MDCR_EL3

Provides EL3 configuration options for self-hosted debug and the Performance Monitors Extension.

Configuration

This register is present only when EL3 is implemented. Otherwise, direct accesses to MDCR_EL3 are UNDEFINED.

Attributes

Field descriptions

Bits [63:56]

EnPMS4, bit [55]
When FEAT_SPE_nVM is implemented:

Enable access to SPE registers. When disabled, accesses to SPE registers generate a trap to EL3.

EnPMS4	Meaning
0b0	Accesses of the specified SPE registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified SPE registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to PMBMAR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

TRBEE, bits [54:53]
When FEAT_TRBE_EXC is implemented:

Trace buffer management event Exception Enable.

TRBEE	Meaning
0b00	Disabled. TRBE Profiling exceptions for all Exception levels are disabled. All of the following apply: No trace buffer management events are recorded in TRBSR_EL3. TRBE Profiling exceptions are not generated. TRBSR_EL1.IRQ drives the interrupt request signal TRBIRQ. Accesses to TRBSR_EL2 at EL2 are trapped to EL3. Accesses to TRBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to TRBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H.
0b01	Delegated. TRBE Profiling exceptions for EL3 are disabled, but might be enabled for EL2 or EL1 by TRFCR_EL2.EE or TRFCR_EL1.EE. All of the following apply: No trace buffer management events are recorded in TRBSR_EL3. TRBSR_EL3.IRQ is ignored and TRBE Profiling exceptions are not taken to EL3.
0b10	Enabled. TRBE Profiling exceptions for EL3 are enabled for trace buffer management events targeting EL3, as follows: Trace buffer management events due to a fault on a write to the trace buffer that would generate a Data Abort exception taken to EL3 if generated by a store instruction executed at the owning Exception level are recorded in TRBSR_EL3. That is, any of the following faults: Granule Protection Check faults other than Granule Protection Faults (GPFs). If SCR_EL3.GPF is 1, GPFs. If SCR_EL3.EA is 1, External aborts. TRBE Profiling exceptions are generated and taken to EL3 when unmasked and TRBSR_EL3.IRQ is 1.
0b11	Trap all. TRBE Profiling exceptions for EL3 are enabled for all trace buffer management events, as follows: All trace buffer management events are recorded in TRBSR_EL3. TRBE Profiling exceptions are generated and taken to EL3 when unmasked and TRBSR_EL3.IRQ is 1.

If EL3 is not implemented, then the Effective value of MDCR_EL3.TRBEE is 0b01.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3, this field resets to '00'.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

PMSEE, bits [52:51]
When FEAT_SPE_EXC is implemented:

Profiling Buffer management event Exception Enable.

PMSEE	Meaning
0b00	Disabled. SPE Profiling exceptions for all Exception levels are disabled. All of the following apply: No Profiling Buffer management events are recorded in PMBSR_EL3. SPE Profiling exceptions are not generated. PMBSR_EL1.S drives the interrupt request signal PMBIRQ. Accesses to PMBSR_EL2 at EL2 are trapped to EL3. Accesses to PMBSR_EL1 at EL1 ignore the value of HCR_EL2.NV1 and accesses to PMBSR_EL1 at EL2 ignore the value of HCR_EL2.E2H.
0b01	Delegated. SPE Profiling exceptions for EL3 are disabled, but might be enabled for EL2 or EL1 by PMSCR_EL2.EE or PMSCR_EL1.EE. All of the following apply: No Profiling Buffer management events are recorded in PMBSR_EL3. PMBSR_EL3.S is ignored and SPE Profiling exceptions are not taken to EL3.
0b10	Enabled. SPE Profiling exceptions for EL3 are enabled for Profiling Buffer management events targeting EL3, as follows: Profiling Buffer management events due to a fault on a write to the Profiling Buffer that would generate a Data Abort exception taken to EL3 if generated by a store instruction executed at the owning Exception level are recorded in PMBSR_EL3. That is, any of the following faults: Granule Protection Check faults other than Granule Protection Faults (GPFs). If SCR_EL3.GPF is 1, GPFs. If SCR_EL3.EA is 1, External aborts. SPE Profiling exceptions are generated and taken to EL3 when unmasked and PMBSR_EL3.S is 1.
0b11	Trap all. SPE Profiling exceptions for EL3 are enabled for all Profiling Buffer management events, as follows: All Profiling Buffer management events are recorded in PMBSR_EL3. SPE Profiling exceptions are generated and taken to EL3 when unmasked and PMBSR_EL3.S is 1.

If EL3 is not implemented, then the Effective value of MDCR_EL3.PMSEE is 0b01.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3, this field resets to '00'.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

EnSTEPOP, bit [50]
When FEAT_STEP2 is implemented:

EnSTEPOP	Meaning
0b0	Execution from MDSTEPOP_EL1 is disabled. EL2, EL1 and EL0 System register accesses to MDSTEPOP_EL1 are trapped to EL3, unless the access generates a higher priority exception.
0b1	Execution from MDSTEPOP_EL1 is not disabled by this control. System register accesses to MDSTEPOP_EL1 are not trapped by this mechanism.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

ETBAD, bits [49:48]
When FEAT_TRBE_EXT is implemented:

External Trace Buffer Access Disable. Controls access to the Trace Buffer registers from an external debugger.

ETBAD	Meaning	Applies when
0b00	Non-secure accesses from an external debugger to Trace Buffer registers are prohibited. If FEAT_RME is implemented, Secure and Realm accesses from an external debugger to Trace Buffer registers are prohibited and Root accesses to Trace Buffer registers are allowed. If FEAT_RME is not implemented, Secure accesses to Trace Buffer registers are allowed.
0b01	Secure and Non-secure accesses from an external debugger to Trace Buffer registers are prohibited. Root and Realm accesses to Trace Buffer registers are allowed.	When FEAT_RME is implemented
0b10	Realm and Non-secure accesses from an external debugger to Trace Buffer registers are prohibited. Root and Secure accesses to Trace Buffer registers are allowed.	When FEAT_RME is implemented
0b11	All accesses from an external debugger to Trace Buffer registers are allowed.

If EL3 is not implemented, then the Effective value of this field is 0b11.

The reset behavior of this field is:

On a Warm reset, this field resets to '00'.

Otherwise:

EnITE, bit [47]
When FEAT_ITE is implemented:

Enable access to Instrumentation trace registers. When disabled, accesses to Instrumentation trace registers generate a trap to EL3.

EnITE	Meaning
0b0	Accesses of the specified Instrumentation trace registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified Instrumentation trace registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to TRCITECR_EL1, TRCITECR_EL2, and TRCITECR_EL12.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EPMSSAD, bits [46:45]
When FEAT_PMUv3_SS is implemented:

External PMU Snapshot Access Disable. Controls access to the PMU Snapshot registers from an external debugger.

External accesses of the following registers are affected by this control:

PMCCNTSVR_EL1, PMEVCNTSVR<n>_EL1, and PMSSCR_EL1.
If FEAT_PMUv3_ICNTR is implemented, PMICNTSVR_EL1.

