MDCR_EL2
Monitor Debug Configuration Register (EL2)
when FEAT_AA64 is implemented
HDCR
Architectural
AArch32
31
0
31
0
31
0
31
0
Provides EL2 configuration options for self-hosted debug and the Performance Monitors Extension.
Virt
If EL2 is not implemented, this register is RES0 from EL3.
This register has no effect if EL2 is not enabled in the current Security state.
MDCR_EL2 is a 64-bit register.
63
51
63:51
Reserved, RES0.
EnSTEPOP
50
50
0
If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 1, other than for a direct read of the register.
0b0
Execution from MDSTEPOP_EL1 is disabled.
0b1
Execution from MDSTEPOP_EL1 is not disabled by this control.
AU
When FEAT_STEP2 is implemented
50
50
50
Reserved, RES0.
Otherwise
49
44
49:44
Reserved, RES0.
EBWE
43
43
0
Extended Breakpoint and Watchpoint Enable. Enables use of additional breakpoints or watchpoints.
It is IMPLEMENTATION DEFINED whether this field is implemented or is RES0 when 16 or fewer breakpoints are implemented, 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI.
If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 1, other than for a direct read of the register.
This field is ignored by the PE and treated as 0 when EL3 is implemented and MDCR_EL3.EBWE is 0.
0b0
The Effective value of MDSCR_EL1.EMBWE is 0.
The Effective value of MDSELR_EL1.BANK is zero at EL2.
0b1
The Effective values of MDSCR_EL1.EMBWE and MDSELR_EL1.BANK are not affected by this field.
'0'
AU
When FEAT_Debugv8p9 is implemented
43
43
43
Reserved, RES0.
Otherwise
42
42
42
Reserved, RES0.
PMEE
41
40
1:0
Performance Monitors Exception Enable. Controls the generation of the PMUIRQ signal and the PMU Profiling exception at EL0, EL1, and EL2.
All other values are reserved.
If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b01, other than for a direct read of the register.
This field is ignored by the PE when all of the following are true:
EL3 is implemented.
MDCR_EL3.PMEE != 0b01.
0b00
The PMUIRQ signal is asserted on a PMU overflow, and the PMU Profiling exception is disabled.
0b01
The PMUIRQ signal and the PMU Profiling exception are both controlled by PMECR_EL1.PMEE.
0b11
The PMUIRQ signal is deasserted, and the PMU Profiling exception is enabled.
'00'
AU
When FEAT_EBEP is implemented
41
40
41:40
Reserved, RES0.
Otherwise
39
37
39:37
Reserved, RES0.
HPMFZS
36
36
0
Hyp Performance Monitors Freeze-on-SPE event. Stop counters when PMBLIMITR_EL1.{PMFZ,E} is {1,1} and profiling is stopped.
The pseudocode function SPEProfilingStopped() describes when profiling is stopped.
The counters affected by this field are the event counters in the second range. This applies even when EL2 is disabled in the current Security state.
Other event counters and PMCCNTR_EL0 are not affected by this field.
When FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 is not affected by this field.
If MDCR_EL2.HPMN is equal to GetNumEventCountersSelfHosted(), then this field has no effect.
0b0
Do not freeze on a Statistical Profiling Buffer Management event.
0b1
Affected counters do not count following a Statistical Profiling Buffer Management event.
AU
When FEAT_SPEv1p2 is implemented
36
36
36
Reserved, RES0.
Otherwise
35
32
35:32
Reserved, RES0.
PMSSE
31
30
1:0
Performance Monitors Snapshot Enable. Controls the generation of Capture events.
If EL2 is not implemented, then the Effective value of this field is 0b01.
0b00
Capture events are disabled.
0b01
Capture events are controlled by PMECR_EL1.SSE.
0b10
Capture events are enabled and prohibited.
0b11
Capture events are enabled and allowed.
'00'
AU
When FEAT_PMUv3_SS is implemented
31
30
31:30
Reserved, RES0.
Otherwise
HPMFZO
29
29
0
Hyp Performance Monitors Freeze-on-overflow. Stop event counters on overflow.
