← Home

MDCR_EL2: Monitor Debug Configuration Register (EL2)

Purpose

Provides EL2 configuration options for self-hosted debug and the Performance Monitors Extension.

Configuration

AArch64 System register MDCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register HDCR[31:0].

If EL2 is not implemented, this register is RES0 from EL3.

This register has no effect if EL2 is not enabled in the current Security state.

Attributes

MDCR_EL2 is a 64-bit register.

Field descriptions

6362616059585756555453525150494847464544434241403938373635343332
313029282726252423222120191817161514131211109876543210
RES0EnSTEPOPRES0EBWERES0PMEERES0HPMFZSRES0
PMSSEHPMFZOMTPMETDCCHLPE2TBHCCDRES0TTRFRES0HPMDRES0EnSPMTPMSE2PBTDRATDOSATDATDEHPMETPMTPMCRHPMN

Bits [63:51]

Reserved, RES0.

EnSTEPOP, bit [50]

When FEAT_STEP2 is implemented:

EnSTEPOPMeaning
0b0

Execution from MDSTEPOP_EL1 is disabled.

0b1

Execution from MDSTEPOP_EL1 is not disabled by this control.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b1, other than for a direct read of the register.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bits [49:44]

Reserved, RES0.

EBWE, bit [43]

When FEAT_Debugv8p9 is implemented:

Extended Breakpoint and Watchpoint Enable. Enables use of additional breakpoints or watchpoints.

EBWEMeaning
0b0

The Effective value of MDSCR_EL1.EMBWE is 0.

The Effective value of MDSELR_EL1.BANK is zero at EL2.

0b1

The Effective values of MDSCR_EL1.EMBWE and MDSELR_EL1.BANK are not affected by this field.

It is IMPLEMENTATION DEFINED whether this field is implemented or is RES0 when 16 or fewer breakpoints are implemented, 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 1, other than for a direct read of the register.

This field is ignored by the PE and treated as 0 when EL3 is implemented and MDCR_EL3.EBWE is 0.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bit [42]

Reserved, RES0.

PMEE, bits [41:40]

When FEAT_EBEP is implemented:

Performance Monitors Exception Enable. Controls the generation of PMUIRQ signal and PMU exception at EL0, EL1, and EL2.

PMEEMeaning
0b00

PMUIRQ signal is enabled, and PMU exception is disabled.

0b01

PMUIRQ signal and PMU exception are both controlled by PMECR_EL1.PMEE.

0b10

PMUIRQ signal is disabled, and PMU exception is disabled.

0b11

PMUIRQ signal is disabled, and PMU exception is enabled.

If EL2 is not implemented or EL2 is disabled in the current Security state, then the Effective value of this field is 0b01, other than for a direct read of the register.

This field is ignored by the PE when all of the following are true:

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bits [39:37]

Reserved, RES0.

HPMFZS, bit [36]

When FEAT_SPEv1p2 is implemented:

Hyp Performance Monitors Freeze-on-SPE event. Stop counters when PMBLIMITR_EL1.{PMFZ, E} == {1, 1} and PMBSR_EL1.S == 1.

HPMFZSMeaning
0b0

Do not freeze on a Statistical Profiling Buffer Management event.

0b1

Affected counters do not count following a Statistical Profiling Buffer Management event.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bits [35:32]

Reserved, RES0.

PMSSE, bits [31:30]

When FEAT_PMUv3_SS is implemented:

Performance Monitors Snapshot Enable. Controls the generation of Capture events.

PMSSEMeaning
0b00

Capture events are disabled.

0b01

Capture events are controlled by PMECR_EL1.SSE.

0b10

Capture events are enabled and prohibited.

0b11

Capture events are enabled and allowed.

If EL2 is not implemented, then the Effective value of this field is 0b01.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

HPMFZO, bit [29]

When FEAT_PMUv3p7 is implemented:

Hyp Performance Monitors Freeze-on-overflow. Stop event counters on overflow.

HPMFZOMeaning
0b0

Do not freeze on overflow.

