AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

# ESR_EL1, Exception Syndrome Register (EL1)

The ESR_EL1 characteristics are:

## Purpose

Holds syndrome information for an exception taken to EL1.

## Configuration

AArch64 System register ESR_EL1 bits [31:0] are architecturally mapped to AArch32 System register DFSR[31:0] .

RW fields in this register reset to architecturally UNKNOWN values.

## Attributes

ESR_EL1 is a 64-bit register.

## Field descriptions

The ESR_EL1 bit assignments are:

63 | 62 | 61 | 60 | 59 | 58 | 57 | 56 | 55 | 54 | 53 | 52 | 51 | 50 | 49 | 48 | 47 | 46 | 45 | 44 | 43 | 42 | 41 | 40 | 39 | 38 | 37 | 36 | 35 | 34 | 33 | 32
RES0
EC | IL | ISS
31 | 30 | 29 | 28 | 27 | 26 | 25 | 24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

ESR_EL1 is made UNKNOWN as a result of an exception return from EL1.

When an UNPREDICTABLE instruction is treated as UNDEFINED, and the exception is taken to EL1, the value of ESR_EL1 is UNKNOWN. The value written to ESR_EL1 must be consistent with a value that could be created as a result of an exception from the same Exception level that generated the exception as a result of a situation that is not UNPREDICTABLE at that Exception level, in order to avoid the possibility of a privilege violation.

#### Bits [63:32]

Reserved, RES0.

#### EC, bits [31:26]

Exception Class. Indicates the reason for the exception that this register holds information about.

For each EC value, the table references a subsection that gives information about:

- The cause of the exception, for example the configuration required to enable the trap.
- The encoding of the associated ISS.

Possible values of the EC field are:

EC | Meaning | ISS | Applies when
--- | --- | --- | ---
0b000000 | Unknown reason. | ISS encoding for exceptions with an unknown reason.
0b000001 | Trapped WFI or WFE instruction execution. Conditional WFE and WFI instructions that fail their condition code check do not cause an exception. | ISS encoding for an exception from a WFI or WFE instruction.
0b000011 | Trapped MCR or MRC access with (coproc==0b1111) that is not reported using EC 0b000000. | ISS encoding for an exception from an MCR or MRC access.
0b000100 | Trapped MCRR or MRRC access with (coproc==0b1111) that is not reported using EC 0b000000. | ISS encoding for an exception from an MCRR or MRRC access.
0b000101 | Trapped MCR or MRC access with (coproc==0b1110). | ISS encoding for an exception from an MCR or MRC access.
0b000110 | Trapped LDC or STC access. The only architected uses of these instruction are: An STC to write data to memory from DBGDTRRXint. An LDC to read data from memory to DBGDTRTXint. | ISS encoding for an exception from an LDC or STC instruction.
0b000111 | Access to SVE, Advanced SIMD, or floating-point functionality trapped by CPACR_EL1.FPEN, CPTR_EL2.FPEN, CPTR_EL2.TFP, or CPTR_EL3.TFP control. Excludes exceptions resulting from CPACR_EL1 when the value of HCR_EL2.TGE is 1, or because SVE or Advanced SIMD and floating-point are not implemented. These are reported with EC value 0b000000 as described in 'EC encodings when routing exceptions to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.10.4. | ISS encoding for an exception from an access to SVE, Advanced SIMD or floating-point functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or CPTR_ELx.TFP.
0b001100 | Trapped MRRC access with (coproc==0b1110). | ISS encoding for an exception from an MCRR or MRRC access.
0b001101 | Branch Target Exception. | ISS encoding for an exception from Branch Target Identification instruction. | When ARMv8.5-BTI is implemented
0b001110 | Illegal Execution state. | ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault.
0b010001 | SVC instruction execution in AArch32 state. This is reported in ESR_EL2 only when the exception is generated because the value of HCR_EL2.TGE is 1. | ISS encoding for an exception from HVC or SVC instruction execution.
0b010101 | SVC instruction execution in AArch64 state. | ISS encoding for an exception from HVC or SVC instruction execution.
0b011000 | Trapped MSR, MRS or System instruction execution in AArch64 state, that is not reported using EC 0b000000, 0b000001 or 0b000111. If ARMv8.4-IDST is implemented, also exceptions generated on a read of an ID register. If ARMv8.0-CSV2 is implemented, also Cache Speculation Variant exceptions. This includes all instructions that cause exceptions that are part of the encoding space defined in 'System instruction class encoding overview' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section C5.2.2, except for those exceptions reported using EC values 0b000000, 0b000001, or 0b000111. | ISS encoding for an exception from MSR, MRS, or System instruction execution in AArch64 state.
0b011001 | Access to SVE functionality trapped as a result of CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ, that is not reported using EC 0b000000. This EC is defined only if SVE is implemented. | ISS encoding for an exception from an access to SVE functionality, resulting from CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ.
0b100000 | Instruction Abort from a lower Exception level, that might be using AArch32 or AArch64. Used for MMU faults generated by instruction accesses and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug related exceptions. | ISS encoding for an exception from an Instruction Abort.
0b100001 | Instruction Abort taken without a change in Exception level. Used for MMU faults generated by instruction accesses and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug related exceptions. | ISS encoding for an exception from an Instruction Abort.
0b100010 | PC alignment fault exception. | ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault.
0b100100 | Data Abort from a lower Exception level, that might be using AArch32 or AArch64. Used for MMU faults generated by data accesses, alignment faults other than those caused by Stack Pointer misalignment, and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug related exceptions. | ISS encoding for an exception from a Data Abort.
0b100101 | Data Abort taken without a change in Exception level. Used for MMU faults generated by data accesses, alignment faults other than those caused by Stack Pointer misalignment, and synchronous External aborts, including synchronous parity or ECC errors. Not used for debug related exceptions. | ISS encoding for an exception from a Data Abort.
0b100110 | SP alignment fault exception. | ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault.
0b101000 | Trapped floating-point exception taken from AArch32 state. This EC value is valid if the implementation supports trapping of floating-point exceptions, otherwise it is reserved. Whether a floating-point implementation supports trapping of floating-point exceptions is IMPLEMENTATION DEFINED. | ISS encoding for an exception from a trapped floating-point exception.
0b101100 | Trapped floating-point exception taken from AArch64 state. This EC value is valid if the implementation supports trapping of floating-point exceptions, otherwise it is reserved. Whether a floating-point implementation supports trapping of floating-point exceptions is IMPLEMENTATION DEFINED. | ISS encoding for an exception from a trapped floating-point exception.
0b101111 | SError interrupt. | ISS encoding for a SError interrupt.
0b110000 | Breakpoint exception from a lower Exception level, that might be using AArch32 or AArch64. | ISS encoding for an exception from a Breakpoint or Vector Catch debug exception.
0b110001 | Breakpoint exception taken without a change in Exception level. | ISS encoding for an exception from a Breakpoint or Vector Catch debug exception.
0b110010 | Software Step exception from a lower Exception level, that might be using AArch32 or AArch64. | ISS encoding for an exception from a Software Step exception.
0b110011 | Software Step exception taken without a change in Exception level. | ISS encoding for an exception from a Software Step exception.
0b110100 | Watchpoint exception from a lower Exception level, that might be using AArch32 or AArch64. | ISS encoding for an exception from a Watchpoint exception.
0b110101 | Watchpoint exception taken without a change in Exception level. | ISS encoding for an exception from a Watchpoint exception.
0b111000 | BKPT instruction execution in AArch32 state. | ISS encoding for an exception from execution of a Breakpoint instruction.
0b111100 | BRK instruction execution in AArch64 state. This is reported in ESR_EL3 only if a BRK instruction is executed. | ISS encoding for an exception from execution of a Breakpoint instruction.

