diff mbox

[v5,22/33] target-arm: add TCR_EL3 and make TTBCR banked

Message ID 1412113785-21525-23-git-send-email-greg.bellows@linaro.org
State New
Headers show

Commit Message

Greg Bellows Sept. 30, 2014, 9:49 p.m. UTC 
From: Fabian Aggeler <aggelerf@ethz.ch>

Adds TCR_EL3 system register and makes existing TTBCR banked. Adjust
translation functions to use TCR/TTBCR instance depending on CPU state.

Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
Signed-off-by: Greg Bellows <greg.bellows@linaro.org>

----------
v4 -> v5
- Changed c2_mask updates to use the TTBCR cpreg bank flag for selcting the
  secure bank instead of the A32_BANKED_CURRENT macro.  This more accurately
  chooses the correct bank matching that of the TTBCR being accessed.
---
 target-arm/cpu.h       | 11 ++++++++++-
 target-arm/helper.c    | 48 +++++++++++++++++++++++++++++++++++-------------
 target-arm/internals.h |  2 +-
 3 files changed, 46 insertions(+), 15 deletions(-)

Comments

Edgar E. Iglesias Sept. 30, 2014, 11:18 p.m. UTC | #1 
On Tue, Sep 30, 2014 at 04:49:34PM -0500, Greg Bellows wrote:
> From: Fabian Aggeler <aggelerf@ethz.ch>
> 
> Adds TCR_EL3 system register and makes existing TTBCR banked. Adjust
> translation functions to use TCR/TTBCR instance depending on CPU state.
> 
> Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
> Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
> 
> ----------
> v4 -> v5
> - Changed c2_mask updates to use the TTBCR cpreg bank flag for selcting the
>   secure bank instead of the A32_BANKED_CURRENT macro.  This more accurately
>   chooses the correct bank matching that of the TTBCR being accessed.
> ---
>  target-arm/cpu.h       | 11 ++++++++++-
>  target-arm/helper.c    | 48 +++++++++++++++++++++++++++++++++++-------------
>  target-arm/internals.h |  2 +-
>  3 files changed, 46 insertions(+), 15 deletions(-)
> 
> diff --git a/target-arm/cpu.h b/target-arm/cpu.h
> index c99158e..477c219 100644
> --- a/target-arm/cpu.h
> +++ b/target-arm/cpu.h
> @@ -221,7 +221,16 @@ typedef struct CPUARMState {
>                  uint64_t ttbr1_el1;
>              };
>          };
> -        uint64_t c2_control; /* MMU translation table base control.  */
> +        union { /* MMU translation table base control. */
> +            struct {
> +                uint64_t ttbcr_ns;
> +                uint64_t ttbcr_s;
> +            };
> +            struct {
> +                uint64_t tcr_el1;
> +                uint64_t tcr_el3;
> +            };
> +        };

I was hoping that the aarch64 regs would be arrays (e.g tcr_el[4])...