EPMSSAD	Meaning	Applies when
0b00	Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited. If FEAT_RME is implemented, Secure and Realm accesses from an external debugger to the affected PMU Snapshot registers are prohibited. Other accesses from an external debugger to the specified registers are not affected by this control.
0b01	Secure and Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited. Other accesses from an external debugger to the specified registers are not affected by this control.	When FEAT_RME is implemented
0b10	Realm and Non-secure accesses from an external debugger to the affected PMU Snapshot registers are prohibited. Other accesses from an external debugger to the specified registers are not affected by this control.	When FEAT_RME is implemented
0b11	No accesses from an external debugger to the affected PMU Snapshot registers are prohibited by this control.

If EL3 is not implemented, then the Effective value of this field is 0b11.

The reset behavior of this field is:

On a Warm reset, this field resets to '00'.

Otherwise:

EnPMSS, bit [44]
When FEAT_PMUv3_SS is implemented:

Enable access to PMU Snapshot registers. When disabled, accesses to PMU Snapshot registers generate a trap to EL3.

EnPMSS	Meaning
0b0	Accesses of the specified PMU Snapshot registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified PMU Snapshot registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to PMCCNTSVR_EL1, PMEVCNTSVR<n>_EL1, and PMSSCR_EL1.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICNTSVR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

EBWE, bit [43]
When FEAT_Debugv8p9 is implemented:

Extended Breakpoint and Watchpoint Enable. Enables use of additional breakpoints or watchpoints, and enables a trap to EL3 on accesses to debug registers.

EBWE	Meaning
0b0	The Effective values of MDSCR_EL1.EMBWE and MDCR_EL2.EBWE are 0. The Effective value of MDSELR_EL1.BANK is zero at EL3. Accesses of MDSELR_EL1 at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	The Effective values of MDSCR_EL1.EMBWE, MDCR_EL2.EBWE, and MDSELR_EL1.BANK are not affected by this field. Accesses of MDSELR_EL1 are not trapped by this mechanism.

EBWE

Meaning

0b0

The Effective values of MDSCR_EL1.EMBWE and MDCR_EL2.EBWE are 0.

The Effective value of MDSELR_EL1.BANK is zero at EL3.

Accesses of MDSELR_EL1 at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.

0b1

The Effective values of MDSCR_EL1.EMBWE, MDCR_EL2.EBWE, and MDSELR_EL1.BANK are not affected by this field.

Accesses of MDSELR_EL1 are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to MDSELR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

It is IMPLEMENTATION DEFINED whether this field is implemented or is RES0 when 16 or fewer breakpoints are implemented, 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI.

If EL3 is not implemented, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

EnPMS3, bit [42]
When FEAT_SPE_FDS is implemented:

Enable access to SPE registers. When disabled, accesses to SPE registers generate a trap to EL3.

EnPMS3	Meaning
0b0	Accesses of the specified SPE registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified SPE registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to PMSDSFR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

PMEE, bits [41:40]
When FEAT_EBEP is implemented:

Performance Monitors Exception Enable. Controls the generation of the PMUIRQ signal and the PMU Profiling exception at all Exception levels.

PMEE	Meaning
0b00	The PMUIRQ signal is asserted on a PMU overflow, and the PMU Profiling exception is disabled.
0b01	The PMUIRQ signal and the PMU Profiling exception are both controlled by MDCR_EL2.PMEE.
0b10	The PMUIRQ signal is deasserted, and the PMU Profiling exception is disabled.
0b11	The PMUIRQ signal is deasserted, and the PMU Profiling exception is enabled.

If EL3 is not implemented, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Warm reset:
- When the highest implemented Exception level is EL3, this field resets to '00'.
- Otherwise, this field resets to an architecturally UNKNOWN value.

Otherwise:

EnTB2, bit [39]
When FEAT_TRBE_MPAM is implemented:

Enable access to Trace Buffer registers. When disabled, accesses to Trace Buffer registers generate a trap to EL3.

EnTB2	Meaning
0b0	Accesses of the specified Trace Buffer registers at EL2 and EL1 are trapped to EL3, unless the instruction generates a higher priority exception.
0b1	Accesses of the specified Trace Buffer registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to TRBMPAM_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

E3BREC, bit [38]
When FEAT_BRBEv1p1 is implemented:

Branch Record Buffer EL3 Cold Reset Enable. With MDCR_EL3.E3BREW, controls branch recording at EL3.

E3BREC	Meaning
0b0	When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is disabled. When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is enabled.
0b1	When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is enabled. When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is disabled.

E3BREC

Meaning

0b0

When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is disabled.

When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is enabled.

0b1

When MDCR_EL3.E3BREW == 0: Branch recording at EL3 is enabled.

When MDCR_EL3.E3BREW == 1: Branch recording at EL3 is disabled.

The reset behavior of this field is:

On a Cold reset, this field resets to '0'.

Otherwise:

E3BREW, bit [37]
When FEAT_BRBEv1p1 is implemented:

Branch Record Buffer EL3 Warm Reset Enable. With MDCR_EL3.E3BREC, controls branch recording at EL3.

For a description of the values derived by evaluating MDCR_EL3.E3BREC and MDCR_EL3.E3BREW together, see MDCR_EL3.E3BREC.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

EnPMSN, bit [36]
When FEAT_SPE_FnE is implemented:

Trap accesses to PMSNEVFR_EL1. Controls access to Statistical Profiling PMSNEVFR_EL1 System register from EL2 and EL1.

EnPMSN	Meaning
0b0	Accesses to PMSNEVFR_EL1 at EL2 and EL1 generate a Trap exception to EL3.
0b1	Do not trap PMSNEVFR_EL1 to EL3.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

MPMX, bit [35]
When FEAT_PMUv3p7 is implemented:

Monitor Performance Monitors Extended control. With MDCR_EL3.SPME, controls PMU operation at EL3.

MPMX	Meaning
0b0	Counters are not affected by this mechanism.
0b1	Affected counters are prohibited from counting at EL3. If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled at EL3. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

MPMX

Meaning

0b0

Counters are not affected by this mechanism.

0b1

Affected counters are prohibited from counting at EL3.

If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled at EL3. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

The counters affected by this field are:

If EL2 is implemented and MDCR_EL3.SPME is 1, event counters PMEVCNTR<n>_EL0 in the first range.
If EL2 is not implemented or MDCR_EL3.SPME is 0, event counters in the first and second ranges.
If FEAT_PMUv3_ICNTR is implemented, the instruction counter, PMICNTR_EL0.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.

Other event counters are not affected by this field. When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

For more information about event counter ranges, see MDCR_EL2.HPMN.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

MCCD, bit [34]
When FEAT_PMUv3p7 is implemented:

Monitor Cycle Counter Disable. Prohibits the Cycle Counter, PMCCNTR_EL0, from counting at EL3.

MCCD	Meaning
0b0	Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1	Cycle counting by PMCCNTR_EL0 is prohibited at EL3.

This field does not affect the CPU_CYCLES event or any other event that counts cycles.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

SBRBE, bits [33:32]
When FEAT_BRBE is implemented:

Secure Branch Record Buffer Enable. Controls branch recording by the BRBE, and access to BRBE registers and instructions at EL2 and EL1.

