AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# MDCR_EL2, Monitor Debug Configuration Register (EL2)

The MDCR_EL2 characteristics are:

## Purpose

Provides EL2 configuration options for self-hosted debug and the Performance Monitors Extension.

## Configuration

AArch64 System register MDCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HDCR[31:0] .

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

This register is in the Warm reset domain. Some or all RW fields of this register have defined reset values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

MDCR_EL2 is a 64-bit register.

## Field descriptions

The MDCR_EL2 bit assignments are:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES0 | HLP | RES0 | HCCD | RES0 | TTRF | RES0 | HPMD | RES0 | TPMS | E2PB | TDRA | TDOSA | TDA | TDE | HPME | TPM | TPMCR | HPMN
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

#### Bits [63:27]

Reserved, RES0.

#### HLP, bit [26]
When ARMv8.5-PMU is implemented:

Hypervisor Long event counter enable. Determines when unsigned overflow is recorded by a counter overflow bit.

HLP | Meaning
--- | ---
0b0 | Event counter overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[31:0].
0b1 | Event counter overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[63:0].

If MDCR_EL2.HPMN is less than PMCR_EL0.N or PMCR.N, this bit affects the operation of event counters in the range [MDCR_EL2.HPMN:(PMCR_EL0.N-1)] or [MDCR_EL2.HPMN:(PMCR.N-1)]. Otherwise this bit has no effect on the operation of the event counters.

Note

The effect of MDCR_EL2.HPMN on the operation of this bit applies regardless of whether EL2 is enabled in the current Security state.

For more information see the description of the MDCR_EL2.HPMN field.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [25:24]

Reserved, RES0.

#### HCCD, bit [23]
When ARMv8.5-PMU is implemented:

Hypervisor Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting at EL2.

HCCD | Meaning
--- | ---
0b0 | Cycle counting by PMCCNTR_EL0 is not affected by this bit.
0b1 | Cycle counting by PMCCNTR_EL0 is prohibited at EL2.

This bit does not affect the CPU_CYCLES event or any other event that counts cycles.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### Bits [22:20]

Reserved, RES0.

#### TTRF, bit [19]
When ARMv8.4-Trace is implemented:

Traps use of the Trace Filter Control registers at EL1 to EL2.

TTRF | Meaning
--- | ---
0b0 | Accesses to TRFCR_EL1 and TRFCR at EL1 are not affected by this control.
0b1 | Accesses to TRFCR_EL1 and TRFCR at EL1 generate a trap exception to EL2 when EL2 is enabled in the current Security state.

####
Otherwise:

Reserved, RES0.

#### Bit [18]

Reserved, RES0.

#### HPMD, bit [17]
When ARMv8.1-PMU is implemented:

Guest Performance Monitors Disable. This control prohibits event counting at EL2.

HPMD | Meaning
--- | ---
0b0 | Event counting allowed at EL2.
0b1 | Event counting prohibited at EL2. In an Armv8.1 implementation, event counting is prohibited unless enabled by the IMPLEMENTATION DEFINED authentication interface ExternalSecureNoninvasiveDebugEnabled().

This control applies only to:

- The event counters in the range [0:(MDCR_EL2.HPMN-1)].
- If PMCR_EL0.DP is set to 1, PMCCNTR_EL0.

The other event counters are unaffected, and when PMCR_EL0.DP is set to 0, PMCCNTR_EL0 is unaffected.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### Bits [16:15]

Reserved, RES0.

#### TPMS, bit [14]
When SPE is implemented:

Trap Performance Monitor Sampling. When EL2 is enabled in the current Security state, this field controls access to Statistical Profiling control registers from EL1.

TPMS | Meaning
--- | ---
0b0 | Do not trap Statistical Profiling controls to EL2.
0b1 | Accesses to Statistical Profiling controls at EL1 generate a Trap exception to EL2 when EL2 is enabled in the current Security state.

####
Otherwise:

Reserved, RES0.

#### E2PB, bits [13:12]
When SPE is implemented:

EL2 Profiling Buffer. When EL2 is enabled in the current Security state, this field controls the owning translation regime and access to Profiling Buffer control registers from EL1.