>          uint32_t c2_mask; /* MMU translation table base selection mask.  */
>          uint32_t c2_base_mask; /* MMU translation table base 0 mask. */
>          uint32_t c2_data; /* MPU data cachable bits.  */
> diff --git a/target-arm/helper.c b/target-arm/helper.c
> index 2a6a129..bdb76e0 100644
> --- a/target-arm/helper.c
> +++ b/target-arm/helper.c
> @@ -1678,11 +1678,12 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
>        .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
>        .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
>        .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
> -      .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
> +      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el1) },
>      { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
>        .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn = vmsa_ttbcr_write,
>        .resetfn = arm_cp_reset_ignore, .raw_writefn = vmsa_ttbcr_raw_write,
> -      .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
> +      .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ttbcr_s),
> +                             offsetoflow32(CPUARMState, cp15.ttbcr_ns) } },
>      /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
>      { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
>        .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
> @@ -2421,6 +2422,11 @@ static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
>        .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 0,
>        .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
>        .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el3) },
> +    { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
> +      .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 2,
> +      .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
> +      .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
> +      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el3) },
>      { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
>        .type = ARM_CP_NO_MIGRATE,
>        .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
> @@ -4515,13 +4521,13 @@ static bool get_level1_table_address(CPUARMState *env, uint32_t *table,
>       * table registers.
>       */
>      if (address & env->cp15.c2_mask) {
> -        if ((env->cp15.c2_control & TTBCR_PD1)) {
> +        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD1) {
>              /* Translation table walk disabled for TTBR1 */
>              return false;
>          }
>          *table = A32_BANKED_CURRENT_REG_GET(env, ttbr1) & 0xffffc000;
>      } else {
> -        if ((env->cp15.c2_control & TTBCR_PD0)) {
> +        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD0) {
>              /* Translation table walk disabled for TTBR0 */
>              return false;
>          }
> @@ -4781,13 +4787,29 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>      int32_t va_size = 32;
>      int32_t tbi = 0;
>      uint32_t cur_el = arm_current_el(env);
> +    uint64_t tcr;
>  
> -    if (arm_el_is_aa64(env, 1)) {
> +    if (arm_el_is_aa64(env, 3)) {
> +        switch (cur_el) {
> +        case 3:
> +            tcr = env->cp15.tcr_el3;
> +            break;
> +        case 1:
> +        case 0:
> +        default:
> +            tcr = env->cp15.tcr_el1;
> +        }
> +
> +    } else {
> +        tcr = A32_BANKED_CURRENT_REG_GET(env, ttbcr);
> +    }
> +
> +    if (arm_el_is_aa64(env, 1) && (cur_el == 0 || cur_el == 1)) {
>          va_size = 64;
>          if (extract64(address, 55, 1))
> -            tbi = extract64(env->cp15.c2_control, 38, 1);
> +            tbi = extract64(tcr, 38, 1);
>          else
> -            tbi = extract64(env->cp15.c2_control, 37, 1);
> +            tbi = extract64(tcr, 37, 1);
>          tbi *= 8;
>      }
>  
> @@ -4796,12 +4818,12 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>       * This is a Non-secure PL0/1 stage 1 translation, so controlled by
>       * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
>       */
> -    uint32_t t0sz = extract32(env->cp15.c2_control, 0, 6);
> +    uint32_t t0sz = extract32(tcr, 0, 6);
>      if (arm_el_is_aa64(env, 1)) {
>          t0sz = MIN(t0sz, 39);
>          t0sz = MAX(t0sz, 16);
>      }
> -    uint32_t t1sz = extract32(env->cp15.c2_control, 16, 6);
> +    uint32_t t1sz = extract32(tcr, 16, 6);
>      if (arm_el_is_aa64(env, 1)) {
>          t1sz = MIN(t1sz, 39);
>          t1sz = MAX(t1sz, 16);
> @@ -4845,10 +4867,10 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>          } else {
>              ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr0);
>          }
> -        epd = extract32(env->cp15.c2_control, 7, 1);
> +        epd = extract32(tcr, 7, 1);
>          tsz = t0sz;
>  
> -        tg = extract32(env->cp15.c2_control, 14, 2);
> +        tg = extract32(tcr, 14, 2);
>          if (tg == 1) { /* 64KB pages */
>              granule_sz = 13;
>          }
> @@ -4857,10 +4879,10 @@ static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
>          }
>      } else {
>          ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr1);
> -        epd = extract32(env->cp15.c2_control, 23, 1);
> +        epd = extract32(tcr, 23, 1);
>          tsz = t1sz;
>  
> -        tg = extract32(env->cp15.c2_control, 30, 2);
> +        tg = extract32(tcr, 30, 2);
>          if (tg == 3)  { /* 64KB pages */
>              granule_sz = 13;
>          }
> diff --git a/target-arm/internals.h b/target-arm/internals.h
> index 43a2e7d..dba7766 100644
> --- a/target-arm/internals.h
> +++ b/target-arm/internals.h
> @@ -155,7 +155,7 @@ static inline bool extended_addresses_enabled(CPUARMState *env)
>  {
>      return arm_el_is_aa64(env, 1)
>          || ((arm_feature(env, ARM_FEATURE_LPAE)
> -             && (env->cp15.c2_control & TTBCR_EAE)));
> +             && (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_EAE)));
>  }
>  
>  /* Valid Syndrome Register EC field values */
> -- 
> 1.8.3.2
>
Greg Bellows Oct. 1, 2014, 1:05 p.m. UTC | #2 
Thanks Edgar.