SBRBE	Meaning
0b00	Direct accesses to BRBE registers and instructions, except when in EL3, generate a Trap exception to EL3. EL0, EL1, and EL2 are prohibited regions.
0b01	Direct accesses to BRBE registers and instructions in Secure state, except when in EL3, generate a Trap exception to EL3. EL0, EL1, and EL2 in Secure state are prohibited regions. This control does not cause any direct accesses to BRBE registers when not in Secure state to be trapped, and does not cause any Exception levels when not in Secure state to be a prohibited region.
0b10	Direct accesses to BRBE registers and instructions, except when in EL3, generate a Trap exception to EL3. This control does not cause any Exception levels to be prohibited regions.
0b11	This control does not cause any direct accesses to BRBE registers or instruction to be trapped, and does not cause any Exception levels to be a prohibited region.

The Branch Record Buffer registers trapped by this control are: BRBCR_EL1, BRBCR_EL2, BRBCR_EL12, BRBFCR_EL1, BRBIDR0_EL1, BRBINF<n>_EL1, BRBINFINJ_EL1, BRBSRC<n>_EL1, BRBSRCINJ_EL1, BRBTGT<n>_EL1, BRBTGTINJ_EL1, and BRBTS_EL1.

The Branch Record Buffer instructions trapped by this control are:

BRB IALL.
BRB INJ.

Note

If FEAT_BRBEv1p1 is not implemented, EL3 is a prohibited region.

If EL3 is not implemented then the Effective value of this field is 0b11.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

PMSSE, bits [31:30]
When FEAT_PMUv3_SS is implemented:

Performance Monitors Snapshot Enable. Controls the generation of Capture events.

PMSSE	Meaning
0b00	Capture events are disabled.
0b01	Capture events are controlled by MDCR_EL2.PMSSE.
0b10	Capture events are enabled and prohibited.
0b11	Capture events are enabled and allowed.

If EL3 is not implemented, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Cold reset, this field resets to '00'.

Otherwise:

Bit [29]

MTPME, bit [28]
When FEAT_MTPMU is implemented:

Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>_EL0.MT bits.

MTPME	Meaning
0b0	FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>_EL0.MT is 0.
0b1	PMEVTYPER<n>_EL0.MT bits not affected by this field.

If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this field is 0.

The reset behavior of this field is:

On a Cold reset, this field resets to '1'.

Otherwise:

TDCC, bit [27]
When FEAT_FGT is implemented:

Trap DCC. Traps use of the Debug Comms Channel at EL2, EL1, and EL0 to EL3.

TDCC	Meaning
0b0	This control does not cause any register accesses to be trapped.
0b1	Accesses to the DCC registers at EL2, EL1, and EL0 generate a Trap exception to EL3, unless the access also generates a higher priority exception. Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

TDCC

Meaning

0b0

This control does not cause any register accesses to be trapped.

0b1

Accesses to the DCC registers at EL2, EL1, and EL0 generate a Trap exception to EL3, unless the access also generates a higher priority exception.

Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

The DCC registers trapped by this control are:

AArch64: OSDTRRX_EL1, OSDTRTX_EL1, MDCCSR_EL0, MDCCINT_EL1, and, when the PE is in Non-debug state, DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.

The traps are reported with EC syndrome value:

0x05 for trapped AArch32 MRC and MCR accesses with coproc == 0b1110.
0x06 for trapped AArch32 LDC to DBGDTRTXint and STC from DBGDTRRXint.
0x18 for trapped AArch64 MRS and MSR accesses.

When the PE is in Debug state, MDCR_EL3.TDCC does not trap any accesses to:

AArch64: DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXint and DBGDTRTXint.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

NSTBE, bit [26]
When FEAT_TRBE is implemented and FEAT_RME is implemented:

Non-secure Trace Buffer Extended. Together with MDCR_EL3.NSTB, controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.

For a description of the values derived by evaluating NSTB and NSTBE together, see MDCR_EL3.NSTB.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

NSTB, bits [25:24]
When FEAT_TRBE is implemented and FEAT_RME is implemented:

Non-secure Trace Buffer. Together with MDCR_EL3.NSTBE, controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.

NSTBE	NSTB	Meaning
0b0	0b00	Secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Realm and Non-secure states. Accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception. When Secure state is not implemented, this encoding is reserved.
0b0	0b01	Secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Realm and Non-secure states. Accesses to trace buffer System registers at Realm and Non-secure EL2, and Realm and Non-secure EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception. When Secure state is not implemented, this encoding is reserved.
0b0	0b10	Non-secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Realm states. Accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b0	0b11	Non-secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Realm states. Accesses to trace buffer System registers at Secure and Realm EL2, and Secure and Realm EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b1	0b10	Realm state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Non-secure states. Accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b1	0b11	Realm state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure and Non-secure states. Accesses to trace buffer System registers at Secure and Non-secure EL2, and Secure and Non-secure EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception.

All other combinations of MDCR_EL3.NSTBE and MDCR_EL3.NSTB are reserved.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.
If FEAT_TRBE_EXC is implemented, MRS and MSR accesses to TRBSR_EL2 and TRBSR_EL12.

Trapped instructions are reported using EC syndrome value 0x18.

When TraceBufferEnabled()==FALSE, these controls have no effect on whether tracing is prohibited.

If the Trace Buffer Unit is enabled and using Self-hosted mode, and MDCR_EL3.{NSTB, NSTBE} selects a reserved value, then the behavior is CONSTRAINED UNPREDICTABLE, and the Trace Buffer Unit does one of:

Behaves as if the Trace Buffer Unit is disabled.
Selects an implemented Security state as the owning Security state.
When trace data is received from the trace unit, it is not written to memory and the Trace Buffer Unit generates a trace buffer management event, as follows:
- TRBSR_ELx.IRQ is set to 1.
- If TRBSR_ELx.S is 0, then all of the following occur:
  - TRBSR_ELx.S is set to 1, Collection is stopped.
  - TRBSR_ELx.EC is set to 0x00, Other buffer management event.
  - TRBSR_ELx.BSC is set to 0b000000, Access not allowed.
- The other fields in TRBSR_ELx are unchanged.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

When FEAT_TRBE is implemented:

Non-secure Trace Buffer. Controls the trace buffer owning Security state and accesses to trace buffer System registers from EL2 and EL1.

NSTB	Meaning
0b00	Secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Non-secure state. Accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b01	Secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Non-secure state. Accesses to trace buffer System registers at EL2 and EL1 in Non-secure state generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b10	Non-secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure state. Accesses to trace buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b11	Non-secure state owns the trace buffer. When TraceBufferEnabled()==TRUE, tracing is prohibited in Secure state. Accesses to trace buffer System registers at EL2 and EL1 in Secure state generate Trap exceptions to EL3, unless the access generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.
If FEAT_TRBE_MPAM is implemented, MRS and MSR accesses to TRBMPAM_EL1.
If FEAT_TRBE_EXC is implemented, MRS and MSR accesses to TRBSR_EL2 and TRBSR_EL12.

