Query regarding extracting instruction which caused a data-abort exception

Hello I am trying to modify genode trustzone. I want to read the instruction which lead to data abort exception in normal world, in the `dump` function in tz_vmm. I have value of all the registers through `_state` register. We tried with `_state->ip`. On converting 16 bits stored at the address pointed by _state->ip, we got ARM Thumb instruction:

STRH R0, [R0, #6]

But the value (R0) + 6, doesn't match dfar. We're not sure if _state->ip is the register to go with. We tried with _state->mode[2].lr which is lr_abt register. But the address stored in lr_abt, lr_abt-16, lr_abt-32 all have 0s.

Which is right register to get the address of the instruction which caused the data-abort exception?

Thanks Abhishek