MDCR_EL3
Monitor Debug Configuration Register (EL3)
when EL3 is implemented and FEAT_AA64 is implemented
Provides EL3 configuration options for self-hosted debug and the Performance Monitors Extension.
Secure
MDCR_EL3 is a 64-bit register.
63
56
63:56
Reserved, RES0.
EnPMS4
55
55
0
Enable access to SPE registers. When disabled, accesses to SPE registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to PMBMAR_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified SPE registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified SPE registers are not trapped by this mechanism.
AU
When FEAT_SPE_nVM is implemented
55
55
55
Reserved, RES0.
Otherwise
TRBEE
54
53
1:0
Trace buffer management event Exception Enable.
If EL3 is not implemented, then the Effective value of MDCR_EL3.TRBEE is 0b01.
0b00
Disabled. TRBE Profiling exceptions for all Exception levels are disabled. All of the following apply:
No trace buffer management events are recorded in TRBSR_EL3.
TRBE Profiling exceptions are not generated.
TRBSR_EL1.IRQ drives the interrupt request signal TRBIRQ.
Accesses to TRBSR_EL2 at EL2 are trapped to EL3.
Accesses to TRBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to TRBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H.
0b01
Delegated. TRBE Profiling exceptions for EL3 are disabled, but might be enabled for EL2 or EL1 by TRFCR_EL2.EE or TRFCR_EL1.EE. All of the following apply:
No trace buffer management events are recorded in TRBSR_EL3.
TRBSR_EL3.IRQ is ignored and TRBE Profiling exceptions are not taken to EL3.
0b10
Enabled. TRBE Profiling exceptions for EL3 are enabled for trace buffer management events targeting EL3, as follows:
Trace buffer management events due to a fault on a write to the trace buffer that would generate a Data Abort exception taken to EL3 if generated by a store instruction executed at the owning Exception level are recorded in TRBSR_EL3. That is, any of the following faults:
Granule Protection Check faults other than Granule Protection Faults (GPFs).
If SCR_EL3.GPF is 1, GPFs.
If SCR_EL3.EA is 1, External aborts.
TRBE Profiling exceptions are generated and taken to EL3 when unmasked and TRBSR_EL3.IRQ is 1.
0b11
Trap all. TRBE Profiling exceptions for EL3 are enabled for all trace buffer management events, as follows:
All trace buffer management events are recorded in TRBSR_EL3.
TRBE Profiling exceptions are generated and taken to EL3 when unmasked and TRBSR_EL3.IRQ is 1.
'00'
AU
When FEAT_TRBE_EXC is implemented
54
53
54:53
Reserved, RES0.
Otherwise
PMSEE
52
51
1:0
Profiling Buffer management event Exception Enable.
If EL3 is not implemented, then the Effective value of MDCR_EL3.PMSEE is 0b01.
0b00
Disabled. SPE Profiling exceptions for all Exception levels are disabled. All of the following apply:
No Profiling Buffer management events are recorded in PMBSR_EL3.
SPE Profiling exceptions are not generated.
PMBSR_EL1.S drives the interrupt request signal PMBIRQ.
Accesses to PMBSR_EL2 at EL2 are trapped to EL3.
Accesses to PMBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to PMBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H.
0b01
Delegated. SPE Profiling exceptions for EL3 are disabled, but might be enabled for EL2 or EL1 by PMSCR_EL2.EE or PMSCR_EL1.EE. All of the following apply:
No Profiling Buffer management events are recorded in PMBSR_EL3.
PMBSR_EL3.S is ignored and SPE Profiling exceptions are not taken to EL3.
0b10
Enabled. SPE Profiling exceptions for EL3 are enabled for Profiling Buffer management events targeting EL3, as follows:
Profiling Buffer management events due to a fault on a write to the Profiling Buffer that would generate a Data Abort exception taken to EL3 if generated by a store instruction executed at the owning Exception level are recorded in PMBSR_EL3. That is, any of the following faults:
Granule Protection Check faults other than Granule Protection Faults (GPFs).
If SCR_EL3.GPF is 1, GPFs.
If SCR_EL3.EA is 1, External aborts.
SPE Profiling exceptions are generated and taken to EL3 when unmasked and PMBSR_EL3.S is 1.
0b11
Trap all. SPE Profiling exceptions for EL3 are enabled for all Profiling Buffer management events, as follows:
All Profiling Buffer management events are recorded in PMBSR_EL3.
SPE Profiling exceptions are generated and taken to EL3 when unmasked and PMBSR_EL3.S is 1.
'00'
AU
When FEAT_SPE_EXC is implemented
52
51
52:51
Reserved, RES0.
Otherwise
EnSTEPOP
50
50
0
0b0
Execution from MDSTEPOP_EL1 is disabled. EL2, EL1 and EL0 System register accesses to MDSTEPOP_EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b1
Execution from MDSTEPOP_EL1 is not disabled by this control. System register accesses to MDSTEPOP_EL1 are not trapped by this mechanism.
AU
When FEAT_STEP2 is implemented
50
50
50
Reserved, RES0.
Otherwise
ETBAD
49
48
1:0
External Trace Buffer Access Disable. Controls access to the Trace Buffer registers from an external debugger.
If EL3 is not implemented, then the Effective value of this field is 0b11.
0b00
Non-secure accesses from an external debugger to Trace Buffer registers are prohibited.
If FEAT_RME is implemented, Secure and Realm accesses from an external debugger to Trace Buffer registers are prohibited and Root accesses to Trace Buffer registers are allowed.
If FEAT_RME is not implemented, Secure accesses to Trace Buffer registers are allowed.
0b01
Secure and Non-secure accesses from an external debugger to Trace Buffer registers are prohibited. Root and Realm accesses to Trace Buffer registers are allowed.
When FEAT_RME is implemented
0b10
Realm and Non-secure accesses from an external debugger to Trace Buffer registers are prohibited. Root and Secure accesses to Trace Buffer registers are allowed.