E2PB | Meaning
--- | ---
0b00 | Profiling Buffer uses the EL2 stage 1 translation regime. Accesses to Profiling Buffer controls at EL1 generate a Trap exception to EL2 when EL2 is enabled in the current Security state.
0b10 | Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling Buffer controls at EL1 generate a Trap exception to EL2 when EL2 is enabled in the current Security state.
0b11 | Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling Buffer controls at EL1 are not trapped.

All other values are reserved.

If EL2 is not implemented, or is disabled in the current Security State, the PE behaves as if E2PB == 0b11, other than for a direct read of the register.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TDRA, bit [11]

Trap Debug ROM Address register access. Traps System register accesses to the Debug ROM registers to EL2 when EL2 is enabled in the current Security state. This trap is from:

- EL0 using AArch32.
- EL1, regardless of which Execution state it is using.

TDRA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL0 and EL1 System register accesses to the Debug ROM registers are trapped to EL2 when EL2 is enabled in the current Security state, unless it is trapped by DBGDSCRext.UDCCdis or MDSCR_EL1.TDCC.

The registers for which accesses are trapped are as follows:

AArch64: MDRAR_EL1.

AArch32: DBGDRAR, DBGDSAR.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

- MDCR_EL2.TDE == 1.
- HCR_EL2.TGE == 1.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### TDOSA, bit [10]
When ARMv8.0-DoubleLock is implemented:

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states:

TDOSA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

The registers for which accesses are trapped are as follows:

AArch64: OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1.

AArch32: DBGOSLSR, DBGOSLAR, DBGOSDLR, and DBGPRCR.

AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

Note

These registers are not accessible at EL0.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

- MDCR_EL2.TDE == 1.
- HCR_EL2.TGE == 1.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states:

TDOSA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

The registers for which accesses are trapped are as follows:

AArch64: OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.

AArch32: DBGOSLSR, DBGOSLAR, and DBGPRCR.

AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 and DBGOSDLR are trapped.

Note

These registers are not accessible at EL0.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

- MDCR_EL2.TDE == 1.
- HCR_EL2.TGE == 1.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### TDA, bit [9]

Trap Debug Access. Traps EL0 and EL1 System register accesses to those debug System registers that are not trapped by either of the following:

- MDCR_EL2.TDRA.
- MDCR_EL2.TDOSA.

TDA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL0 or EL1 System register accesses to the debug registers are trapped from both Execution states to EL2 when EL2 is enabled in the current Security state, unless the access generates a higher priority exception.

Traps of AArch32 accesses to DBGDTRRXint and DBGDTRTXint are ignored in Debug state.

Traps of AArch64 accesses to DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0 are ignored in Debug state.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

- MDCR_EL2.TDE == 1
- HCR_EL2.TGE == 1

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### TDE, bit [8]

Trap Debug exceptions.

TDE | Meaning
--- | ---
0b0 | This control has no effect on the routing of debug exceptions, and has no effect on accesses to debug registers.
0b1 | Debug exceptions generated at EL1 or EL0 are routed to EL2 when EL2 is enabled in the current Security state. The MDCR_EL2.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.

This field is treated as being 1 for all purposes other than a direct read when HCR_EL2.TGE == 1.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### HPME, bit [7]
When PMUv3 is implemented:

[MDCR_EL2.HPMN:(N-1)] event counters enable.

HPME | Meaning
--- | ---
0b0 | Event counters in the range [MDCR_EL2.HPMN:(PMCR_EL0.N-1)] are disabled.
0b1 | Event counters in the range [MDCR_EL2.HPMN:(PMCR_EL0.N-1)] are enabled by PMCNTENSET_EL0.

If MDCR_EL2.HPMN is less than PMCR_EL0.N or PMCR.N, the event counters in the range [MDCR_EL2.HPMN:(PMCR_EL0.N-1)] or [HDCR.HPMN:(PMCR.N-1)], are enabled and disabled by this bit. Otherwise this bit has no effect on the operation of the event counters.

