AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# MDCR_EL3, Monitor Debug Configuration Register (EL3)

The MDCR_EL3 characteristics are:

## Purpose

Provides EL3 configuration options for self-hosted debug and the Performance Monitors Extension.

## Configuration

AArch64 System register MDCR_EL3 bits [31:0] can be mapped to AArch32 System register SDCR[31:0] , but this is not architecturally mandated.

This register is in the Warm reset domain. Some or all RW fields of this register have defined reset values. On a Warm or Cold reset these apply only if the PE resets into an Exception level that is using AArch64. Otherwise, on a Warm or Cold reset RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

MDCR_EL3 is a 64-bit register.

## Field descriptions

The MDCR_EL3 bit assignments are:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
RES0 | NSTB | SCCD | ETAD | EPMAD | EDAD | TTRF | STE | SPME | SDD | SPD32 | NSPB | RES0 | TDOSA | TDA | RES0 | TPM | RES0
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

#### Bits [63:26]

Reserved, RES0.

#### NSTB, bits [25:24]
When TRBE is implemented:

Non-secure Trace Buffer. Controls the owning translation regime and accesses to Trace Buffer control registers from EL2 and EL1.

NSTB | Meaning
--- | ---
0b00 | Trace Buffer owning security state is Secure state. If TraceBufferEnabled() == TRUE, tracing is prohibited in Non-secure state. Accesses to Trace Buffer controls at EL2 and EL1 generate Trap exceptions to EL3.
0b01 | Trace Buffer owning security state is Secure state. If TraceBufferEnabled() == TRUE, tracing is prohibited in Non-secure state. Accesses to Trace Buffer controls at EL2 and EL1 in Non-secure state generate Trap exceptions to EL3.
0b10 | Trace Buffer owning security state is Non-secure state. If TraceBufferEnabled() == TRUE, tracing is prohibited in Secure state. Accesses to Trace Buffer controls at EL2 and EL1 generate Trap exceptions to EL3.
0b11 | Trace Buffer owning security state is Non-secure state. If TraceBufferEnabled() == TRUE, tracing is prohibited in Secure state. Accesses to Trace Buffer controls at EL2 and EL1 in Secure state generate Trap exceptions to EL3.

The Trace Buffer control registers trapped by this control are: TRBBASER_EL1, TRBLIMITR_EL1, TRBMAR_EL1, TRBPTR_EL1, TRBSR_EL1, and TRBTRG_EL1.

If EL3 is not implemented and the PE is in Non-secure state, the PE behaves as if this field is 0b11. If EL3 is not implemented and the PE is in Secure state, the PE behaves as if this field is 0b01.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### SCCD, bit [23]
When ARMv8.5-PMU is implemented:

Secure Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting in Secure state.

SCCD | Meaning
--- | ---
0b0 | Cycle counting by PMCCNTR_EL0 is not affected by this bit.
0b1 | Cycle counting by PMCCNTR_EL0 is prohibited in Secure state.

This bit does not affect the CPU_CYCLES event or any other event that counts cycles.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### ETAD, bit [22]
When TRBE is implemented:

External Trace access disable. Controls Non-secure access to PE Trace Unit by an external debugger.

ETAD | Meaning
--- | ---
0b0 | Non-secure accesses from an external debugger to PE Trace Unit are allowed.
0b1 | Non-secure accesses from an external debugger to PE Trace Unit are prohibited.

If EL3 is not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this field is 0b1.

If the Trace Extension does not support external debug interface accesses this bit is RES0.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### EPMAD, bit [21]
When ARMv8.4-Debug is implemented and PMUv3 is implemented:

External debug interface Performance Monitors registers disable. This disables Non-secure access to these registers by an external debugger.

EPMAD | Meaning
--- | ---
0b0 | Non-secure access to Performance Monitors registers from external debugger is enabled.
0b1 | Non-secure access to Performance Monitors registers from external debugger is disabled.

If the Performance Monitors Extension does not support external debug interface accesses this bit is RES0.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this bit is 0b1.

On a Warm reset, this field resets to 0.

####
When PMUv3 is implemented:

External debug interface Performance Monitors registers disable. This disables access to these registers by an external debugger.

EPMAD | Meaning
--- | ---
0b0 | Access to Performance Monitors registers from external debugger is enabled.
0b1 | Access to Performance Monitors registers from external debugger is disabled, unless overridden by the IMPLEMENTATION DEFINED authentication interface.

If the Performance Monitors Extension does not support external debug interface accesses this bit is RES0.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this bit is 0b1.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### EDAD, bit [20]
When ARMv8.4-Debug is implemented:

External debug interface breakpoint and watchpoint register access disable. This disables access to these registers by an external debugger.

EDAD | Meaning
--- | ---
0b0 | Non-secure access to debug registers from external debugger is enabled.
0b1 | Non-secure access to breakpoint and watchpoint registers, and OSLAR_EL1 from external debugger is disabled.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this field is 0b1.

On a Warm reset, this field resets to 0.