When FEAT_RME is implemented
0b11
All accesses from an external debugger to Trace Buffer registers are allowed.
'00'
When FEAT_TRBE_EXT is implemented
49
48
49:48
Reserved, RES0.
Otherwise
EnITE
47
47
0
Enable access to Instrumentation trace System registers. When disabled, accesses to Instrumentation trace System registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to TRCITECR_EL1, TRCITECR_EL2, and TRCITECR_EL12.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified Instrumentation trace System registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified Instrumentation trace System registers are not trapped by this mechanism.
AU
When FEAT_ITE is implemented
47
47
47
Reserved, RES0.
Otherwise
EPMSSAD
46
45
1:0
External PMU Snapshot Access Disable. Controls access to the PMU Snapshot registers from an external debugger.
External accesses of the following registers are affected by this control:
PMCCNTSVR_EL1, PMEVCNTSVR<n>_EL1, and PMSSCR_EL1.
If FEAT_PMUv3_ICNTR is implemented, PMICNTSVR_EL1.
If EL3 is not implemented, then the Effective value of this field is 0b11.
0b00
Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited.
If FEAT_RME is implemented, Secure and Realm accesses from an external debugger to the affected PMU Snapshot registers are prohibited.
Other accesses from an external debugger to the specified registers are not affected by this control.
0b01
Secure and Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited.
Other accesses from an external debugger to the specified registers are not affected by this control.
When FEAT_RME is implemented
0b10
Realm and Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited.
Other accesses from an external debugger to the specified registers are not affected by this control.
When FEAT_RME is implemented
0b11
No accesses from an external debugger to the affected PMU Snapshot registers are prohibited by this control.
'00'
When FEAT_PMUv3_SS is implemented
46
45
46:45
Reserved, RES0.
Otherwise
EnPMSS
44
44
0
Enable access to PMU Snapshot registers. When disabled, accesses to PMU Snapshot registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMCCNTSVR_EL1, PMEVCNTSVR<n>_EL1, and PMSSCR_EL1.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICNTSVR_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified PMU Snapshot registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified PMU Snapshot registers are not trapped by this mechanism.
AU
When FEAT_PMUv3_SS is implemented
44
44
44
Reserved, RES0.
Otherwise
EBWE
43
43
0
Extended Breakpoint and Watchpoint Enable. Enables use of additional breakpoints or watchpoints, and enables a trap to EL3 on accesses to debug System registers.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to MDSELR_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
It is IMPLEMENTATION DEFINED whether this field is implemented or is RES0 when 16 or fewer breakpoints are implemented, 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI.
If EL3 is not implemented, then the Effective value of this field is 1.
0b0
The Effective values of MDSCR_EL1.EMBWE and MDCR_EL2.EBWE are 0.
The Effective value of MDSELR_EL1.BANK is zero at EL3.
Accesses of MDSELR_EL1 at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
The Effective values of MDSCR_EL1.EMBWE, MDCR_EL2.EBWE, and MDSELR_EL1.BANK are not affected by this field.
Accesses of MDSELR_EL1 are not trapped by this mechanism.
'0'
When FEAT_Debugv8p9 is implemented
43
43
43
Reserved, RES0.
Otherwise
EnPMS3
42
42
0
Enable access to SPE registers. When disabled, accesses to SPE registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to PMSDSFR_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified SPE registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified SPE registers are not trapped by this mechanism.
AU
When FEAT_SPE_FDS is implemented
42
42
42
Reserved, RES0.
Otherwise
PMEE
41
40
1:0
Performance Monitors Exception Enable. Controls the generation of the PMUIRQ signal and the PMU Profiling exception at all Exception levels.
All other values are reserved.
If EL3 is not implemented, then the Effective value of this field is 0b01.
0b00
The PMUIRQ signal is asserted on a PMU overflow, and the PMU Profiling exception is disabled.
0b01
The PMUIRQ signal and the PMU Profiling exception are both controlled by MDCR_EL2.PMEE.
0b11
The PMUIRQ signal is deasserted, and the PMU Profiling exception is enabled.
'00'
AU
When FEAT_EBEP is implemented
41
40
41:40
Reserved, RES0.
Otherwise
EnTB2
39
39
0
Enable access to Trace Buffer registers. When disabled, accesses to Trace Buffer registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to TRBMPAM_EL1.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified Trace Buffer registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1
Accesses of the specified Trace Buffer registers are not trapped by this mechanism.
AU
When FEAT_TRBE_MPAM is implemented
39
39
39
Reserved, RES0.
Otherwise
E3BREC
38
38
0
Branch Record Buffer EL3 Cold Reset Enable. With MDCR_EL3.E3BREW, controls branch recording at EL3.
0b0
When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is disabled.
When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is enabled.
0b1
When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is enabled.
When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is disabled.
'0'
When FEAT_BRBEv1p1 is implemented
38
38
38
Reserved, RES0.
Otherwise
E3BREW
37
37
0
Branch Record Buffer EL3 Warm Reset Enable. With MDCR_EL3.E3BREC, controls branch recording at EL3.
For a description of the values derived by evaluating MDCR_EL3.E3BREC and MDCR_EL3.E3BREW together, see MDCR_EL3.E3BREC.
'0'
When FEAT_BRBEv1p1 is implemented
37
37
37
Reserved, RES0.
Otherwise
EnPMSN
36
36
0
Trap accesses to PMSNEVFR_EL1. Controls access to Statistical Profiling PMSNEVFR_EL1 System register from EL2 and EL1.
0b0
Accesses to PMSNEVFR_EL1 at EL2 and EL1 generate a Trap exception to EL3.
0b1
Do not trap PMSNEVFR_EL1 to EL3.
AU
When FEAT_SPE_FnE is implemented
36
36
36
Reserved, RES0.
