELx_DFSC(EL2) == '010001' 12 10 12:10 Reserved, RES0. Otherwise EA 9 9 0 External abort type. Provides an IMPLEMENTATION DEFINED classification of External aborts. AU When FEAT_RAS is implemented and GetESR_ELx_DFSC(EL2) == '010001' 9 9 9 Reserved, RES0. Otherwise 8 8 8 Reserved, RES0. WnRV 7 7 0 ESR_EL2.WnR valid. 0b0 ESR_EL2.WnR is not valid and has been set to 0. 0b1 ESR_EL2.WnR is valid. AU When FEAT_RASv2 is implemented and GetESR_ELx_DFSC(EL2) == '010001' 7 7 7 Reserved, RES0. Otherwise WnR 6 6 0 Write-not-Read. When the WnRV field is 1, indicates whether an exception was caused by an instruction writing to a memory location, or by an instruction reading from a memory location. Accessing this bit has the following behavior: This bit is RES0 if ESR_EL2.WnRV is 0. This bit is not valid and reads UNKNOWN if an External abort on a Atomic access, reported with ESR_EL2.WU == 0b00. Otherwise RW. 0b0 Exception was caused by an instruction reading from a memory location. 0b1 Exception was caused by an instruction writing to a memory location. AU When FEAT_RASv2 is implemented and GetESR_ELx_DFSC(EL2) == '010001' 6 6 6 Reserved, RES0. Otherwise DFSC 5 0 5:0 Data Fault Status Code. All other values are reserved. 0b000000 Uncategorized error. 0b010001 Asynchronous SError exception. AU When FEAT_RAS is implemented 5 0 5:0 Reserved, RES0. Otherwise an exception from a Breakpoint or Vector Catch debug exception 24 6 24:6 Reserved, RES0. IFSC 5 0 5:0 Instruction Fault Status Code. 0b100010 Debug exception. AU For more information about generating these exceptions: For exceptions from AArch64, see 'Breakpoint exceptions'. For exceptions from AArch32, see 'Breakpoint exceptions' and 'Vector Catch exceptions'. an exception from a Software Step exception ISV 24 24 24 Instruction syndrome valid. Indicates whether the EX bit, ISS[6], is valid, as follows: See the EX bit description for more information. 0b0 EX bit is RES0. 0b1 EX bit is valid. AU 23 7 23:7 Reserved, RES0. EX 6 6 6 Exclusive operation. If the ISV bit is set to 1, this bit indicates whether a Load-Exclusive instruction was stepped. If the ISV bit is set to 0, this bit is RES0, indicating no syndrome data is available. 0b0 An instruction other than a Load-Exclusive instruction was stepped. 0b1 A Load-Exclusive instruction was stepped. AU IFSC 5 0 5:0 Instruction Fault Status Code. 0b100010 Debug exception. AU For more information about generating these exceptions, see 'Software Step exceptions'. an exception from a Watchpoint exception 24 24 24 Reserved, RES0. WPT 23 18 5:0 Watchpoint number. All other values are reserved. When FEAT_Debugv8p2 is implemented 23 18 23:18 Reserved, RES0. Otherwise WPTV 17 17 0 Watchpoint number Valid. If FEAT_Debugv8p9 is implemented, value 0 is not permitted. When a Watchpoint exception is triggered by a watchpoint match: If FEAT_Debugv8p9 is implemented or the PE sets any of FnV, FnP, or WPF to 1, then the PE sets WPTV to 1. Otherwise, the PE sets WPTV to an IMPLEMENTATION DEFINED value, 0 or 1. 0b0 The WPT field is invalid, and holds an UNKNOWN value. 0b1 The WPT field is valid, and holds the number of a watchpoint that triggered a Watchpoint exception. When FEAT_Debugv8p2 is implemented 17 17 17 Reserved, RES0. Otherwise WPF 16 16 16 Watchpoint might be false-positive. Arm strongly recommends that this bit is set to 0, other than when one of the following instructions might generate a watchpoint match for an address or address range that the instruction does not access: An SVE contiguous vector load/store instruction, when the PE is in Streaming SVE mode. An SME load/store instruction. 0b0 The watchpoint matched an address or address range that was accessed by the instruction. 