Trapped instructions are reported using EC syndrome value 0x18.

When TraceBufferEnabled()==FALSE, this control has no effect on whether tracing is prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

SCCD, bit [23]
When FEAT_PMUv3p5 is implemented:

Secure Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting in Secure state and EL3.

SCCD	Meaning
0b0	Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.
0b1	Cycle counting by PMCCNTR_EL0 is prohibited in Secure state and EL3.

This field does not affect the CPU_CYCLES event or any other event that counts cycles.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

ETAD, bit [22]
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented:

External Trace Access Disable. Together with MDCR_EL3.ETADE, controls access to trace unit registers by an external debugger.

ETADE	ETAD	Meaning
0b0	0b0	No accesses from an external debugger to trace unit registers are prohibited by this control.
0b0	0b1	Realm and Non-secure accesses from an external debugger to trace unit registers are prohibited. Other accesses from an external debugger to trace unit registers are not affected by this control.
0b1	0b0	Secure and Non-secure accesses from an external debugger to trace unit registers are prohibited. Other accesses from an external debugger to trace unit registers are not affected by this control.
0b1	0b1	Secure, Non-secure, and Realm accesses from an external debugger to trace unit registers are prohibited. Other accesses from an external debugger to trace unit registers are not affected by this control.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_TRC_EXT is implemented and FEAT_TRBE is implemented:

External Trace Access Disable. Controls Non-secure access to trace unit registers by an external debugger.

ETAD	Meaning
0b0	No accesses from an external debugger to the trace unit registers are prohibited by this control.
0b1	Non-secure accesses from an external debugger to some trace unit registers are prohibited. See individual registers for the effect of this field.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

EPMAD, bit [21]
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented:

External Performance Monitors Access Disable. Together with MDCR_EL3.EPMADE, controls access to Performance Monitor registers by an external debugger.

External accesses of the following Performance Monitor registers are affected by this control:

PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.
If FEAT_PMUv3_EXT64 is implemented, PMCNTEN, PMINTEN, and PMOVS.
If FEAT_PMUv3p9 is implemented, PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMCGCR0, PMICFILTR_EL0, and PMICNTR_EL0.
If FEAT_PCSRv8p9 is implemented, PMPCSCTL.

EPMADE	EPMAD	Meaning
0b0	0b0	No accesses from an external debugger to affected Performance Monitor registers are prohibited by this control.
0b0	0b1	Realm and Non-secure accesses from an external debugger to affected Performance Monitor registers are prohibited. Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.
0b1	0b0	Secure and Non-secure accesses from an external debugger to affected Performance Monitor registers are prohibited. Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.
0b1	0b1	Secure, Non-secure, and Realm accesses from an external debugger to affected Performance Monitor registers are prohibited. Other accesses from an external debugger to affected Performance Monitor registers are not affected by this control.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_Debugv8p4 is implemented and FEAT_PMUv3_EXT is implemented:

External Performance Monitors Access Disable. Controls Non-secure access to Performance Monitor registers by an external debugger.

External accesses of the following Performance Monitor registers are affected by this control:

PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.
If FEAT_PMUv3_EXT64 is implemented, PMCNTEN, PMINTEN, and PMOVS.
If FEAT_PMUv3p9 is implemented, PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, PMCGCR0, PMICFILTR_EL0, and PMICNTR_EL0.
If FEAT_PCSRv8p9 is implemented, PMPCSCTL.

EPMAD	Meaning
0b0	No accesses from an external debugger to the Performance Monitor registers are prohibited by this control.
0b1	Non-secure accesses from an external debugger to the affected Performance Monitor registers are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_PMUv3_EXT is implemented:

External Performance Monitors Access Disable. Controls access to Performance Monitor registers by an external debugger.

External accesses of the following Performance Monitor registers are affected by this control:

PMCCFILTR_EL0, PMCCNTR_EL0, PMCFGR, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, and PMOVSSET_EL0.
If PMEVFILT2R<n> is implemented, PMEVFILT2R<n>.
If implemented, PMIIDR.
If PMSWINC_EL0 is implemented in the external view, PMSWINC_EL0.
If FEAT_PMUv3p4 is implemented, PMMIR.

EPMAD	Meaning
0b0	No accesses from an external debugger to the Performance Monitor registers are prohibited by this control.
0b1	If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected Performance Monitor registers are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

EDAD, bit [20]
When FEAT_RME is implemented:

External Debug Access Disable. Together with MDCR_EL3.EDADE, controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.

External accesses of the following debug registers are affected by this control:

DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.

EDADE	EDAD	Meaning
0b0	0b0	No accesses from an external debugger to affected debug registers are prohibited by this control.
0b0	0b1	Realm and Non-secure accesses from an external debugger to affected debug registers are prohibited. Other accesses from an external debugger to affected debug registers are not affected by this control.
0b1	0b0	Secure and Non-secure accesses from an external debugger to affected debug registers are prohibited. Other accesses from an external debugger to affected debug registers are not affected by this control.
0b1	0b1	Secure, Non-secure, and Realm accesses from an external debugger to affected debug registers are prohibited. Other accesses from an external debugger to affected debug registers are not affected by this control.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_Debugv8p4 is implemented:

External Debug Access Disable. Controls Non-secure access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.

External accesses of the following debug registers are affected by this control:

DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.

EDAD	Meaning
0b0	No accesses from an external debugger to the debug registers are prohibited by this control.
0b1	Non-secure accesses from an external debugger to the affected debug registers are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_Debugv8p2 is implemented:

External Debug Access Disable. Controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.

External accesses of the following debug registers are affected by this control:

DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, DBGWVR<n>_EL1, and OSLAR_EL1.

EDAD	Meaning
0b0	No accesses from an external debugger to the debug registers are prohibited by this control.
0b1	If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected debug registers are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

External Debug Access Disable. Controls access to breakpoint registers, watchpoint registers, and optionally OSLAR_EL1 by an external debugger.

External accesses of the following debug registers are affected by this control:

DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGWCR<n>_EL1, and DBGWVR<n>_EL1.
It is IMPLEMENTATION DEFINED whether this control affects OSLAR_EL1.

EDAD	Meaning
0b0	No accesses from an external debugger to the debug registers are prohibited by this control.
0b1	If the IMPLEMENTATION DEFINED authentication interface function ExternalSecureInvasiveDebugEnabled() returns FALSE, then accesses from an external debugger to the affected debug registers are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

TTRF, bit [19]
When FEAT_TRF is implemented:

Trap Trace Filter controls. Traps use of the Trace Filter control registers at EL2 and EL1 to EL3.

The Trace Filter registers trapped by this control are:

TRFCR_EL2, TRFCR_EL12, TRFCR_EL1, reported using EC syndrome value 0x18.
HTRFCR and TRFCR, reported using EC syndrome value 0x03.

TTRF	Meaning
0b0	Accesses to Trace Filter registers at EL2 and EL1 are not affected by this field.
0b1	Accesses to Trace Filter registers at EL2 and EL1 generate a Trap exception to EL3, unless the access generates a higher priority exception.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

STE, bit [18]
When FEAT_TRF is implemented and Secure state is implemented:

Secure Trace enable. Enables tracing in Secure state.