Otherwise
MPMX
35
35
0
Monitor Performance Monitors Extended control. With MDCR_EL3.SPME, controls PMU operation at EL3.
The counters affected by this field are:
If EL2 is implemented and MDCR_EL3.SPME is 1, event counters PMEVCNTR<n>_EL0 in the first range.
If EL2 is not implemented or MDCR_EL3.SPME is 0, event counters in the first and second ranges.
If FEAT_PMUv3_ICNTR is implemented, the instruction counter, PMICNTR_EL0.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.
Other event counters are not affected by this field. When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
For more information about event counter ranges, see MDCR_EL2.HPMN.
0b0
Counters are not affected by this mechanism.
0b1
Affected counters are prohibited from counting at EL3.
If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled at EL3. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
'0'
When FEAT_PMUv3p7 is implemented
35
35
35
Reserved, RES0.
Otherwise
MCCD
34
34
0
Monitor Cycle Counter Disable. Prohibits the Cycle Counter, PMCCNTR_EL0, from counting at EL3.
This field does not affect the CPU_CYCLES event or any other event that counts cycles.
0b0
Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1
Cycle counting by PMCCNTR_EL0 is prohibited at EL3.
'0'
When FEAT_PMUv3p7 is implemented
34
34
34
Reserved, RES0.
Otherwise
SBRBE
33
32
1:0
Secure Branch Record Buffer Enable. Controls branch recording by the BRBE, and access to BRBE registers and instructions at EL2 and EL1.
The Branch Record Buffer registers trapped by this control are: BRBCR_EL1, BRBCR_EL2, BRBCR_EL12, BRBFCR_EL1, BRBIDR0_EL1, BRBINF<n>_EL1, BRBINFINJ_EL1, BRBSRC<n>_EL1, BRBSRCINJ_EL1, BRBTGT<n>_EL1, BRBTGTINJ_EL1, and BRBTS_EL1.
The Branch Record Buffer instructions trapped by this control are:
BRB IALL.
BRB INJ.
If FEAT_BRBEv1p1 is not implemented, EL3 is a prohibited region.If EL3 is not implemented, then the Effective value of this field is 0b11.
0b00
Direct accesses to BRBE registers and instructions, except when at EL3, generate a Trap exception to EL3. EL0, EL1, and EL2 are prohibited regions.
0b01
Direct accesses to BRBE registers and instructions in Secure state, except when at EL3, generate a Trap exception to EL3. EL0, EL1, and EL2 in Secure state are prohibited regions. This control does not cause any direct accesses to BRBE registers when not in Secure state to be trapped, and does not cause any Exception levels when not in Secure state to be a prohibited region.
0b10
Direct accesses to BRBE registers and instructions, except when at EL3, generate a Trap exception to EL3. This control does not cause any Exception levels to be prohibited regions.
0b11
This control does not cause any direct accesses to BRBE registers or instruction to be trapped, and does not cause any Exception levels to be a prohibited region.
AU
When FEAT_BRBE is implemented
33
32
33:32
Reserved, RES0.
Otherwise
PMSSE
31
30
1:0
Performance Monitors Snapshot Enable. Controls the generation of Capture events.
If EL3 is not implemented, then the Effective value of this field is 0b01.
0b00
Capture events are disabled.
0b01
Capture events are controlled by MDCR_EL2.PMSSE.
0b10
Capture events are enabled and prohibited.
0b11
Capture events are enabled and allowed.
'00'
When FEAT_PMUv3_SS is implemented
31
30
31:30
Reserved, RES0.
Otherwise
29
29
29
Reserved, RES0.
MTPME
28
28
0
Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>_EL0.MT bits.
If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this field is 0.
0b0
FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>_EL0.MT is 0.
0b1
PMEVTYPER<n>_EL0.MT bits not affected by this field.
'1'
When FEAT_MTPMU is implemented
28
28
28
Reserved, RES0.
Otherwise
TDCC
27
27
0
Trap DCC. Traps use of the Debug Comms Channel at EL2, EL1, and EL0 to EL3.
The DCC System registers trapped by this control are:
AArch64: OSDTRRX_EL1, OSDTRTX_EL1, MDCCSR_EL0, MDCCINT_EL1, and, when the PE is in Non-debug state, DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.
AArch32: DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.
The traps are reported with EC syndrome value:
0x05 for trapped AArch32 MRC and MCR accesses with coproc == 0b1110.
0x06 for trapped AArch32 LDC to DBGDTRTXint and STC from DBGDTRRXint.
0x18 for trapped AArch64 MRS and MSR accesses.
When the PE is in Debug state, MDCR_EL3.TDCC does not trap any accesses to:
AArch64: DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.
AArch32: DBGDTRRXint and DBGDTRTXint.
0b0
This control does not cause any register accesses to be trapped.
0b1
Accesses to the DCC System registers at EL2, EL1, and EL0 generate a Trap exception to EL3, unless the access also generates a higher priority exception.
Traps on the DCC data transfer registers are ignored when the PE is in Debug state.
AU
When FEAT_FGT is implemented
27
27
27
Reserved, RES0.
Otherwise
NSTBE
26
26
0
Non-secure Trace Buffer Extended. Together with MDCR_EL3.NSTB, controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.
For a description of the values derived by evaluating NSTB and NSTBE together, see MDCR_EL3.NSTB.
AU
When FEAT_TRBE is implemented and FEAT_RME is implemented
26
26
26
Reserved, RES0.
Otherwise
NSTB
25
24
1:0
Non-secure Trace Buffer. Together with MDCR_EL3.NSTBE, controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.
NSTBENSTBMeaning
0b00b00Trace buffer owning Security state is Secure state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Realm and Non-secure states.
Accesses to trace buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
When Secure state is not implemented, this encoding is reserved.
0b00b01Trace buffer owning Security state is Secure state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Realm and Non-secure states.