Note

The effect of MDCR_EL2.HPMN on the operation of this bit applies regardless of whether EL2 is enabled in the current Security state.

For more information see the description of the HPMN field.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TPM, bit [6]
When PMUv3 is implemented:

Trap Performance Monitors accesses. Traps EL0 and EL1 accesses to all Performance Monitors registers to EL2 when EL2 is enabled in the current Security state, from both Execution states:

TPM | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL0 and EL1 accesses to all Performance Monitors registers are trapped to EL2 when EL2 is enabled in the current Security state.

Note

EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped external debug interface.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### TPMCR, bit [5]
When PMUv3 is implemented:

Trap PMCR_EL0 or PMCR accesses. Traps EL0 and EL1 accesses to the PMCR_EL0 or PMCR to EL2 when EL2 is enabled in the current Security state.

TPMCR | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL0 and EL1 accesses to the PMCR_EL0 or PMCR are trapped to EL2 when EL2 is enabled in the current Security state, unless it is trapped by PMUSERENR.EN or PMUSERENR_EL0.EN.

Note

EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped external debug interface.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### HPMN, bits [4:0]
When PMUv3 is implemented:

Defines the number of event counters that are accessible from EL3, EL2, EL1, and from EL0 if permitted.

If HPMN is less than PMCR_EL0.N, HPMN divides the Performance Monitors into two ranges: [0:(HPMN-1)] and [HPMN:(PMCR_EL0.N-1)].

For an event counter in the range [0:(HPMN-1)]:

- The counter is accessible from EL3, EL2, and EL1, and from EL0 if permitted by PMUSERENR_EL0 or PMUSERENR.
- If ARMv8.5-PMU is implemented, PMCR_EL0.LP or PMCR.LP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
- The counter is enabled by PMCR_EL0.E or PMCR.E and bit <n> of PMCNTENSET_EL0.

Note

If HPMN is equal to PMCR_EL0.N, this applies to all event counters.

If HPMN is less than PMCR_EL0.N, for an event counter in the range [HPMN:(PMCR_EL0.N-1)]:

- The counter is accessible from EL2 and EL3.
- If ARMv8.4-SecEL2 is disabled or is not implemented, the counter is also accessible from Secure EL1 and from Secure EL0 if permitted by PMUSERENR_EL0.
- If ARMv8.5-PMU is implemented, MDCR_EL2.HLP or HDCR.HLP determines whether the counter overflow flag is set on unsigned overflow of PMEVCNTR<n>_EL0[31:0] or PMEVCNTR<n>_EL0[63:0].
- The counter is enabled by MDCR_EL2.HPME or HDCR.HPME and bit <n> of PMCNTENSET_EL0.

If this field is set to 0, or to a value larger than PMCR_EL0.N, then the following CONSTRAINED UNPREDICTABLE behavior applies:

- The value returned by a direct read of MDCR_EL2.HPMN is UNKNOWN.
- Either:
  - An UNKNOWN number of counters are reserved for EL2 and EL3 use. That is, the PE behaves as if MDCR_EL2.HPMN is set to an UNKNOWN non-zero value less than or equal to PMCR_EL0.N.
  - All counters are reserved for EL2 and EL3 use, meaning no counters are accessible from EL1 and EL0.

On a Warm reset, this field resets to the value in PMCR_EL0.N.

####
Otherwise:

Reserved, RES0.

## Accessing the MDCR_EL2

Accesses to this register use the following encodings:

#### MRS <Xt>, MDCR_EL2

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0001 | 0b0001 | 0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then AArch64.SystemAccessTrap(EL3, 0x18); else return MDCR_EL2; elsif PSTATE.EL == EL3 then return MDCR_EL2;

#### MSR MDCR_EL2, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0001 | 0b0001 | 0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && !ELUsingAArch32(EL3) && MDCR_EL3.TDA == '1' then AArch64.SystemAccessTrap(EL3, 0x18); else MDCR_EL2 = X[t]; elsif PSTATE.EL == EL3 then MDCR_EL2 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

27/03/2019 21:59; e5e4db499bf9867a4b93324c4dbac985d3da9376

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.