All other EC values are reserved by Arm, and:

- Unused values in the range 0b000000 - 0b101100 (0x00 - 0x2C) are reserved for future use for synchronous exceptions.
- Unused values in the range 0b101101 - 0b111111 (0x2D - 0x3F) are reserved for future use, and might be used for synchronous or asynchronous exceptions.

The effect of programming this field to a reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in System and memory-mapped registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section K1.1.11.

This field resets to an architecturally UNKNOWN value.

#### IL, bit [25]

Instruction Length for synchronous exceptions. Possible values of this bit are:

IL | Meaning
--- | ---
0b0 | 16-bit instruction trapped.
0b1 | An SError interrupt. An Instruction Abort exception. A PC alignment fault exception. An SP alignment fault exception. A Data Abort exception for which the value of the ISV bit is 0. An Illegal Execution state exception. Any debug exception except for Breakpoint instruction exceptions. For Breakpoint instruction exceptions, this bit has its standard meaning: 0b0: 16-bit T32 BKPT instruction. 0b1: 32-bit A32 BKPT instruction or A64 BRK instruction. An exception reported using EC value 0b000000.

This field resets to an architecturally UNKNOWN value.

#### ISS, bits [24:0]

Instruction Specific Syndrome. Architecturally, this field can be defined independently for each defined Exception class. However, in practice, some ISS encodings are used for more than one Exception class.

Typically, an ISS encoding has a number of subfields. When an ISS subfield holds a register number, the value returned in that field is the AArch64 view of the register number. For an exception taken from AArch32 state, 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1, defines this view of the specified AArch32 register. If the AArch32 register descriptor is 0b1111, then:

- If the instruction that generated the exception was not UNPREDICTABLE, the field takes the value 0b11111.
- If the instruction that generated the exception was UNPREDICTABLE, the field takes an UNKNOWN value that must be either:
  - The AArch64 view of the register number of a register that might have been used at the Exception level from which the exception was taken.
  - The value 0b11111.

When the EC field is 0b000000, indicating an exception with an unknown reason, the ISS field is not valid, RES0.

### ISS encoding for exceptions with an unknown reason.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0

#### Bits [24:0]

Reserved, RES0.

When an exception is reported using this EC code the IL field is set to 1.

This EC code is used for all exceptions that are not covered by any other EC value. This includes exceptions that are generated in the following situations:

- The attempted execution of an instruction bit pattern that has no allocated instruction at the current Exception level and Security state, including:
  - A read access using a System register pattern that is not allocated for reads at the current Exception level and Security state.
  - A write access using a System register pattern that is not allocated for writes at the current Exception level and Security state.
  - Instruction encodings for instructions not implemented in the implementation.
- In Debug state, the attempted execution of an instruction bit pattern that is unallocated in Debug state.
- In Non-debug state, the attempted execution of an instruction bit pattern that is unallocated in Non-debug state.
- In AArch32 state, attempted execution of a short vector floating-point instruction.
- In an implementation that does not include Advanced SIMD and floating-point functionality, an attempted access to Advanced SIMD or floating-point functionality under conditions where that access would be permitted if that functionality was present. This includes the attempted execution of an Advanced SIMD or floating-point instruction, and attempted accesses to Advanced SIMD and floating-point System registers.
- An exception generated because of the value of one of the SCTLR_EL1.{ITD, SED, CP15BEN} control bits.
- Attempted execution of:
  - An HVC instruction when disabled by HCR_EL2.HCD or SCR_EL3.HCE.
  - An SMC instruction when disabled by SCR_EL3.SMD.
  - An HLT instruction when disabled by EDSCR.HDE.
- Attempted execution of an MSR or MRS instruction to access SP_EL0 when the value of SPSel.SP is 0.
- Attempted execution, in Debug state, of:
  - A DCPS1 instruction when the value of HCR_EL2.TGE is 1 and EL2 is disabled or not implemented in the current Security state.
  - A DCPS2 instruction from EL1 or EL0 when EL2 is disabled or not implemented in the current Security state.
  - A DCPS3 instruction when the value of EDSCR.SDD is 1, or when EL3 is not implemented.
- When EL3 is using AArch64, attempted execution from Secure EL1 of an SRS instruction using R13_mon. See 'Traps to EL3 of monitor functionality from Secure EL1 using AArch32' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- In Debug state when the value of EDSCR.SDD is 1, the attempted execution at EL2, EL1, or EL0 of an instruction that is configured to trap to EL3.
- In AArch32 state, the attempted execution of an MRS (banked register) or an MSR (banked register) instruction to SPSR_mon, SP_mon, or LR_mon.
- An exception that is taken to EL2 because the value of HCR_EL2.TGE is 1 that, if the value of HCR_EL2.TGE was 0 would have been reported with an ESR_ELx.EC value of 0b000111.
- When SVE is not implemented, attempted execution of:
  - An SVE instruction.
  - An MSR or MRS instruction to access ZCR_EL1, ZCR_EL2, or ZCR_EL3.

### ISS encoding for an exception from a WFI or WFE instruction.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | RES0 | TI

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field resets to an architecturally UNKNOWN value.

#### Bits [19:1]

Reserved, RES0.

#### TI, bit [0]

Trapped instruction. Possible values of this bit are:

TI | Meaning
--- | ---
0b0 | WFI trapped.
0b1 | WFE trapped.

This field resets to an architecturally UNKNOWN value.

The following sections describe configuration settings for generating this exception:

- 'Controls for exceptions taken to EL1 using AArch64' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL2 of Non-secure EL1 and EL0 execution of WFE and WFI instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL3 of EL2, EL1, and EL0 execution of WFE and WFI instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

### ISS encoding for an exception from an MCR or MRC access.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | Opc2 | Opc1 | CRn | Rt | CRm | Direction

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field resets to an architecturally UNKNOWN value.

#### Opc2, bits [19:17]

The Opc2 value from the issued instruction.

For a trapped VMRS access, holds the value 0b000.

This field resets to an architecturally UNKNOWN value.

#### Opc1, bits [16:14]

The Opc1 value from the issued instruction.

For a trapped VMRS access, holds the value 0b111.

This field resets to an architecturally UNKNOWN value.

#### CRn, bits [13:10]

The CRn value from the issued instruction.

For a trapped VMRS access, holds the reg field from the VMRS instruction encoding.

This field resets to an architecturally UNKNOWN value.

#### Rt, bits [9:5]

The Rt value from the issued instruction, the general-purpose register used for the transfer. The reported value gives the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1.

This field resets to an architecturally UNKNOWN value.

#### CRm, bits [4:1]

The CRm value from the issued instruction.

For a trapped VMRS access, holds the value 0b0000.

This field resets to an architecturally UNKNOWN value.

#### Direction, bit [0]

Indicates the direction of the trapped instruction. The possible values of this bit are:

Direction | Meaning
--- | ---
0b0 | Write to System register space. MCR instruction.
0b1 | Read from System register space. MRC or VMRS instruction.

This field resets to an architecturally UNKNOWN value.