Accesses to trace buffer System registers at Realm and Non-secure
EL2, and Realm and Non-secure EL1, are trapped to EL3, unless the access generates a higher
priority exception.
When Secure state is not implemented, this encoding is reserved.
0b00b10Trace buffer owning Security state is Non-secure state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Realm states.
Accesses to trace buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
0b00b11Trace buffer owning Security state is Non-secure state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Realm states.
Accesses to trace buffer System registers at Secure and Realm EL2,
and Secure and Realm EL1, are trapped to EL3, unless the access generates a higher priority
exception.
0b10b10Trace buffer owning Security state is Realm state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Non-secure states.
Accesses to trace buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
0b10b11Trace buffer owning Security state is Realm state.
When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Non-secure states.
Accesses to trace buffer System registers at Secure and Non-secure
EL2, and Secure and Non-secure EL1, are trapped to EL3, unless the access generates a higher
priority exception.
All other combinations of MDCR_EL3.NSTBE and MDCR_EL3.NSTB are reserved.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.
If FEAT_TRBE_EXC is implemented, MRS and MSR accesses to TRBSR_EL2 and TRBSR_EL12.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL3, reported using EC syndrome value 0x18.
When TraceBufferEnabled()==FALSE, these controls have no effect on whether tracing is prohibited.
If the Trace Buffer Unit is enabled and using Self-hosted mode, and MDCR_EL3.{NSTB, NSTBE} selects a reserved value, then the behavior is CONSTRAINED UNPREDICTABLE, and the Trace Buffer Unit does one of:
Behaves as if the Trace Buffer Unit is disabled.
Selects an implemented Security state as the owning Security state.
When trace data is received from the trace unit, it is not written to memory and the Trace Buffer Unit generates a trace buffer management event, as follows:
TRBSR_ELx.IRQ is set to 1.
If TRBSR_ELx.S is 0, then all of the following occur:
TRBSR_ELx.S is set to 1, Collection is stopped.
TRBSR_ELx.EC is set to 0x00, Other buffer management event.
TRBSR_ELx.BSC is set to 0b000000, Access not allowed.
The other fields in TRBSR_ELx are unchanged.
If the Trace Buffer Unit is enabled and using Self-hosted mode, and MDCR_EL3.{NSTB, NSTBE} selects a reserved value, then it is CONSTRAINED UNPREDICTABLE whether or not accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.
AU
When FEAT_TRBE is implemented and FEAT_RME is implemented
NSTB
25
24
1:0
Non-secure Trace Buffer. Controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.
If FEAT_TRBE_EXC is implemented, MRS and MSR accesses to TRBSR_EL2 and TRBSR_EL12.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL3, reported using EC syndrome value 0x18.
When TraceBufferEnabled()==FALSE, this control has no effect on whether tracing is prohibited.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.
0b00
Trace buffer owning Security state is Secure state. When TraceBufferEnabled()==TRUE, tracing is prohibited in Non-secure state.
Accesses to trace buffer System registers at EL2 and EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b01
Trace buffer owning Security state is Secure state. When TraceBufferEnabled()==TRUE, tracing is prohibited in Non-secure state.
Accesses to trace buffer System registers at EL2 and EL1 in Non-secure state are trapped to EL3, unless the access generates a higher priority exception.
0b10
Trace buffer owning Security state is Non-secure state. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure state.
Accesses to trace buffer System registers at EL2 and EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b11
Trace buffer owning Security state is Non-secure state. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure state.
Accesses to trace buffer System registers at EL2 and EL1 in Secure state are trapped to EL3, unless the access generates a higher priority exception.
AU
When FEAT_TRBE is implemented
25
24
25:24
Reserved, RES0.
Otherwise
SCCD
23
23
0
Secure Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting in Secure state and EL3.
This field does not affect the CPU_CYCLES event or any other event that counts cycles.
0b0
Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1
Cycle counting by PMCCNTR_EL0 is prohibited in Secure state and EL3.
'0'
When FEAT_PMUv3p5 is implemented
23
23
23
Reserved, RES0.
Otherwise
ETAD
22
22
0
External Trace Access Disable. Together with MDCR_EL3.ETADE, controls access to trace unit registers by an external debugger.
ETADE
ETAD
Meaning
0b0
0b0
No accesses from an external debugger to trace unit registers are prohibited by this control.
0b0
0b1
Realm and Non-secure accesses from an external debugger to trace unit registers are prohibited.
Other accesses from an external debugger to trace unit registers are not affected by this control.
0b1
0b0
Secure and Non-secure accesses from an external debugger to trace unit registers are prohibited.
Other accesses from an external debugger to trace unit registers are not affected by this control.
0b1
0b1
Secure, Non-secure, and Realm accesses from an external debugger to trace unit registers are prohibited.
Other accesses from an external debugger to trace unit registers are not affected by this control.
'0'
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented
ETAD
22
22
0
External Trace Access Disable. Controls Non-secure access to trace unit registers by an external debugger.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the trace unit registers are prohibited by this control.
0b1
Non-secure accesses from an external debugger to some trace unit registers are prohibited. See individual registers for the effect of this field.
'0'
When FEAT_TRC_EXT is implemented and FEAT_TRBE is implemented
22
22
22
Reserved, RES0.
Otherwise
EPMAD
21
21
0
External Performance Monitors Access Disable. Together with MDCR_EL3.EPMADE, controls access to Performance Monitor registers by an external debugger.
External accesses of the following Performance Monitor registers are affected by this control:
PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.
If FEAT_PMUv3_EXT64 is implemented, PMCNTEN, PMINTEN, and PMOVS.
If FEAT_PMUv3p9 is implemented, PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMCGCR0, PMICFILTR_EL0, and PMICNTR_EL0.
If FEAT_PCSRv8p9 is implemented, PMPCSCTL.
EPMADE
EPMAD
Meaning
0b0
0b0
No accesses from an external debugger to affected Performance Monitor registers are prohibited by this control.