STE	Meaning
0b0	Trace prohibited in Secure state unless overridden by the IMPLEMENTATION DEFINED authentication interface.
0b1	Trace in Secure state is not affected by this field.

This field also controls the level of authentication required by an external debugger to enable external tracing. See 'Register controls to enable self-hosted trace'.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

SPME, bit [17]
When FEAT_PMUv3 is implemented and FEAT_PMUv3p7 is implemented:

Secure Performance Monitors Enable. Controls PMU operation in Secure state and at EL3 when MDCR_EL3.MPMX is 0.

SPME	Meaning
0b0	Affected counters are prohibited from counting in Secure state and at EL3. If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state and at EL3. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1	Counters are not affected by this mechanism.

When MDCR_EL3.MPMX is 0, the counters affected by this field are:

Event counters in the first and second ranges. For more information about event counter ranges, see MDCR_EL2.HPMN.
If FEAT_PMUv3_ICNTR is implemented, the instruction counter, PMICNTR_EL0.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.

When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

When MDCR_EL3.MPMX is 1, this field controls which event counters are affected by MDCR_EL3.MPMX at EL3. See MDCR_EL3.MPMX for more information.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_PMUv3 is implemented and FEAT_Debugv8p2 is implemented:

Secure Performance Monitors Enable. Controls PMU operation in Secure state.

SPME	Meaning
0b0	Event counting is prohibited in Secure state. If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1	Event counting and PMCCNTR_EL0 are not affected by this mechanism.

SPME

Meaning

0b0

Event counting is prohibited in Secure state.

If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

0b1

Event counting and PMCCNTR_EL0 are not affected by this mechanism.

The counters affected by this field are:

All event counters.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.

When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

When FEAT_PMUv3 is implemented:

Secure Performance Monitors Enable. Controls PMU operation in Secure state.

SPME	Meaning
0b0	If ExternalSecureNoninvasiveDebugEnabled() is FALSE, then all the following apply: Event counting is prohibited in Secure state. If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.
0b1	Event counting and PMCCNTR_EL0 are not affected by this mechanism.

SPME

Meaning

0b0

If ExternalSecureNoninvasiveDebugEnabled() is FALSE, then all the following apply:

Event counting is prohibited in Secure state.
If PMCR_EL0.DP is 1, PMCCNTR_EL0 is disabled in Secure state. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

0b1

Event counting and PMCCNTR_EL0 are not affected by this mechanism.

If ExternalSecureNoninvasiveDebugEnabled() is TRUE then the event counters and PMCCNTR_EL0 are not affected by this field.

Otherwise, the counters affected by this field are:

All event counters.
If PMCR_EL0.DP is 1, the cycle counter, PMCCNTR_EL0.

When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

SDD, bit [16]
When Secure state is implemented:

AArch64 Secure Self-hosted invasive debug disable. Disables Software debug exceptions in Secure state, other than Breakpoint Instruction exceptions.

SDD	Meaning
0b0	Debug exceptions in Secure state are not affected by this field.
0b1	Debug exceptions, other than Breakpoint Instruction exceptions, are disabled from all Exception levels in Secure state.

The SDD bit is ignored unless both of the following are true:

The PE is in Secure state.
The Effective value of SCR_EL3.RW is 0.

If Secure EL2 is implemented and enabled, and Secure EL1 is using AArch32, then:

If debug exceptions from Secure EL1 are enabled, debug exceptions from Secure EL0 are also enabled.
Otherwise, debug exceptions from Secure EL0 are enabled only if the value of SDER32_EL3.SUIDEN is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

SPD32, bits [15:14]
When EL1 is capable of using AArch32:

AArch32 Secure self-hosted privileged debug. Enables or disables debug exceptions from Secure EL1 using AArch32, other than Breakpoint Instruction exceptions.

SPD32	Meaning
0b00	Legacy mode. Debug exceptions from Secure EL1 are enabled by the IMPLEMENTATION DEFINED authentication interface.
0b10	Secure privileged debug disabled. Debug exceptions from Secure EL1 are disabled.
0b11	Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled.

Other values are reserved, and have the CONSTRAINED UNPREDICTABLE behavior that they must have the same behavior as 0b00. Software must not rely on this property as the behavior of reserved values might change in a future revision of the architecture.

This field has no effect on Breakpoint Instruction exceptions. These are always enabled.

This field is ignored unless both of the following are true:

The PE is in Secure state.
The Effective value of SCR_EL3.RW is 0.

If Secure EL1 is using AArch32, then:

If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure EL0 are also enabled.
Otherwise, debug exceptions from Secure EL0 are enabled only if the value of SDER32_EL3.SUIDEN is 1.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b11.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

NSPB, bits [13:12]
When FEAT_SPE is implemented and FEAT_RME is implemented:

Non-secure Profiling Buffer. Together with MDCR_EL3.NSPBE, controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.

NSPBE	NSPB	Meaning
0b0	0b00	Secure state owns the Profiling Buffer. Profiling is disabled in Realm and Non-secure states. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception. When Secure state is not implemented, this encoding is reserved.
0b0	0b01	Secure state owns the Profiling Buffer. Profiling is disabled in Realm and Non-secure states. Accesses to Statistical Profiling and Profiling Buffer System registers at Realm and Non-secure EL2, and Realm and Non-secure EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception. When Secure state is not implemented, this encoding is reserved.
0b0	0b10	Non-secure state owns the Profiling Buffer. Profiling is disabled in Secure and Realm states. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b0	0b11	Non-secure state owns the Profiling Buffer. Profiling is disabled in Secure and Realm states. Accesses to Statistical Profiling and Profiling Buffer System registers at Secure and Realm EL2, and Secure and Realm EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b1	0b10	Realm state owns the Profiling Buffer. Profiling is disabled in Secure and Non-secure states. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b1	0b11	Realm state owns the Profiling Buffer. Profiling is disabled in Secure and Non-secure states. Accesses to Statistical Profiling and Profiling Buffer System registers at Secure and Non-secure EL2, and Secure and Non-secure EL1, generate Trap exceptions to EL3, unless the access generates a higher priority exception.

All other combinations of MDCR_EL3.NSPBE and MDCR_EL3.NSPB are reserved.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to PMBLIMITR_EL1, PMBPTR_EL1, PMBSR_EL1, PMSCR_EL1, PMSCR_EL2, PMSCR_EL12, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
MRS accesses to PMSIDR_EL1.
If FEAT_SPE_FnE is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.
If FEAT_SPE_EXC is implemented, MRS and MSR accesses to PMBSR_EL2 and PMBSR_EL12.
If FEAT_SPE_nVM is implemented, MRS and MSR accesses to PMBMAR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

If profiling is enabled and MDCR_EL3.{NSPB, NSPBE} selects a reserved value, then the behavior is CONSTRAINED UNPREDICTABLE, and the Statistical Profiling Unit does one of:

Behaves as if profiling is disabled.
Selects an implemented Security state as the owning Security state.
When profiling data is generated, it is not written to memory and the Statistical Profiling Unit generates a Profiling Buffer management event, as follows:
- If PMBSR_ELx.S is 0, then all of the following occur:
  - PMBSR_ELx.S is set to 1.
  - PMBSR_ELx.DL is set to 1.
  - PMBSR_ELx.EC is set to 0b000000, Other buffer management event.
  - PMBSR_ELx.BSC is set to 0b000000, Access not allowed.
- The other fields in PMBSR_ELx are unchanged.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

When FEAT_SPE is implemented:

Non-secure Profiling Buffer. Controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.