The counters affected by this field are the event counters in the second range. This applies even when EL2 is disabled in the current Security state.
Other event counters and PMCCNTR_EL0 are not affected by this field.
When FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 is not affected by this field.
If MDCR_EL2.HPMN is equal to GetNumEventCountersSelfHosted(), then this field has no effect.
0b0
Do not freeze on overflow.
0b1
Affected counters do not count when PMOVSCLR_EL0[m] is 1 for any event counter PMEVCNTR<m>_EL0 in the second range.
AU
When FEAT_PMUv3p7 is implemented
29
29
29
Reserved, RES0.
Otherwise
MTPME
28
28
0
Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>_EL0.MT bits.
If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this field is 0.
0b0
FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>_EL0.MT is 0.
0b1
PMEVTYPER<n>_EL0.MT bits not affected by this field.
'1'
When FEAT_MTPMU is implemented and EL3 is not implemented
28
28
28
Reserved, RES0.
Otherwise
TDCC
27
27
0
Trap DCC. Traps use of the Debug Comms Channel at EL1 and EL0 to EL2.
The DCC System registers trapped by this control are:
AArch64: OSDTRRX_EL1, OSDTRTX_EL1, MDCCSR_EL0, MDCCINT_EL1, and, when the PE is in Non-debug state, DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.
AArch32: DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.
The traps are reported with EC syndrome value:
0x05 for trapped AArch32 MRC and MCR accesses with coproc == 0b1110.
0x06 for trapped AArch32 LDC to DBGDTRTXint and STC from DBGDTRRXint.
0x18 for trapped AArch64 MRS and MSR accesses.
When the PE is in Debug state, MDCR_EL2.TDCC does not trap any accesses to:
AArch64: DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.
AArch32: DBGDTRRXint and DBGDTRTXint.
0b0
This control does not cause any register accesses to be trapped.
0b1
If EL2 is implemented and enabled in the current Security state, accesses to the DCC System registers at EL1 and EL0 generate a Trap exception to EL2, unless the access also generates a higher priority exception.
Traps on the DCC data transfer registers are ignored when the PE is in Debug state.
AU
When FEAT_FGT is implemented
27
27
27
Reserved, RES0.
Otherwise
HLP
26
26
0
Hypervisor Long Event Counter Enable. Determines which event counter bit generates an overflow recorded by PMOVSR[n].
When FEAT_EBEP is implemented and the PMU Profiling exception is enabled, the Effective value of this field is 1.
The counters affected by this field are the event counters in the second range. This applies even when EL2 is disabled in the current Security state.
The following are not affected by this field:
Other event counters.
PMCCNTR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0.
If MDCR_EL2.HPMN is equal to GetNumEventCountersSelfHosted(), then this field has no effect.
For more information see the description of MDCR_EL2.HPMN.
0b0
Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[31:0].
0b1
Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[63:0].
AU
When FEAT_PMUv3p5 is implemented
26
26
26
Reserved, RES0.
Otherwise
E2TB
25
24
1:0
EL2 Trace Buffer.
If EL2 is implemented and enabled in the trace buffer owning Security state, then this field controls the trace buffer owning translation regime.
If EL2 is implemented and enabled in the current Security state, then this field controls access to trace buffer System registers from EL1.
All other values are reserved.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.
If FEAT_TRBE_EXC is implemented, MRS and MSR accesses to TRBSR_EL2 and TRBSR_EL12.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL2, reported using EC syndrome value 0x18.
When TraceBufferEnabled()==FALSE, this field has no effect on whether tracing is prohibited.
0b00
If EL2 is implemented and enabled in the trace buffer owning Security state, then the trace buffer owning Exception level is EL2. Otherwise, the trace buffer owning Exception level is EL1 and, if TraceBufferEnabled() == TRUE, tracing is prohibited at EL2.
If EL2 is implemented and enabled in the current Security state, then accesses to trace buffer System registers at EL1 are trapped to EL2, unless the access generates a higher priority exception.
0b10
Trace buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2.