0b0
0b1
Realm and Non-secure accesses from an external debugger to affected Performance Monitor registers are prohibited.
Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.
0b1
0b0
Secure and Non-secure accesses from an external debugger to affected Performance Monitor registers are prohibited.
Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.
0b1
0b1
Secure, Non-secure, and Realm accesses from an external debugger to affected Performance Monitor registers are prohibited.
Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.
'0'
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented
EPMAD
21
21
0
External Performance Monitors Access Disable. Controls Non-secure access to Performance Monitor registers by an external debugger.
External accesses of the following Performance Monitor registers are affected by this control:
PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.
If FEAT_PMUv3_EXT64 is implemented, PMCNTEN, PMINTEN, and PMOVS.
If FEAT_PMUv3p9 is implemented, PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMCGCR0, PMICFILTR_EL0, and PMICNTR_EL0.
If FEAT_PCSRv8p9 is implemented, PMPCSCTL.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the Performance Monitor registers are prohibited by this control.
0b1
Non-secure accesses from an external debugger to the affected Performance Monitor registers are prohibited.
'0'
When FEAT_Debugv8p4 is implemented and FEAT_PMUv3_EXT is implemented
EPMAD
21
21
0
External Performance Monitors Access Disable. Controls access to Performance Monitor registers by an external debugger.
External accesses of the following Performance Monitor registers are affected by this control:
PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the Performance Monitor registers are prohibited by this control.
0b1
If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected Performance Monitor registers are prohibited.
'0'
When FEAT_PMUv3_EXT is implemented
21
21
21
Reserved, RES0.
Otherwise
EDAD
20
20
0
External Debug Access Disable. Together with MDCR_EL3.EDADE, controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.
External accesses of the following debug registers are affected by this control:
DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.
EDADE
EDAD
Meaning
0b0
0b0
No accesses from an external debugger to affected debug registers are prohibited by this control.
0b0
0b1
Realm and Non-secure accesses from an external debugger to affected debug registers are prohibited.
Other accesses from an external debugger to affected debug registers are not affected by this control.
0b1
0b0
Secure and Non-secure accesses from an external debugger to affected debug registers are prohibited.
Other accesses from an external debugger to affected debug registers are not affected by this control.
0b1
0b1
Secure, Non-secure, and Realm accesses from an external debugger to affected debug registers are prohibited.
Other accesses from an external debugger to affected debug registers are not affected by this control.
'0'
When FEAT_RME is implemented
EDAD
20
20
0
External Debug Access Disable. Controls Non-secure access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.
External accesses of the following debug registers are affected by this control:
DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the debug registers are prohibited by this control.
0b1
Non-secure accesses from an external debugger to the affected debug registers are prohibited.
'0'
When FEAT_Debugv8p4 is implemented
EDAD
20
20
0
External Debug Access Disable. Controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.
External accesses of the following debug registers are affected by this control:
DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the debug registers are prohibited by this control.
0b1
If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected debug registers are prohibited.
'0'
When FEAT_Debugv8p2 is implemented
EDAD
20
20
0
External Debug Access Disable. Controls access to breakpoint registers, watchpoint registers, and optionally OSLAR_EL1 by an external debugger.
External accesses of the following debug registers are affected by this control:
DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, and DBGWVR<n>_EL1.
It is IMPLEMENTATION DEFINED whether this control affects OSLAR_EL1.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
No accesses from an external debugger to the debug registers are prohibited by this control.
0b1
If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected debug registers are prohibited.
'0'
Otherwise
TTRF
19
19
0
Trap Trace Filter controls. Traps use of the Trace Filter control registers at EL2 and EL1 to EL3.
The Trace Filter registers trapped by this control are:
TRFCR_EL2, TRFCR_EL12, TRFCR_EL1, reported using EC syndrome value 0x18.
HTRFCR and TRFCR, reported using EC syndrome value 0x03.
0b0
Accesses to Trace Filter registers at EL2 and EL1 are not affected by this field.
0b1
Accesses to Trace Filter registers at EL2 and EL1 generate a Trap exception to EL3, unless the access generates a higher priority exception.
AU
When FEAT_TRF is implemented
19
19
19
Reserved, RES0.
Otherwise
STE
18
18
0
Secure Trace enable. Enables tracing in Secure state.
This field also controls the level of authentication required by an external debugger to enable external tracing. See 'Register controls to enable self-hosted trace'.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, the Effective value of this field is 1.
0b0
Trace prohibited in Secure state unless overridden by the IMPLEMENTATION DEFINED authentication interface.
0b1
Trace in Secure state is not affected by this field.
'0'
When FEAT_TRF is implemented and HaveSecureState()
18
18
18
Reserved, RES0.
Otherwise
SPME
17
17
0
Secure Performance Monitors Enable. Controls PMU operation in Secure state and at EL3 when MDCR_EL3.MPMX is 0.
When MDCR_EL3.MPMX is 0, the counters affected by this field are:
Event counters in the first and second ranges. For more information about event counter ranges, see MDCR_EL2.HPMN.
If FEAT_PMUv3_ICNTR is implemented, the instruction counter, PMICNTR_EL0.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.
When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
When MDCR_EL3.MPMX is 1, this field controls which event counters are affected by MDCR_EL3.MPMX at EL3. See MDCR_EL3.MPMX for more information.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
Affected counters are prohibited from counting in Secure state and at EL3. If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state and at EL3. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1
Counters are not affected by this mechanism.
'0'
When FEAT_PMUv3 is implemented and FEAT_PMUv3p7 is implemented
SPME
17
17
0
Secure Performance Monitors Enable. Controls PMU operation in Secure state.
The counters affected by this field are:
All event counters.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.
When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
Event counting is prohibited in Secure state.
If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1
Event counting and PMCCNTR_EL0 are not affected by this mechanism.
