diff --git a/target/arm/helper.c b/target/arm/helper.c
index 568a834a96..b6de6a7414 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8624,27 +8624,32 @@ void register_cp_regs_for_features(ARMCPU *cpu)
           CAPRESETVALUE(max_cap) },
         { .name = "DDC_EL0", .state = ARM_CP_STATE_AA64,
           .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 1, .opc2 = 1,
-          .access = PL1_RW | PL_NO_SYSREG, .type = ARM_CP_CAP_ONLY,
+          .access = PL1_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
+          .type = ARM_CP_CAP_ONLY,
           .fieldoffset = offsetof(CPUARMState, DDCs[0]),
           CAPRESETVALUE(max_cap) },
         { .name = "DDC_EL1", .state = ARM_CP_STATE_AA64,
           .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 1, .opc2 = 1,
-          .access = PL2_RW | PL_NO_SYSREG, .type = ARM_CP_CAP_ONLY,
+          .access = PL2_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
+          .type = ARM_CP_CAP_ONLY,
           .fieldoffset = offsetof(CPUARMState, DDCs[1]),
           CAPRESETVALUE(max_cap) },
         { .name = "DDC_EL2", .state = ARM_CP_STATE_AA64,
           .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 1, .opc2 = 1,
-          .access = PL3_RW | PL_NO_SYSREG, .type = ARM_CP_CAP_ONLY,
+          .access = PL3_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
+          .type = ARM_CP_CAP_ONLY,
           .fieldoffset = offsetof(CPUARMState, DDCs[2]),
           CAPRESETVALUE(max_cap) },
         { .name = "RDDC_EL0", .state = ARM_CP_STATE_AA64,
           .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 3, .opc2 = 1,
-          .access = PL0_RW | PL_NO_SYSREG, .type = ARM_CP_CAP_ONLY,
+          .access = PL0_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
+          .type = ARM_CP_CAP_ONLY,
           .fieldoffset = offsetof(CPUARMState, DDCs[4]),
           CAPRESETVALUE(max_cap) },
         { .name = "RSP_EL0", .state = ARM_CP_STATE_AA64,
           .opc0 = 3, .opc1 = 7, .crn = 4, .crm = 1, .opc2 = 3,
-          .access = PL0_RW | PL_NO_SYSREG, .type = ARM_CP_CAP,
+          .access = PL0_RW | PL_IN_EXECUTIVE | PL_NO_SYSREG,
+          .type = ARM_CP_CAP,
           .fieldoffset = offsetof(CPUARMState, sp_el[4]) },
         // TODO: bits in CPTR control access to these
         { .name = "CHCR_EL2", .state = ARM_CP_STATE_AA64,