####
When ARMv8.2-Debug is implemented:

External debug interface breakpoint and watchpoint register access disable. This disables access to these registers by an external debugger.

EDAD | Meaning
--- | ---
0b0 | Access to debug registers, and to OSLAR_EL1 from external debugger is enabled.
0b1 | Access to breakpoint and watchpoint registers, and to OSLAR_EL1 from external debugger is disabled, unless overridden by the IMPLEMENTATION DEFINED authentication interface.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this field is 0b1.

On a Warm reset, this field resets to 0.

####
Otherwise:

External debug interface breakpoint and watchpoint register access disable. This disables access to these registers by an external debugger.

EDAD | Meaning
--- | ---
0b0 | Access to debug registers from external debugger is enabled.
0b1 | Access to breakpoint and watchpoint registers from external debugger is disabled, unless overridden by the IMPLEMENTATION DEFINED authentication interface. It is IMPLEMENTATION DEFINED whether this disable applies to the external register OSLAR_EL1.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this field is 0b1.

On a Warm reset, this field resets to 0.

#### TTRF, bit [19]
When ARMv8.4-Trace is implemented:

Trap Trace Filter controls. Traps use of the Trace Filter control registers at EL2 and EL1 to EL3.

TTRF | Meaning
--- | ---
0b0 | Accesses to TRFCR_EL2, TRFCR_EL12, TRFCR_EL1, HTRFCR and TRFCR registers at EL2 and EL1 are not affected by this control.
0b1 | Accesses to TRFCR_EL2, TRFCR_EL12, TRFCR_EL1, HTRFCR and TRFCR registers at EL2 and EL1 generate a Trap exception to EL3.

####
Otherwise:

Reserved, RES0.

#### STE, bit [18]
When ARMv8.4-Trace is implemented:

Secure Trace enable. Enables tracing in Secure state.

STE | Meaning
--- | ---
0b0 | Trace prohibited in Secure state unless overridden by the external debugger.
0b1 | Trace allowed in Secure state unless prohibited by the Trace Filter control registers.

This bit also controls the level of authentication required by an external debugger to enable external tracing. If EL3 is not implemented and the PE is executing in Secure state, the Effective value of this bit is 0b1.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### SPME, bit [17]
When ARMv8.2-Debug is implemented and PMUv3 is implemented:

Secure Performance Monitors enable. This allows event counting in Secure state.

SPME | Meaning
--- | ---
0b0 | Event counting prohibited in Secure state.
0b1 | Event counting allowed in Secure state.

If EL3 is not implemented and the PE is executing in Secure state, then the Effective value of this bit is 0b1.

On a Warm reset, this field resets to 0.

####
When PMUv3 is implemented:

Secure Performance Monitors enable. This allows event counting in Secure state.

SPME | Meaning
--- | ---
0b0 | Event counting prohibited in Secure state, unless ExternalSecureNoninvasiveDebugEnabled() is TRUE.
0b1 | Event counting allowed in Secure state.

If EL3 is not implemented and the PE is executing in Secure state, then the Effective value of this bit is 0b1.

On a Warm reset, this field resets to 0.

####
Otherwise:

Reserved, RES0.

#### SDD, bit [16]

AArch64 Secure self-hosted invasive debug disable. Disables Software debug exceptions in Secure state, other than Breakpoint Instruction exceptions.

SDD | Meaning
--- | ---
0b0 | Debug exceptions from Secure EL0 are enabled, and debug exceptions from Secure EL1 are enabled if the value of MDSCR_EL1.KDE is 1 and the value of PSTATE.D is 0.
0b1 | Debug exceptions, other than Breakpoint Instruction exceptions, are disabled from all Exception levels in Secure state.

The SDD bit is ignored unless both of the following are true:

- The PE is in Secure state.
- The Effective value of SCR_EL3.RW is 0b1.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### SPD32, bits [15:14]

AArch32 Secure self-hosted privileged invasive debug control. Enables or disables debug exceptions from Secure EL1 using AArch32, other than Breakpoint Instruction exceptions.

SPD32 | Meaning
--- | ---
0b00 | Legacy mode. Debug exceptions from Secure EL1 are enabled by the IMPLEMENTATION DEFINED authentication interface.
0b10 | Secure privileged debug disabled. Debug exceptions from Secure EL1 are disabled.
0b11 | Secure privileged debug enabled. Debug exceptions from Secure EL1 are enabled.

Other values are reserved, and have the CONSTRAINED UNPREDICTABLE behavior that they must have the same behavior as 0b00. Software must not rely on this property as the behavior of reserved values might change in a future revision of the architecture.

This field has no effect on Breakpoint Instruction exceptions. These are always enabled.

This field is:

- Ignored if the PE is either:
  - In Non-secure state.
  - In Secure state and the Effective value of SCR_EL3.RW is 0b1.
- RES0 if the implementation does not support EL1 using AArch32.

