一. ESR_ELn1、ESR_ELn结构63 32 31 26 25 0 ---------------------------------------------- | RES0 | EC | ISS | ----------------------------------------------2.ECException Class表示异常类别ARMv8-A 中ESR_ELn.ECException Class异常类别用来描述“为什么进入异常处理”。它位于共6 bit可以表示 0~63 共 64 类异常。EC值名称说明虚拟化常见场景0x00Unknown reason未知异常非法指令、未定义异常0x01Trapped WFI/WFEWFI/WFE 指令异常Guest 等待事件/空闲0x03Trapped MCR/MRC (AArch32)AArch32 CP15访问陷入32位Guest访问系统寄存器0x04Trapped MCRR/MRRC (AArch32)AArch32双寄存器访问陷入32位系统寄存器访问0x05Trapped MCR/MRC (AArch32)AArch32 CP访问协处理器访问0x06Trapped LDC/STC (AArch32)Load/Store协处理器异常较少使用0x07Trapped access to SVESVE访问陷入虚拟化SVE0x0EIllegal Execution State非法执行状态CPU状态错误0x11SVC instruction AArch32Supervisor Call系统调用0x12HVC instruction AArch32Hypervisor CallGuest调用Hypervisor0x13SMC instruction AArch32Secure Monitor CallSecure Monitor调用0x15SVC instruction AArch64AArch64系统调用Linux syscall0x16HVC instruction AArch64AArch64 Hypervisor CallGuest→EL2通信0x17SMC instruction AArch64Secure Monitor CallEL3调用0x18MSR/MRS access trap系统寄存器访问陷入Guest访问EL2控制寄存器0x19SVE instruction trapSVE指令异常SVE虚拟化0x1CPointer Authentication trapPAC异常指针认证0x20Instruction Abort from lower EL低异常级取指异常Guest代码访问异常0x21Instruction Abort from same EL同级取指异常EL2自身异常0x22PC alignment faultPC未对齐指令地址错误0x24Data Abort from lower EL低异常级数据访问异常Guest访问MMIO/内存异常0x25Data Abort from same EL同级数据访问异常EL2自身数据异常0x26SP alignment faultSP栈指针未对齐栈错误0x28FP/SIMD exception浮点异常FP虚拟化0x2CSError interrupt系统错误异常硬件错误0x2FSError interrupt异步系统错误RAS错误处理0x30Breakpoint from lower ELGuest断点调试0x31Breakpoint from same ELEL2断点Hypervisor调试0x32Software Step exception单步调试Debug0x33Watchpoint from lower ELGuest数据观察点调试0x34Watchpoint from same ELEL2观察点调试0x35BKPT instruction AArch32断点指令32位调试0x3CBRK instruction AArch64AArch64断点调试异常/* ESR register */ #define ESR_EC_SHIFT (26UL) /// The shift value for the Exception Class (EC) field within the ESR. #define ESR_EC_LEN (6UL) /// The length (in bits) of the EC field in the ESR. #define ESR_ISS_OFF (0UL) /// The offset for the Exception Specific Syndrome (ISS) field in the ESR. #define ESR_ISS_LEN (25UL) /// The length (in bits) of the ISS field. #define ESR_IL_OFF (25UL) /// The offset for the Illegal Instruction (IL) field in the ESR. It occupies bit position 25. #define ESR_IL_LEN (1UL) /// The length (in bits) of the IL field, indicating whether the instruction was illegal. #define EC_UNKNOWN (0X00UL) /// Unknown exception class. #define EC_WFE_WFI (0x01UL) /// Exception class for WFE or WFI (Wait For Event/Interrupt) instructions. #define EC_CP15_MRC_MCR_32 (0x03UL) /// CP15 MRC/MCR (32-bit), typically related to system control #define EC_CP15_MRRC_MCRR_32 (0x04UL) /// CP15 MRRC/MCRR (32-bit), another type of system control exception. #define EC_CP14_MRC_MCR_32 (0x05UL) /// CP14 MRC/MCR (32-bit), system control for ARMv7 or earlier. #define EC_FP_SIMD (0x07UL) /// Floating-point and SIMD exception. #define EC_CP10_MRC_32 (0x08UL) /// EL2 only #define EC_PAC (0x09UL) /// EL2 and above #define EC_LD64B_ST64B (0x0AUL) /// Exception class for load/store 64-byte instructions. #define EC_CP14_MRRC_MCRR_32 (0x0CUL) /// CP14 MRRC/MCRR (32-bit), another type of exception. #define EC_BTI (0x0DUL) /// BTI (Branch Target Indicator) exception. #define EC_ILLEGAL (0x0EUL) /// Illegal exception class. #define EC_SVC32 (0x11UL) /// Exception caused by the SVC (Supervisor Call) instruction in 32-bit mode. #define EC_HVC32 (0x12UL) /// EL2 only #define EC_SMC32 (0x13UL) /// EL2 and above #define EC_MSRR_MRRS_64 (0x14UL) /// MSRR/MRRS (64-bit) exception. #define EC_SVC64 (0x15UL) /// Exception caused by the SVC (Supervisor Call) instruction in 64-bit mode. #define EC_HVC64 (0x16UL) /// EL2 and above #define EC_SMC64 (0x17UL) /// EL2 and above #define EC_SYS64 (0x18UL) /// System call exception in 64-bit mode. #define EC_SVE (0x19UL) /// Exception caused by SVE (Scalable Vector Extension) instructions. #define EC_ERET (0x1AUL) /// EL2 only #define EC_TME (0x1BUL) /// TME (Transaction Manager Exception) exception. #define EC_FPAC (0x1CUL) /// EL1 and above #define EC_SME (0x1DUL) /// EL1 and above #define EC_RME (0x1EUL) /// EL3 only #define EC_IMP_DEF (0x1FUL) /// EL3 only #define EC_IABT_LOW (0x20UL) /// Instruction Abort (Low Level) #define EC_IABT_CUR (0x21UL) /// Instruction Abort (Current Level) #define EC_PC_ALIGN (0x22UL) /// PC Alignment Exception (indicates a misaligned memory access) #define EC_DABT_LOW (0x24UL) /// Data Abort (Low Level) #define EC_DABT_CUR (0x25UL) /// Data Abort (Current Level) #define EC_SP_ALIGN (0x26UL) /// Stack Pointer Alignment Exception #define EC_MOPS (0x27UL) /// Memory Operations Exception (could represent some form of invalid memory access or operation) #define EC_FP_EXC32 (0x28UL) /// Floating-Point Exception (32-bit precision) #define EC_FP_EXC64 (0x2CUL) /// Floating-Point Exception (64-bit precision) #define EC_GCS_EXC (0x2DUL) /// General Control Status Exception #define EC_SERROR (0x2FUL) /// SError (System Error Exception, often associated with errors in the system) #define EC_BREAKPT_LOW (0x30UL) /// Breakpoint (Low Level) #define EC_BREAKPT_CUR (0x31UL) /// Breakpoint (Current Level) #define EC_SOFTSTP_LOW (0x32UL) /// Software Step (Low Level) #define EC_SOFTSTP_CUR (0x33UL) /// Software Step (Current Level) #define EC_WATCHPT_LOW (0x34UL) /// Watchpoint (Low Level) #define EC_WATCHPT_CUR (0x35UL) /// Watchpoint (Current Level) #define EC_BKPT32 (0x38UL) /// Breakpoint (32-bit precision) #define EC_VECTOR32 (0x3AUL) /// EL2 only #define EC_BKPT64 (0x3CUL) /// Breakpoint (64-bit precision) #define EC_PMU_EXC (0x3DUL) /// Performance Monitoring Unit Exception #define ESR_ISS_DA_DSFC_OFF (0UL) /// The offset for the Data Fault Status Code (DSFC) in the ISS for a Data Abort (DA). #define ESR_ISS_DA_DSFC_LEN (6UL) /// Length of the DSFC field, 6 bits. #define ESR_ISS_DA_WnR_BIT (1UL 6) /// A bit mask for the WnR field (bit 6). #define