0b1 The watchpoint matched an address or address range that might not have been accessed by the instruction. When FEAT_SVE is implemented or FEAT_SME is implemented FnP 15 15 15 FAR not Precise. This field only has meaning if the FAR is valid; that is, when the FnV field is 0. If the FnV field is 1, the FnP field is 0. 0b0 If the FnV field is 0, the FAR holds the virtual address of an access or set of contiguous accesses that triggered a Watchpoint exception. 0b1 The FAR holds any address within the smallest implemented translation granule that contains the virtual address of an access or set of contiguous accesses that triggered a Watchpoint exception. When FEAT_SVE is implemented or FEAT_SME is implemented 14 14 14 Reserved, RES0. VNCR 13 13 13 Indicates that the watchpoint came from use of VNCR_EL2 register by EL1 code. 0b0 The watchpoint was not generated by the use of VNCR_EL2 by EL1 code. 0b1 The watchpoint was generated by the use of VNCR_EL2 by EL1 code. When FEAT_NV2 is implemented AU 12 11 12:11 Reserved, RES0. FnV 10 10 10 FAR not Valid. 0b0 The FAR is valid, and its value is as described by the FnP field. 0b1 The FAR is invalid, and holds an UNKNOWN value. When FEAT_SVE is implemented or FEAT_SME is implemented 9 9 9 Reserved, RES0. CM 8 8 8 Cache maintenance. Indicates whether the Watchpoint exception came from a cache maintenance instruction: 0b0 The Watchpoint exception was not generated by the execution of one of the System instructions identified in the description of value 1. 0b1 The Watchpoint exception was generated by the execution of a cache maintenance instruction. The DC ZVA, DC GVA, and DC GZVA instructions are not classified as a cache maintenance instructions, and therefore their execution does not cause this field to be set to 1. AU 7 7 7 Reserved, RES0. WnR 6 6 6 Write not Read. Indicates whether the Watchpoint exception was caused by an instruction writing to a memory location, or by an instruction reading from a memory location. For Watchpoint exceptions on cache maintenance instructions, this bit always returns a value of 1. For Watchpoint exceptions from an atomic instruction, this field is set to 0 if a read of the location would have generated the Watchpoint exception, otherwise it is set to 1. If multiple watchpoints match on the same access, it is UNPREDICTABLE which watchpoint generates the Watchpoint exception. 0b0 Watchpoint exception caused by an instruction reading from a memory location. 0b1 Watchpoint exception caused by an instruction writing to a memory location. AU DFSC 5 0 5:0 Data Fault Status Code. 0b100010 Debug exception. AU For more information about generating these exceptions, see 'Watchpoint exceptions'. an exception from execution of a Breakpoint instruction 24 16 24:16 Reserved, RES0. Comment 15 0 15:0 Set to the instruction comment field value, zero extended as necessary. For the AArch32 BKPT instructions, the comment field is described as the immediate field. AU For more information about generating these exceptions, see 'Breakpoint instruction exceptions'. When FEAT_NV is implemented or FEAT_FGT is implemented an exception from an ERET, ERETAA, or ERETAB instruction This EC value applies when: FEAT_FGT is implemented. The Effective value of HCR_EL2.NV is 1. 24 2 24:2 Reserved, RES0. ERET 1 1 1 Indicates whether an ERET or ERETA* instruction was trapped to EL2. If this bit is 0, the ERETA field is RES0. 0b0 ERET instruction trapped to EL2. 0b1 ERETAA or ERETAB instruction trapped to EL2. AU ERETA 0 0 0 Indicates whether an ERETAA or ERETAB instruction was trapped to EL2. When the ERET field is 0, this bit is RES0. 0b0 ERETAA instruction trapped to EL2. 