The TLBTR register (encoding cp15, 0, c0, c0, 3) is listed in the v7A
Arm ARM appendix O as being present in v4 and v5 (section O.7.1,
diagram "Organization of CP15 registers in an ARMv4 or ARMv5 VMSA
implementation").  However, it isn't listed in the v5 Arm ARM, and
checking individual TRMs for the arm926, arm1026, sa1100, sa1110 and
ti925 shows that none of them implement it, so it seems much more
likely that TLBTR was new for v6.  It's also confirmed not to be
present on a real arm926.

Gate the register on ARM_FEATURE_V6 being present; this means that on
pre-v6 cores the encoding will fall back to reporting the MIDR (due
to the CP_ANY wildcarding), matching the hardware behaviour.

We can also remove the "make id_tlbtr_reginfo r/w for strongarm and
omap" code, because those CPUs are pre-v6 so won't be using that
reginfo struct now.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4207
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index af45234ad2a..db7a0c55380 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7290,7 +7290,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
                 id_cp_reginfo[i].access = PL1_RW;
             }
             id_mpuir_reginfo.access = PL1_RW;
-            id_tlbtr_reginfo.access = PL1_RW;
         }
         if (arm_feature(env, ARM_FEATURE_V8)) {
             define_arm_cp_regs(cpu, id_v8_midr_cp_reginfo);
@@ -7301,7 +7300,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             define_arm_cp_regs(cpu, id_pre_v8_midr_cp_reginfo);
         }
         define_arm_cp_regs(cpu, id_cp_reginfo);
-        if (!arm_feature(env, ARM_FEATURE_PMSA)) {
+        if (arm_feature(env, ARM_FEATURE_V6) &&
+            !arm_feature(env, ARM_FEATURE_PMSA)) {
             define_one_arm_cp_reg(cpu, &id_tlbtr_reginfo);
         } else if (arm_feature(env, ARM_FEATURE_PMSA) &&
                    arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.43.0

On 8/21/26 05:00, Peter Maydell wrote:
> The TLBTR register (encoding cp15, 0, c0, c0, 3) is listed in the v7A
> Arm ARM appendix O as being present in v4 and v5 (section O.7.1,
> diagram "Organization of CP15 registers in an ARMv4 or ARMv5 VMSA
> implementation").  However, it isn't listed in the v5 Arm ARM, and
> checking individual TRMs for the arm926, arm1026, sa1100, sa1110 and
> ti925 shows that none of them implement it, so it seems much more
> likely that TLBTR was new for v6.  It's also confirmed not to be
> present on a real arm926.
> 
> Gate the register on ARM_FEATURE_V6 being present; this means that on
> pre-v6 cores the encoding will fall back to reporting the MIDR (due
> to the CP_ANY wildcarding), matching the hardware behaviour.
> 
> We can also remove the "make id_tlbtr_reginfo r/w for strongarm and
> omap" code, because those CPUs are pre-v6 so won't be using that
> reginfo struct now.
> 
> Resolves:https://gitlab.com/qemu-project/qemu/-/work_items/4207
> Signed-off-by: Peter Maydell<peter.maydell@linaro.org>
> ---
>   target/arm/helper.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~