I'm okay with array notation (I think we agreed to that) as long as we are
okay with the extra padding which should be minor.

I will update the few fields that can and should be arrays.

Greg

On 30 September 2014 18:18, Edgar E. Iglesias <edgar.iglesias@gmail.com>
wrote:

> On Tue, Sep 30, 2014 at 04:49:34PM -0500, Greg Bellows wrote:
> > From: Fabian Aggeler <aggelerf@ethz.ch>
> >
> > Adds TCR_EL3 system register and makes existing TTBCR banked. Adjust
> > translation functions to use TCR/TTBCR instance depending on CPU state.
> >
> > Signed-off-by: Fabian Aggeler <aggelerf@ethz.ch>
> > Signed-off-by: Greg Bellows <greg.bellows@linaro.org>
> >
> > ----------
> > v4 -> v5
> > - Changed c2_mask updates to use the TTBCR cpreg bank flag for selcting
> the
> >   secure bank instead of the A32_BANKED_CURRENT macro.  This more
> accurately
> >   chooses the correct bank matching that of the TTBCR being accessed.
> > ---
> >  target-arm/cpu.h       | 11 ++++++++++-
> >  target-arm/helper.c    | 48
> +++++++++++++++++++++++++++++++++++-------------
> >  target-arm/internals.h |  2 +-
> >  3 files changed, 46 insertions(+), 15 deletions(-)
> >
> > diff --git a/target-arm/cpu.h b/target-arm/cpu.h
> > index c99158e..477c219 100644
> > --- a/target-arm/cpu.h
> > +++ b/target-arm/cpu.h
> > @@ -221,7 +221,16 @@ typedef struct CPUARMState {
> >                  uint64_t ttbr1_el1;
> >              };
> >          };
> > -        uint64_t c2_control; /* MMU translation table base control.  */
> > +        union { /* MMU translation table base control. */
> > +            struct {
> > +                uint64_t ttbcr_ns;
> > +                uint64_t ttbcr_s;
> > +            };
> > +            struct {
> > +                uint64_t tcr_el1;
> > +                uint64_t tcr_el3;
> > +            };
> > +        };
>
> I was hoping that the aarch64 regs would be arrays (e.g tcr_el[4])...
>
>
>
>
>
> >          uint32_t c2_mask; /* MMU translation table base selection
> mask.  */
> >          uint32_t c2_base_mask; /* MMU translation table base 0 mask. */
> >          uint32_t c2_data; /* MPU data cachable bits.  */
> > diff --git a/target-arm/helper.c b/target-arm/helper.c
> > index 2a6a129..bdb76e0 100644
> > --- a/target-arm/helper.c
> > +++ b/target-arm/helper.c
> > @@ -1678,11 +1678,12 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
> >        .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
> >        .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
> >        .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
> > -      .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
> > +      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el1) },
> >      { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 =
> 2,
> >        .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn =
> vmsa_ttbcr_write,
> >        .resetfn = arm_cp_reset_ignore, .raw_writefn =
> vmsa_ttbcr_raw_write,
> > -      .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
> > +      .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ttbcr_s),
> > +                             offsetoflow32(CPUARMState, cp15.ttbcr_ns)
> } },
> >      /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
> >      { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
> >        .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
> > @@ -2421,6 +2422,11 @@ static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
> >        .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 0,
> >        .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
> >        .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el3) },
> > +    { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
> > +      .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 2,
> > +      .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
> > +      .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
> > +      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el3) },
> >      { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
> >        .type = ARM_CP_NO_MIGRATE,
> >        .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