0b1

Affected counters do not count when all the following are true for any value of m greater than or equal to MDCR_EL2.HPMN:

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

MTPME, bit [28]

When FEAT_MTPMU is implemented and EL3 is not implemented:

Multi-threaded PMU Enable. Enables use of the PMEVTYPER<n>_EL0.MT bits.

MTPMEMeaning
0b0

FEAT_MTPMU is disabled. The Effective value of PMEVTYPER<n>_EL0.MT is 0.

0b1

PMEVTYPER<n>_EL0.MT bits not affected by this field.

If FEAT_MTPMU is disabled for any other PE in the system that has the same level 1 Affinity as the PE, it is IMPLEMENTATION DEFINED whether the PE behaves as if this field is 0.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

TDCC, bit [27]

When FEAT_FGT is implemented:

Trap DCC. Traps use of the Debug Comms Channel at EL1 and EL0 to EL2.

TDCCMeaning
0b0

This control does not cause any register accesses to be trapped.

0b1

If EL2 is implemented and enabled in the current Security state, accesses to the DCC registers at EL1 and EL0 generate a Trap exception to EL2, unless the access also generates a higher priority exception.

Traps on the DCC data transfer registers are ignored when the PE is in Debug state.

The DCC registers trapped by this control are:

AArch64: OSDTRRX_EL1, OSDTRTX_EL1, MDCCSR_EL0, MDCCINT_EL1, and, when the PE is in Non-debug state, DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXext, DBGDTRTXext, DBGDSCRint, DBGDCCINT, and, when the PE is in Non-debug state, DBGDTRRXint and DBGDTRTXint.

The traps are reported with EC syndrome value:

When the PE is in Debug state, MDCR_EL2.TDCC does not trap any accesses to:

AArch64: DBGDTR_EL0, DBGDTRRX_EL0, and DBGDTRTX_EL0.

AArch32: DBGDTRRXint and DBGDTRTXint.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

HLP, bit [26]

When FEAT_PMUv3p5 is implemented:

Hypervisor Long Event Counter Enable. Determines which event counter bit generates an overflow recorded by PMOVSR[n].

HLPMeaning
0b0

Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[31:0].

0b1

Affected counters overflow on increment that causes unsigned overflow of PMEVCNTR<n>_EL0[63:0].

When FEAT_EBEP is implemented and the PMU exception is enabled, the Effective value of this field is 1.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

For more information see the description of MDCR_EL2.HPMN.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

E2TB, bits [25:24]

When FEAT_TRBE is implemented:

EL2 Trace Buffer.

If EL2 is implemented and enabled in the Trace Buffer owning Security state, controls the owning translation regime.

If EL2 is implemented and enabled in the current Security state, controls access to Trace Buffer control registers from EL1.

E2TBMeaning
0b00

If EL2 is implemented and enabled in the Trace Buffer owning Security state, then the Trace Buffer owning Exception level is EL2. Otherwise, the Trace Buffer owning Exception level is EL1 and, if TraceBufferEnabled() == TRUE, tracing is prohibited at EL2.

If EL2 is implemented and enabled in the current Security state, accesses to Trace Buffer control registers at EL1 generate a Trap exception to EL2.

0b10

Trace Buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2.

If EL2 is implemented and enabled in the current Security state, accesses to Trace Buffer control registers at EL1 generate a Trap exception to EL2.

0b11

Trace Buffer owning Exception level is EL1. If TraceBufferEnabled() == TRUE, then tracing is prohibited at EL2.

All other values are reserved.

In AArch64 state, the instructions affected by this control are:

Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL2.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

HCCD, bit [23]

When FEAT_PMUv3p5 is implemented:

Hypervisor Cycle Counter Disable. Prohibits PMCCNTR_EL0 from counting at EL2.

HCCDMeaning
0b0

Cycle counting by PMCCNTR_EL0 is not affected by this mechanism.

0b1

Cycle counting by PMCCNTR_EL0 is prohibited at EL2.

This field does not affect the CPU_CYCLES event or any other event that counts cycles.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bits [22:20]

Reserved, RES0.

TTRF, bit [19]

When FEAT_TRF is implemented:

Traps use of the Trace Filter Control registers at EL1 to EL2, as follows:

TTRFMeaning
0b0

Accesses to the specified registers at EL1 are not affected by this control.

0b1

Accesses to the specified registers at EL1 generate a trap exception to EL2 when EL2 is enabled in the current Security state.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bit [18]

Reserved, RES0.

HPMD, bit [17]

When FEAT_PMUv3p1 is implemented and FEAT_Debugv8p2 is implemented:

Guest Performance Monitors Disable. Controls PMU operation at EL2.

HPMDMeaning
0b0

Counters are not affected by this mechanism.

0b1

Affected counters are prohibited from counting at EL2.

If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

The counters affected by this field are:

Other event counters are not affected by this field.

When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

The reset behavior of this field is:



When FEAT_PMUv3p1 is implemented:

Guest Performance Monitors Disable. Controls PMU operation at EL2 when ExternalSecureNoninvasiveDebugEnabled() is FALSE.

HPMDMeaning
0b0

Counters are not affected by this mechanism.

0b1

If ExternalSecureNoninvasiveDebugEnabled() is FALSE then all the following apply:

  • Affected event counters are prohibited from counting at EL2.
  • If PMCR_EL0.DP is 1, then PMCCNTR_EL0 is disabled at EL2. Otherwise, PMCCNTR_EL0 is not affected by this mechanism.

If ExternalSecureNoninvasiveDebugEnabled() is TRUE then the event counters and PMCCNTR_EL0 are not affected by this field.

Otherwise, the counters affected by this field are:

Other event counters are not affected by this field. When PMCR_EL0.DP is 0, PMCCNTR_EL0 is not affected by this field.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Bit [16]

Reserved, RES0.

EnSPM, bit [15]

When FEAT_SPMU is implemented:

Enable access to System PMU registers. When disabled, accesses to System PMU registers generate a trap to EL2.

EnSPMMeaning
0b0

Accesses of the specified System PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

0b1

Accesses of the specified System PMU registers are not trapped by this mechanism.

In AArch64 state, the instructions affected by this control are: MRS and MSR accesses to SPMACCESSR_EL1, SPMCFGR_EL1, SPMCGCR<n>_EL1, SPMCNTENCLR_EL0, SPMCNTENSET_EL0, SPMCR_EL0, SPMDEVAFF_EL1, SPMDEVARCH_EL1, SPMEVCNTR<n>_EL0, SPMEVFILT2R<n>_EL0, SPMEVFILTR<n>_EL0, SPMEVTYPER<n>_EL0, SPMIIDR_EL1, SPMINTENCLR_EL1, SPMINTENSET_EL1, SPMOVSCLR_EL0, SPMOVSSET_EL0, SPMSCR_EL1, and SPMSELR_EL0.

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

TPMS, bit [14]

When FEAT_SPE is implemented:

Trap Performance Monitor Sampling. Enables a trap to EL2 on accesses of SPE registers.

TPMSMeaning
0b0

Accesses of the specified SPE registers are not trapped by this mechanism.

0b1

Accesses of the specified SPE registers at EL1 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

Trapped instructions are reported using EC syndrome value 0x18.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

E2PB, bits [13:12]

When FEAT_SPE is implemented:

EL2 Profiling Buffer. If EL2 is implemented and enabled in the Profiling Buffer owning Security state, this field controls the owning translation regime. If EL2 is implemented and enabled in the current Security state, this field controls access to Profiling Buffer control registers from EL1.

E2PBMeaning
0b00

If EL2 is implemented and enabled in the Profiling Buffer owning Security state, the Profiling Buffer uses the EL2 or EL2&0 stage 1 translation regime. Otherwise the Profiling Buffer uses the EL1&0 stage 1 translation regime.

If EL2 is implemented and enabled in the current Security state, accesses to Profiling Buffer control registers at EL1 generate a Trap exception to EL2.

0b10

Profiling Buffer uses the EL1&0 stage 1 translation regime. If EL2 is implemented and enabled in the current Security state, accesses to Profiling Buffer control registers at EL1 generate a Trap exception to EL2.

0b11

Profiling Buffer uses the EL1&0 stage 1 translation regime. Accesses to Profiling Buffer control registers at EL1 are not trapped to EL2.

All other values are reserved.

The Profiling Buffer control registers trapped by this control are: PMBLIMITR_EL1, PMBPTR_EL1, and PMBSR_EL1.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

TDRA, bit [11]

Trap Debug ROM Address register access. Traps System register accesses to the Debug ROM registers to EL2 when EL2 is enabled in the current Security state as follows:

TDRAMeaning
0b0

This control does not cause any instructions to be trapped.

0b1

EL0 and EL1 System register accesses to the Debug ROM registers are trapped to EL2 when EL2 is enabled in the current Security state, unless it is trapped by the following:

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

Note

EL2 does not provide traps on debug register accesses through the optional memory-mapped external debug interfaces.

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:

TDOSA, bit [10]

When FEAT_DoubleLock is implemented:

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states as follows:

TDOSAMeaning
0b0

This control does not cause any instructions to be trapped.

0b1

EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

Note

These registers are not accessible at EL0.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:



Otherwise:

Trap debug OS-related register access. Traps EL1 System register accesses to the powerdown debug registers to EL2, from both Execution states as follows:

It is IMPLEMENTATION DEFINED whether accesses to OSDLR_EL1 are trapped.

It is IMPLEMENTATION DEFINED whether accesses to DBGOSDLR are trapped.

TDOSAMeaning
0b0

This control does not cause any instructions to be trapped.

0b1

EL1 System register accesses to the powerdown debug registers are trapped to EL2 when EL2 is enabled in the current Security state.

Note

These registers are not accessible at EL0.

This field is treated as being 1 for all purposes other than a direct read when one or more of the following are true:

Note

EL2 does not provide traps on debug register accesses through the optional memory-mapped external debug interfaces.

System register accesses to the debug registers might have side-effects. When a System register access is trapped to EL2, no side-effects occur before the exception is taken to EL2.

The reset behavior of this field is:

TDA, bit [9]

Trap accesses of debug System registers. Enables a trap to EL2 on accesses of debug System registers.

TDAMeaning
0b0

Accesses of the specified debug System registers are not trapped by this mechanism.

0b1

Accesses of the specified debug System registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

In AArch32 state, the instructions affected by this control are:

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x05 for MRC and MCR accesses, and 0x06 for LDC and STC accesses.

The following instructions are not trapped in Debug state:

If 16 or fewer breakpoints and 16 or fewer watchpoints are implemented, and MDSELR_EL1 is implemented as RAZ/WI, then it is IMPLEMENTATION DEFINED whether AArch64 accesses to MDSELR_EL1 are trapped to EL2 when MDCR_EL2.TDA is 1.

This field is ignored by the PE and treated as one when any of the following are true:

The reset behavior of this field is:

TDE, bit [8]

Trap Debug Exceptions. Controls routing of Debug exceptions, and defines the debug target Exception level, ELD.

TDEMeaning
0b0

The debug target Exception level is EL1.

0b1

If EL2 is enabled for the current Effective value of SCR_EL3.NS, the debug target Exception level is EL2, otherwise the debug target Exception level is EL1.

The MDCR_EL2.{TDRA, TDOSA, TDA} fields are treated as being 1 for all purposes other than returning the result of a direct read of the register.

For more information, see 'Routing debug exceptions'.

This field is treated as being 1 for all purposes other than a direct read when HCR_EL2.TGE == 1.

The reset behavior of this field is:

HPME, bit [7]

When FEAT_PMUv3 is implemented:

Hyp Enable.

HPMEMeaning
0b0

Affected counters are disabled and do not count.

0b1

Affected counters are enabled by PMCNTENSET_EL0.

The counters affected by this field are event counters PMEVCNTR<n>_EL0 for values of n greater than or equal to MDCR_EL2.HPMN and less than PMCR_EL0.N. This applies even when EL2 is disabled in the current Security state.

Other event counters, PMCCNTR_EL0, and, if FEAT_PMUv3_ICNTR is implemented, PMICNTR_EL0 are not affected by this field.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then this field has no effect.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

TPM, bit [6]

When FEAT_PMUv3 is implemented:

Trap accesses of PMU registers. Enables a trap to EL2 on accesses of PMU registers.

TPMMeaning
0b0

Accesses of the specified PMU registers are not trapped by this mechanism.

0b1

Accesses of the specified PMU registers at EL1 and EL0 are trapped to EL2, unless the instruction generates a higher priority exception.

In AArch64 state, the instructions affected by this control are:

In AArch32 state, the instructions affected by this control are:

Trapped AArch64 instructions are reported using EC syndrome value 0x18.

Trapped AArch32 instructions are reported using EC syndrome value 0x03 for MRC and MCR accesses, and 0x04 for MRRC and MCRR accesses.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

TPMCR, bit [5]

When FEAT_PMUv3 is implemented:

Trap PMCR_EL0 or PMCR accesses. Traps EL0 and EL1 accesses to EL2, when EL2 is enabled in the current Security state, as follows:

TPMCRMeaning
0b0

This control does not cause any instructions to be trapped.

0b1

EL0 and EL1 accesses to the specified registers are trapped to EL2 when EL2 is enabled in the current Security state, unless they are trapped by the following:

Note

EL2 does not provide traps on Performance Monitor register accesses through the optional memory-mapped external debug interface.

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

HPMN, bits [4:0]

When FEAT_PMUv3 is implemented:

Defines the number of event counters PMEVCNTR<n>_EL0 and, if FEAT_PMUv3_SS is implemented, snapshot registers PMEVCNTSVR<n>_EL1, that are accessible from EL1 and from EL0 if permitted.

MDCR_EL2.HPMN divides the event counters into a first range and a second range.

If MDCR_EL2.HPMN is not 0 and is less than PMCR_EL0.N, then event counters [0..(MDCR_EL2.HPMN-1)] are in the first range, and the remaining event counters [MDCR_EL2.HPMN..(PMCR_EL0.N-1)] are in the second range.

If FEAT_HPMN0 is implemented and MDCR_EL2.HPMN is 0, then all event counters are in the second range and none are in the first range.

If MDCR_EL2.HPMN is equal to PMCR_EL0.N, then all event counters are in the first range and none are in the second range.

For an event counter PMEVCNTR<n>_EL0 in the first range:

For an event counter PMEVCNTR<n>_EL0 in the second range:

If FEAT_PMUv3_SS is implemented:

Values greater than PMCR_EL0.N are reserved. If FEAT_HPMN0 is not implemented then the value 0 is reserved.

If this field is set to a reserved value, then the following CONSTRAINED UNPREDICTABLE behaviors apply:

The reset behavior of this field is:



Otherwise:

Reserved, RES0.

Accessing MDCR_EL2

Accesses to this register use the following encodings in the System register encoding space:

MRS <Xt>, MDCR_EL2

op0op1CRnCRmop2
0b110b1000b00010b00010b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && MDCR_EL3.TDA == '1' then UNDEFINED; elsif HaveEL(EL3) && MDCR_EL3.TDA == '1' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x18); else X[t, 64] = MDCR_EL2; elsif PSTATE.EL == EL3 then X[t, 64] = MDCR_EL2;

MSR MDCR_EL2, <Xt>

op0op1CRnCRmop2
0b110b1000b00010b00010b001

if PSTATE.EL == EL0 then UNDEFINED; elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64.SystemAccessTrap(EL2, 0x18); else UNDEFINED; elsif PSTATE.EL == EL2 then if HaveEL(EL3) && EL3SDDUndefPriority() && MDCR_EL3.TDA == '1' then UNDEFINED; elsif HaveEL(EL3) && MDCR_EL3.TDA == '1' then if EL3SDDUndef() then UNDEFINED; else AArch64.SystemAccessTrap(EL3, 0x18); else MDCR_EL2 = X[t, 64]; elsif PSTATE.EL == EL3 then MDCR_EL2 = X[t, 64];