If EL2 is implemented and enabled in the current Security state, then accesses to trace buffer System registers at EL1 are trapped to EL2, unless the access generates a higher priority exception.
0b11
Trace buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2.
Accesses to trace buffer System registers at EL1 are not trapped by this mechanism.
AU
When FEAT_TRBE is implemented
25
24
25:24
Reserved, RES0.
Otherwise
HCCD
23
23
0
Hypervisor Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting at EL2.
This field does not affect the CPU_CYCLES event or any other event that counts cycles.
0b0
Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1
Cycle counting by PMCCNTR_EL0 is prohibited at EL2.
'0'
When FEAT_PMUv3p5 is implemented
23
23
23
Reserved, RES0.
Otherwise
22
20
22:20
Reserved, RES0.
TTRF
19
19
0
Traps use of the Trace Filter Control registers at EL1 to EL2, as follows:
Access to TRFCR_EL1 is trapped to EL2, reported using EC syndrome value 0x18.
Access to TRFCR is trapped to EL2, reported using EC syndrome value 0x03.
0b0
Accesses to the specified registers at EL1 are not affected by this control.
0b1
Accesses to the specified registers at EL1 generate a trap exception to EL2 when EL2 is enabled in the current Security state.
AU
When FEAT_TRF is implemented
19
19
19
Reserved, RES0.
Otherwise
18
18
18
Reserved, RES0.
HPMD
17
17
0
Guest Performance Monitors Disable. Controls PMU operation at EL2.
The counters affected by this field are:
Event counters in the first range.
If FEAT_PMUv3_ICNTR is implemented, the instruction counter PMICNTR_EL0.
If PMCR_EL0.DP is 1, the cycle counter PMCCNTR_EL0.
Other event counters are not affected by this field.
When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
0b0
Counters are not affected by this mechanism.
0b1
Affected counters are prohibited from counting at EL2.
If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
'0'
When FEAT_PMUv3p1 is implemented and FEAT_Debugv8p2 is implemented
HPMD
17
17
0
Guest Performance Monitors Disable. Controls PMU operation at EL2 when ExternalSecureNoninvasiveDebugEnabled() is FALSE.
If ExternalSecureNoninvasiveDebugEnabled() is TRUE, then the event counters and PMCCNTR_EL0 are not affected by this field.
Otherwise, the counters affected by this field are:
Event counters in the first range.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.
Other event counters are not affected by this field. When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
0b0
Counters are not affected by this mechanism.
0b1
If ExternalSecureNoninvasiveDebugEnabled() is FALSE, then all the following apply:
Affected event counters are prohibited from counting at EL2.
If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
'0'
When FEAT_PMUv3p1 is implemented
17
17
17
Reserved, RES0.
Otherwise
16
16
16
Reserved, RES0.
EnSPM
15
15
0
Enable access to System PMU registers. When disabled, accesses to System PMU registers generate a trap to EL2.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to SPMACCESSR_EL1, SPMCFGR_EL1, SPMCGCR<n>_EL1, SPMCNTENCLR_EL0, SPMCNTENSET_EL0, SPMCR_EL0, SPMDEVAFF_EL1, SPMDEVARCH_EL1, SPMEVCNTR<n>_EL0, SPMEVFILT2R<n>_EL0, SPMEVFILTR<n>_EL0, SPMEVTYPER<n>_EL0, SPMIIDR_EL1, SPMINTENCLR_EL1, SPMINTENSET_EL1, SPMOVSCLR_EL0, SPMOVSSET_EL0, SPMSCR_EL1, and SPMSELR_EL0.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified System PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified System PMU registers are not trapped by this mechanism.
AU
When FEAT_SPMU is implemented
15
15
15
Reserved, RES0.
Otherwise
TPMS
14
14
0
Trap Performance Monitor Sampling. Enables a trap to EL2 on accesses of SPE registers.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMSCR_EL1, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
MRS accesses to PMSIDR_EL1.
If FEAT_SPE_FnE is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified SPE registers are not trapped by this mechanism.
0b1
Accesses of the specified SPE registers at EL1 are trapped to EL2, unless the instruction generates a higher priority exception.