> > @@ -4515,13 +4521,13 @@ static bool get_level1_table_address(CPUARMState
> *env, uint32_t *table,
> >       * table registers.
> >       */
> >      if (address & env->cp15.c2_mask) {
> > -        if ((env->cp15.c2_control & TTBCR_PD1)) {
> > +        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD1) {
> >              /* Translation table walk disabled for TTBR1 */
> >              return false;
> >          }
> >          *table = A32_BANKED_CURRENT_REG_GET(env, ttbr1) & 0xffffc000;
> >      } else {
> > -        if ((env->cp15.c2_control & TTBCR_PD0)) {
> > +        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD0) {
> >              /* Translation table walk disabled for TTBR0 */
> >              return false;
> >          }
> > @@ -4781,13 +4787,29 @@ static int get_phys_addr_lpae(CPUARMState *env,
> target_ulong address,
> >      int32_t va_size = 32;
> >      int32_t tbi = 0;
> >      uint32_t cur_el = arm_current_el(env);
> > +    uint64_t tcr;
> >
> > -    if (arm_el_is_aa64(env, 1)) {
> > +    if (arm_el_is_aa64(env, 3)) {
> > +        switch (cur_el) {
> > +        case 3:
> > +            tcr = env->cp15.tcr_el3;
> > +            break;
> > +        case 1:
> > +        case 0:
> > +        default:
> > +            tcr = env->cp15.tcr_el1;
> > +        }
> > +
> > +    } else {
> > +        tcr = A32_BANKED_CURRENT_REG_GET(env, ttbcr);
> > +    }
> > +
> > +    if (arm_el_is_aa64(env, 1) && (cur_el == 0 || cur_el == 1)) {
> >          va_size = 64;
> >          if (extract64(address, 55, 1))
> > -            tbi = extract64(env->cp15.c2_control, 38, 1);
> > +            tbi = extract64(tcr, 38, 1);
> >          else
> > -            tbi = extract64(env->cp15.c2_control, 37, 1);
> > +            tbi = extract64(tcr, 37, 1);
> >          tbi *= 8;
> >      }
> >
> > @@ -4796,12 +4818,12 @@ static int get_phys_addr_lpae(CPUARMState *env,
> target_ulong address,
> >       * This is a Non-secure PL0/1 stage 1 translation, so controlled by
> >       * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
> >       */
> > -    uint32_t t0sz = extract32(env->cp15.c2_control, 0, 6);
> > +    uint32_t t0sz = extract32(tcr, 0, 6);
> >      if (arm_el_is_aa64(env, 1)) {
> >          t0sz = MIN(t0sz, 39);
> >          t0sz = MAX(t0sz, 16);
> >      }
> > -    uint32_t t1sz = extract32(env->cp15.c2_control, 16, 6);
> > +    uint32_t t1sz = extract32(tcr, 16, 6);
> >      if (arm_el_is_aa64(env, 1)) {
> >          t1sz = MIN(t1sz, 39);
> >          t1sz = MAX(t1sz, 16);
> > @@ -4845,10 +4867,10 @@ static int get_phys_addr_lpae(CPUARMState *env,
> target_ulong address,
> >          } else {
> >              ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr0);
> >          }
> > -        epd = extract32(env->cp15.c2_control, 7, 1);
> > +        epd = extract32(tcr, 7, 1);
> >          tsz = t0sz;
> >
> > -        tg = extract32(env->cp15.c2_control, 14, 2);
> > +        tg = extract32(tcr, 14, 2);
> >          if (tg == 1) { /* 64KB pages */
> >              granule_sz = 13;
> >          }
> > @@ -4857,10 +4879,10 @@ static int get_phys_addr_lpae(CPUARMState *env,
> target_ulong address,
> >          }
> >      } else {
> >          ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr1);
> > -        epd = extract32(env->cp15.c2_control, 23, 1);
> > +        epd = extract32(tcr, 23, 1);
> >          tsz = t1sz;
> >
> > -        tg = extract32(env->cp15.c2_control, 30, 2);
> > +        tg = extract32(tcr, 30, 2);
> >          if (tg == 3)  { /* 64KB pages */
> >              granule_sz = 13;
> >          }
> > diff --git a/target-arm/internals.h b/target-arm/internals.h
> > index 43a2e7d..dba7766 100644
> > --- a/target-arm/internals.h
> > +++ b/target-arm/internals.h
> > @@ -155,7 +155,7 @@ static inline bool
> extended_addresses_enabled(CPUARMState *env)
> >  {
> >      return arm_el_is_aa64(env, 1)
> >          || ((arm_feature(env, ARM_FEATURE_LPAE)
> > -             && (env->cp15.c2_control & TTBCR_EAE)));
> > +             && (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_EAE)));
> >  }
> >
> >  /* Valid Syndrome Register EC field values */
> > --
> > 1.8.3.2
> >
>
diff mbox

Patch

diff --git a/target-arm/cpu.h b/target-arm/cpu.h
index c99158e..477c219 100644
--- a/target-arm/cpu.h
+++ b/target-arm/cpu.h
@@ -221,7 +221,16 @@  typedef struct CPUARMState {
                 uint64_t ttbr1_el1;
             };
         };
-        uint64_t c2_control; /* MMU translation table base control.  */
+        union { /* MMU translation table base control. */
+            struct {
+                uint64_t ttbcr_ns;
+                uint64_t ttbcr_s;
+            };
+            struct {
+                uint64_t tcr_el1;
+                uint64_t tcr_el3;
+            };
+        };
         uint32_t c2_mask; /* MMU translation table base selection mask.  */
         uint32_t c2_base_mask; /* MMU translation table base 0 mask. */
         uint32_t c2_data; /* MPU data cachable bits.  */
diff --git a/target-arm/helper.c b/target-arm/helper.c
index 2a6a129..bdb76e0 100644
--- a/target-arm/helper.c
+++ b/target-arm/helper.c
@@ -1678,11 +1678,12 @@  static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .writefn = vmsa_tcr_el1_write,
       .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
-      .fieldoffset = offsetof(CPUARMState, cp15.c2_control) },
+      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el1) },
     { .name = "TTBCR", .cp = 15, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 2,
       .access = PL1_RW, .type = ARM_CP_NO_MIGRATE, .writefn = vmsa_ttbcr_write,
       .resetfn = arm_cp_reset_ignore, .raw_writefn = vmsa_ttbcr_raw_write,
-      .fieldoffset = offsetoflow32(CPUARMState, cp15.c2_control) },
+      .bank_fieldoffsets = { offsetoflow32(CPUARMState, cp15.ttbcr_s),
+                             offsetoflow32(CPUARMState, cp15.ttbcr_ns) } },
     /* 64-bit FAR; this entry also gives us the AArch32 DFAR */
     { .name = "FAR_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 0,
@@ -2421,6 +2422,11 @@  static const ARMCPRegInfo v8_el3_cp_reginfo[] = {
       .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 0,
       .access = PL3_RW, .writefn = vmsa_ttbr_write, .resetvalue = 0,
       .fieldoffset = offsetof(CPUARMState, cp15.ttbr0_el3) },
+    { .name = "TCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .crn = 2, .crm = 0, .opc1 = 6, .opc2 = 2,
+      .access = PL3_RW, .writefn = vmsa_tcr_el1_write,
+      .resetfn = vmsa_ttbcr_reset, .raw_writefn = raw_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.tcr_el3) },
     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_NO_MIGRATE,
       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
@@ -4515,13 +4521,13 @@  static bool get_level1_table_address(CPUARMState *env, uint32_t *table,
      * table registers.
      */
     if (address & env->cp15.c2_mask) {
-        if ((env->cp15.c2_control & TTBCR_PD1)) {
+        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD1) {
             /* Translation table walk disabled for TTBR1 */
             return false;
         }
         *table = A32_BANKED_CURRENT_REG_GET(env, ttbr1) & 0xffffc000;
     } else {
-        if ((env->cp15.c2_control & TTBCR_PD0)) {
+        if (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_PD0) {
             /* Translation table walk disabled for TTBR0 */
             return false;
         }
@@ -4781,13 +4787,29 @@  static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
     int32_t va_size = 32;
     int32_t tbi = 0;
     uint32_t cur_el = arm_current_el(env);
+    uint64_t tcr;
 
