Series comparison

-[Qemu-devel] [PULL 0/5] target-arm queue
+[PULL 00/36] target-arm queue
-Handful of bug fixes to sneak in before rc3.
+Hi; here's another arm pullreq; by volume most of this is
 refactoring from me, but there are also some bugfixes and
 other bits and pieces here.
 thanks
 -- PMM
-The following changes since commit c985266ea5b50e46e07b3568c1346e10064205c9:
+The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:
-  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20190726' into staging (2019-07-26 13:52:06 +0100)
+  Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190726
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1
-for you to fetch changes up to 67505c114e6acc26f3a1a2b74833c61b6a34ff95:
+for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:
-  hw/arm/boot: Further improve initrd positioning code (2019-07-26 16:17:56 +0100)
+  hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix broken migration on pl330 device
+ * hw/arm: Remove various uses of first_cpu global
- * Fix broken migration on stellaris-input device
+ * hw/char/imx_serial: Fix reset value of UFCR register
- * Add type checks to vmstate varry macros to avoid this class of bugs
+ * hw/char/imx_serial: Update all state before restarting ageing timer
- * hw/arm/boot: Fix some remaining cases where we would put the
+ * hw/pci-host/designware: Expose MSI IRQ
-   initrd on top of the kernel image
+ * hw/arm/stellaris: refactoring, cleanup
  * hw/arm/stellaris: map both I2C controllers
  * tests/functional: Add a test for the arm microbit machine
  * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
  * target/arm: refactorings preparatory to FEAT_AFP implementation
  * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
  * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
  * hw/usb/canokey: Fix buffer overflow for OUT packet
 ----------------------------------------------------------------
-Damien Hedde (1):
+Bernhard Beschow (3):
-      pl330: fix vmstate description
+      hw/char/imx_serial: Fix reset value of UFCR register
       hw/char/imx_serial: Update all state before restarting ageing timer
       hw/pci-host/designware: Expose MSI IRQ
-Peter Maydell (4):
+Hongren Zheng (1):
-      stellaris_input: Fix vmstate description of buttons field
+      hw/usb/canokey: Fix buffer overflow for OUT packet
       vmstate.h: Type check VMSTATE_STRUCT_VARRAY macros
       hw/arm/boot: Rename elf_{low, high}_addr to image_{low, high}_addr
       hw/arm/boot: Further improve initrd positioning code
- include/migration/vmstate.h | 30 ++++++++++++++++++++++++------
+Peter Maydell (22):
- hw/arm/boot.c               | 37 +++++++++++++++++++++++++++----------
+      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
- hw/dma/pl330.c              | 17 +++++++++--------
+      target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
- hw/input/stellaris_input.c  | 10 ++++++----
+      target/arm: Use uint32_t in vfp_exceptbits_from_host()
-files changed, 66 insertions(+), 28 deletions(-)
+      target/arm: Define new fp_status_a32 and fp_status_a64
       target/arm: Use vfp.fp_status_a64 in A64-only helper functions
       target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
       target/arm: Use fp_status_a32 in vjvct helper
       target/arm: Use fp_status_a32 in vfp_cmp helpers
       target/arm: Use FPST_A32 in A32 decoder
       target/arm: Use FPST_A64 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
       target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
       target/arm: Use fp_status_f16_a32 in AArch32-only helpers
       target/arm: Use fp_status_f16_a64 in AArch64-only helpers
       target/arm: Use FPST_A32_F16 in A32 decoder
       target/arm: Use FPST_A64_F16 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
       fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
       fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
       fpu: Fix a comment in softfloat-types.h
       target/arm: Remove redundant advsimd float16 helpers
       target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
+Philippe Mathieu-Daudé (9):