AU
When FEAT_SPE is implemented
14
14
14
Reserved, RES0.
Otherwise
E2PB
13
12
1:0
EL2 Profiling Buffer.
If EL2 is implemented and enabled in the Profiling Buffer owning Security state, then this field controls the Profiling Buffer owning translation regime.
If EL2 is implemented and enabled in the current Security state, then this field controls access to Profiling Buffer System registers from EL1.
All other values are reserved.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMBLIMITR_EL1, PMBPTR_EL1, and PMBSR_EL1.
If FEAT_SPE_nVM is implemented, MRS and MSR accesses to PMBMAR_EL1.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL2, reported using EC syndrome value 0x18.
0b00
If EL2 is implemented and enabled in the Profiling Buffer owning Security state, then the Profiling Buffer owning Exception level is EL2. Otherwise, the Profiling Buffer owning Exception level is EL1 and, Profiling is prohibited at EL2.
If EL2 is implemented and enabled in the current Security state, then accesses to Profiling Buffer System registers at EL1 are trapped to EL2, unless the access generates a higher priority exception.
0b10
Profiling Buffer owning Exception level is EL1. Profiling is prohibited at EL2.
If EL2 is implemented and enabled in the current Security state, then accesses to Profiling Buffer System registers at EL1 are trapped to EL2, unless the access generates a higher priority exception.
0b11
Profiling Buffer owning Exception level is EL1. Profiling is prohibited at EL2.
Accesses to Profiling Buffer System registers at EL1 are not trapped by this mechanism.
AU
When FEAT_SPE is implemented
13
12
13:12
Reserved, RES0.
Otherwise
TDRA
11
11
11
Trap Debug ROM Address register access. Traps System register accesses to the Debug ROM registers to EL2 when EL2 is enabled in the current Security state as follows:
If EL1 is using AArch64, accesses to MDRAR_EL1 are trapped to EL2, reported using EC syndrome value 0x18.
If EL0 or EL1 is using AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05 and MRRC or MCRR accesses are trapped to EL2, reported using EC syndrome value 0x0C:
DBGDRAR, DBGDSAR.
This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:
The Effective value of MDCR_EL2.TDE is 1.
The Effective value of HCR_EL2.TGE is 1.
EL2 does not provide traps on debug register accesses through the optional memory-mapped external debug interfaces.System register accesses to the debug System registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.
0b0
This control does not cause any instructions to be trapped.
0b1
EL0 and EL1 System register accesses to the Debug ROM registers are trapped to EL2 when EL2 is enabled in the current Security state, unless it is trapped by the following:
DBGDSCRext.UDCCdis.
MDSCR_EL1.TDCC.
AU
TDOSA
10
10
0
Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug System registers to EL2, from both Execution states as follows:
In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x18:
OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.
In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05:
DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.
These registers are not accessible at EL0.This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:
The Effective value of MDCR_EL2.TDE is 1.
The Effective value of HCR_EL2.TGE is 1.
System register accesses to the debug System registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.
0b0
This control does not cause any instructions to be trapped.
0b1
EL1 System register accesses to the powerdown debug System registers are trapped to EL2 when EL2 is enabled in the current Security state.
AU
When FEAT_DoubleLock is implemented
TDOSA
10
10
0
Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug System registers to EL2, from both Execution states as follows:
In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x18:
OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.
In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05:
DBGOSLSR, DBGOSLAR, and DBGPRCR.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.
It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 are trapped.
It is IMPLEMENTATION DEFINED whether accesses to DBGOSDLR are trapped.
These registers are not accessible at EL0.This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:
The Effective value of MDCR_EL2.TDE is 1.
The Effective value of HCR_EL2.TGE is 1.
EL2 does not provide traps on debug register accesses through the optional memory-mapped external debug interfaces.System register accesses to the debug System registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.
0b0
This control does not cause any instructions to be trapped.
0b1
EL1 System register accesses to the powerdown debug System registers are trapped to EL2 when EL2 is enabled in the current Security state.