ESR_ISS_DA_FnV_BIT (1UL 10) /// Bitmask for the Function Not Valid (FnV) field #define ESR_ISS_DA_SF_OFF (15UL) /// Offset for the Storage Fault (SF) field #define ESR_ISS_DA_SF_LEN (1UL) /// Length of the Storage Fault (SF) field #define ESR_ISS_DA_SRT_OFF (16UL) /// Offset for the Source Register (SRT) field #define ESR_ISS_DA_SRT_LEN (5UL) /// Length of the Source Register (SRT) field #define ESR_ISS_DA_SSE_OFF (21UL) /// Offset for the SSE (System Software Exception) field #define ESR_ISS_DA_SSE_LEN (1UL) /// Length of the SSE (System Software Exception) field #define ESR_ISS_DA_SAS_OFF (22UL) /// Offset for the SAS (System Address Space) field #define ESR_ISS_DA_SAS_LEN (2UL) /// Length of the SAS (System Address Space) field #define ESR_ISS_DA_ISV_BIT (1UL 24) /// Bitmask for the Invalid Status Vector (ISV) field #define ESR_ISS_DA_DSFC_TRNSLT (0x4UL) /// Translation fault. #define ESR_ISS_SYSREG_ADDR ((0xfffUL 10) | (0xfUL 1)) /// The system register address mask. #define ESR_ISS_SYSREG_DIR (0x1UL) /// The direction bit for system register access. #define ESR_ISS_SYSREG_REG_OFF (5UL) /// The offset for the system register number. #define ESR_ISS_SYSREG_REG_LEN (5UL) /// The length of the system register number field. #define ESR_ISS_SYSREG_REG2_OFF (10) #define ESR_ISS_SYSREG_REG2_LEN (5)3.ISSInstruction Specific Syndrome详细描述异常ISSInstruction Specific Syndrome用于提供异常相关的详细信息。需要注意的是ISS 并不是固定格式不同类型的异常由 EC 字段决定对应不同的 ISS 位域定义。也就是说EC 决定如何解释 ISSISS 提供该异常发生时的具体上下文信息。例如当 EC HVC Instruction 时ISS 中保存 HVC 指令的立即数Immediate Value当 EC MSR/MRS Trap 时ISS 中保存访问的系统寄存器编号当 EC Data Abort 时ISS 中保存访问方向、访问大小、访问寄存器以及 Fault 原因等信息。在 ARMv8 虚拟化场景中Data Abort 是 Hypervisor 最常处理的异常类型之一尤其是在Stage-2 地址转换失败Guest 访问虚拟设备 MMIOGuest 访问受保护内存区域等场景中Hypervisor 都需要通过解析 Data Abort 对应的 ISS 来完成异常处理。按照 Data Abort ISS 格式解析。其主要字段如下Data Abort ISS 31 25 24 23:22 21 20 16 15 10 9 5 4 0 ---------------------------------------------------------- | RES0 |ISV | SAS |SSE| SRT| ... | AR | DFSC | ----------------------------------------------------------1DFSCData Fault Status Code位置ISS[5:0]作用描述数据访问失败的具体原因。常见类型DFSC类型含义虚拟化场景Translation Fault地址转换失败Guest访问未映射的Stage-2地址Permission Fault权限错误Guest访问只读区域Access Flag Fault访问标志错误页表AF位未设置Alignment Fault地址未对齐非对齐访问2WnRWrite not Read位置ISS[6]作用判断异常访问是读操作还是写操作。值含义0Read1Write3SASSize of Access位置ISS[23:22]作用描述触发异常的访问数据大小。编码SAS访问大小00Byte (8 bit)01Half-word (16 bit)10Word (32 bit)11Double-word (64 bit)4SRTSyndrome Register Transfer位置ISS[20:16]作用指示发生异常的数据访问使用了哪个通用寄存器。5ISVInstruction Syndrome Valid位置ISS[24]作用表示 ISS 中是否包含有效的指令访问信息。当ISV 16SFSixty-Four bit Register Transfer作用表示访问数据宽度SF含义032-bit访问164-bit访问二、FAR_ELnFault Address Register1. FAR_ELnFault Address Register故障地址寄存器ARMv8 为每个异常级维护对应的 FAR 寄存器FAR_EL1 FAR_EL2 FAR_EL3其中FAR_EL1记录进入 EL1 异常处理时的故障地址FAR_EL2记录进入 EL2 异常处理时的故障地址FAR_EL3记录进入 EL3 异常处理时的故障地址。2、HPFAR_EL2Hypervisor IPA Fault Address Register这里需要特别说明HPFAR 不是所有 EL 都有而是 ARMv8 虚拟化扩展提供给 EL2 使用的寄存器。它的作用是在stage2地址翻译时故障记录IPA中间物理地址。 ESR和FAR