The following sections describe configuration settings for generating exceptions that are reported using EC value 0b000011:

- 'Traps to EL1 of EL0 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL1 of EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL1 of EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL2 of Non-secure EL1 accesses to virtual memory control registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 execution of TLB maintenance instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 and EL0 execution of cache maintenance instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 and EL0 accesses to the Auxiliary Control Register' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 and EL0 accesses to lockdown, DMA, and TCM operations' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 and EL0 accesses to the ID registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Trapping to EL2 of Non-secure EL1 accesses to the CPACR_EL1 or CPACR' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Generic trapping to EL2 of Non-secure EL1 and EL0 accesses to System registers, from AArch32 state only' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1
- 'Traps to EL2 of Non-secure EL0 and EL1 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1
- 'Traps to EL2 of Non-secure EL1 and EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of EL1 and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL3 of Secure monitor functionality from Secure EL1 using AArch32' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Trapping to EL3 of EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 accesses to the CPACR_EL1 or CPACR' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL3 of EL2, EL1, and EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL3 of EL2, EL1, and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

The following sections describe configuration settings for generating exceptions that are reported using EC value 0b000101:

- 'Traps to EL1 of EL0 and EL1 System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL1 of EL0 accesses to the Debug Communications Channel (DCC) registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL1 and EL0 accesses to the ID registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1, for trapped accesses to the JIDR.
- 'Traps to EL2 of Non-secure system register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping System register accesses to Debug ROM registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping System register accesses to OS-related debug registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping general System register accesses to debug registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL3 of all System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping System register accesses to OS-related debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping general System register accesses to debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

'Traps to EL2 of Non-secure EL1 and EL0 accesses to the ID registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1, describes configuration settings for generating exceptions that are reported using EC value 0b001000.

### ISS encoding for an exception from an MCRR or MRRC access.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | Opc1 | RES0 | Rt2 | Rt | CRm | Direction

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field resets to an architecturally UNKNOWN value.

#### Opc1, bits [19:16]

The Opc1 value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Bit [15]

Reserved, RES0.

#### Rt2, bits [14:10]

The Rt2 value from the issued instruction, the second general-purpose register used for the transfer. The reported value gives the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1.

This field resets to an architecturally UNKNOWN value.

#### Rt, bits [9:5]

The Rt value from the issued instruction, the first general-purpose register used for the transfer. The reported value gives the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1.

This field resets to an architecturally UNKNOWN value.

#### CRm, bits [4:1]

The CRm value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Direction, bit [0]

Indicates the direction of the trapped instruction. The possible values of this bit are:

Direction | Meaning
--- | ---
0b0 | Write to System register space. MCRR instruction.
0b1 | Read from System register space. MRRC instruction.

This field resets to an architecturally UNKNOWN value.

The following sections describe configuration settings for generating exceptions that are reported using EC value 0b000100:

- 'Traps to EL1 of EL0 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL1 of EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL1 of EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL2 of Non-secure EL1 accesses to virtual memory control registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'General trapping to EL2 of Non-secure EL0 and EL1 accesses to System registers, from AArch32 state only' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL2 of Non-secure EL0 and EL1 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure EL0 and EL1 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of EL1 and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL3 of EL2, EL1, and EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- 'Traps to EL3 of EL2, EL1, and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

The following sections describe configuration settings for generating exceptions that are reported using EC value 0b001100:

- 'Traps to EL1 of EL0 and EL1 System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL1 of EL0 accesses to the Debug Communications Channel (DCC) registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL2 of Non-secure system register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping System register accesses to Debug ROM registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL3 of all System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping System register accesses to powerdown debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping general System register accesses to debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

### ISS encoding for an exception from an LDC or STC instruction.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | imm8 | RES0 | Rn | Offset | AM | Direction

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field resets to an architecturally UNKNOWN value.

#### imm8, bits [19:12]

The immediate value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Bits [11:10]

Reserved, RES0.

#### Rn, bits [9:5]

The Rn value from the issued instruction, the general-purpose register used for the transfer. The reported value gives the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1.

This field is valid only when AM[2] is 0, indicating an immediate form of the LDC or STC instruction. When AM[2] is 1, indicating a literal form of the LDC or STC instruction, this field is UNKNOWN.

This field resets to an architecturally UNKNOWN value.

#### Offset, bit [4]

Indicates whether the offset is added or subtracted:

Offset | Meaning
--- | ---
0b0 | Subtract offset.
0b1 | Add offset.

This bit corresponds to the U bit in the instruction encoding.

This field resets to an architecturally UNKNOWN value.

#### AM, bits [3:1]

Addressing mode. The permitted values of this field are:

AM | Meaning
--- | ---
0b000 | Immediate unindexed.
0b001 | Immediate post-indexed.
0b010 | Immediate offset.
0b011 | Immediate pre-indexed.
0b100 | For a trapped STC instruction or a trapped T32 LDC instruction this encoding is reserved.
0b110 | For a trapped STC instruction, this encoding is reserved.

The values 0b101 and 0b111 are reserved. The effect of programming this field to a reserved value is that behavior is CONSTRAINED UNPREDICTABLE, as described in 'Reserved values in AArch64 System registers and translation table entries' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section K1.2.2.

Bit [2] in this subfield indicates the instruction form, immediate or literal.

Bits [1:0] in this subfield correspond to the bits {P, W} in the instruction encoding.

This field resets to an architecturally UNKNOWN value.

#### Direction, bit [0]

Indicates the direction of the trapped instruction. The possible values of this bit are:

Direction | Meaning
--- | ---
0b0 | Write to memory. STC instruction.
0b1 | Read from memory. LDC instruction.

This field resets to an architecturally UNKNOWN value.

The following sections describe the configuration settings for the traps that are reported using EC value 0b000110:

- 'Traps to EL1 of EL0 accesses to the Debug Communications Channel (DCC) registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping general System register accesses to debug registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trapping general System register accesses to debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

### ISS encoding for an exception from an access to SVE, Advanced SIMD or floating-point functionality, resulting from CPACR_EL1.FPEN, CPTR_EL2.FPEN or CPTR_ELx.TFP.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | RES0

The accesses covered by this trap include:

- Execution of SVE or Advanced SIMD and floating-point instructions.
- Accesses to the Advanced SIMD and floating-point System registers.

For an implementation that does not include either SVE or support for floating-point and Advanced SIMD, the exception is reported using the EC value 0b000000.

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field resets to an architecturally UNKNOWN value.

#### Bits [19:0]

Reserved, RES0.

The following sections describe the configuration settings for the traps that are reported using EC value 0b000111:

- 'Traps to EL1 of EL0 and EL1 accesses to SIMD and floating-point functionality' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'General trapping to EL2 of Non-secure accesses to the SIMD and floating-point registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Traps to EL3 of all accesses to the SIMD and floating-point registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1

### ISS encoding for an exception from an access to SVE functionality, resulting from CPACR_EL1.ZEN, CPTR_EL2.ZEN, CPTR_EL2.TZ, or CPTR_EL3.EZ.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0

#### Bits [24:0]
When SVE is implemented:

Reserved, RES0.

####
Otherwise:

Reserved, RES0.

The accesses covered by this trap include:

- Execution of SVE instructions.
- Accesses to the SVE system registers, ZCR_ELx and ID_AA64ZFR0_EL1.

For an implementation that does not include SVE, the exception is reported using the EC value 0b000000.

### ISS encoding for an exception from an Illegal Execution state, or a PC or SP alignment fault.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0

#### Bits [24:0]

Reserved, RES0.

There are no configuration settings for generating Illegal Execution state exceptions and PC alignment fault exceptions. For more information about these exceptions see 'The Illegal Execution state exception' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 and 'PC alignment checking' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

'Stack pointer alignment checking' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 describes the configuration settings for generating SP alignment fault exceptions.

### ISS encoding for an exception from HVC or SVC instruction execution.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | imm16

#### Bits [24:16]

Reserved, RES0.

#### imm16, bits [15:0]

The value of the immediate field from the HVC or SVC instruction.

For an HVC instruction, and for an A64 SVC instruction, this is the value of the imm16 field of the issued instruction.

