MDCR_EL2, Monitor Debug Configuration Register (EL2)

Reserved, RES0.

EnSTEPOP	Meaning
0b0	Execution from MDSTEPOP_EL1 is disabled.
0b1	Execution from MDSTEPOP_EL1 is not disabled by this control.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b1, other than for a direct read of the register.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Reserved, RES0.

Extended Breakpoint and Watchpoint Enable. Enables use of additional breakpoints or watchpoints.

EBWE	Meaning
0b0	The Effective value of MDSCR_EL1.EMBWE is 0. The Effective value of MDSELR_EL1.BANK is zero at EL2.
0b1	The Effective values of MDSCR_EL1.EMBWE and MDSELR_EL1.BANK are not affected by this field.

It is IMPLEMENTATION DEFINED whether this field is implemented or is RES0 when 16 or fewer breakpoints are implemented, 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 1, other than for a direct read of the register.

This field is ignored by the PE and treated as 0 when EL3 is implemented and MDCR_EL3.EBWE is 0.

The reset behavior of this field is:

• On a Warm reset:
  • When the highest implemented Exception level is EL2, this field resets to 0.
  • Otherwise, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Reserved, RES0.

Performance Monitors Exception Enable. Controls the generation of PMUIRQ signal and PMU exception at EL0, EL1, and EL2.

PMEE	Meaning
0b00	PMUIRQ signal is enabled, and PMU exception is disabled.
0b01	PMUIRQ signal and PMU exception are both controlled by PMECR_EL1.PMEE.
0b10	PMUIRQ signal is disabled, and PMU exception is disabled.
0b11	PMUIRQ signal is disabled, and PMU exception is enabled.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b01, other than for a direct read of the register.

This field is ignored by the PE when all of the following are true:

• EL3 is implemented.
• MDCR_EL3.PMEE != 0b01.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Reserved, RES0.

Hyp Performance Monitors Freeze-on-SPE event. Stop counters when PMBLIMITR_EL1.{PMFZ, E} == {1, 1} and PMBSR_EL1.S == 1.

HPMFZS	Meaning
0b0	Do not freeze on a Statistical Profiling Buffer Management event.
0b1	Affected counters do not count following a Statistical Profiling Buffer Management event.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Reserved, RES0.

Performance Monitors Snapshot Enable. Controls the generation of Capture events.

PMSSE	Meaning
0b00	Capture events are disabled.
0b01	Capture events are controlled by PMECR_EL1.SSE.
0b10	Capture events are enabled and prohibited.
0b11	Capture events are enabled and allowed.

If EL2 is not implemented, then the Effective value of this field is 0b01.

The reset behavior of this field is:

• On a Cold reset:
  • When the highest implemented Exception level is EL2, this field resets to 0.
  • Otherwise, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Hyp Performance Monitors Freeze-on-overflow. Stop event counters on overflow.

HPMFZO	Meaning
0b0	Do not freeze on overflow.
0b1	Affected counters do not count when all the following are true for any value of m greater than or equal to MDCR_EL2.HPMN: PMOVSCLR_EL0[m] is 1. Either FEAT_SEBEP is not implemented or PMEVTYPER<m>_EL0.SYNC is 0.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>_EL0.MT bits.

MTPME	Meaning
0b0	FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>_EL0.MT is 0.
0b1	PMEVTYPER<n>_EL0.MT bits not affected by this field.

If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this field is 0.

The reset behavior of this field is:

• On a Cold reset, this field resets to 1.

Reserved, RES0.

Trap DCC. Traps use of the Debug Comms Channel at EL1 and EL0 to EL2.

TDCC	Meaning
0b0	This control does not cause any register accesses to be trapped.
0b1	If EL2 is implemented and enabled in the current Security state, accesses to the DCC registers at EL1 and EL0 generate a Trap exception to EL2, unless the access also generates a higher priority exception. Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

The DCC registers trapped by this control are:

AArch64: OSDTRRX_EL1, OSDTRTX_EL1, MDCCSR_EL0, MDCCINT_EL1, and, when the PE is in Non-debug state, DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.

