CA72 can't access ICC_IAR1_EL1 at EL1

I can access ICC_IAR1_EL1 at EL3 using SP_EL0, however, after I switch EL3 to EL1 non-secure, I can't read IIC_IAR1_EL1 anymore, which doesn't make sense. 

Can anybody help here? much appreciated.  

__func__011000 EC=MSR, MRS, or System instruction, that isn't reported using EC 0x00/0x01/0x07Unhandled exception 0x18(24) from CA72_0 to CA72_0
EXC number:0x00000018
EXC class: 0x00000018
FaultReg: 0x00000000
StatusPrg: 0x80000005
PC: 0x00000000 0xA0007F78
FaultReg: 0xD538CC00
StatusPrg: 0x00303019
Exception class is MSR_MRS
These report exceptions from MSR, MRS, or System instructions
Instruction syndrome MSR/MRS:
Op0: 0x00000000
Op2: 0x00000000
Op1: 0x00000000
CRn: 0x00000000
Rt : 0x00000000
CRm: 0x00000018
dir: 0x00000001