一. ESR_ELn1、ESR_ELn结构63 32 31 26 25 0 ---------------------------------------------- | RES0 | EC | ISS | ----------------------------------------------2.ECException Class表示异常类别ARMv8-A 中ESR_ELn.ECException Class异常类别用来描述“为什么进入异常处理”。它位于共6 bit可以表示 0~63 共 64 类异常。EC值名称说明虚拟化常见场景0x00Unknown reason未知异常非法指令、未定义异常0x01Trapped WFI/WFEWFI/WFE 指令异常Guest 等待事件/空闲0x03Trapped MCR/MRC (AArch32)AArch32 CP15访问陷入32位Guest访问系统寄存器0x04Trapped MCRR/MRRC (AArch32)AArch32双寄存器访问陷入32位系统寄存器访问0x05Trapped MCR/MRC (AArch32)AArch32 CP访问协处理器访问0x06Trapped LDC/STC (AArch32)Load/Store协处理器异常较少使用0x07Trapped access to SVESVE访问陷入虚拟化SVE0x0EIllegal Execution State非法执行状态CPU状态错误0x11SVC instruction AArch32Supervisor Call系统调用0x12HVC instruction AArch32Hypervisor CallGuest调用Hypervisor0x13SMC instruction AArch32Secure Monitor CallSecure Monitor调用0x15SVC instruction AArch64AArch64系统调用Linux syscall0x16HVC instruction AArch64AArch64 Hypervisor CallGuest→EL2通信0x17SMC instruction AArch64Secure Monitor CallEL3调用0x18MSR/MRS access trap系统寄存器访问陷入Guest访问EL2控制寄存器0x19SVE instruction trapSVE指令异常SVE虚拟化0x1CPointer Authentication trapPAC异常指针认证0x20Instruction Abort from lower EL低异常级取指异常Guest代码访问异常0x21Instruction Abort from same EL同级取指异常EL2自身异常0x22PC alignment faultPC未对齐指令地址错误0x24Data Abort from lower EL低异常级数据访问异常Guest访问MMIO/内存异常0x25Data Abort from same EL同级数据访问异常EL2自身数据异常0x26SP alignment faultSP栈指针未对齐栈错误0x28FP/SIMD exception浮点异常FP虚拟化0x2CSError interrupt系统错误异常硬件错误0x2FSError interrupt异步系统错误RAS错误处理0x30Breakpoint from lower ELGuest断点调试0x31Breakpoint from same ELEL2断点Hypervisor调试0x32Software Step exception单步调试Debug0x33Watchpoint from lower ELGuest数据观察点调试0x34Watchpoint from same ELEL2观察点调试0x35BKPT instruction AArch32断点指令32位调试0x3CBRK instruction AArch64AArch64断点调试异常/* ESR register */ #define ESR_EC_SHIFT (26UL) /// The shift value for the Exception Class (EC) field within the ESR. #define ESR_EC_LEN (6UL) /// The length (in bits) of the EC field in the ESR. #define ESR_ISS_OFF (0UL) /// The offset for the Exception Specific Syndrome (ISS) field in the ESR. #define ESR_ISS_LEN (25UL) /// The length (in bits) of the ISS field. #define ESR_IL_OFF (25UL) /// The offset for the Illegal Instruction (IL) field in the ESR. It occupies bit position 25. #define ESR_IL_LEN (1UL) /// The length (in bits) of the IL field, indicating whether the instruction was illegal. #define EC_UNKNOWN (0X00UL) /// Unknown exception class. #define EC_WFE_WFI (0x01UL) /// Exception class for WFE or WFI (Wait For Event/Interrupt) instructions. #define EC_CP15_MRC_MCR_32 (0x03UL) /// CP15 MRC/MCR (32-bit), typically related to system control #define EC_CP15_MRRC_MCRR_32 (0x04UL) /// CP15 MRRC/MCRR (32-bit), another type of system control exception. #define EC_CP14_MRC_MCR_32 (0x05UL) /// CP14 MRC/MCR (32-bit), system control for ARMv7 or earlier. #define EC_FP_SIMD (0x07UL) /// Floating-point and SIMD exception. #define EC_CP10_MRC_32 (0x08UL) /// EL2 only #define EC_PAC (0x09UL) /// EL2 and