The traps are reported with EC syndrome value:

• 0x05 for trapped AArch32 MRC and MCR accesses with coproc == 0b1110.
• 0x06 for trapped AArch32 LDC to DBGDTRTXint and STC from DBGDTRRXint.
• 0x18 for trapped AArch64 MRS and MSR accesses.

When the PE is in Debug state, MDCR_EL2.TDCC does not trap any accesses to:

AArch64: DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXint and DBGDTRTXint.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Hypervisor Long Event Counter Enable. Determines which event counter bit generates an overflow recorded by PMOVSR[n].

HLP	Meaning
0b0	Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[31:0].
0b1	Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[63:0].

When FEAT_EBEP is implemented and the PMU exception is enabled, the Effective value of this field is 1.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

For more information see the description of MDCR_EL2.HPMN.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

EL2 Trace Buffer.

If EL2 is implemented and enabled in the Trace Buffer owning Security state, controls the owning translation regime.

If EL2 is implemented and enabled in the current Security state, controls access to Trace Buffer control registers from EL1.

E2TB	Meaning
0b00	If EL2 is implemented and enabled in the Trace Buffer owning Security state, then the Trace Buffer owning Exception level is EL2. Otherwise, the Trace Buffer owning Exception level is EL1 and, if TraceBufferEnabled() == TRUE, tracing is prohibited at EL2. If EL2 is implemented and enabled in the current Security state, accesses to Trace Buffer control registers at EL1 generate a Trap exception to EL2.
0b10	Trace Buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2. If EL2 is implemented and enabled in the current Security state, accesses to Trace Buffer control registers at EL1 generate a Trap exception to EL2.
0b11	Trace Buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2.

All other values are reserved.

In AArch64 state, the instructions affected by this control are:

• MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
• If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.

Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL2.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Hypervisor Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting at EL2.

HCCD	Meaning
0b0	Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1	Cycle counting by PMCCNTR_EL0 is prohibited at EL2.

This field does not affect the CPU_CYCLES event or any other event that counts cycles.

The reset behavior of this field is:

• On a Warm reset, this field resets to 0.

Reserved, RES0.

Reserved, RES0.

Traps use of the Trace Filter Control registers at EL1 to EL2, as follows:

• Access to TRFCR_EL1 is trapped to EL2, reported using EC syndrome value 0x18.

• Access to TRFCR is trapped to EL2, reported using EC syndrome value 0x03.

TTRF	Meaning
0b0	Accesses to the specified registers at EL1 are not affected by this control.
0b1	Accesses to the specified registers at EL1 generate a trap exception to EL2 when EL2 is enabled in the current Security state.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Reserved, RES0.

Guest Performance Monitors Disable. Controls PMU operation at EL2.

HPMD	Meaning
0b0	Counters are not affected by this mechanism.
0b1	Affected counters are prohibited from counting at EL2. If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

The counters affected by this field are:

• Event counters PMEVCNTR<n>_EL0 for values of n less than MDCR_EL2.HPMN.
• If FEAT_PMUv3_ICNTR is implemented, the instruction counter PMICNTR_EL0.
• If PMCR_EL0.DP is 1, the cycle counter PMCCNTR_EL0.

Other event counters are not affected by this field.

When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

The reset behavior of this field is:

• On a Warm reset, this field resets to 0.

Guest Performance Monitors Disable. Controls PMU operation at EL2 when ExternalSecureNoninvasiveDebugEnabled() is FALSE.

HPMD	Meaning
0b0	Counters are not affected by this mechanism.
0b1	If ExternalSecureNoninvasiveDebugEnabled() is FALSE then all the following apply: Affected event counters are prohibited from counting at EL2. If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

If ExternalSecureNoninvasiveDebugEnabled() is TRUE then the event counters and PMCCNTR_EL0 are not affected by this field.

Otherwise, the counters affected by this field are:

• Event counters PMEVCNTR<n>_EL0 for values of n less than MDCR_EL2.HPMN.
• If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.