For an A32 or T32 SVC instruction:

- If the instruction is unconditional, then:
  - For the T32 instruction, this field is zero-extended from the imm8 field of the instruction.
  - For the A32 instruction, this field is the bottom 16 bits of the imm24 field of the instruction.
- If the instruction is conditional, this field is UNKNOWN.

This field resets to an architecturally UNKNOWN value.

In AArch32 state, the HVC instruction is unconditional, and a conditional SVC instruction generates an exception only if it passes its condition code check. Therefore, the syndrome information for these exceptions does not require conditionality information.

For T32 and A32 instructions, see 'SVC' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section F7 (T32 and A32 Base Instruction Set Instruction Descriptions) and 'HVC' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section F7.

For A64 instructions, see 'SVC' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section C5 (A64 Base Instruction Descriptions), and 'HVC' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section C5.

### ISS encoding for an exception from SMC instruction execution in AArch32 state.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
CV | COND | CCKNOWNPASS | RES0

For an SMC instruction that completes normally and generates an exception that is taken to EL3, the ISS encoding is RES0.

For an SMC instruction that is trapped to EL2 from EL1 because HCR_EL2.TSC is 1, the ISS encoding is as shown in the diagram.

#### CV, bit [24]

Condition code valid. Possible values of this bit are:

CV | Meaning
--- | ---
0b0 | The COND field is not valid.
0b1 | The COND field is valid.

For exceptions taken from AArch64, CV is set to 1.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether CV is set to 1 or set to 0. See the description of the COND field for more information.

This field is only valid if CCKNOWNPASS is 1, otherwise it is RES0.

This field resets to an architecturally UNKNOWN value.

#### COND, bits [23:20]

The condition code for the trapped instruction. This field is valid only for exceptions taken from AArch32, and only when the value of CV is 1.

For exceptions taken from AArch64, this field is set to 0b1110.

For exceptions taken from AArch32:

- When an A32 instruction is trapped, CV is set to 1 and:
  - If the instruction is conditional, COND is set to the condition code field value from the instruction.
  - If the instruction is unconditional, COND is set to 0b1110.
- A conditional A32 instruction that is known to pass its condition code check can be presented either:
  - With COND set to 0b1110, the value for unconditional.
  - With the COND value held in the instruction.
- When a T32 instruction is trapped, it is IMPLEMENTATION DEFINED whether:
  - CV is set to 0 and COND is set to an UNKNOWN value. Software must examine the SPSR.IT field to determine the condition, if any, of the T32 instruction.
  - CV is set to 1 and COND is set to the condition code for the condition that applied to the instruction.
- For an implementation that, for both A32 and T32 instructions, takes an exception on a trapped conditional instruction only if the instruction passes its condition code check, these definitions mean that when CV is set to 1 it is IMPLEMENTATION DEFINED whether the COND field is set to 0b1110, or to the value of any condition that applied to the instruction.

This field is only valid if CCKNOWNPASS is 1, otherwise it is RES0.

This field resets to an architecturally UNKNOWN value.

#### CCKNOWNPASS, bit [19]

Indicates whether the instruction might have failed its condition code check.

CCKNOWNPASS | Meaning
--- | ---
0b0 | The instruction was unconditional, or was conditional and passed its condition code check.
0b1 | The instruction was conditional, and might have failed its condition code check.

Note

In an implementation in which an SMC instruction that fails it code check is not trapped, this field can always return the value 0.

This field resets to an architecturally UNKNOWN value.

#### Bits [18:0]

Reserved, RES0.

'Traps to EL2 of Non-secure EL1 execution of SMC instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model), describes the configuration settings for trapping SMC instructions from EL1 modes, and 'System calls' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.16, describes the case where these exceptions are trapped to EL3.

### ISS encoding for an exception from SMC instruction execution in AArch64 state.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | imm16

#### Bits [24:16]

Reserved, RES0.

#### imm16, bits [15:0]

The value of the immediate field from the issued SMC instruction.

This field resets to an architecturally UNKNOWN value.

The value of ISS[24:0] described here is used both:

- When an SMC instruction is trapped from EL1 modes.
- When an SMC instruction is not trapped, so completes normally and generates an exception that is taken to EL3.

'Traps to EL2 of Non-secure EL1 execution of SMC instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model), describes the configuration settings for trapping SMC instructions from Non-secure EL1 modes, and 'System calls' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.16, describes the case where these exceptions are trapped to EL3.

### ISS encoding for an exception from MSR, MRS, or System instruction execution in AArch64 state.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | Op0 | Op2 | Op1 | CRn | Rt | CRm | Direction

#### Bits [24:22]

Reserved, RES0.

#### Op0, bits [21:20]

The Op0 value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Op2, bits [19:17]

The Op2 value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Op1, bits [16:14]

The Op1 value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### CRn, bits [13:10]

The CRn value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Rt, bits [9:5]

The Rt value from the issued instruction, the general-purpose register used for the transfer.

This field resets to an architecturally UNKNOWN value.

#### CRm, bits [4:1]

The CRm value from the issued instruction.

This field resets to an architecturally UNKNOWN value.

#### Direction, bit [0]

Indicates the direction of the trapped instruction. The possible values of this bit are:

Direction | Meaning
--- | ---
0b0 | Write access, including MSR instructions.
0b1 | Read access, including MRS instructions.

This field resets to an architecturally UNKNOWN value.

For exceptions caused by System instructions, see the 'System' subsection of 'Branches, exception generating and System instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section C3 (A64 Instruction Set Encoding), for the encoding values returned by an instruction.

The following sections describe configuration settings for generating the exception that is reported using EC value 0b011000:

- In 'EL1 configurable controls' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 execution of cache maintenance instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 accesses to the CTR_EL0' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 execution of DC ZVA instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 accesses to the PSTATE.{D, A, I, F} interrupt masks' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1(The AArch64 System Level Programmers' Model).
  - 'Traps to EL1 of EL0 and EL1 System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 accesses to the Debug Communications Channel (DCC) registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
  - 'Traps to EL1 of EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL1 of EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
- In 'EL2 configurable controls' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL1 accesses to virtual memory control registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 execution of DC ZVA instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL1 execution of TLB maintenance instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 execution of cache maintenance instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL1 accesses to the Auxiliary Control Register' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 accesses to lockdown, DMA, and TCM operations' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 accesses to the ID registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping to EL2 of Non-secure EL1 accesses to the CPACR_EL1 or CPACR' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure system register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping System register accesses to Debug ROM registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping System register accesses to OS-related debug registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 accesses to the Generic Timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping general System register accesses to debug registers to EL2' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of Non-secure EL0 and EL1 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 of EL1 and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).
  - 'Trap to EL2 Non-secure EL1 accesses to Pointer authentication key registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL2 for Nested virtualization' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trap to EL2 Non-secure EL1 accesses to AT S1E* instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trap to EL3 accesses to Pointer authentication key registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- In 'EL3 configurable controls' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL3 of Secure EL1 accesses to the Counter-timer Physical Secure timer registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping to EL3 of EL2 accesses to the CPTR_EL2 or HCPTR, and EL2 and EL1 accesses to the CPACR_EL1 or CPACR' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL3 of all System register accesses to the trace registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping System register accesses to OS-related debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Trapping general System register accesses to debug registers to EL3' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL3 of EL2, EL1, and EL0 accesses to Performance Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
  - 'Traps to EL3 of EL2, EL1, and EL0 accesses to Activity Monitors registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1 (The AArch64 System Level Programmers' Model).