NSPB	Meaning
0b00	Secure state owns the Profiling Buffer. Profiling is disabled in Non-secure state. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b01	Secure state owns the Profiling Buffer. Profiling is disabled in Non-secure state. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 in Non-secure state generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b10	Non-secure state owns the Profiling Buffer. Profiling is disabled in Secure state. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 generate Trap exceptions to EL3, unless the access generates a higher priority exception.
0b11	Non-secure state owns the Profiling Buffer. Profiling is disabled in Secure state. Accesses to Statistical Profiling and Profiling Buffer System registers at EL2 and EL1 in Secure state generate Trap exceptions to EL3, unless the access generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to PMBLIMITR_EL1, PMBPTR_EL1, PMBSR_EL1, PMSCR_EL1, PMSCR_EL2, PMSCR_EL12, PMSEVFR_EL1, PMSFCR_EL1, PMSICR_EL1, PMSIRR_EL1, and PMSLATFR_EL1.
MRS accesses to PMSIDR_EL1.
If FEAT_SPE_FnE is implemented, MRS and MSR accesses to PMSNEVFR_EL1.
If FEAT_SPE_FDS is implemented, MRS and MSR accesses to PMSDSFR_EL1.
If FEAT_SPE_EXC is implemented, MRS and MSR accesses to PMBSR_EL2 and PMBSR_EL12.
If FEAT_SPE_nVM is implemented, MRS and MSR accesses to PMBMAR_EL1.

Trapped instructions are reported using EC syndrome value 0x18.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 1, then the Effective value of this field is 0b11.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0, then the Effective value of this field is 0b01.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

NSPBE, bit [11]
When FEAT_SPE is implemented and FEAT_RME is implemented:

Non-secure Profiling Buffer Extended. Together with MDCR_EL3.NSPB, controls the Profiling Buffer owning Security state and accesses to Statistical Profiling and Profiling Buffer System registers from EL2 and EL1.

For a description of the values derived by evaluating NSPB and NSPBE together, see MDCR_EL3.NSPB.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

TDOSA, bit [10]
When FEAT_DoubleLock is implemented:

Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug registers to EL3.

Accesses to the registers are trapped as follows:

Accesses from AArch64 state, OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, DBGPRCR_EL1, and any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field, are trapped to EL3 and reported using EC syndrome value 0x18.
Accesses using MCR or MRC to DBGOSLAR, DBGOSLSR, DBGOSDLR, and DBGPRCR, are trapped to EL3 and reported using EC syndrome value 0x05.
Accesses to any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL2 and EL1 System register accesses to the powerdown debug registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.

Note

The powerdown debug registers are not accessible at EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug registers to EL3.

The following registers are affected by this trap:

AArch64: OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.
AArch32: DBGOSLAR, DBGOSLSR, and DBGPRCR.
AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this field.
It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 and DBGOSDLR are trapped.

TDOSA	Meaning
0b0	This control does not cause any instructions to be trapped.
0b1	EL2 and EL1 System register accesses to the powerdown debug registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.

Note

The powerdown debug registers are not accessible at EL0.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

TDA, bit [9]

Trap accesses of debug System registers. Enables a trap to EL3 on accesses of debug System registers.

TDA	Meaning
0b0	Accesses of the specified debug System registers are not trapped by this mechanism.
0b1	Accesses of the specified debug System registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to DBGAUTHSTATUS_EL1, DBGBCR<n>_EL1, DBGBVR<n>_EL1, DBGCLAIMCLR_EL1, DBGCLAIMSET_EL1, DBGVCR32_EL2, DBGWCR<n>_EL1, DBGWVR<n>_EL1, MDCCINT_EL1, MDCCSR_EL0, MDCR_EL2, MDRAR_EL1, MDSCR_EL1, OSDTRRX_EL1, OSDTRTX_EL1, and OSECCR_EL1.
If FEAT_Debugv8p9 is implemented, MRS and MSR accesses to MDSELR_EL1.
If FEAT_STEP2 is implemented, MRS and MSR accesses to MDSTEPOP_EL1.
In Non-debug state, MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.

In AArch32 state, the instructions affected by this control are:

MRC and MCR accesses to DBGAUTHSTATUS, DBGBCR<n>, DBGBVR<n>, DBGBXVR<n>, DBGCLAIMCLR, DBGCLAIMSET, DBGDCCINT, DBGDEVID, DBGDEVID1, DBGDEVID2, DBGDIDR, DBGDRAR, DBGDSAR, DBGDSCRext, DBGDSCRint, DBGDTRRXext, DBGDTRTXext, DBGOSECCR, DBGVCR, DBGWCR<n>, DBGWFAR, DBGWVR<n>, HDCR, and SDER.
MRRC accesses to DBGDRAR and DBGDSAR.
STC accesses to DBGDTRRXint and LDC accesses to DBGDTRTXint.
In Non-debug state, MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses with coproc == 0b1111, 0x05 for MCR and MCR accesses with coproc == 0b1110, 0x06 for LDC and STC accesses, and 0x0C for MRRC accesses.

The following instructions are not trapped in Debug state:

AArch64 MRS accesses to DBGDTRRX_EL0 and DBGDTR_EL0 and MSR accesses to DBGDTRTX_EL0 and DBGDTR_EL0.
AArch32 MRC accesses to DBGDTRRXint and MCR accesses to DBGDTRTXint.

If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI, then it is IMPLEMENTATION DEFINED whether AArch64 accesses to MDSELR_EL1 are trapped to EL3 when MDCR_EL3.TDA is 1.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Bit [8]

EnPM2, bit [7]
When FEAT_PMUv3p9 is implemented, or FEAT_SPMU is implemented, or FEAT_EBEP is implemented, or FEAT_PMUv3_SS is implemented, or FEAT_SPMU2 is implemented:

Enable access to PMU registers. When disabled, accesses to PMU registers generate a trap to EL3.

EnPM2	Meaning
0b0	Accesses of the specified PMU registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception. If FEAT_PMUv3_ICNTR is implemented, then: PMCNTENCLR_EL0.F, PMCNTENSET_EL0.F, PMOVSCLR_EL0.F, PMOVSSET_EL0.F, and PMZR_EL0.F read-as-zero and ignore writes at EL2, EL1, and EL0. PMINTENCLR_EL1.F and PMINTENSET_EL1.F read-as-zero and ignore writes at EL2 and EL1.
0b1	Accesses of the specified PMU registers are not trapped by this mechanism.

EnPM2

Meaning

0b0

Accesses of the specified PMU registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.