Other event counters are not affected by this field. When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

The reset behavior of this field is:

• On a Warm reset, this field resets to 0.

Reserved, RES0.

Reserved, RES0.

Enable access to System PMU registers. When disabled, accesses to System PMU registers generate a trap to EL2.

EnSPM	Meaning
0b0	Accesses of the specified System PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified System PMU registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to SPMACCESSR_EL1, SPMCFGR_EL1, SPMCGCR<n>_EL1, SPMCNTENCLR_EL0, SPMCNTENSET_EL0, SPMCR_EL0, SPMDEVAFF_EL1, SPMDEVARCH_EL1, SPMEVCNTR<n>_EL0, SPMEVFILT2R<n>_EL0, SPMEVFILTR<n>_EL0, SPMEVTYPER<n>_EL0, SPMIIDR_EL1, SPMINTENCLR_EL1, SPMINTENSET_EL1, SPMOVSCLR_EL0, SPMOVSSET_EL0, SPMSCR_EL1, and SPMSELR_EL0.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Trap Performance Monitor Sampling. Enables a trap to EL2 on accesses of SPE registers.

TPMS	Meaning
0b0	Accesses of the specified SPE registers are not trapped by this mechanism.
0b1	Accesses of the specified SPE registers at EL1 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

• MRS and MSR accesses to PMSCR_EL1, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
• MRS accesses to PMSIDR_EL1.
• If FEAT_SPEv1p2 is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
• If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

EL2 Profiling Buffer. If EL2 is implemented and enabled in the Profiling Buffer owning Security state, this field controls the owning translation regime. If EL2 is implemented and enabled in the current Security state, this field controls access to Profiling Buffer control registers from EL1.

E2PB	Meaning
0b00	If EL2 is implemented and enabled in the Profiling Buffer owning Security state, the Profiling Buffer uses the EL2 or EL2&0 stage 1 translation regime. Otherwise the Profiling Buffer uses the EL1&0 stage 1 translation regime. If EL2 is implemented and enabled in the current Security state, accesses to Profiling Buffer control registers at EL1 generate a Trap exception to EL2.
0b10	Profiling Buffer uses the EL1&0 stage 1 translation regime. If EL2 is implemented and enabled in the current Security state, accesses to Profiling Buffer control registers at EL1 generate a Trap exception to EL2.
0b11	Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling Buffer control registers at EL1 are not trapped to EL2.

All other values are reserved.

The Profiling Buffer control registers trapped by this control are: PMBLIMITR_EL1, PMBPTR_EL1, and PMBSR_EL1.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Trap Debug ROM Address register access. Traps System register accesses to the Debug ROM registers to EL2 when EL2 is enabled in the current Security state as follows:

• If EL1 is using AArch64 state, accesses to MDRAR_EL1 are trapped to EL2, reported using EC syndrome value 0x18.
• If EL0 or EL1 is using AArch32 state, MRC or MCR accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05 and MRRC or MCRR accesses are trapped to EL2, reported using EC syndrome value 0x0C:
  • DBGDRAR, DBGDSAR.

TDRA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 System register accesses to the Debug ROM registers are trapped to EL2 when EL2 is enabled in the current Security state, unless it is trapped by the following: DBGDSCRext.UDCCdis. MDSCR_EL1.TDCC.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

• MDCR_EL2.TDE == 1.
• HCR_EL2.TGE == 1.

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states as follows:

• In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x18:
  • OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1.
  • Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.
• In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05:
  • DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR.
  • Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

• MDCR_EL2.TDE == 1.
• HCR_EL2.TGE == 1.

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states as follows:

• In AArch64 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x18:

  • OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.

  • Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

• In AArch32 state, accesses to the following registers are trapped to EL2, reported using EC syndrome value 0x05:

  • DBGOSLSR, DBGOSLAR, and DBGPRCR.

  • Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 are trapped.

It is IMPLEMENTATION DEFINED whether accesses to DBGOSDLR are trapped.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

• MDCR_EL2.TDE == 1.
• HCR_EL2.TGE == 1.

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Trap accesses of debug System registers. Enables a trap to EL2 on accesses of debug System registers.

TDA	Meaning
0b0	Accesses of the specified debug System registers are not trapped by this mechanism.
0b1	Accesses of the specified debug System registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

• MRS and MSR accesses to DBGAUTHSTATUS_EL1, DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGCLAIMCLR_EL1, DBGCLAIMSET_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, MDCCINT_EL1, MDCCSR_EL0, MDSCR_EL1, OSDTRRX_EL1, OSDTRTX_EL1, and OSECCR_EL1.
• If FEAT_Debugv8p9 is implemented, MRS and MSR accesses to MDSELR_EL1.
• If FEAT_STEP2 is implemented, MRS and MSR accesses to MDSTEPOP_EL1.
• In Non-debug state, MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.

In AArch32 state, the instructions affected by this control are:

• MRC and MCR accesses to DBGAUTHSTATUS, DBGBCR<n>, DBGBVR<n>, DBGBXVR<n>, DBGCLAIMCLR, DBGCLAIMSET, DBGDCCINT, DBGDEVID, DBGDEVID1, DBGDEVID2, DBGDIDR, DBGDSCRext, DBGDSCRint, DBGDTRRXext, DBGDTRTXext, DBGOSECCR, DBGVCR, DBGWCR<n>, DBGWFAR, and DBGWVR<n>.

• STC accesses to DBGDTRRXint and LDC accesses to DBGDTRTXint.

• In Non-debug state, MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x05 for MRC and MCR accesses, and 0x06 for LDC and STC accesses.

The following instructions are not trapped in Debug state:

• AArch64 MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
• AArch32 MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.

If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI, then it is IMPLEMENTATION DEFINED whether AArch64 accesses to MDSELR_EL1 are trapped to EL2 when MDCR_EL2.TDA is 1.

This field is ignored by the PE and treated as one when any of the following are true:

• MDCR_EL2.TDE == 1.
• HCR_EL2.TGE == 1.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Trap Debug Exceptions. Controls routing of Debug exceptions, and defines the debug target Exception level, EL_D.

TDE	Meaning
0b0	The debug target Exception level is EL1.
0b1	If EL2 is enabled for the current Effective value of SCR_EL3.NS, the debug target Exception level is EL2, otherwise the debug target Exception level is EL1. The MDCR_EL2.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.

For more information, see 'Routing debug exceptions'.

This field is treated as being 1 for all purposes other than a direct read when HCR_EL2.TGE == 1.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Hyp Enable.

HPME	Meaning
0b0	Affected counters are disabled and do not count.
0b1	Affected counters are enabled by PMCNTENSET_EL0.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Trap accesses of PMU registers. Enables a trap to EL2 on accesses of PMU registers.

TPM	Meaning
0b0	Accesses of the specified PMU registers are not trapped by this mechanism.
0b1	Accesses of the specified PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

• MRS and MSR accesses to PMCCFILTR_EL0, PMCCNTR_EL0, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, PMOVSSET_EL0, PMSELR_EL0, PMSWINC_EL0, PMUSERENR_EL0, PMXEVCNTR_EL0, and PMXEVTYPER_EL0.
• MRS accesses to PMCEID0_EL0 and PMCEID1_EL0.
• If FEAT_PMUv3p4 is implemented, MRS accesses to PMMIR_EL1.
• If FEAT_PMUv3p9 is implemented, MSR accesses to PMZR_EL0.
• If FEAT_PMUv3_ICNTR is implemented, MRS accesses to PMICFILTR_EL0 and PMICNTR_EL0.
• If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
• If FEAT_SEBEP is implemented, MRS and MSR accesses to PMIAR_EL1.

In AArch32 state, the instructions affected by this control are:

• MRC and MCR accesses to PMCCFILTR, PMCCNTR, PMCNTENCLR, PMCNTENSET, PMCR, PMEVCNTR<n>, PMEVTYPER<n>, PMINTENCLR, PMINTENSET, PMOVSR, PMOVSSET, PMSELR, PMSWINC, PMUSERENR, PMXEVCNTR, and PMXEVTYPER.