'0'
When FEAT_PMUv3 is implemented and FEAT_Debugv8p2 is implemented
SPME
17
17
0
Secure Performance Monitors Enable. Controls PMU operation in Secure state.
If ExternalSecureNoninvasiveDebugEnabled() is TRUE, then the event counters and PMCCNTR_EL0 are not affected by this field.
Otherwise, the counters affected by this field are:
All event counters.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.
When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.
0b0
If ExternalSecureNoninvasiveDebugEnabled() is FALSE, then all the following apply:
Event counting is prohibited in Secure state.
If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1
Event counting and PMCCNTR_EL0 are not affected by this mechanism.
'0'
When FEAT_PMUv3 is implemented
17
17
17
Reserved, RES0.
Otherwise
SDD
16
16
0
AArch64 Secure Self-hosted invasive debug disable. Disables Software debug exceptions in Secure state, other than Breakpoint Instruction exceptions.
The SDD bit is ignored unless both of the following are true:
The PE is in Secure state.
The Effective value of SCR_EL3.RW is 0.
If Secure EL2 is implemented and enabled, and Secure EL1 is using AArch32, then:
If debug exceptions from Secure EL1 are enabled, debug exceptions from Secure EL0 are also enabled.
Otherwise, debug exceptions from Secure EL0 are enabled only if the value of SDER32_EL3.SUIDEN is 1.
0b0
Debug exceptions in Secure state are not affected by this field.
0b1
Debug exceptions, other than Breakpoint Instruction exceptions, are disabled from all Exception levels in Secure state.
AU
When HaveSecureState()
16
16
16
Reserved, RES0.
Otherwise
SPD32
15
14
1:0
AArch32 Secure self-hosted privileged debug. Enables or disables debug exceptions from Secure EL1 using AArch32, other than Breakpoint Instruction exceptions.
Other values are reserved, and have the CONSTRAINED UNPREDICTABLE behavior that they must have the same behavior as 0b00. Software must not rely on this property as the behavior of reserved values might change in a future revision of the architecture.
This field has no effect on Breakpoint Instruction exceptions. These are always enabled.
This field is ignored unless both of the following are true:
The PE is in Secure state.
The Effective value of SCR_EL3.RW is 0.
If Secure EL1 is using AArch32, then:
If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure EL0 are also enabled.
Otherwise, debug exceptions from Secure EL0 are enabled only if the value of SDER32_EL3.SUIDEN is 1.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b11.
0b00
Legacy mode. Debug exceptions from Secure EL1 are enabled by the IMPLEMENTATION DEFINED authentication interface.
0b10
Secure privileged debug disabled. Debug exceptions from Secure EL1 are disabled.
0b11
Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled.
AU
When FEAT_AA32EL1 is implemented
15
14
15:14
Reserved, RES0.
Otherwise
NSPB
13
12
1:0
Non-secure Profiling Buffer. Together with MDCR_EL3.NSPBE, controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.
NSPBENSPBMeaning
0b00b00Profiling Buffer owning Security state is Secure state.
Profiling is disabled in Realm and Non-secure states.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
When Secure state is not implemented, this encoding is reserved.
0b00b01Profiling Buffer owning Security state is Secure state.
Profiling is disabled in Realm and Non-secure states.
Accesses to Statistical Profiling and Profiling Buffer System registers at Realm and Non-secure
EL2, and Realm and Non-secure EL1, are trapped to EL3, unless the access generates a higher
priority exception.
When Secure state is not implemented, this encoding is reserved.
0b00b10Profiling Buffer owning Security state is Non-secure state.
Profiling is disabled in Secure and Realm states.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
0b00b11Profiling Buffer owning Security state is Non-secure state.
Profiling is disabled in Secure and Realm states.
Accesses to Statistical Profiling and Profiling Buffer System registers at Secure and Realm EL2,
and Secure and Realm EL1, are trapped to EL3, unless the access generates a higher priority
exception.
0b10b10Profiling Buffer owning Security state is Realm state.
Profiling is disabled in Secure and Non-secure states.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 are
trapped to EL3, unless the access generates a higher priority exception.
0b10b11Profiling Buffer owning Security state is Realm state.
Profiling is disabled in Secure and Non-secure states.
Accesses to Statistical Profiling and Profiling Buffer System registers at Secure and Non-secure
EL2, and Secure and Non-secure EL1, are trapped to EL3, unless the access generates a higher
priority exception.
All other combinations of MDCR_EL3.NSPBE and MDCR_EL3.NSPB are reserved.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMBLIMITR_EL1, PMBPTR_EL1, PMBSR_EL1, PMSCR_EL1, PMSCR_EL2, PMSCR_EL12, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
MRS accesses to PMSIDR_EL1.
If FEAT_SPE_FnE is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.
If FEAT_SPE_EXC is implemented, MRS and MSR accesses to PMBSR_EL2 and PMBSR_EL12.
If FEAT_SPE_nVM is implemented, MRS and MSR accesses to PMBMAR_EL1.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL3, reported using EC syndrome value 0x18.
If profiling is enabled and MDCR_EL3.{NSPB, NSPBE} selects a reserved value, then the behavior is CONSTRAINED UNPREDICTABLE, and the Statistical Profiling Unit does one of:
Behaves as if profiling is disabled.
Selects an implemented Security state as the owning Security state.
When profiling data is generated, it is not written to memory and the Statistical Profiling Unit generates a Profiling Buffer management event, as follows:
If PMBSR_ELx.S is 0, then all of the following occur:
PMBSR_ELx.S is set to 1.
PMBSR_ELx.DL is set to 1.
PMBSR_ELx.EC is set to 0b000000, Other buffer management event.
PMBSR_ELx.BSC is set to 0b000000, Access not allowed.
The other fields in PMBSR_ELx are unchanged.
If profiling is enabled and MDCR_EL3.{NSPB, NSPBE} selects a reserved value, then it is CONSTRAINED UNPREDICTABLE whether or not accesses to the Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.
AU
When FEAT_SPE is implemented and FEAT_RME is implemented
NSPB
13
12
1:0
Non-secure Profiling Buffer. Controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMBLIMITR_EL1, PMBPTR_EL1, PMBSR_EL1, PMSCR_EL1, PMSCR_EL2, PMSCR_EL12, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
MRS accesses to PMSIDR_EL1.
If FEAT_SPE_FnE is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.
If FEAT_SPE_EXC is implemented, MRS and MSR accesses to PMBSR_EL2 and PMBSR_EL12.
If FEAT_SPE_nVM is implemented, MRS and MSR accesses to PMBMAR_EL1.
Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL3, reported using EC syndrome value 0x18.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.
If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.
0b00
Profiling Buffer owning Security state is Secure state. Profiling is disabled in Non-secure state.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b01
Profiling Buffer owning Security state is Secure state. Profiling is disabled in Non-secure state.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 in Non-secure state are trapped to EL3, unless the access generates a higher priority exception.
0b10
Profiling Buffer owning Security state is Non-secure state. Profiling is disabled in Secure state.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b11
Profiling Buffer owning Security state is Non-secure state. Profiling is disabled in Secure state.
Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 in Secure state are trapped to EL3, unless the access generates a higher priority exception.
AU
When FEAT_SPE is implemented
13
12
13:12
Reserved, RES0.
Otherwise
NSPBE
11
11
0
Non-secure Profiling Buffer Extended. Together with MDCR_EL3.NSPB, controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.
For a description of the values derived by evaluating NSPB and NSPBE together, see MDCR_EL3.NSPB.
AU
When FEAT_SPE is implemented and FEAT_RME is implemented
11
11
11
Reserved, RES0.
Otherwise
TDOSA
10
10
0
Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug System registers to EL3.
Accesses to the registers are trapped as follows:
Accesses from AArch64 state, OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, DBGPRCR_EL1, and any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field, are trapped to EL3 and reported using EC syndrome value 0x18.
Accesses using MCR or MRC to DBGOSLAR, DBGOSLSR, DBGOSDLR, and DBGPRCR, are trapped to EL3 and reported using EC syndrome value 0x05.
Accesses to any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field.
The powerdown debug System registers are not accessible at EL0.
0b0
This control does not cause any instructions to be trapped.
0b1
EL2 and EL1 System register accesses to the powerdown debug System registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.
AU
When FEAT_DoubleLock is implemented
TDOSA
10
10
0
Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug System registers to EL3.
The following registers are affected by this trap:
AArch64: OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.
AArch32: DBGOSLAR, DBGOSLSR, and DBGPRCR.
AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field.
It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 and DBGOSDLR are trapped.
The powerdown debug System registers are not accessible at EL0.
0b0
This control does not cause any instructions to be trapped.
0b1
EL2 and EL1 System register accesses to the powerdown debug System registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.
AU
Otherwise
TDA
9
9
9
Trap accesses of debug System registers. Enables a trap to EL3 on accesses of debug System registers.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to DBGAUTHSTATUS_EL1, DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGCLAIMCLR_EL1, DBGCLAIMSET_EL1, DBGVCR32_EL2, DBGWCR<n>_EL1, DBGWVR<n>_EL1, MDCCINT_EL1, MDCCSR_EL0, MDCR_EL2, MDRAR_EL1, MDSCR_EL1, OSDTRRX_EL1, OSDTRTX_EL1, and OSECCR_EL1.
If FEAT_Debugv8p9 is implemented, MRS and MSR accesses to MDSELR_EL1.
If FEAT_STEP2 is implemented, MRS and MSR accesses to MDSTEPOP_EL1.
In Non-debug state, MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
In AArch32 state, the instructions affected by this control are:
MRC and MCR accesses to DBGAUTHSTATUS, DBGBCR<n>, DBGBVR<n>, DBGBXVR<n>, DBGCLAIMCLR, DBGCLAIMSET, DBGDCCINT, DBGDEVID, DBGDEVID1, DBGDEVID2, DBGDIDR, DBGDRAR, DBGDSAR, DBGDSCRext, DBGDSCRint, DBGDTRRXext, DBGDTRTXext, DBGOSECCR, DBGVCR, DBGWCR<n>, DBGWFAR, DBGWVR<n>, HDCR, and SDER.
MRRC accesses to DBGDRAR and DBGDSAR.
STC accesses to DBGDTRRXint and LDC accesses to DBGDTRTXint.
In Non-debug state, MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.
Trapped AArch64 instructions are reported using EC syndrome value 0x18.
Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses with coproc == 0b1111, 0x05 for MCR and MCR accesses with coproc == 0b1110, 0x06 for LDC and STC accesses, and 0x0C for MRRC accesses.
The following instructions are not trapped in Debug state:
AArch64 MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
AArch32 MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.
If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI, then it is IMPLEMENTATION DEFINED whether AArch64 accesses to MDSELR_EL1 are trapped to EL3 when MDCR_EL3.TDA is 1.
0b0
Accesses of the specified debug System registers are not trapped by this mechanism.
0b1
Accesses of the specified debug System registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.
AU
8
8
8
Reserved, RES0.
EnPM2
7
7
0
Enable access to PMU registers. When disabled, accesses to PMU registers generate a trap to EL3.
In AArch64 state, the instructions affected by this control are:
If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICFILTR_EL0 and PMICNTR_EL0.
If FEAT_PMUv3p9 is implemented, MRS and MSR accesses to PMUACR_EL1.
If FEAT_SPMU is implemented, MRS and MSR accesses to SPMACCESSR_EL1, SPMACCESSR_EL2, SPMACCESSR_EL12, SPMCFGR_EL1, SPMCGCR<n>_EL1, SPMCNTENCLR_EL0, SPMCNTENSET_EL0, SPMCR_EL0, SPMDEVAFF_EL1, SPMDEVARCH_EL1, SPMEVCNTR<n>_EL0, SPMEVFILT2R<n>_EL0, SPMEVFILTR<n>_EL0, SPMEVTYPER<n>_EL0, SPMIIDR_EL1, SPMINTENCLR_EL1, SPMINTENSET_EL1, SPMOVSCLR_EL0, SPMOVSSET_EL0, SPMSCR_EL1, and SPMSELR_EL0.
If FEAT_SPMU2 is implemented, MSR writes to SPMZR_EL0.
Trapped instructions are reported using EC syndrome value 0x18.
0b0
Accesses of the specified PMU registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.
If FEAT_PMUv3_ICNTR is implemented, then:
PMCNTENCLR_EL0.F0, PMCNTENSET_EL0.F0, PMOVSCLR_EL0.F0, PMOVSSET_EL0.F0, and PMZR_EL0.F0 read-as-zero and ignore writes at EL2, EL1, and EL0.
PMINTENCLR_EL1.F0 and PMINTENSET_EL1.F0 read-as-zero and ignore writes at EL2 and EL1.
0b1
Accesses of the specified PMU registers are not trapped by this mechanism.
AU
When FEAT_PMUv3p9 is implemented, or FEAT_SPMU is implemented, or FEAT_EBEP is implemented, or FEAT_PMUv3_SS is implemented, or FEAT_SPMU2 is implemented
7
7
7
Reserved, RES0.
Otherwise
TPM
6
6
0
Trap accesses of PMU registers. Enables a trap to EL3 on accesses of PMU registers.
In AArch64 state, the instructions affected by this control are:
MRS and MSR accesses to PMCCFILTR_EL0, PMCCNTR_EL0, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, PMOVSSET_EL0, PMSELR_EL0, PMSWINC_EL0, PMUSERENR_EL0, PMXEVCNTR_EL0, and PMXEVTYPER_EL0.
MRS accesses to PMCEID0_EL0 and PMCEID1_EL0.
If FEAT_PMUv3p4 is implemented, MRS accesses to PMMIR_EL1.
If FEAT_PMUv3p9 is implemented, MSR accesses to PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICFILTR_EL0 and PMICNTR_EL0.
If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
In AArch32 state, the instructions affected by this control are:
MRC and MCR accesses to PMCCFILTR, PMCCNTR, PMCEID0, PMCEID1, PMCNTENCLR, PMCNTENSET, PMCR, PMEVCNTR<n>, PMEVTYPER<n>, PMINTENCLR, PMINTENSET, PMOVSR, PMOVSSET, PMSELR, PMSWINC, PMUSERENR, PMXEVCNTR, and PMXEVTYPER.
MRRC and MCRR accesses to PMCCNTR.
If FEAT_PMUv3p1 is implemented, MRC accesses to PMCEID2 and PMCEID3.
If FEAT_PMUv3p4 is implemented, MRC accesses to PMMIR.
Trapped AArch64 instructions are reported using EC syndrome value 0x18.
Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.
0b0
Accesses of the specified PMU registers are not trapped by this mechanism.
0b1
Accesses of the specified PMU registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.
AU
When FEAT_PMUv3 is implemented
6
6
6
Reserved, RES0.
Otherwise
5
5
5
Reserved, RES0.
EDADE
4
4
0
External Debug Access Disable Extended. Together with MDCR_EL3.EDAD, controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.
For a description of the values derived by evaluating MDCR_EL3.EDAD and MDCR_EL3.EDADE together, see MDCR_EL3.EDAD.
'0'
When FEAT_RME is implemented
4
4
4
Reserved, RES0.
Otherwise
ETADE
3
3
0
External Trace Access Disable Extended. Together with MDCR_EL3.ETAD, controls access to trace unit registers by an external debugger.
For a description of the values derived by evaluating MDCR_EL3.ETAD and MDCR_EL3.ETADE together, see MDCR_EL3.ETAD.
'0'
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented
3
3
3
Reserved, RES0.
Otherwise
EPMADE
2
2
0
External Performance Monitors Access Disable Extended. Together with MDCR_EL3.EPMAD, controls access to Performance Monitor registers by an external debugger.
For a description of the values derived by evaluating MDCR_EL3.EPMAD and MDCR_EL3.EPMADE together, see MDCR_EL3.EPMAD.
'0'
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented
2
2
2
Reserved, RES0.
Otherwise
1
1
1
Reserved, RES0.
RLTE
0
0
0
Realm Trace enable. Enables tracing in Realm state.
This field also controls the level of authentication that is required by an external debugger to enable external tracing.
0b0
Trace prohibited in Realm state, unless overridden by the IMPLEMENTATION DEFINED authentication interface.
0b1
Trace in Realm state is not affected by this field.
'0'
When FEAT_RME is implemented and FEAT_TRF is implemented
0
0
0
Reserved, RES0.
Otherwise
MRS <Xt>, MDCR_EL3
if !(HaveEL(EL3) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
Undefined();
elsif PSTATE.EL == EL2 then
Undefined();
elsif PSTATE.EL == EL3 then
X{64}(t) = MDCR_EL3();
end;
MSR MDCR_EL3, <Xt>
if !(HaveEL(EL3) && IsFeatureImplemented(FEAT_AA64)) then
Undefined();
elsif PSTATE.EL == EL0 then
Undefined();
elsif PSTATE.EL == EL1 then
Undefined();
elsif PSTATE.EL == EL2 then
Undefined();
elsif PSTATE.EL == EL3 then
if IsFeatureImplemented(FEAT_FGWTE3) && FGWTE3_EL3().MDCR_EL3 == '1' then
AArch64_SystemAccessTrap(EL3, 0x18);
else
MDCR_EL3() = X{64}(t);
end;
end;
2026-03-26 20:27:25
2026-03_rel