AU
Otherwise
TDA
9
9
9
Trap accesses of debug System registers. Enables a trap to EL2 on accesses of debug System registers.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to DBGAUTHSTATUS_EL1, DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGCLAIMCLR_EL1, DBGCLAIMSET_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, MDCCINT_EL1, MDCCSR_EL0, MDSCR_EL1, OSDTRRX_EL1, OSDTRTX_EL1, and OSECCR_EL1.
If FEAT_Debugv8p9 is implemented, MRS and MSR accesses to MDSELR_EL1.
If FEAT_STEP2 is implemented, MRS and MSR accesses to MDSTEPOP_EL1.
In Non-debug state, MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
In AArch32 state, the instructions affected by this control are:
MRC and MCR accesses to DBGAUTHSTATUS, DBGBCR<n>, DBGBVR<n>, DBGBXVR<n>, DBGCLAIMCLR, DBGCLAIMSET, DBGDCCINT, DBGDEVID, DBGDEVID1, DBGDEVID2, DBGDIDR, DBGDSCRext, DBGDSCRint, DBGDTRRXext, DBGDTRTXext, DBGOSECCR, DBGVCR, DBGWCR<n>, DBGWFAR, and DBGWVR<n>.
STC accesses to DBGDTRRXint and LDC accesses to DBGDTRTXint.
In Non-debug state, MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.
Trapped AArch64 instructions are reported using EC syndrome value 0x18.
Trapped AArch32 instructions are reported using EC syndrome value 0x05 for MRC and MCR accesses, and 0x06 for LDC and STC accesses.
The following instructions are not trapped in Debug state:
AArch64 MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
AArch32 MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.
If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI, then it is IMPLEMENTATION DEFINED whether AArch64 accesses to MDSELR_EL1 are trapped to EL2 when MDCR_EL2.TDA is 1.
This field is ignored by the PE and treated as one when any of the following are true:
The Effective value of MDCR_EL2.TDE is 1.
The Effective value of HCR_EL2.TGE is 1.
0b0
Accesses of the specified debug System registers are not trapped by this mechanism.
0b1
Accesses of the specified debug System registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.
AU
TDE
8
8
8
Trap Debug Exceptions. Controls routing of Debug exceptions, and defines the debug target Exception level, ELD.
For more information, see 'Routing debug exceptions'.
This field is treated as being 1 for all purposes other than a direct read when the Effective value of HCR_EL2.TGE is 1.
0b0
The debug target Exception level is EL1.
0b1
If EL2 is enabled for the current Effective value of SCR_EL3.NS, the debug target Exception level is EL2, otherwise the debug target Exception level is EL1.
The MDCR_EL2.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.
AU
HPME
7
7
0
Hyp Enable.
The counters affected by this field are the event counters in the second range. This applies even when EL2 is disabled in the current Security state.
The following counters are not affected by this field:
Other event counters.
PMCCNTR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0.
If MDCR_EL2.HPMN is equal to GetNumEventCountersSelfHosted(), then this field has no effect.
0b0
Affected counters are disabled and do not count.
0b1
Affected counters are enabled by PMCNTENSET_EL0.
AU
When FEAT_PMUv3 is implemented
7
7
7
Reserved, RES0.
Otherwise
TPM
6
6
0
Trap accesses of PMU registers. Enables a trap to EL2 on accesses of PMU registers.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMCCFILTR_EL0, PMCCNTR_EL0, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, PMOVSSET_EL0, PMSELR_EL0, PMSWINC_EL0, PMUSERENR_EL0, PMXEVCNTR_EL0, and PMXEVTYPER_EL0.
MRS accesses to PMCEID0_EL0 and PMCEID1_EL0.
If FEAT_PMUv3p4 is implemented, MRS accesses to PMMIR_EL1.
If FEAT_PMUv3p9 is implemented, MSR accesses to PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, MRS accesses to PMICFILTR_EL0 and PMICNTR_EL0.
If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
In AArch32 state, the instructions affected by this control are:
MRC and MCR accesses to PMCCFILTR, PMCCNTR, PMCNTENCLR, PMCNTENSET, PMCR, PMEVCNTR<n>, PMEVTYPER<n>, PMINTENCLR, PMINTENSET, PMOVSR, PMOVSSET, PMSELR, PMSWINC, PMUSERENR, PMXEVCNTR, and PMXEVTYPER.