If Secure EL1 is using AArch32 then:

- If debug exceptions from Secure EL1 are enabled, then debug exceptions from Secure EL0 are also enabled.
- Otherwise, debug exceptions from Secure EL0 are enabled only if the value of SDER32_EL3.SUIDEN is 1.

If EL3 and EL2 are not implemented and the Effective value of SCR_EL3.NS is 0b0, then the Effective value of this field is 0b11.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### NSPB, bits [13:12]
When SPE is implemented:

Non-secure Profiling Buffer. This field controls the owning translation regime and accesses to Statistical Profiling and Profiling Buffer control registers.

NSPB | Meaning
--- | ---
0b00 | Profiling Buffer uses Secure Virtual Addresses. Statistical Profiling enabled in Secure state and disabled in Non-secure state. Accesses to Statistical Profiling and Profiling Buffer controls at EL2 and EL1 in both security states generate Trap exceptions to EL3.
0b01 | Profiling Buffer uses Secure Virtual Addresses. Statistical Profiling enabled in Secure state and disabled in Non-secure state. Accesses to Statistical Profiling and Profiling Buffer controls in Non-secure state generate Trap exceptions to EL3.
0b10 | Profiling Buffer uses Non-secure Virtual Addresses. Statistical Profiling enabled in Non-secure state and disabled in Secure state. Accesses to Statistical Profiling and Profiling Buffer controls at EL2 and EL1 in both security states generate Trap exceptions to EL3.
0b11 | Profiling Buffer uses Non-secure Virtual Addresses. Statistical Profiling enabled in Non-secure state and disabled in Secure state. Accesses to Statistical Profiling and Profiling Buffer controls in Secure state generate Trap exceptions to EL3.

If EL3 is not implemented and the PE is executing in Non-secure state, the Effective value of this field is 0b11.

If EL3 is not implemented and the PE is executing in Secure state, the Effective value of this field is 0b01.

####
Otherwise:

Reserved, RES0.

#### Bit [11]

Reserved, RES0.

#### TDOSA, bit [10]
When ARMv8.0-DoubleLock is implemented:

Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug registers to EL3.

TDOSA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL2 and EL1 System register accesses to the powerdown debug registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.

The registers for which accesses are trapped are as follows:

AArch64: OSLAR_EL1, OSLSR_EL1, OSDLR_EL1, and DBGPRCR_EL1.

AArch32: DBGOSLAR, DBGOSLSR, DBGOSDLR, and DBGPRCR.

AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Trap debug OS-related register access. Traps EL2 and EL1 System register accesses to the powerdown debug registers to EL3.

TDOSA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL2 and EL1 System register accesses to the powerdown debug registers are trapped to EL3, unless it is trapped by HDCR.TDOSA or MDCR_EL2.TDOSA.

The registers for which accesses are trapped are as follows:

AArch64: OSLAR_EL1, OSLSR_EL1, and DBGPRCR_EL1.

AArch32: DBGOSLAR, DBGOSLSR, and DBGPRCR.

AArch64 and AArch32: Any IMPLEMENTATION DEFINED register with similar functionality that the implementation specifies as trapped by this bit.

It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 and DBGOSDLR are trapped.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### TDA, bit [9]

Trap Debug Access. Traps EL2, EL1, and EL0 System register accesses to those debug System registers that cannot be trapped using the MDCR_EL3.TDOSA field. When MDCR_EL3.TDA is:

TDA | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL0, EL1, and EL2 accesses to the debug registers, other than the registers that can be trapped by MDCR_EL3.TDOSA, are trapped to EL3, from both Security states and both Execution states, unless it is trapped by DBGDSCRext.UDCCdis, MDSCR_EL1.TDCC, HDCR.TDA or MDCR_EL2.TDA.

Traps of AArch32 accesses to DBGDTRRXint and DBGDTRTXint are ignored in Debug state.

Traps of AArch64 accesses to DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0 are ignored in Debug state.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

#### Bits [8:7]

Reserved, RES0.

#### TPM, bit [6]
When PMUv3 is implemented:

Trap Performance Monitors accesses. Traps EL2, EL1, and EL0 accesses to all Performance Monitors registers to EL3, from both Security states and both Execution states.

TPM | Meaning
--- | ---
0b0 | This control does not cause any instructions to be trapped.
0b1 | EL2, EL1, and EL0 System register accesses to all Performance Monitors registers are trapped to EL3, unless it is trapped by HDCR.TPM or MDCR_EL2.TPM.

On a Warm reset, this field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [5:0]

Reserved, RES0.

## Accessing the MDCR_EL3

Accesses to this register use the following encodings:

#### MRS <Xt>, MDCR_EL3

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b110 | 0b0001 | 0b0011 | 0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then return MDCR_EL3;

#### MSR MDCR_EL3, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b110 | 0b0001 | 0b0011 | 0b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then UNDEFINED; elsif PSTATE.EL == EL2 then UNDEFINED; elsif PSTATE.EL == EL3 then MDCR_EL3 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

15/04/2019 16:47; 8c23526ba8a13a72aada4137daf3e3977b49036e

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.