If FEAT_PMUv3_ICNTR is implemented, then:

PMCNTENCLR_EL0.F, PMCNTENSET_EL0.F, PMOVSCLR_EL0.F, PMOVSSET_EL0.F, and PMZR_EL0.F read-as-zero and ignore writes at EL2, EL1, and EL0.
PMINTENCLR_EL1.F and PMINTENSET_EL1.F read-as-zero and ignore writes at EL2 and EL1.

0b1

Accesses of the specified PMU registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are:

If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICFILTR_EL0 and PMICNTR_EL0.
If FEAT_PMUv3p9 is implemented, MRS and MSR accesses to PMUACR_EL1.
If FEAT_SEBEP is implemented, MRS and MSR accesses to PMIAR_EL1.
If FEAT_SPMU is implemented, MRS and MSR accesses to SPMACCESSR_EL1, SPMACCESSR_EL2, SPMACCESSR_EL12, SPMCFGR_EL1, SPMCGCR<n>_EL1, SPMCNTENCLR_EL0, SPMCNTENSET_EL0, SPMCR_EL0, SPMDEVAFF_EL1, SPMDEVARCH_EL1, SPMEVCNTR<n>_EL0, SPMEVFILT2R<n>_EL0, SPMEVFILTR<n>_EL0, SPMEVTYPER<n>_EL0, SPMIIDR_EL1, SPMINTENCLR_EL1, SPMINTENSET_EL1, SPMOVSCLR_EL0, SPMOVSSET_EL0, SPMSCR_EL1, and SPMSELR_EL0.
If FEAT_SPMU2 is implemented, MSR writes to SPMZR_EL0.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

TPM, bit [6]
When FEAT_PMUv3 is implemented:

Trap accesses of PMU registers. Enables a trap to EL3 on accesses of PMU registers.

TPM	Meaning
0b0	Accesses of the specified PMU registers are not trapped by this mechanism.
0b1	Accesses of the specified PMU registers at EL2, EL1, and EL0 are trapped to EL3, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

MRS and MSR accesses to PMCCFILTR_EL0, PMCCNTR_EL0, PMCNTENCLR_EL0, PMCNTENSET_EL0, PMCR_EL0, PMEVCNTR<n>_EL0, PMEVTYPER<n>_EL0, PMINTENCLR_EL1, PMINTENSET_EL1, PMOVSCLR_EL0, PMOVSSET_EL0, PMSELR_EL0, PMSWINC_EL0, PMUSERENR_EL0, PMXEVCNTR_EL0, and PMXEVTYPER_EL0.
MRS accesses to PMCEID0_EL0 and PMCEID1_EL0.
If FEAT_PMUv3p4 is implemented, MRS accesses to PMMIR_EL1.
If FEAT_PMUv3p9 is implemented, MSR accesses to PMZR_EL0.
If FEAT_PMUv3_ICNTR is implemented, MRS and MSR accesses to PMICFILTR_EL0 and PMICNTR_EL0.
If FEAT_EBEP is implemented or FEAT_PMUv3_SS is implemented, MRS and MSR accesses to PMECR_EL1.
If FEAT_SEBEP is implemented, MRS and MSR accesses to PMIAR_EL1.

In AArch32 state, the instructions affected by this control are:

MRC and MCR accesses to PMCCFILTR, PMCCNTR, PMCEID0, PMCEID1, PMCNTENCLR, PMCNTENSET, PMCR, PMEVCNTR<n>, PMEVTYPER<n>, PMINTENCLR, PMINTENSET, PMOVSR, PMOVSSET, PMSELR, PMSWINC, PMUSERENR, PMXEVCNTR, and PMXEVTYPER.
MRRC and MCRR accesses to PMCCNTR.
If FEAT_PMUv3p1 is implemented, MRC accesses to PMCEID2 and PMCEID3.
If FEAT_PMUv3p4 is implemented, MRC accesses to PMMIR.

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.

The reset behavior of this field is:

On a Warm reset, this field resets to an architecturally UNKNOWN value.

Otherwise:

Bit [5]

EDADE, bit [4]
When FEAT_RME is implemented:

External Debug Access Disable Extended. Together with MDCR_EL3.EDAD, controls access to breakpoint registers, watchpoint registers, and OSLAR_EL1 by an external debugger.

For a description of the values derived by evaluating MDCR_EL3.EDAD and MDCR_EL3.EDADE together, see MDCR_EL3.EDAD.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

ETADE, bit [3]
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented:

External Trace Access Disable Extended. Together with MDCR_EL3.ETAD, controls access to trace unit registers by an external debugger.

For a description of the values derived by evaluating MDCR_EL3.ETAD and MDCR_EL3.ETADE together, see MDCR_EL3.ETAD.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

EPMADE, bit [2]
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented:

External Performance Monitors Access Disable Extended. Together with MDCR_EL3.EPMAD, controls access to Performance Monitor registers by an external debugger.

For a description of the values derived by evaluating MDCR_EL3.EPMAD and MDCR_EL3.EPMADE together, see MDCR_EL3.EPMAD.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

Bit [1]

RLTE, bit [0]
When FEAT_RME is implemented and FEAT_TRF is implemented:

Realm Trace enable. Enables tracing in Realm state.

RLTE	Meaning
0b0	Trace prohibited in Realm state, unless overridden by the IMPLEMENTATION DEFINED authentication interface.
0b1	Trace in Realm state is not affected by this field.

This field also controls the level of authentication that is required by an external debugger to enable external tracing.

The reset behavior of this field is:

On a Warm reset, this field resets to '0'.

Otherwise:

Accessing MDCR_EL3

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, MDCR_EL3

op0	op1	CRn	CRm	op2
0b11	0b110	0b0001	0b0011	0b001

if !HaveEL(EL3) then UNDEFINED; elsif PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then X[t, 64] = MDCR_EL3;

MSR MDCR_EL3, <Xt>

op0	op1	CRn	CRm	op2
0b11	0b110	0b0001	0b0011	0b001

if !HaveEL(EL3) then UNDEFINED; elsif PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then if IsFeatureImplemented(FEAT_FGWTE3) && FGWTE3_EL3.MDCR_EL3 == '1' then AArch64.SystemAccessTrap(EL3, 0x18); else MDCR_EL3 = X[t, 64];

63	62	61	60	59	58	57	56	55	54	53	52	51	50	49	48	47	46	45	44	43	42	41	40	39	38	37	36	35	34	33	32
31	30	29	28	27	26	25	24	23	22	21	20	19	18	17	16	15	14	13	12	11	10	9	8	7	6	5	4	3	2	1	0
RES0								EnPMS4	TRBEE		PMSEE		EnSTEPOP	ETBAD		EnITE	EPMSSAD		EnPMSS	EBWE	EnPMS3	PMEE		EnTB2	E3BREC	E3BREW	EnPMSN	MPMX	MCCD	SBRBE
PMSSE		RES0	MTPME	TDCC	NSTBE	NSTB		SCCD	ETAD	EPMAD	EDAD	TTRF	STE	SPME	SDD	SPD32		NSPB		NSPBE	TDOSA	TDA	RES0	EnPM2	TPM	RES0	EDADE	ETADE	EPMADE	RES0	RLTE

MDCR_EL3, Monitor Debug Configuration Register (EL3)