• MRC accesses to PMCEID0 and PMCEID1.

• MRRC and MCRR accesses to PMCCNTR.

• If FEAT_PMUv3p1 is implemented, MRC accesses to PMCEID2 and PMCEID3.

• If FEAT_PMUv3p4 is implemented, MRC accesses to PMMIR.

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Trap PMCR_EL0 or PMCR accesses. Traps EL0 and EL1 accesses to EL2, when EL2 is enabled in the current Security state, as follows:

• In AArch64 state, accesses to PMCR_EL0 are trapped to EL2, reported using EC syndrome value 0x18.

• In AArch32 state, accesses to PMCR are trapped to EL2, reported using EC syndrome value 0x03.

TPMCR	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL0 and EL1 accesses to the specified registers are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by the following: PMUSERENR.EN. PMUSERENR_EL0.EN.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.

Reserved, RES0.

Defines the number of event counters PMEVCNTR<n>_EL0 and, if FEAT_PMUv3_SS is implemented, snapshot registers PMEVCNTSVR<n>_EL1, that are accessible from EL1 and from EL0 if permitted.

MDCR_EL2.HPMN divides the event counters into a first range and a second range.

If MDCR_EL2.HPMN is not 0 and is less than PMCR_EL0.N, then event counters [0..(MDCR_EL2.HPMN-1)] are in the first range, and the remaining event counters [MDCR_EL2.HPMN..(PMCR_EL0.N-1)] are in the second range.

If FEAT_HPMN0 is implemented and MDCR_EL2.HPMN is 0, then all event counters are in the second range and none are in the first range.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then all event counters are in the first range and none are in the second range.

For an event counter PMEVCNTR<n>_EL0 in the first range:

• The counter is accessible from EL1, EL2, and EL3.
• The counter is accessible from EL0 if permitted by PMUSERENR_EL0 and PMUACR_EL1, or by PMUSERENR.
• If FEAT_PMUv3p5 is implemented, PMCR_EL0.LP or PMCR.LP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
• PMCR_EL0.E and PMCNTENSET_EL0[n] enable the operation of the event counter.

For an event counter PMEVCNTR<n>_EL0 in the second range:

• The counter is accessible from EL2 and EL3.
• If EL2 is disabled in the current Security state, the event counter is also accessible from EL1, and from EL0 if permitted by PMUSERENR_EL0 and PMUACR_EL1, or by PMUSERENR.
• If FEAT_PMUv3p5 is implemented, MDCR_EL2.HLP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
• MDCR_EL2.HPME and PMCNTENSET_EL0[n] enable the operation of the event counter.

If FEAT_PMUv3_SS is implemented:

• For an event counter snapshot register PMEVCNTSVR<n>_EL1 in the first range, the register is accessible from EL1, EL2, and EL3.

• For an event counter snapshot register PMEVCNTSVR<n>_EL1 in the second range, the register is accessible from EL2 and EL3. If EL2 is disabled in the current Security state, the event counter is also accessible from EL1.

Values greater than PMCR_EL0.N are reserved. If FEAT_HPMN0 is not implemented then the value 0 is reserved.

If this field is set to a reserved value, then the following CONSTRAINED UNPREDICTABLE behaviors apply:

• The value returned by a direct read of MDCR_EL2.HPMN is UNKNOWN.
• Either:
  • An UNKNOWN number of counters are reserved for EL2 and EL3 use. That is, the PE behaves as if MDCR_EL2.HPMN is set to an UNKNOWN nonzero value less than or equal to PMCR_EL0.N.
  • All counters are reserved for EL2 and EL3 use, meaning no counters are accessible from EL1 and EL0 when EL2 is enabled in the current Security state.

The reset behavior of this field is:

• On a Warm reset, this field resets to the expression NUM_PMU_COUNTERS.

Reserved, RES0.