### ISS encoding for a IMPLEMENTATION DEFINED exception to EL3.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
IMPLEMENTATION DEFINED

#### IMPLEMENTATION DEFINED, bits [24:0]

IMPLEMENTATION DEFINED.

This field resets to an architecturally UNKNOWN value.

### ISS encoding for an exception from an Instruction Abort.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | SET | FnV | EA | RES0 | S1PTW | RES0 | IFSC

#### Bits [24:13]

Reserved, RES0.

#### SET, bits [12:11]

Synchronous Error Type. When the RAS Extension is implemented and IFSC is 0b010000, describes the state of the PE after taking the Instruction Abort exception. The possible values of this field are:

SET | Meaning
--- | ---
0b00 | Recoverable error (UER).
0b10 | Uncontainable error (UC).
0b11 | Restartable error (UEO) or Corrected error (CE).

All other values are reserved.

Note

Software can use this information to determine what recovery might be possible. Taking a synchronous External Abort exception might result in an unrecoverable PE state.

This field is RES0 if either:

- The RAS Extension is not implemented.
- The value returned in the IFSC field is not 0b010000.

This field resets to an architecturally UNKNOWN value.

#### FnV, bit [10]

FAR not Valid, for a synchronous External abort other than a synchronous External abort on a translation table walk.

FnV | Meaning
--- | ---
0b0 | FAR is valid.
0b1 | FAR is not valid, and holds an UNKNOWN value.

This field is only valid if the IFSC code is 0b010000. It is RES0 for all other aborts.

This field resets to an architecturally UNKNOWN value.

#### EA, bit [9]

External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External aborts.

For any abort other than an External abort this bit returns a value of 0.

This field resets to an architecturally UNKNOWN value.

#### Bit [8]

Reserved, RES0.

#### S1PTW, bit [7]

For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 translation table walk:

S1PTW | Meaning
--- | ---
0b0 | Fault not on a stage 2 translation for a stage 1 translation table walk.
0b1 | Fault on the stage 2 translation of an access for a stage 1 translation table walk.

For any abort other than a stage 2 fault this bit is RES0.

This field resets to an architecturally UNKNOWN value.

#### Bit [6]

Reserved, RES0.

#### IFSC, bits [5:0]

Instruction Fault Status Code. Possible values of this field are:

IFSC | Meaning
--- | ---
0b000000 | Address size fault, level 0 of translation or translation table base register
0b000001 | Address size fault, level 1
0b000010 | Address size fault, level 2
0b000011 | Address size fault, level 3
0b000100 | Translation fault, level 0
0b000101 | Translation fault, level 1
0b000110 | Translation fault, level 2
0b000111 | Translation fault, level 3
0b001001 | Access flag fault, level 1
0b001010 | Access flag fault, level 2
0b001011 | Access flag fault, level 3
0b001101 | Permission fault, level 1
0b001110 | Permission fault, level 2
0b001111 | Permission fault, level 3
0b010000 | Synchronous External abort, not on translation table walk
0b010100 | Synchronous External abort, on translation table walk, level 0
0b010101 | Synchronous External abort, on translation table walk, level 1
0b010110 | Synchronous External abort, on translation table walk, level 2
0b010111 | Synchronous External abort, on translation table walk, level 3
0b011000 | Synchronous parity or ECC error on memory access, not on translation table walk
0b011100 | Synchronous parity or ECC error on memory access on translation table walk, level 0
0b011101 | Synchronous parity or ECC error on memory access on translation table walk, level 1
0b011110 | Synchronous parity or ECC error on memory access on translation table walk, level 2
0b011111 | Synchronous parity or ECC error on memory access on translation table walk, level 3
0b110000 | TLB conflict abort
0b110001 | Unsupported atomic hardware update fault, if the implementation includes ARMv8.1-TTHM]. Otherwise reserved.

All other values are reserved.

When the RAS Extension is implemented, 0b011000, 0b011100, 0b011101, 0b011110, and 0b011111, are reserved.

Note

Armv8.2 requires the implementation of the RAS Extension.

For more information about the lookup level associated with a fault, see 'The level associated with MMU faults' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

Note

Because Access flag faults and Permission faults can only result from a Block or Page translation table descriptor, they cannot occur at level 0.

If the S1PTW bit is set, then the level refers the level of the stage2 translation that is translating a stage 1 translation walk.

This field resets to an architecturally UNKNOWN value.

### ISS encoding for an exception from a Data Abort.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
ISV | SAS | SSE | SRT | SF | AR | VNCR | SET | FnV | EA | CM | S1PTW | WnR | DFSC

#### ISV, bit [24]

Instruction syndrome valid. Indicates whether the syndrome information in ISS[23:0] is valid.

ISV | Meaning
--- | ---
0b0 | No valid instruction syndrome. ISS[23:14] are RES0.
0b1 | ISS[23:14] hold a valid instruction syndrome.

This bit is 0 for all faults reported in ESR_EL2 except the following stage 2 aborts:

- AArch64 loads and stores of a single general-purpose register (including the register specified with 0b11111, including those with Acquire/Release semantics, but excluding Load Exclusive or Store Exclusive and excluding those with writeback.
- AArch32 instructions where the instruction:
  - Is an LDR, LDA, LDRT, LDRSH, LDRSHT, LDRH, LDAH, LDRHT, LDRSB, LDRSBT, LDRB, LDAB, LDRBT, STR, STL, STRT, STRH, STLH, STRHT, STRB, STLB, or STRBT instruction.
  - Is not performing register writeback.
  - Is not using R15 as a source or destination register.

For these cases, ISV is UNKNOWN if the exception was generated in Debug state in memory access mode, and otherwise indicates whether ISS[23:14] hold a valid syndrome.

ISV is 0 for all faults reported in ESR_EL1 or ESR_EL3.

When the RAS Extension is implemented, ISV is 0 for any synchronous External abort.

For ISS reporting, a stage 2 abort on a stage 1 translation table walk does not return a valid instruction syndrome, and therefore ISV is 0 for these aborts.

When the RAS Extension is not implemented, the value of ISV on a synchronous External abort on a stage 2 translation table walk is IMPLEMENTATION DEFINED.

This field resets to an architecturally UNKNOWN value.

#### SAS, bits [23:22]

Syndrome Access Size. When ISV is 1, indicates the size of the access attempted by the faulting operation.

SAS | Meaning
--- | ---
0b00 | Byte
0b01 | Halfword
0b10 | Word
0b11 | Doubleword

This field is UNKNOWN when the value of ISV is UNKNOWN.

This field is RES0 when the value of ISV is 0.

This field resets to an architecturally UNKNOWN value.

#### SSE, bit [21]

Syndrome Sign Extend. When ISV is 1, for a byte, halfword, or word load operation, indicates whether the data item must be sign extended. For these cases, the possible values of this bit are:

SSE | Meaning
--- | ---
0b0 | Sign-extension not required.
0b1 | Data item must be sign-extended.

For all other operations this bit is 0.

This field is UNKNOWN when the value of ISV is UNKNOWN.

This field is RES0 when the value of ISV is 0.

This field resets to an architecturally UNKNOWN value.

#### SRT, bits [20:16]

Syndrome Register transfer. When ISV is 1, the register number of the Rt operand of the faulting instruction. If the exception was taken from an Exception level that is using AArch32 then this is the AArch64 view of the register. See 'Mapping of the general-purpose registers between the Execution states' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.20.1.

This field is UNKNOWN when the value of ISV is UNKNOWN.

This field is RES0 when the value of ISV is 0.

This field resets to an architecturally UNKNOWN value.

#### SF, bit [15]

Width of the register accessed by the instruction is Sixty-Four. When ISV is 1, the possible values of this bit are:

SF | Meaning
--- | ---
0b0 | Instruction loads/stores a 32-bit wide register.
0b1 | Instruction loads/stores a 64-bit wide register.

Note

This field specifies the register width identified by the instruction, not the Execution state.

This field is UNKNOWN when the value of ISV is UNKNOWN.

This field is RES0 when the value of ISV is 0.

This field resets to an architecturally UNKNOWN value.

#### AR, bit [14]

Acquire/Release. When ISV is 1, the possible values of this bit are:

AR | Meaning
--- | ---
0b0 | Instruction did not have acquire/release semantics.
0b1 | Instruction did have acquire/release semantics.

This field is UNKNOWN when the value of ISV is UNKNOWN.

This field is RES0 when the value of ISV is 0.

This field resets to an architecturally UNKNOWN value.

#### VNCR, bit [13]
When ARMv8.4-NV is implemented:

Indicates that the fault came from use of VNCR_EL2 register by EL1 code.

VNCR | Meaning
--- | ---
0b0 | The fault was not generated by the use of VNCR_EL2, by an MRS or MSR instruction executed at EL1.
0b1 | The fault was generated by the use of VNCR_EL2, by an MRS or MSR instruction executed at EL1.

This field is 0 in ESR_EL1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### SET, bits [12:11]

Synchronous Error Type. When the RAS Extension is implemented and DFSC is 0b010000, describes the state of the PE after taking the Data Abort exception. The possible values of this field are:

SET | Meaning
--- | ---
0b00 | Recoverable error (UER).
0b10 | Uncontainable error (UC).
0b11 | Restartable error (UEO) or Corrected error (CE).

All other values are reserved.

Note

Software can use this information to determine what recovery might be possible. Taking a synchronous External Abort exception might result in an unrecoverable PE state.

This field is RES0 if either:

- The RAS Extension is not implemented.
- The value returned in the DFSC field is not 0b010000.

This field resets to an architecturally UNKNOWN value.

#### FnV, bit [10]

FAR not Valid, for a synchronous External abort other than a synchronous External abort on a translation table walk.

FnV | Meaning
--- | ---
0b0 | FAR is valid.
0b1 | FAR is not valid, and holds an UNKNOWN value.

This field is valid only if the DFSC code is 0b010000. It is RES0 for all other aborts.

This field resets to an architecturally UNKNOWN value.

#### EA, bit [9]

External abort type. This bit can provide an IMPLEMENTATION DEFINED classification of External aborts.

For any abort other than an External abort this bit returns a value of 0.

This field resets to an architecturally UNKNOWN value.

#### CM, bit [8]

Cache maintenance. Indicates whether the Data Abort came from a cache maintenance or address translation instruction:

CM | Meaning
--- | ---
0b0 | The Data Abort was not generated by the execution of one of the System instructions identified in the description of value 1.
0b1 | The Data Abort was generated by either the execution of a cache maintenance instruction or by a synchronous fault on the execution of an address translation instruction. The DC ZVA instruction is not classified as a cache maintenance instruction, and therefore its execution cannot cause this field to be set to 1.

This field resets to an architecturally UNKNOWN value.

#### S1PTW, bit [7]

For a stage 2 fault, indicates whether the fault was a stage 2 fault on an access made for a stage 1 translation table walk:

S1PTW | Meaning
--- | ---
0b0 | Fault not on a stage 2 translation for a stage 1 translation table walk.
0b1 | Fault on the stage 2 translation of an access for a stage 1 translation table walk.

For any abort other than a stage 2 fault this bit is RES0.

This field resets to an architecturally UNKNOWN value.

#### WnR, bit [6]

Write not Read. Indicates whether a synchronous abort was caused by an instruction writing to a memory location, or by an instruction reading from a memory location. The possible values of this bit are:

WnR | Meaning
--- | ---
0b0 | Abort caused by an instruction reading from a memory location.
0b1 | Abort caused by an instruction writing to a memory location.

For faults on cache maintenance and address translation instructions, this bit always returns a value of 1.

For faults from an atomic instruction that both reads and writes from a memory location, this bit is set to 0 if a read of the address specified by the instruction would have generated the fault which is being reported, otherwise it is set to 1. The architecture permits, but does not require, a relaxation of this requirement such that for all stage 2 aborts on stage 1 translation table walks for atomic instructions, the WnR bit is always 0.

This field is UNKNOWN for:

- An External abort on an Atomic access.
- A fault reported using a DFSC value of 0b110101 or 0b110001, indicating an unsupported Exclusive or atomic access.

This field resets to an architecturally UNKNOWN value.

#### DFSC, bits [5:0]

Data Fault Status Code. Possible values of this field are:

DFSC | Meaning
--- | ---
0b000000 | Address size fault, level 0 of translation or translation table base register.
0b000001 | Address size fault, level 1.
0b000010 | Address size fault, level 2.
0b000011 | Address size fault, level 3.
0b000100 | Translation fault, level 0.
0b000101 | Translation fault, level 1.
0b000110 | Translation fault, level 2.
0b000111 | Translation fault, level 3.
0b001001 | Access flag fault, level 1.
0b001010 | Access flag fault, level 2.
0b001011 | Access flag fault, level 3.
0b001101 | Permission fault, level 1.
0b001110 | Permission fault, level 2.
0b001111 | Permission fault, level 3.
0b010000 | Synchronous External abort, not on translation table walk.
0b010001 | Synchronous Tag Check fail
0b010100 | Synchronous External abort, on translation table walk, level 0.
0b010101 | Synchronous External abort, on translation table walk, level 1.
0b010110 | Synchronous External abort, on translation table walk, level 2.
0b010111 | Synchronous External abort, on translation table walk, level 3.
0b011000 | Synchronous parity or ECC error on memory access, not on translation table walk.
0b011100 | Synchronous parity or ECC error on memory access on translation table walk, level 0.
0b011101 | Synchronous parity or ECC error on memory access on translation table walk, level 1.
0b011110 | Synchronous parity or ECC error on memory access on translation table walk, level 2.
0b011111 | Synchronous parity or ECC error on memory access on translation table walk, level 3.
0b100001 | Alignment fault.
0b110000 | TLB conflict abort.
0b110001 | Unsupported atomic hardware update fault, if the implementation includes ARMv8.1-TTHM]. Otherwise reserved.
0b110100 | IMPLEMENTATION DEFINED fault (Lockdown).
0b110101 | IMPLEMENTATION DEFINED fault (Unsupported Exclusive or Atomic access).
0b111101 | Section Domain Fault, used only for faults reported in the PAR_EL1.
0b111110 | Page Domain Fault, used only for faults reported in the PAR_EL1.

All other values are reserved.

When the RAS Extension is implemented, 0b011000, 0b011100, 0b011101, 0b011110, and 0b011111, are reserved.

For more information about the lookup level associated with a fault, see 'The level associated with MMU faults' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile.

Note

Because Access flag faults and Permission faults can only result from a Block or Page translation table descriptor, they cannot occur at level 0.

If the S1PTW bit is set, then the level refers the level of the stage2 translation that is translating a stage 1 translation walk.

This field resets to an architecturally UNKNOWN value.

### ISS encoding for an exception from a trapped floating-point exception.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | TFV | RES0 | VECITR | IDF | RES0 | IXF | UFF | OFF | DZF | IOF

#### Bit [24]

Reserved, RES0.

#### TFV, bit [23]

Trapped Fault Valid bit. Indicates whether the IDF, IXF, UFF, OFF, DZF, and IOF bits hold valid information about trapped floating-point exceptions. The possible values of this bit are:

TFV | Meaning
--- | ---
0b0 | The IDF, IXF, UFF, OFF, DZF, and IOF bits do not hold valid information about trapped floating-point exceptions and are UNKNOWN.
0b1 | One or more floating-point exceptions occurred during an operation performed while executing the reported instruction. The IDF, IXF, UFF, OFF, DZF, and IOF bits indicate trapped floating-point exceptions that occurred. For more information see 'Floating-point exception traps' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.13.4.

It is IMPLEMENTATION DEFINED whether this field is set to 0 on an exception generated by a trapped floating point exception from a vector instruction.

Note

This is not a requirement. Implementations can set this field to 1 on a trapped floating-point exception from a vector instruction and return valid information in the {IDF, IXF, UFF, OFF, DZF, IOF} fields.

This field resets to an architecturally UNKNOWN value.

#### Bits [22:11]

Reserved, RES0.

#### VECITR, bits [10:8]

For a trapped floating-point exception from an instruction executed in AArch32 state this field is RES1.

For a trapped floating-point exception from an instruction executed in AArch64 state this field is UNKNOWN.

This field resets to an architecturally UNKNOWN value.

#### IDF, bit [7]

Input Denormal floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

IDF | Meaning
--- | ---
0b0 | Input denormal floating-point exception has not occurred.
0b1 | Input denormal floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

#### Bits [6:5]

Reserved, RES0.

#### IXF, bit [4]

Inexact floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

IXF | Meaning
--- | ---
0b0 | Inexact floating-point exception has not occurred.
0b1 | Inexact floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

#### UFF, bit [3]

Underflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

UFF | Meaning
--- | ---
0b0 | Underflow floating-point exception has not occurred.
0b1 | Underflow floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

#### OFF, bit [2]

Overflow floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

OFF | Meaning
--- | ---
0b0 | Overflow floating-point exception has not occurred.
0b1 | Overflow floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

#### DZF, bit [1]

Divide by Zero floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

DZF | Meaning
--- | ---
0b0 | Divide by Zero floating-point exception has not occurred.
0b1 | Divide by Zero floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

#### IOF, bit [0]

Invalid Operation floating-point exception trapped bit. If the TFV field is 0, this bit is UNKNOWN. Otherwise, the possible values of this bit are:

IOF | Meaning
--- | ---
0b0 | Invalid Operation floating-point exception has not occurred.
0b1 | Invalid Operation floating-point exception occurred during execution of the reported instruction.

This field resets to an architecturally UNKNOWN value.

In an implementation that supports the trapping of floating-point exceptions:

- From an Exception level using AArch64, the FPCR.{IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of the floating-point exception traps.
- From an Exception level using AArch32, the FPSCR.{IDE, IXE, UFE, OFE, DZE, IOE} bits enable each of the floating-point exception traps.

### ISS encoding for a SError interrupt.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
IDS | RES0 | IESB | AET | EA | RES0 | DFSC

#### IDS, bit [24]

IMPLEMENTATION DEFINED syndrome. Possible values of this bit are:

IDS | Meaning
--- | ---
0b0 | Bits[23:0] of the ISS field holds the fields described in this encoding. Note If the RAS Extension is not implemented, this means that bits[23:0] of the ISS field are RES0.
0b1 | Bits[23:0] of the ISS field holds IMPLEMENTATION DEFINED syndrome information that can be used to provide additional information about the SError interrupt.

Note

This field was previously called ISV.

This field resets to an architecturally UNKNOWN value.

#### Bits [23:14]

Reserved, RES0.

#### IESB, bit [13]
When ARMv8.2-IESB is implemented:

Implicit error synchronization event.

IESB | Meaning
--- | ---
0b0 | The SError interrupt was either not synchronized by the implicit error synchronization event or not taken immediately.
0b1 | The SError interrupt was synchronized by the implicit error synchronization event and taken immediately.

This field is RES0 if the value returned in the DFSC field is not 0b010001.

Note

Armv8.2 requires the implementation of the RAS Extension and ARMv8.2-IESB.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### AET, bits [12:10]

Asynchronous Error Type.

When the RAS Extension is implemented and DFSC is 0b010001, describes the state of the PE after taking the SError interrupt exception. The possible values of this field are:

AET | Meaning
--- | ---
0b000 | Uncontainable error (UC).
0b001 | Unrecoverable error (UEU).
0b010 | Restartable error (UEO).
0b011 | Recoverable error (UER).
0b110 | Corrected error (CE).

All other values are reserved.

If multiple errors are taken as a single SError interrupt exception, the overall state of the PE is reported. For example, if both a Recoverable and Unrecoverable error occurred, the state is Unrecoverable.

Note

Software can use this information to determine what recovery might be possible. The recovery software must also examine any implemented fault records to determine the location and extent of the error.

This field is RES0 if either:

- The RAS Extension is not implemented.
- The value returned in the DFSC field is not 0b010001.

Note

Armv8.2 requires the implementation of the RAS Extension.

This field resets to an architecturally UNKNOWN value.

#### EA, bit [9]

External abort type. When the RAS Extension is implemented, this bit can provide an IMPLEMENTATION DEFINED classification of External aborts.

For any abort other than an External abort this bit returns a value of 0.

This field is RES0 if either:

- The RAS Extension is not implemented.
- The value returned in the DFSC field is not 0b010001.

Note

Armv8.2 requires the implementation of the RAS Extension.

This field resets to an architecturally UNKNOWN value.

#### Bits [8:6]

Reserved, RES0.

#### DFSC, bits [5:0]

Data Fault Status Code. When the RAS Extension is implemented, possible values of this field are:

DFSC | Meaning
--- | ---
0b000000 | Uncategorized.
0b010001 | Asynchronous SError interrupt.

All other values are reserved.

If the RAS Extension is not implemented, this field is RES0.

Note

Armv8.2 requires the implementation of the RAS Extension.

This field resets to an architecturally UNKNOWN value.

### ISS encoding for an exception from a Breakpoint or Vector Catch debug exception.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | IFSC

#### Bits [24:6]

Reserved, RES0.

#### IFSC, bits [5:0]

Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception.

This field resets to an architecturally UNKNOWN value.

For more information about generating these exceptions:

- For exceptions from AArch64, see 'Breakpoint exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D2 (AArch64 Self-hosted Debug).
- For exceptions from AArch32, see 'Breakpoint exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section G2 (AArch32 Self-hosted Debug) and 'Vector Catch exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section G2.

### ISS encoding for an exception from a Software Step exception.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
ISV | RES0 | EX | IFSC

#### ISV, bit [24]

Instruction syndrome valid. Indicates whether the EX bit, ISS[6], is valid, as follows:

ISV | Meaning
--- | ---
0b0 | EX bit is RES0.
0b1 | EX bit is valid.

See the EX bit description for more information.

This field resets to an architecturally UNKNOWN value.

#### Bits [23:7]

Reserved, RES0.

#### EX, bit [6]

Exclusive operation. If the ISV bit is set to 1, this bit indicates whether a Load-Exclusive instruction was stepped.

EX | Meaning
--- | ---
0b0 | An instruction other than a Load-Exclusive instruction was stepped.
0b1 | A Load-Exclusive instruction was stepped.

If the ISV bit is set to 0, this bit is RES0, indicating no syndrome data is available.

This field resets to an architecturally UNKNOWN value.

#### IFSC, bits [5:0]

Instruction Fault Status Code. This field is set to 0b100010, to indicate a Debug exception.

This field resets to an architecturally UNKNOWN value.

For more information about generating these exceptions, see 'Software Step exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D2 (AArch64 Self-hosted Debug).

### ISS encoding for an exception from a Watchpoint exception.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | VNCR | RES0 | CM | RES0 | WnR | DFSC

#### Bits [24:14]

Reserved, RES0.

#### VNCR, bit [13]
When ARMv8.4-NV is implemented:

Indicates that the watchpoint came from use of VNCR_EL2 register by EL1 code.

VNCR | Meaning
--- | ---
0b0 | The watchpoint was not generated by the use of VNCR_EL2 by EL1 code.
0b1 | The watchpoint was generated by the use of VNCR_EL2 by EL1 code.

This field is 0 in ESR_EL1.

This field resets to an architecturally UNKNOWN value.

####
Otherwise:

Reserved, RES0.

#### Bits [12:9]

Reserved, RES0.

#### CM, bit [8]

Cache maintenance. Indicates whether the Watchpoint exception came from a cache maintenance or address translation instruction:

CM | Meaning
--- | ---
0b0 | The Watchpoint exception was not generated by the execution of one of the System instructions identified in the description of value 1.
0b1 | The Watchpoint exception was generated by either the execution of a cache maintenance instruction or by a synchronous Watchpoint exception on the execution of an address translation instruction. The DC ZVA instruction is not classified as a cache maintenance instruction, and therefore its execution cannot cause this field to be set to 1.

This field resets to an architecturally UNKNOWN value.

#### Bit [7]

Reserved, RES0.

#### WnR, bit [6]

Write not Read. Indicates whether the Watchpoint exception was caused by an instruction writing to a memory location, or by an instruction reading from a memory location. The possible values of this bit are:

WnR | Meaning
--- | ---
0b0 | Watchpoint exception caused by an instruction reading from a memory location.
0b1 | Watchpoint exception caused by an instruction writing to a memory location.

For Watchpoint exceptions on cache maintenance and address translation instructions, this bit always returns a value of 1.

For Watchpoint exceptions from an atomic instruction, this field is set to 0 if a read of the location would have generated the Watchpoint exception, otherwise it is set to 1.

If multiple watchpoints match on the same access, it is UNPREDICTABLE which watchpoint generates the Watchpoint exception.

This field resets to an architecturally UNKNOWN value.

#### DFSC, bits [5:0]

Data Fault Status Code. This field is set to 0b100010, to indicate a Debug exception.

This field resets to an architecturally UNKNOWN value.

For more information about generating these exceptions, see 'Watchpoint exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D2 (AArch64 Self-hosted Debug).

### ISS encoding for an exception from execution of a Breakpoint instruction.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | Comment

#### Bits [24:16]

Reserved, RES0.

#### Comment, bits [15:0]

Set to the instruction comment field value, zero extended as necessary. For the AArch32 BKPT instructions, the comment field is described as the immediate field.

This field resets to an architecturally UNKNOWN value.

For more information about generating these exceptions, see 'Breakpoint instruction exceptions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D2 (AArch64 Self-hosted Debug).

### ISS encoding for an exception from ERET, ERETAA or ERETAB instruction.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | ERET | ERETA

This EC value only applies when HCR_EL2.NV is 1.

#### Bits [24:2]

Reserved, RES0.

#### ERET, bit [1]

Indicates whether an ERET or ERETA* instruction was trapped to EL2. Possible values are:

ERET | Meaning
--- | ---
0b0 | ERET instruction trapped to EL2.
0b1 | ERETAA or ERETAB instruction trapped to EL2.

If this bit is 0, the ERETA field is RES0.

This field resets to an architecturally UNKNOWN value.

#### ERETA, bit [0]

Indicates whether an ERETAA or ERETAB instruction was trapped to EL2. Possible values are:

ERETA | Meaning
--- | ---
0b0 | ERETAA instruction trapped to EL2.
0b1 | ERETAB instruction trapped to EL2.

When the ERET field is 0, this bit is RES0.

This field resets to an architecturally UNKNOWN value.

For more information about generating these exceptions, see 'Traps to EL2 for Nested virtualization' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

### ISS encoding for an exception from Branch Target Identification instruction.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0 | BTYPE

#### Bits [24:2]

Reserved, RES0.

#### BTYPE, bits [1:0]

This field is set to the PSTATE.BTYPE value that generated the Branch Target Exception.

For more information about generating these exceptions, see The AArch64 application level programmers' model' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section B1.

### ISS encoding for an exception from a Pointer Authentication instruction when HCR_EL2.API == 0 || SCR_EL3.API == 0.

24 | 23 | 22 | 21 | 20 | 19 | 18 | 17 | 16 | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0
RES0

#### Bits [24:0]

Reserved, RES0.

For more information about generating these exceptions, see:

- 'Trap to EL2 Non-secure EL0 accesses to Pointer authentication key registers' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.
- 'Trap to EL3 accesses to Pointer authentication instructions' in the Arm® Architecture Reference Manual, Armv8, for Armv8-A architecture profile, section D1.

## Accessing the ESR_EL1

When HCR_EL2.E2H is 1, without explicit synchronization, access from EL3 using the mnemonic ESR_EL1 or ESR_EL12 are not guaranteed to be ordered with respect to accesses using the other mnemonic.

Accesses to this register use the following encodings:

#### MRS <Xt>, ESR_EL1

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TRVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then return NVMem[0x138]; else return ESR_EL1; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then return ESR_EL2; else return ESR_EL1; elsif PSTATE.EL == EL3 then return ESR_EL1;

#### MSR ESR_EL1, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b000 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.TVM == '1' then AArch64.SystemAccessTrap(EL2, 0x18); elsif EL2Enabled() && !ELUsingAArch32(EL2) && HCR_EL2.<NV2,NV1,NV> == '111' then NVMem[0x138] = X[t]; else ESR_EL1 = X[t]; elsif PSTATE.EL == EL2 then if HCR_EL2.E2H == '1' then ESR_EL2 = X[t]; else ESR_EL1 = X[t]; elsif PSTATE.EL == EL3 then ESR_EL1 = X[t];

#### MRS <Xt>, ESR_EL12

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then return NVMem[0x138]; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if EL2Enabled() && HCR_EL2.E2H == '1' then return ESR_EL1; else UNDEFINED; elsif PSTATE.EL == EL3 then if EL2Enabled() && HCR_EL2.E2H == '1' then return ESR_EL1; else UNDEFINED;

#### MSR ESR_EL12, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b101 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV1,NV> == '101' then NVMem[0x138] = X[t]; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if EL2Enabled() && HCR_EL2.E2H == '1' then ESR_EL1 = X[t]; else UNDEFINED; elsif PSTATE.EL == EL3 then if EL2Enabled() && HCR_EL2.E2H == '1' then ESR_EL1 = X[t]; else UNDEFINED;

#### MRS <Xt>, ESR_EL2

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then return ESR_EL1; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then return ESR_EL2; elsif PSTATE.EL == EL3 then return ESR_EL2;

#### MSR ESR_EL2, <Xt>

op0 | op1 | CRn | CRm | op2
--- | --- | --- | --- | ---
0b11 | 0b100 | 0b0101 | 0b0010 | 0b000

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EL2Enabled() && HCR_EL2.<NV2,NV> == '11' then ESR_EL1 = X[t]; elsif EL2Enabled() && HCR_EL2.NV == '1' then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then ESR_EL2 = X[t]; elsif PSTATE.EL == EL3 then ESR_EL2 = X[t];

AArch32 Registers | AArch64 Registers | AArch32 Instructions | AArch64 Instructions | Index by Encoding | External Registers | External Registers by Offset | Registers by Functional Group | Proprietary Notice

27/03/2019 21:59; e5e4db499bf9867a4b93324c4dbac985d3da9376

Copyright © 2010-2019 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.