Purpose

Configuration

Attributes

Field descriptions

Bits [63:56]

EnPMS4, bit [55]When FEAT_SPE_nVM is implemented:

Otherwise:

TRBEE, bits [54:53]When FEAT_TRBE_EXC is implemented:

Otherwise:

PMSEE, bits [52:51]When FEAT_SPE_EXC is implemented:

Otherwise:

EnSTEPOP, bit [50]When FEAT_STEP2 is implemented:

Otherwise:

ETBAD, bits [49:48]When FEAT_TRBE_EXT is implemented:

Otherwise:

EnITE, bit [47]When FEAT_ITE is implemented:

Otherwise:

EPMSSAD, bits [46:45]When FEAT_PMUv3_SS is implemented:

Otherwise:

EnPMSS, bit [44]When FEAT_PMUv3_SS is implemented:

Otherwise:

EBWE, bit [43]When FEAT_Debugv8p9 is implemented:

Otherwise:

EnPMS3, bit [42]When FEAT_SPE_FDS is implemented:

Otherwise:

PMEE, bits [41:40]When FEAT_EBEP is implemented:

Otherwise:

EnTB2, bit [39]When FEAT_TRBE_MPAM is implemented:

Otherwise:

E3BREC, bit [38]When FEAT_BRBEv1p1 is implemented:

Otherwise:

E3BREW, bit [37]When FEAT_BRBEv1p1 is implemented:

Otherwise:

EnPMSN, bit [36]When FEAT_SPE_FnE is implemented:

Otherwise:

MPMX, bit [35]When FEAT_PMUv3p7 is implemented:

Otherwise:

MCCD, bit [34]When FEAT_PMUv3p7 is implemented:

Otherwise:

SBRBE, bits [33:32]When FEAT_BRBE is implemented:

Otherwise:

PMSSE, bits [31:30]When FEAT_PMUv3_SS is implemented:

Otherwise:

Bit [29]

MTPME, bit [28]When FEAT_MTPMU is implemented:

Otherwise:

TDCC, bit [27]When FEAT_FGT is implemented:

Otherwise:

NSTBE, bit [26]When FEAT_TRBE is implemented and FEAT_RME is implemented:

Otherwise:

NSTB, bits [25:24]When FEAT_TRBE is implemented and FEAT_RME is implemented:

When FEAT_TRBE is implemented:

Otherwise:

SCCD, bit [23]When FEAT_PMUv3p5 is implemented:

Otherwise:

ETAD, bit [22]When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented:

When FEAT_TRC_EXT is implemented and FEAT_TRBE is implemented:

Otherwise:

EPMAD, bit [21]When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented:

When FEAT_Debugv8p4 is implemented and FEAT_PMUv3_EXT is implemented:

When FEAT_PMUv3_EXT is implemented:

Otherwise:

EDAD, bit [20]When FEAT_RME is implemented:

When FEAT_Debugv8p4 is implemented:

When FEAT_Debugv8p2 is implemented:

Otherwise:

TTRF, bit [19]When FEAT_TRF is implemented:

Otherwise:

STE, bit [18]When FEAT_TRF is implemented and Secure state is implemented:

Otherwise:

SPME, bit [17]When FEAT_PMUv3 is implemented and FEAT_PMUv3p7 is implemented:

When FEAT_PMUv3 is implemented and FEAT_Debugv8p2 is implemented:

When FEAT_PMUv3 is implemented:

Otherwise:

SDD, bit [16]When Secure state is implemented:

Otherwise:

SPD32, bits [15:14]When EL1 is capable of using AArch32:

Otherwise:

NSPB, bits [13:12]When FEAT_SPE is implemented and FEAT_RME is implemented:

EnPMS4, bit [55]
When FEAT_SPE_nVM is implemented:

TRBEE, bits [54:53]
When FEAT_TRBE_EXC is implemented:

PMSEE, bits [52:51]
When FEAT_SPE_EXC is implemented:

EnSTEPOP, bit [50]
When FEAT_STEP2 is implemented:

ETBAD, bits [49:48]
When FEAT_TRBE_EXT is implemented:

EnITE, bit [47]
When FEAT_ITE is implemented:

EPMSSAD, bits [46:45]
When FEAT_PMUv3_SS is implemented:

EnPMSS, bit [44]
When FEAT_PMUv3_SS is implemented:

EBWE, bit [43]
When FEAT_Debugv8p9 is implemented:

EnPMS3, bit [42]
When FEAT_SPE_FDS is implemented:

PMEE, bits [41:40]
When FEAT_EBEP is implemented:

EnTB2, bit [39]
When FEAT_TRBE_MPAM is implemented:

E3BREC, bit [38]
When FEAT_BRBEv1p1 is implemented:

E3BREW, bit [37]
When FEAT_BRBEv1p1 is implemented:

EnPMSN, bit [36]
When FEAT_SPE_FnE is implemented:

MPMX, bit [35]
When FEAT_PMUv3p7 is implemented:

MCCD, bit [34]
When FEAT_PMUv3p7 is implemented:

SBRBE, bits [33:32]
When FEAT_BRBE is implemented:

PMSSE, bits [31:30]
When FEAT_PMUv3_SS is implemented:

MTPME, bit [28]
When FEAT_MTPMU is implemented:

TDCC, bit [27]
When FEAT_FGT is implemented:

NSTBE, bit [26]
When FEAT_TRBE is implemented and FEAT_RME is implemented:

NSTB, bits [25:24]
When FEAT_TRBE is implemented and FEAT_RME is implemented:

SCCD, bit [23]
When FEAT_PMUv3p5 is implemented:

ETAD, bit [22]
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented:

EPMAD, bit [21]
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented:

EDAD, bit [20]
When FEAT_RME is implemented:

TTRF, bit [19]
When FEAT_TRF is implemented:

STE, bit [18]
When FEAT_TRF is implemented and Secure state is implemented:

SPME, bit [17]
When FEAT_PMUv3 is implemented and FEAT_PMUv3p7 is implemented:

SDD, bit [16]
When Secure state is implemented:

SPD32, bits [15:14]
When EL1 is capable of using AArch32:

NSPB, bits [13:12]
When FEAT_SPE is implemented and FEAT_RME is implemented:

NSPBE, bit [11]
When FEAT_SPE is implemented and FEAT_RME is implemented:

TDOSA, bit [10]
When FEAT_DoubleLock is implemented:

EnPM2, bit [7]
When FEAT_PMUv3p9 is implemented, or FEAT_SPMU is implemented, or FEAT_EBEP is implemented, or FEAT_PMUv3_SS is implemented, or FEAT_SPMU2 is implemented:

TPM, bit [6]
When FEAT_PMUv3 is implemented:

EDADE, bit [4]
When FEAT_RME is implemented:

ETADE, bit [3]
When FEAT_RME is implemented, FEAT_TRC_EXT is implemented, and FEAT_TRBE is implemented:

EPMADE, bit [2]
When FEAT_RME is implemented and FEAT_PMUv3_EXT is implemented:

RLTE, bit [0]
When FEAT_RME is implemented and FEAT_TRF is implemented: