HDCR

Controls the trapping to Hyp mode of Non-secure accesses, at EL1 or lower, to functions provided by the debug and trace architectures and the Performance Monitors Extension.

Configuration

AArch32 System register HDCR bits [31:0] are architecturally mapped to AArch64 System register MDCR_EL2[31:0].

This register is present only when EL2 is capable of using AArch32. Otherwise, direct accesses to HDCR are UNDEFINED.

If EL2 is not implemented, this register is RES0 from EL3, and other than for a direct read of the register, the PE behaves as if HDCR.HPMN == PMCR.N.

Attributes

Field descriptions

Bits [31:30]

HPMFZO, bit [29]
When FEAT_PMUv3p7 is implemented:

Hyp Performance Monitors Freeze-on-overflow. Stop event counters on overflow.

HPMFZO	Meaning
0b0	Do not freeze on overflow.
0b1	Event counters do not count when PMOVSR[(PMCR.N-1):HDCR.HPMN] is nonzero.

If HDCR.HPMN is less than PMCR.N, this field affects the operation of event counters in the range [HDCR.HPMN .. (PMCR.N-1)].

This field does not affect the operation of other event counters and PMCCNTR.

The operation of this field applies even when EL2 is disabled in the current Security state.

The reset behavior of this field is:

On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN value.

Otherwise:

MTPME, bit [28]
When FEAT_MTPMU is implemented and EL3 is not implemented:

Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>.MT bits.

MTPME	Meaning
0b0	FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>.MT is zero.
0b1	PMEVTYPER<n>.MT bits not affected by this bit.

If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this bit is 0b0.

The reset behavior of this field is:

On a Cold reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 1.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

TDCC, bit [27]
When FEAT_FGT is implemented:

Trap DCC. Traps use of the Debug Comms Channel at EL1 and EL0 to EL2.

TDCC	Meaning
0b0	This control does not cause any register accesses to be trapped.
0b1	If EL2 is implemented and enabled in the current Security state, accesses to the DCC registers at EL1 and EL0 generate a Hyp Trap exception, unless the access also generates a higher priority exception. Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

TDCC

Meaning

0b0

This control does not cause any register accesses to be trapped.

0b1

If EL2 is implemented and enabled in the current Security state, accesses to the DCC registers at EL1 and EL0 generate a Hyp Trap exception, unless the access also generates a higher priority exception.

Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

The DCC registers trapped by this control are:

DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.

The traps are reported with EC syndrome value:

0x05 for trapped MRC and MCR accesses with coproc == 0b1110.
0x06 for trapped LDC to DBGDTRTXint and STC from DBGDTRRXint.

When the PE is in Debug state, HDCR.TDCC does not trap any accesses to:

DBGDTRRXint and DBGDTRTXint.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

HLP, bit [26]
When FEAT_PMUv3p5 is implemented:

Hypervisor Long event counter enable. Determines when unsigned overflow is recorded by an event counter overflow bit.

HLP	Meaning
0b0	Event counter overflow on increment that causes unsigned overflow of PMEVCNTR<n>[31:0].
0b1	Event counter overflow on increment that causes unsigned overflow of PMEVCNTR<n>[63:0].

If the highest implemented Exception level is using AArch32, it is IMPLEMENTATION DEFINED whether this bit is read/write or RAZ/WI.

If HDCR.HPMN is less than PMCR.N, this bit affects the operation of event counters in the range [HDCR.HPMN..(PMCR.N-1)].

This field does not affect the operation of other event counters.

The operation of this field applies even when EL2 is disabled in the current Security state.

Note

PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state.

The reset behavior of this field is:

On a Warm reset, in a system where the PE resets into EL2 or EL3, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [25:24]

HCCD, bit [23]
When FEAT_PMUv3p5 is implemented:

Hypervisor Cycle Counter Disable. Prohibits PMCCNTR from counting at EL2.

HCCD	Meaning
0b0	Cycle counting by PMCCNTR is not affected by this mechanism.
0b1	Cycle counting by PMCCNTR is prohibited at EL2.

This field does not affect the CPU_CYCLES event or any other event that counts cycles.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [22:20]

TTRF, bit [19]
When FEAT_TRF is implemented:

Traps use of the Trace Filter Control registers at EL1 to EL2 for MRC or MCR accesses, reported using EC syndrome value 0x03.

TTRF	Meaning
0b0	Accesses to TRFCR at EL1 are not affected by this control bit.
0b1	Accesses to TRFCR at EL1 generate a Hyp Trap exception.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bit [18]

HPMD, bit [17]
When FEAT_PMUv3p1 is implemented and FEAT_Debugv8p2 is implemented:

Guest Performance Monitors Disable. Controls PMU operation in Hyp mode.

HPMD	Meaning
0b0	Counters are not affected by this mechanism.
0b1	Affected counters are prohibited from counting in Hyp mode. If PMCR.DP is 1, then PMCCNTR is disabled in Hyp mode. Otherwise, PMCCNTR is not affected by this mechanism.

HPMD

Meaning

0b0

Counters are not affected by this mechanism.

0b1

Affected counters are prohibited from counting in Hyp mode.

If PMCR.DP is 1, then PMCCNTR is disabled in Hyp mode. Otherwise, PMCCNTR is not affected by this mechanism.

The counters affected by this field are:

Event counters PMEVCNTR<n> for values of n less than HDCR.HPMN.
If PMCR.DP is 1, the cycle counter PMCCNTR.

Other event counters are not affected by this field.

When PMCR.DP is 0, PMCCNTR is not affected by this field.

The reset behavior of this field is:

On a Warm reset:
- When the implementation only supports execution in AArch32 state, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

When FEAT_PMUv3p1 is implemented:

Guest Performance Monitors Disable. Controls PMU operation in Hyp mode when ExternalSecureNoninvasiveDebugEnabled() is FALSE.

HPMD	Meaning
0b0	Counters are not affected by this mechanism.
0b1	If ExternalSecureNoninvasiveDebugEnabled() is FALSE then all the following apply: Affected event counters are prohibited from counting in Hyp mode. If PMCR.DP is 1, then PMCCNTR is disabled in Hyp mode. Otherwise, PMCCNTR is not affected by this mechanism.

HPMD

Meaning

0b0

Counters are not affected by this mechanism.

0b1

If ExternalSecureNoninvasiveDebugEnabled() is FALSE then all the following apply:

Affected event counters are prohibited from counting in Hyp mode.
If PMCR.DP is 1, then PMCCNTR is disabled in Hyp mode. Otherwise, PMCCNTR is not affected by this mechanism.

If ExternalSecureNoninvasiveDebugEnabled() is TRUE then the event counters and PMCCNTR are not affected by this field.

Otherwise, the counters affected by this field are:

Event counters PMEVCNTR<n> for values of n less than HDCR.HPMN.
If PMCR.DP is 1, the cycle counter, PMCCNTR.

Other event counters are not affected by this field. When PMCR.DP is 0, PMCCNTR is not affected by this field.

The reset behavior of this field is:

On a Warm reset:
- When the implementation only supports execution in AArch32 state, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bits [16:12]

TDRA, bit [11]

Trap Debug ROM Address register access. Traps Non-secure EL0 and EL1 System register MRC or MCR accesses, reported using EC syndrome value 0x05, and MRRC accesses, reported using EC syndrome value 0x0C, to the Debug ROM registers to Hyp mode.

TDRA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	Non-secure EL0 and EL1 System register accesses to the DBGDRAR or DBGDSAR are trapped to Hyp mode, unless it is trapped by DBGDSCRext.UDCCdis.

If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

TDOSA, bit [10]
When FEAT_DoubleLock is implemented:

Trap debug OS-related register access. Traps Non-secure EL1 System register MRC or MCR accesses, reported using EC syndrome value 0x05, to the powerdown debug registers to Hyp mode.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	Non-secure EL1 System register accesses to the powerdown debug registers are trapped to Hyp mode.

The registers for which accesses are trapped are as follows:

DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

Note

These registers are not accessible at EL0.

If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

Trap debug OS-related register access. Traps Non-secure EL1 System register MRC or MCR accesses, reported using EC syndrome value 0x05, to the powerdown debug registers to Hyp mode.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	Non-secure EL1 System register accesses to the powerdown debug registers are trapped to Hyp mode.

The registers for which accesses are trapped are as follows:

DBGOSLSR, DBGOSLAR, and DBGPRCR.
Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

It is IMPLEMENTATION DEFINED whether accesses to DBGOSDLR are trapped.

Note

These registers are not accessible at EL0.

If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

TDA, bit [9]

Trap debug access. Traps Non-secure EL0 and EL1 System register MRC or MCR accesses, reported using EC syndrome value 0x05, to those debug System registers in the (coproc==0b1110) encoding space that are not trapped by either of the following:

HDCR.TDRA.
HDCR.TDOSA.

TDA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	Non-secure EL0 or EL1 System register accesses to the debug registers, other than the registers trapped by HDCR.TDRA and HDCR.TDOSA, are trapped to Hyp mode, unless it is trapped by DBGDSCRext.UDCCdis.

Traps of AArch32 accesses to DBGDTRRXint and DBGDTRTXint are ignored in Debug state.

If HCR.TGE or HDCR.TDE is 1, behavior is as if this bit is 1 other than for the purpose of a direct read.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

TDE, bit [8]

Trap Debug exceptions. Controls routing of Debug exceptions, and defines the debug target Exception level, EL_D.

TDE	Meaning
0b0	The debug target Exception level is EL1.
0b1	If EL2 is enabled for the current Effective value of SCR.NS, the debug target Exception level is EL2, otherwise the debug target Exception level is EL1. The HDCR.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.

TDE

Meaning

0b0

The debug target Exception level is EL1.

0b1

If EL2 is enabled for the current Effective value of SCR.NS, the debug target Exception level is EL2, otherwise the debug target Exception level is EL1.

The HDCR.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.

For more information, see 'Routing debug exceptions'.

When HCR.TGE == 1, the PE behaves as if the value of this field is 1 for all purposes other than returning the value of a direct read of the register.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

HPME, bit [7]
When FEAT_PMUv3 is implemented:

Hyp Enable.

HPME	Meaning
0b0	Affected counters are disabled and do not count.
0b1	Affected counters are enabled by PMCNTENSET.

The counters affected by this field are event counters PMEVCNTR<n> for values of n greater than or equal to HDCR.HPMN and less than PMCR.N. This applies even when EL2 is disabled in the current Security state.

Other event counters and PMCCNTR are not affected by this field.

If HDCR.HPMN is equal to PMCR.N, then this field has no effect.

The reset behavior of this field is:

On a Warm reset:
- When the implementation only supports execution in AArch32 state, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

TPM, bit [6]
When FEAT_PMUv3 is implemented:

Trap accesses of PMU registers. Enables a trap to EL2 on accesses of PMU registers.

TPM	Meaning
0b0	Accesses of the specified PMU registers are not trapped by this mechanism.
0b1	Accesses of the specified PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

The instructions affected by this control are:

MRC and MCR accesses to PMCCFILTR, PMCCNTR, PMCNTENCLR, PMCNTENSET, PMCR, PMEVCNTR<n>, PMEVTYPER<n>, PMINTENCLR, PMINTENSET, PMOVSR, PMOVSSET, PMSELR, PMSWINC, PMUSERENR, PMXEVCNTR, and PMXEVTYPER.
MRC accesses to PMCEID0 and PMCEID1.
MRRC and MCRR accesses to PMCCNTR.
If FEAT_PMUv3p1 is implemented, MRC accesses to PMCEID2 and PMCEID3.
If FEAT_PMUv3p4 is implemented, MRC accesses to PMMIR.

Unless the instruction generates a higher priority exception, trapped instructions generate a Hyp Trap exception.

Trapped instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.

The reset behavior of this field is:

On a Warm reset:
- When the implementation only supports execution in AArch32 state, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

TPMCR, bit [5]
When FEAT_PMUv3 is implemented:

Trap PMCR accesses. Traps Non-secure EL0 and EL1 MCR or MRC accesses to the PMCR to Hyp mode, reported using EC syndrome value 0x03.

TPMCR	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	Non-secure EL0 and EL1 accesses to the PMCR are trapped to Hyp mode, unless it is trapped by PMUSERENR.EN.

Note

EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped external debug interface.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3 or the highest implemented Exception level is EL2, this field resets to 0.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

HPMN, bits [4:0]
When FEAT_PMUv3 is implemented:

Defines the number of event counters PMEVCNTR<n> that are accessible from EL1 and from EL0 if permitted.

HDCR.HPMN divides the event counters into a first range and a second range.

If HDCR.HPMN is not 0 and is less than PMCR.N, then event counters [0..(HDCR.HPMN-1)] are in the first range, and the remaining event counters [HDCR.HPMN..(PMCR.N-1)] are in the second range.

If FEAT_HPMN0 is implemented and HDCR.HPMN is 0, then all event counters are in the second range and none are in the first range.

If HDCR.HPMN is equal to PMCR.N, then all event counters are in the first range and none are in the second range.

For an event counter PMEVCNTR<n> in the first range:

The counter is accessible from EL1, EL2, and EL3.
The counter is accessible from EL0 if permitted by PMUSERENR.
If FEAT_PMUv3p5 is implemented, PMCR.LP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>[31:0] or PMEVCNTR<n>. PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state.
PMCR.E and PMCNTENSET[n] enable the operation of the event counter.

For an event counter PMEVCNTR<n> in the second range:

The counter is accessible from EL2 and EL3.
If EL2 is disabled in the current Security state, the event counter is also accessible from EL1, and from EL0 if permitted by PMUSERENR.
If FEAT_PMUv3p5 is implemented, HDCR.HLP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>[31:0] or PMEVCNTR<n>. PMEVCNTR<n>[63:32] cannot be accessed directly in AArch32 state.
HDCR.HPME and PMCNTENSET[n] enable the operation of the event counter.

Values greater than PMCR.N are reserved. If FEAT_HPMN0 is not implemented then the value 0 is reserved.