above #define EC_LD64B_ST64B (0x0AUL) /// Exception class for load/store 64-byte instructions. #define EC_CP14_MRRC_MCRR_32 (0x0CUL) /// CP14 MRRC/MCRR (32-bit), another type of exception. #define EC_BTI (0x0DUL) /// BTI (Branch Target Indicator) exception. #define EC_ILLEGAL (0x0EUL) /// Illegal exception class. #define EC_SVC32 (0x11UL) /// Exception caused by the SVC (Supervisor Call) instruction in 32-bit mode. #define EC_HVC32 (0x12UL) /// EL2 only #define EC_SMC32 (0x13UL) /// EL2 and above #define EC_MSRR_MRRS_64 (0x14UL) /// MSRR/MRRS (64-bit) exception. #define EC_SVC64 (0x15UL) /// Exception caused by the SVC (Supervisor Call) instruction in 64-bit mode. #define EC_HVC64 (0x16UL) /// EL2 and above #define EC_SMC64 (0x17UL) /// EL2 and above #define EC_SYS64 (0x18UL) /// System call exception in 64-bit mode. #define EC_SVE (0x19UL) /// Exception caused by SVE (Scalable Vector Extension) instructions. #define EC_ERET (0x1AUL) /// EL2 only #define EC_TME (0x1BUL) /// TME (Transaction Manager Exception) exception. #define EC_FPAC (0x1CUL) /// EL1 and above #define EC_SME (0x1DUL) /// EL1 and above #define EC_RME (0x1EUL) /// EL3 only #define EC_IMP_DEF (0x1FUL) /// EL3 only #define EC_IABT_LOW (0x20UL) /// Instruction Abort (Low Level) #define EC_IABT_CUR (0x21UL) /// Instruction Abort (Current Level) #define EC_PC_ALIGN (0x22UL) /// PC Alignment Exception (indicates a misaligned memory access) #define EC_DABT_LOW (0x24UL) /// Data Abort (Low Level) #define EC_DABT_CUR (0x25UL) /// Data Abort (Current Level) #define EC_SP_ALIGN (0x26UL) /// Stack Pointer Alignment Exception #define EC_MOPS (0x27UL) /// Memory Operations Exception (could represent some form of invalid memory access or operation) #define EC_FP_EXC32 (0x28UL) /// Floating-Point Exception (32-bit precision) #define EC_FP_EXC64 (0x2CUL) /// Floating-Point Exception (64-bit precision) #define EC_GCS_EXC (0x2DUL) /// General Control Status Exception #define EC_SERROR (0x2FUL) /// SError (System Error Exception, often associated with errors in the system) #define EC_BREAKPT_LOW (0x30UL) /// Breakpoint (Low Level) #define EC_BREAKPT_CUR (0x31UL) /// Breakpoint (Current Level) #define EC_SOFTSTP_LOW (0x32UL) /// Software Step (Low Level) #define EC_SOFTSTP_CUR (0x33UL) /// Software Step (Current Level) #define EC_WATCHPT_LOW (0x34UL) /// Watchpoint (Low Level) #define EC_WATCHPT_CUR (0x35UL) /// Watchpoint (Current Level) #define EC_BKPT32 (0x38UL) /// Breakpoint (32-bit precision) #define EC_VECTOR32 (0x3AUL) /// EL2 only #define EC_BKPT64 (0x3CUL) /// Breakpoint (64-bit precision) #define EC_PMU_EXC (0x3DUL) /// Performance Monitoring Unit Exception #define ESR_ISS_DA_DSFC_OFF (0UL) /// The offset for the Data Fault Status Code (DSFC) in the ISS for a Data Abort (DA). #define ESR_ISS_DA_DSFC_LEN (6UL) /// Length of the DSFC field, 6 bits. #define ESR_ISS_DA_WnR_BIT (1UL 6) /// A bit mask for the WnR field (bit 6). #define ESR_ISS_DA_FnV_BIT (1UL 10) /// Bitmask for the Function Not Valid (FnV) field #define ESR_ISS_DA_SF_OFF (15UL) /// Offset for the Storage Fault (SF) field #define ESR_ISS_DA_SF_LEN (1UL) /// Length of the Storage Fault (SF) field #define ESR_ISS_DA_SRT_OFF (16UL) /// Offset for the Source Register (SRT) field #define ESR_ISS_DA_SRT_LEN (5UL) /// Length of the Source Register (SRT) field #define ESR_ISS_DA_SSE_OFF (21UL) /// Offset for the SSE (System Software Exception) field #define ESR_ISS_DA_SSE_LEN (1UL) /// Length of the SSE (System Software Exception) field #define ESR_ISS_DA_SAS_OFF (22UL) /// Offset for the SAS (System Address Space) field #define ESR_ISS_DA_SAS_LEN (2UL) /// Length of the SAS (System Address Space) field #define ESR_ISS_DA_ISV_BIT (1UL 24) /// Bitmask for the Invalid Status Vector (ISV) field #define ESR_ISS_DA_DSFC_TRNSLT (0x4UL) /// Translation fault. #define ESR_ISS_SYSREG_ADDR ((0xfffUL 10) | (0xfUL 1)) /// The system register address mask. #define ESR_ISS_SYSREG_DIR (0x1UL) /// The direction bit for system register access. #define ESR_ISS_SYSREG_REG_OFF (5UL) /// The offset for the system register number. #define ESR_ISS_SYSREG_REG_LEN (5UL) /// The length of the system register number field. #define ESR_ISS_SYSREG_REG2_OFF (10) #define ESR_ISS_SYSREG_REG2_LEN (5)3.ISSInstruction Specific Syndrome详细描述异常ISSInstruction Specific Syndrome用于提供异常相关的详细信息。需要注意的是ISS 并不是固定格式不同类型的异常由 EC 字段决定对应不同的 ISS 位域定义。也就是说EC 决定如何解释 ISSISS 提供该异常发生时的具体上下文信息。例如当 EC HVC Instruction 时ISS 中保存 HVC 指令的立即数Immediate Value当 EC MSR/MRS Trap 时ISS 中保存访问的系统寄存器编号当 EC Data Abort 时ISS 中保存访问方向、访问大小、访问寄存器以及 Fault 原因等信息。在 ARMv8 虚拟化场景中Data Abort 是 Hypervisor 最常处理的异常类型之一尤其是在Stage-2 地址转换失败Guest 访问虚拟设备 MMIOGuest 访问受保护内存区域等场景中Hypervisor 都需要通过解析 Data Abort 对应的 ISS 来完成异常处理。按照 Data Abort ISS 格式解析。其主要字段如下Data Abort ISS 31 25 24 23:22 21 20 16 15 10 9 5 4 0 ---------------------------------------------------------- | RES0 |ISV | SAS |SSE| SRT| ... | AR | DFSC | ----------------------------------------------------------1DFSCData Fault Status Code位置ISS[5:0]作用描述数据访问失败的具体原因。常见类型DFSC类型含义虚拟化场景Translation Fault地址转换失败Guest访问未映射的Stage-2地址Permission Fault权限错误Guest访问只读区域Access Flag Fault访问标志错误页表AF位未设置Alignment Fault地址未对齐非对齐访问2WnRWrite not Read位置ISS[6]作用判断异常访问是读操作还是写操作。值含义0Read1Write3SASSize of Access位置ISS[23:22]作用描述触发异常的访问数据大小。编码SAS访问大小00Byte (8 bit)01Half-word (16 bit)10Word (32 bit)11Double-word (64 bit)4SRTSyndrome Register Transfer位置ISS[20:16]作用指示发生异常的数据访问使用了哪个通用寄存器。5ISVInstruction Syndrome Valid位置ISS[24]作用表示 ISS 中是否包含有效的指令访问信息。当ISV 16SFSixty-Four bit Register Transfer作用表示访问数据宽度SF含义032-bit访问164-bit访问二、FAR_ELnFault Address Register1. FAR_ELnFault Address Register故障地址寄存器ARMv8 为每个异常级维护对应的 FAR 寄存器FAR_EL1 FAR_EL2 FAR_EL3其中FAR_EL1记录进入 EL1 异常处理时的故障地址FAR_EL2记录进入 EL2 异常处理时的故障地址FAR_EL3记录进入 EL3 异常处理时的故障地址。2、HPFAR_EL2Hypervisor IPA Fault Address Register这里需要特别说明HPFAR 不是所有 EL 都有而是 ARMv8 虚拟化扩展提供给 EL2 使用的寄存器。它的作用是在stage2地址翻译时故障记录IPA中间物理地址。