MRC accesses to PMCEID0 and PMCEID1.
MRRC and MCRR accesses to PMCCNTR.
If FEAT_PMUv3p1 is implemented, MRC accesses to PMCEID2 and PMCEID3.
If FEAT_PMUv3p4 is implemented, MRC accesses to PMMIR.
Trapped AArch64 instructions are reported using EC syndrome value 0x18.
Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.
0b0
Accesses of the specified PMU registers are not trapped by this mechanism.
0b1
Accesses of the specified PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.
AU
When FEAT_PMUv3 is implemented
6
6
6
Reserved, RES0.
Otherwise
TPMCR
5
5
0
Trap PMCR_EL0 or PMCR accesses. Traps EL0 and EL1 accesses to EL2, when EL2 is enabled in the current Security state, as follows:
In AArch64 state, accesses to PMCR_EL0 are trapped to EL2, reported using EC syndrome value 0x18.
In AArch32 state, accesses to PMCR are trapped to EL2, reported using EC syndrome value 0x03.
EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped external debug interface.
0b0
This control does not cause any instructions to be trapped.
0b1
EL0 and EL1 accesses to the specified registers are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by the following:
PMUSERENR.EN.
PMUSERENR_EL0.EN.
AU
When FEAT_PMUv3 is implemented
5
5
5
Reserved, RES0.
Otherwise
HPMN
4
0
4:0
Defines the number of event counters PMEVCNTR<n>_EL0 and, if FEAT_PMUv3_SS is implemented, event counter snapshot registers PMEVCNTSVR<n>_EL1, that are accessible from EL1 and, if permitted, from EL0.
MDCR_EL2.HPMN divides the event counters accessible from self-hosted software into a first range and a second range.
When FEAT_PMUv3_EXTPMN is implemented, all of the following apply:
PMCCR.EPMN divides the NUM_PMU_COUNTERS event counters implemented by the PE into the event counters that MDCR_EL2.HPMN divides into the first and second ranges, and a third range that is inaccessible from self-hosted software.
If MDCR_EL2.HPMN is not 0 and is less than the Effective value of PMCCR.EPMN, then event counters [0..(MDCR_EL2.HPMN-1)] are in the first range, and the remaining event counters [MDCR_EL2.HPMN..(PMCCR.EPMN-1)] are in the second range.
The pseudocode function GetNumEventCountersSelfHosted() returns the Effective value of PMCCR.EPMN.
When FEAT_PMUv3_EXTPMN is not implemented, all of the following apply:
All of the NUM_PMU_COUNTERS event counters are accessible to self-hosted software and no counters are in the third range.
If MDCR_EL2.HPMN is not 0 and is less than NUM_PMU_COUNTERS, then event counters [0..(MDCR_EL2.HPMN-1)] are in the first range, and the remaining event counters [MDCR_EL2.HPMN..(NUM_PMU_COUNTERS-1)] are in the second range.
The pseudocode function GetNumEventCountersSelfHosted() returns NUM_PMU_COUNTERS.
If FEAT_HPMN0 is implemented and MDCR_EL2.HPMN is 0, then all of the following apply:
No event counters are in the first range.
If FEAT_PMUv3_EXTPMN is implemented, then event counters [0..(PMCCR.EPMN-1)] are in the second range.
If FEAT_PMUv3_EXTPMN is not implemented, then all event counters are in the second range.
If MDCR_EL2.HPMN is equal to GetNumEventCountersSelfHosted(), or EL2 is not implemented, then all of the following apply:
If FEAT_PMUv3_EXTPMN is implemented, then event counters [0..(PMCCR.EPMN-1)] are in the first range.
If FEAT_PMUv3_EXTPMN is not implemented, then all event counters are in the first range.
No event counters are in the second range.
All of the following apply for an event counter PMEVCNTR<n>_EL0 in the first range:
The counter is accessible from EL1, EL2, and EL3.