0b1 ERETAB instruction trapped to EL2. AU For more information about generating these exceptions, see HCR_EL2.NV. If FEAT_FGT is implemented, HFGITR_EL2.ERET controls fine-grained trap exceptions from ERET, ERETAA, and ERETAB execution. When FEAT_NV is implemented or FEAT_FGT is implemented When FEAT_BTI is implemented a Branch Target Exception 24 2 24:2 Reserved, RES0. BTYPE 1 0 1:0 This field is set to the PSTATE.BTYPE value that generated the Branch Target Exception. For more information about generating these exceptions, see 'The AArch64 application level programmers model'. When FEAT_BTI is implemented an exception from a trapped Pointer Authentication instruction 24 0 24:0 Reserved, RES0. For more information about generating these exceptions, see: HCR_EL2.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to EL2. SCR_EL3.API, for exceptions from Pointer authentication instructions, using AArch64 state, trapped to EL3. a PAC Fail exception 24 2 24:2 Reserved, RES0. DnI 1 1 1 This field indicates whether the exception is as a result of an Instruction key or a Data key. 0b0 Instruction Key. 0b1 Data Key. AU BnA 0 0 0 This field indicates whether the exception is as a result of an A key or a B key. 0b0 A key. 0b1 B key. AU The following instructions generate a PAC Fail exception when the Pointer Authentication Code (PAC) is incorrect: AUTDA, AUTDZA. AUTDB, AUTDZB. AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIZA. AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZB. AUTIASPPC, AUTIASPPCR, AUTIA171615. AUTIBSPPC, AUTIBSPPCR, AUTIB171615. If FEAT_FPACCOMBINE is implemented, the following instructions generate a PAC Fail exception when the Pointer Authentication Code (PAC) is incorrect: RETAA, RETAB. RETAASPPC, RETABSPPC. RETAASPPCR, RETABSPPCR. BLRAA, BLRAAZ, BLRAB, BLRABZ. BRAA, BRAB, BRAAZ, BRABZ. ERETAA, ERETAB. LDRAA, LDRAB, whether the authenticated address is written back to the base register or not. When the Effective value of HCR_EL2.E2H is 1, without explicit synchronization, accesses from EL2 using the accessor name ESR_EL2 or ESR_EL1 are not guaranteed to be ordered with respect to accesses using the other accessor name. MRS <Xt>, ESR_EL2 if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'1x1'} then X{64}(t) = ESR_EL1(); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then X{64}(t) = ESR_EL2(); elsif PSTATE.EL == EL3 then X{64}(t) = ESR_EL2(); end; MSR ESR_EL2, <Xt> if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'1x1'} then ESR_EL1() = X{64}(t); elsif EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then ESR_EL2() = X{64}(t); elsif PSTATE.EL == EL3 then ESR_EL2() = X{64}(t); end; MRS <Xt>, ESR_EL1 if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TRVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGRTR_EL2().ESR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then X{64}(t) = NVMem(0x138); else X{64}(t) = ESR_EL1(); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then X{64}(t) = ESR_EL2(); else X{64}(t) = ESR_EL1(); end; elsif PSTATE.EL == EL3 then X{64}(t) = ESR_EL1(); end; MSR ESR_EL1, <Xt> if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2().TVM == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && IsFeatureImplemented(FEAT_FGT) && (!HaveEL(EL3) || SCR_EL3().FGTEn == '1') && HFGWTR_EL2().ESR_EL1 == '1' then AArch64_SystemAccessTrap(EL2, 0x18); elsif EffectiveHCR_EL2_NVx() IN {'111'} then NVMem(0x138) = X{64}(t); else ESR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL2 then if ELIsInHost(EL2) then ESR_EL2() = X{64}(t); else ESR_EL1() = X{64}(t); end; elsif PSTATE.EL == EL3 then ESR_EL1() = X{64}(t); end; 2026-03-26 20:27:25 2026-03_rel