HPFAR_EL2 Hypervisor IPA Fault Address Register when FEAT_AA64 is implemented HPFAR Architectural AArch32 31 0 31 0 31 0 31 0 Holds the faulting IPA for some aborts on a stage 2 translation taken to EL2 and GPC exceptions due to a fault on an access for a stage 2 translation. Virt Exception If EL2 is not implemented, this register is RES0 from EL3. This register has no effect if EL2 is not enabled in the current Security state. The HPFAR_EL2 is written for: A Translation fault, Access Flag fault, or Address Size fault on a stage 2 translation not on a stage 1 translation table walk. A Translation fault, Access Flag fault, Address Size fault, or Permission fault on stage 2 translation of an address accessed in a stage 1 translation table walk. If FEAT_RME is implemented, a Granule Protection Check fault in the second stage of translation. For all other exceptions taken to EL2, this register is UNKNOWN. The address held in this register is an address accessed by the instruction fetch or data access that caused the exception that gave rise to the Instruction Abort exception or Data Abort exception. It is the lower address that gave rise to the fault that is reported. Where different faults from different addresses arise from the same instruction, such as for an instruction that loads or stores an unaligned address that crosses a page boundary, the architecture does not prioritize which fault is reported. HPFAR_EL2 is a 64-bit register. Execution at EL1 or EL0 makes HPFAR_EL2 become UNKNOWN. NS 63 63 0 Faulting IPA address space. For Data Abort exceptions or Instruction Abort exceptions taken to Non-secure EL2: This field is RES0. The address is from the Non-secure IPA space. If FEAT_RME is implemented, for Data Abort exceptions or Instruction Abort exceptions taken to Realm EL2: This field is RES0. The address is from the Realm IPA space. 0b0 Faulting IPA is from the Secure IPA space. 0b1 Faulting IPA is from the Non-secure IPA space. AU When FEAT_SEL2 is implemented 63 63 63 Reserved, RES0. Otherwise 62 48 62:48 Reserved, RES0. FIPA 47 4 47:4 When FEAT_D128 is implemented FIPA 43 0 43:0 Bits [55:12] of the Faulting Intermediate Physical Address. For implementations with fewer than 55 physical address bits, the corresponding upper bits in this field are RES0. When FEAT_MOPS is implemented, the value presented in FIPA on a synchronous exception that set the HPFAR_EL2 from any of the Memory Copy and Memory Set instructions is within the address range of the current stage 2 translation granule, aligned to the size of the current stage 2 translation granule, of the address that generated the Data abort. In this case, bits[(n-1):0] of the value are UNKNOWN, where 2ⁿ is the current stage 2 translation granule size in bytes. AU When FEAT_D128 is implemented When FEAT_LPA is implemented and FEAT_D128 is not implemented 43 40 43:40 Reserved, RES0. FIPA 39 0 39:0 Bits [51:12] of the Faulting Intermediate Physical Address. For implementations with fewer than 52 physical address bits, the corresponding upper bits in this field are RES0. When FEAT_MOPS is implemented, the value presented in FIPA on a synchronous exception that set the HPFAR_EL2 from any of the Memory Copy and Memory Set instructions is within the address range of the current stage 2 translation granule, aligned to the size of the current stage 2 translation granule, of the address that generated the Data abort. In this case, bits[(n-1):0] of the value are UNKNOWN, where 2ⁿ is the current stage 2 translation granule size in bytes. AU When FEAT_LPA is implemented and FEAT_D128 is not implemented When FEAT_LPA is not implemented 43 36 43:36 Reserved, RES0. FIPA 35 0 35:0 Bits[47:12] Faulting Intermediate Physical Address. For implementations with fewer than 48 physical address bits, the corresponding upper bits in this field are RES0. When FEAT_MOPS is implemented, the value presented in FIPA on a synchronous exception that set the HPFAR_EL2 from any of the Memory Copy and Memory Set instructions is within the address range of the current stage 2 translation granule, aligned to the size of the current stage 2 translation granule, of the address that generated the Data abort. In this case, bits[(n-1):0] of the value are UNKNOWN, where 2ⁿ is the current stage 2 translation granule size in bytes. AU When FEAT_LPA is not implemented 3 0 3:0 Reserved, RES0. MRS <Xt>, HPFAR_EL2 if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then X{64}(t) = HPFAR_EL2(); elsif PSTATE.EL == EL3 then X{64}(t) = HPFAR_EL2(); end; MSR HPFAR_EL2, <Xt> if !IsFeatureImplemented(FEAT_AA64) then Undefined(); elsif PSTATE.EL == EL0 then Undefined(); elsif PSTATE.EL == EL1 then if EffectiveHCR_EL2_NVx() IN {'xx1'} then AArch64_SystemAccessTrap(EL2, 0x18); else Undefined(); end; elsif PSTATE.EL == EL2 then HPFAR_EL2() = X{64}(t); elsif PSTATE.EL == EL3 then HPFAR_EL2() = X{64}(t); end; 2026-03-26 20:27:25 2026-03_rel