The counter is accessible from EL0 if permitted by PMUSERENR_EL0 and PMUACR_EL1, or by PMUSERENR.
If FEAT_PMUv3p5 is implemented, then PMCR_EL0.LP or PMCR.LP determines whether the counter overflow flag PMOVSSET_EL0[n] is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
PMCR_EL0.E and PMCNTENSET_EL0[n] enable the operation of the event counter.
All of the following apply for an event counter PMEVCNTR<n>_EL0 in the second range:
The counter is accessible from EL2 and EL3.
If EL2 is disabled in the current Security state, then the event counter is accessible from EL1, and from EL0 if permitted by PMUSERENR_EL0 and PMUACR_EL1, or by PMUSERENR.
If FEAT_PMUv3p5 is implemented, MDCR_EL2.HLP determines whether the counter overflow flag PMOVSSET_EL0[n] is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
MDCR_EL2.HPME and PMCNTENSET_EL0[n] enable the operation of the event counter.
If FEAT_PMUv3_SS is implemented, then all of the following apply:
For an event counter snapshot register PMEVCNTSVR<n>_EL1 in the first range, the register is accessible from EL1, EL2, and EL3.
For an event counter snapshot register PMEVCNTSVR<n>_EL1 in the second range, the register is accessible from EL2 and EL3. If EL2 is disabled in the current Security state, the event counter is also accessible from EL1.
For information about counters in the third range, see the description of PMCCR.EPMN.
Values greater than GetNumEventCountersSelfHosted() are reserved. If FEAT_HPMN0 is not implemented, then the value 0 is reserved.
When FEAT_PMUv3_EXTPMN is not implemented and this field is set to a reserved value, the following CONSTRAINED UNPREDICTABLE behaviors apply:
The value returned by a direct read of MDCR_EL2.HPMN is UNKNOWN.
The number of event counters in each of the first and second ranges is UNKNOWN. That is, either:
The PE behaves as if MDCR_EL2.HPMN is set to an UNKNOWN nonzero value less than or equal to NUM_PMU_COUNTERS.
All counters are in the second range and none are in the first range.
When FEAT_PMUv3_EXTPMN is implemented and this field is set to a reserved value, the following behaviors apply:
The value returned by a direct read of MDCR_EL2.HPMN is the Effective value of PMCCR.EPMN.
No event counters are in the second range.
The value returned by an indirect read of MDCR_EL2.HPMN as a result of direct reads of PMCR_EL0.N or PMCR.N is the Effective value of PMCCR.EPMN.
NUM_PMU_COUNTERS
When FEAT_PMUv3 is implemented
4
0
4:0
Reserved, RES0.
Otherwise
MRS <Xt>, MDCR_EL2
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if HaveEL(EL3) && EL3SDDUndefPriority() && MDCR_EL3().TDA == '1' then
Undefined();
elsif HaveEL(EL3) && MDCR_EL3().TDA == '1' then
if EL3SDDUndef() then
Undefined();
else
AArch64_SystemAccessTrap(EL3, 0x18);
end;
else
X{64}(t) = MDCR_EL2();
end;
elsif PSTATE.EL == EL3 then
X{64}(t) = MDCR_EL2();
end;
MSR MDCR_EL2, <Xt>
if !IsFeatureImplemented(FEAT_AA64) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
if EffectiveHCR_EL2_NVx() IN {'xx1'} then
AArch64_SystemAccessTrap(EL2, 0x18);
else
Undefined();
end;
elsif PSTATE.EL == EL2 then
if HaveEL(EL3) && EL3SDDUndefPriority() && MDCR_EL3().TDA == '1' then
Undefined();
elsif HaveEL(EL3) && MDCR_EL3().TDA == '1' then
if EL3SDDUndef() then
Undefined();
else
AArch64_SystemAccessTrap(EL3, 0x18);
end;
else
MDCR_EL2() = X{64}(t);
end;
elsif PSTATE.EL == EL3 then
MDCR_EL2() = X{64}(t);
end;
2026-03-26 20:27:25
2026-03_rel