-    if (arm_el_is_aa64(env, 1)) {
+    if (arm_el_is_aa64(env, 3)) {
+        switch (cur_el) {
+        case 3:
+            tcr = env->cp15.tcr_el3;
+            break;
+        case 1:
+        case 0:
+        default:
+            tcr = env->cp15.tcr_el1;
+        }
+
+    } else {
+        tcr = A32_BANKED_CURRENT_REG_GET(env, ttbcr);
+    }
+
+    if (arm_el_is_aa64(env, 1) && (cur_el == 0 || cur_el == 1)) {
         va_size = 64;
         if (extract64(address, 55, 1))
-            tbi = extract64(env->cp15.c2_control, 38, 1);
+            tbi = extract64(tcr, 38, 1);
         else
-            tbi = extract64(env->cp15.c2_control, 37, 1);
+            tbi = extract64(tcr, 37, 1);
         tbi *= 8;
     }
 
@@ -4796,12 +4818,12 @@  static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
      * This is a Non-secure PL0/1 stage 1 translation, so controlled by
      * TTBCR/TTBR0/TTBR1 in accordance with ARM ARM DDI0406C table B-32:
      */
-    uint32_t t0sz = extract32(env->cp15.c2_control, 0, 6);
+    uint32_t t0sz = extract32(tcr, 0, 6);
     if (arm_el_is_aa64(env, 1)) {
         t0sz = MIN(t0sz, 39);
         t0sz = MAX(t0sz, 16);
     }
-    uint32_t t1sz = extract32(env->cp15.c2_control, 16, 6);
+    uint32_t t1sz = extract32(tcr, 16, 6);
     if (arm_el_is_aa64(env, 1)) {
         t1sz = MIN(t1sz, 39);
         t1sz = MAX(t1sz, 16);
@@ -4845,10 +4867,10 @@  static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
         } else {
             ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr0);
         }
-        epd = extract32(env->cp15.c2_control, 7, 1);
+        epd = extract32(tcr, 7, 1);
         tsz = t0sz;
 
-        tg = extract32(env->cp15.c2_control, 14, 2);
+        tg = extract32(tcr, 14, 2);
         if (tg == 1) { /* 64KB pages */
             granule_sz = 13;
         }
@@ -4857,10 +4879,10 @@  static int get_phys_addr_lpae(CPUARMState *env, target_ulong address,
         }
     } else {
         ttbr = A32_BANKED_CURRENT_REG_GET(env, ttbr1);
-        epd = extract32(env->cp15.c2_control, 23, 1);
+        epd = extract32(tcr, 23, 1);
         tsz = t1sz;
 
-        tg = extract32(env->cp15.c2_control, 30, 2);
+        tg = extract32(tcr, 30, 2);
         if (tg == 3)  { /* 64KB pages */
             granule_sz = 13;
         }
diff --git a/target-arm/internals.h b/target-arm/internals.h
index 43a2e7d..dba7766 100644
--- a/target-arm/internals.h
+++ b/target-arm/internals.h
@@ -155,7 +155,7 @@  static inline bool extended_addresses_enabled(CPUARMState *env)
 {
     return arm_el_is_aa64(env, 1)
         || ((arm_feature(env, ARM_FEATURE_LPAE)
-             && (env->cp15.c2_control & TTBCR_EAE)));
+             && (A32_BANKED_CURRENT_REG_GET(env, ttbcr) & TTBCR_EAE)));
 }
 
 /* Valid Syndrome Register EC field values */