If this field is set to a reserved value, then the following CONSTRAINED UNPREDICTABLE behaviors apply:

The value returned by a direct read of HDCR.HPMN is UNKNOWN.
Either:
- An UNKNOWN number of counters are reserved for EL2 and EL3 use. That is, the PE behaves as if HDCR.HPMN is set to an UNKNOWN nonzero value less than or equal to PMCR.N.
- All counters are reserved for EL2 and EL3 use, meaning no counters are accessible from EL1 and EL0 when EL2 is enabled in the current Security state.

The reset behavior of this field is:

On a Warm reset:
- When the implementation only supports execution in AArch32 state, this field resets to the expression UInt(AArch32-PMCR.N).
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

Accessing HDCR

Accesses to this register use the following encodings in the System register encoding space:

MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>}

coproc	opc1	CRn	CRm	opc2
0b1111	0b100	0b0001	0b0001	0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then AArch64.AArch32SystemAccessTrap(EL2, 0x03); elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then AArch32.TakeHypTrapException(0x03); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then UNDEFINED; elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then if EL3SDDUndef() then UNDEFINED; else AArch64.AArch32SystemAccessTrap(EL3, 0x03); else R[t] = HDCR; elsif PSTATE.EL == EL3 then if SCR.NS == '0' then UNDEFINED; else R[t] = HDCR;

MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>}

coproc	opc1	CRn	CRm	opc2
0b1111	0b100	0b0001	0b0001	0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HSTR_EL2.T1 == '1' then AArch64.AArch32SystemAccessTrap(EL2, 0x03); elsif EL2Enabled() && ELUsingAArch32(EL2) && HSTR.T1 == '1' then AArch32.TakeHypTrapException(0x03); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then UNDEFINED; elsif HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then if EL3SDDUndef() then UNDEFINED; else AArch64.AArch32SystemAccessTrap(EL3, 0x03); else HDCR = R[t]; elsif PSTATE.EL == EL3 then if SCR.NS == '0' then UNDEFINED; else HDCR = R[t];

31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0		HPMFZO	MTPME	TDCC	HLP	RES0		HCCD	RES0			TTRF	RES0	HPMD	RES0					TDRA	TDOSA	TDA	TDE	HPME	TPM	TPMCR	HPMN

HDCR, Hyp Debug Control Register

Purpose

Configuration

Attributes

Field descriptions

Bits [31:30]

HPMFZO, bit [29]When FEAT_PMUv3p7 is implemented:

Otherwise:

MTPME, bit [28]When FEAT_MTPMU is implemented and EL3 is not implemented:

Otherwise:

TDCC, bit [27]When FEAT_FGT is implemented:

Otherwise:

HLP, bit [26]When FEAT_PMUv3p5 is implemented:

Otherwise:

Bits [25:24]

HCCD, bit [23]When FEAT_PMUv3p5 is implemented:

Otherwise:

Bits [22:20]

TTRF, bit [19]When FEAT_TRF is implemented:

Otherwise:

Bit [18]

HPMD, bit [17]When FEAT_PMUv3p1 is implemented and FEAT_Debugv8p2 is implemented:

When FEAT_PMUv3p1 is implemented:

Otherwise:

Bits [16:12]

TDRA, bit [11]

TDOSA, bit [10]When FEAT_DoubleLock is implemented:

Otherwise:

TDA, bit [9]

TDE, bit [8]

HPME, bit [7]When FEAT_PMUv3 is implemented:

Otherwise:

TPM, bit [6]When FEAT_PMUv3 is implemented:

Otherwise:

TPMCR, bit [5]When FEAT_PMUv3 is implemented:

Otherwise:

HPMN, bits [4:0]When FEAT_PMUv3 is implemented:

Otherwise:

Accessing HDCR

MRC{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>}

MCR{<c>}{<q>} <coproc>, {#}<opc1>, <Rt>, <CRn>, <CRm>{, {#}<opc2>}

HPMFZO, bit [29]
When FEAT_PMUv3p7 is implemented:

MTPME, bit [28]
When FEAT_MTPMU is implemented and EL3 is not implemented:

TDCC, bit [27]
When FEAT_FGT is implemented:

HLP, bit [26]
When FEAT_PMUv3p5 is implemented:

HCCD, bit [23]
When FEAT_PMUv3p5 is implemented:

TTRF, bit [19]
When FEAT_TRF is implemented:

HPMD, bit [17]
When FEAT_PMUv3p1 is implemented and FEAT_Debugv8p2 is implemented:

TDOSA, bit [10]
When FEAT_DoubleLock is implemented:

HPME, bit [7]
When FEAT_PMUv3 is implemented:

TPM, bit [6]
When FEAT_PMUv3 is implemented:

TPMCR, bit [5]
When FEAT_PMUv3 is implemented:

HPMN, bits [4:0]
When FEAT_PMUv3 is implemented: