FAR_EL1, Fault Address Register (EL1)

Faulting Virtual Address for synchronous exceptions taken to EL1. Exceptions that set the FAR_EL1 are Instruction Aborts (EC 0x20 or 0x21), Data Aborts (EC 0x24 or 0x25), PC alignment faults (EC 0x22), and Watchpoints (EC 0x34 or 0x35). ESR_EL1.EC holds the EC value for the exception.

For a synchronous External abort:

• If the VA that generated the abort was from an address range for which Address tagging is enabled for the translation regime in use when the abort was generated, then bits[63:56] of FAR_EL1 are UNKNOWN.
• If the VA that generated the abort was from an address range for which Address tagging is disabled and Logical Address Tagging is enabled for the translation regime in use when the abort was generated, then bits[59:56] of FAR_EL1 are UNKNOWN.

For a synchronous External abort other than a synchronous External abort on a translation table walk, this field is valid only if ESR_EL1.FnV is 0, and FAR_EL1 is UNKNOWN if ESR_EL1.FnV is 1.

On an exception due to a Tag Check Fault caused by a data cache maintenance or other DC instruction, the address held in FAR_EL1 is IMPLEMENTATION DEFINED as one of the following:

• The lowest address that gave rise to the fault.
• The address specified in the register argument of the instruction as generated by MMU faults caused by DC ZVA.

If a memory fault that sets FAR_EL1 is generated from an STZGM instruction, the address held in FAR_EL1 is IMPLEMENTATION DEFINED as one of the following:

• The lowest address that gave rise to the fault.
• The address specified in the register argument.

If a memory fault that sets FAR_EL1, other than a Tag Check Fault, is generated from a data cache maintenance or other DC instruction, this field holds the address specified in the register argument of the instruction.

If the exception that updates FAR_EL1 is taken from an Exception level using AArch32, the top 32 bits are all zero, unless both of the following apply, in which case the top 32 bits of FAR_ELx are 0x00000001:

• The faulting address was generated by a load or store instruction that sequentially incremented from address 0xFFFFFFFF. Such a load or store instruction is CONSTRAINED UNPREDICTABLE.
• The implementation treats such incrementing as setting bit[32] of the virtual address to 1.

When the PE sets ESR_EL1.{ISV,FnP} to {0,1} on taking a Data Abort exception, the PE sets FAR_EL1 to any address within the naturally-aligned fault granule that contains the virtual address of the memory access that generated the Data Abort exception.

When the PE sets ESR_EL1.{FnV,FnP} to {0,1} on taking a Watchpoint exception, the PE sets FAR_EL1 to any address within the naturally-aligned fault granule that contains the virtual address of the memory access that generated the Watchpoint exception.

The naturally-aligned fault granule is one of:

• When ESR_EL1.DFSC is 0b010001, indicating a Synchronous Tag Check fault, it is a 16-byte tag granule.
• When ESR_EL1.DFSC is 0b11010x, indicating an IMPLEMENTATION DEFINED fault, it is an IMPLEMENTATION DEFINED granule.
• Otherwise, it is the smallest implemented translation granule.

When FEAT_MOPS is implemented, the value in FAR_EL1 on a synchronous exception from any of the Memory Copy and Memory Set instructions represents the first element that has not been copied or set, and is determined as follows:

• For a Data Abort generated by the MMU, the value is within the address range of the relevant translation granule, aligned to the size of the relevant translation granule of the address that generated the Data Abort. Bits[(n-1):0] of the value are UNKNOWN, where 2ⁿ is the relevant translation granule size in bytes. For the purpose of calculating the relevant translation granule, if the MMU is disabled for a stage of translation, then the current translation granule size is equal to 2⁶⁴ for stage 1, and the PARange for stage 2. The relevant translation granule is:

  • For MMU faults generated at stage 1, the current stage 1 translation granule.
  • For MMU faults generated at stage 2, the smaller of the current stage 1 translation granule and the current stage 2 translation granule.
  • If FEAT_RME is implemented, for a synchronous Data Abort generated as the result of a GPF, the smallest of the current stage 1 translation granule, the current stage 2 translation granule and the configured granule size in GPCCR_EL3.PGS.

• For a Data Abort generated by a Tag Check Fault, the value is any address that caused a Tag Check Fault within the block size of the load or store.

• For a Watchpoint exception, the value is an address range of the size defined by the DCZID_EL0.BS field. This address does not need to be the element with a watchpoint, but can be some earlier element.

• Otherwise, the value is the lowest address in the block size of the load or store.

For a Data Abort exception or Watchpoint exception, if address tagging is enabled for the address accessed by the data access that caused the exception, then this field includes the tag. For more information about address tagging, see 'Address tagging'.

For a synchronous Tag Check Fault:

• If FEAT_MTE_TAGGED_FAR is implemented or Address tagging is disabled for the translation regime in use when the abort was generated, all bits of FAR_EL1 are not UNKNOWN.
• If FEAT_MTE_TAGGED_FAR is not implemented and Address tagging is enabled for the translation regime in use when the abort was generated, bits[63:60] of FAR_EL1 are UNKNOWN.

Execution at EL0 makes FAR_EL1 become UNKNOWN.

For all other exceptions taken to EL1, FAR_EL1 is UNKNOWN.

FAR_EL1 is made UNKNOWN on an exception return from EL1.

The reset behavior of this field is:

• On a Warm reset, this field resets to an architecturally UNKNOWN value.