+      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
+      hw/arm/stellaris: Add 'armv7m' local variable
+      hw/arm/v7m: Remove use of &first_cpu in machine_init()
+      hw/arm/stellaris: Link each board schematic
+      hw/arm/stellaris: Constify read-only arrays
+      hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
+      hw/arm/stellaris: Replace magic numbers by definitions
+      hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
+      hw/arm/stellaris: Map both I2C controllers
+Thomas Huth (1):
+      tests/functional: Add a test for the arm microbit machine
+ MAINTAINERS                           |   1 +
+ hw/usb/canokey.h                      |   4 --
+ include/fpu/softfloat-types.h         |  10 +--
+ include/hw/arm/fsl-imx6.h             |   4 +-
+ include/hw/arm/fsl-imx7.h             |   4 +-
+ include/hw/arm/nrf51_soc.h            |   2 +-
+ include/hw/char/imx_serial.h          |   2 +-
+ include/hw/pci-host/designware.h      |   1 +
+ target/arm/cpu.h                      |  12 ++--
+ target/arm/tcg/helper-a64.h           |   8 ---
+ target/arm/tcg/translate.h            |  32 ++++++---
+ fpu/softfloat.c                       |   6 +-
+ hw/arm/b-l475e-iot01a.c               |   2 +-
+ hw/arm/fsl-imx6.c                     |  13 +++-
+ hw/arm/fsl-imx7.c                     |  13 +++-
+ hw/arm/microbit.c                     |   2 +-
+ hw/arm/mps2-tz.c                      |   2 +-
+ hw/arm/mps2.c                         |   2 +-
+ hw/arm/msf2-som.c                     |   2 +-
+ hw/arm/musca.c                        |   2 +-
+ hw/arm/netduino2.c                    |   2 +-
+ hw/arm/netduinoplus2.c                |   2 +-
+ hw/arm/nrf51_soc.c                    |  18 ++---
+ hw/arm/olimex-stm32-h405.c            |   2 +-
+ hw/arm/stellaris.c                    | 118 +++++++++++++++++++-----------
+ hw/arm/stm32vldiscovery.c             |   2 +-
+ hw/char/imx_serial.c                  |   7 +-
+ hw/pci-host/designware.c              |   7 +-
+ hw/usb/canokey.c                      |   6 +-
+ target/arm/cpu.c                      |   6 +-
+ target/arm/helper.c                   |   2 +-
+ target/arm/tcg/helper-a64.c           |   9 ---
+ target/arm/tcg/sme_helper.c           |   6 +-
+ target/arm/tcg/sve_helper.c           |   6 +-
+ target/arm/tcg/translate-a64.c        | 103 ++++++++++++++-------------
+ target/arm/tcg/translate-sme.c        |   4 +-
+ target/arm/tcg/translate-sve.c        | 130 +++++++++++++++++-----------------
+ target/arm/tcg/translate-vfp.c        |  78 ++++++++++----------
+ target/arm/tcg/vec_helper.c           |  22 +++---
+ target/arm/vfp_helper.c               |  73 +++++++++++--------
+ target/i386/tcg/fpu_helper.c          |   8 +--
+ target/m68k/fpu_helper.c              |   2 +-
+ target/mips/tcg/msa_helper.c          |   4 +-
+ target/rx/op_helper.c                 |   4 +-
+ target/tricore/fpu_helper.c           |   6 +-
+ fpu/softfloat-parts.c.inc             |   4 +-
+ hw/arm/Kconfig                        |   2 +
+ tests/functional/meson.build          |   1 +
+ tests/functional/test_arm_microbit.py |  31 ++++++++
+files changed, 452 insertions(+), 337 deletions(-)
+ create mode 100755 tests/functional/test_arm_microbit.py

-New patch
+[PULL 01/36] hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+The ARMv7MState object is not simply a CPU, it also
+contains the NVIC, SysTick timer, and various MemoryRegions.
+Rename the field as 'armv7m', like other Cortex-M boards.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20250112225614.33723-2-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/nrf51_soc.h |  2 +-
+ hw/arm/nrf51_soc.c         | 18 +++++++++---------
+files changed, 10 insertions(+), 10 deletions(-)
+diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/nrf51_soc.h
++++ b/include/hw/arm/nrf51_soc.h
+@@ -XXX,XX +XXX,XX @@ struct NRF51State {
+     SysBusDevice parent_obj;
+     /*< public >*/
+-    ARMv7MState cpu;
++    ARMv7MState armv7m;
+     NRF51UARTState uart;
+     NRF51RNGState rng;
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     }
+     /* This clock doesn't need migration because it is fixed-frequency */
+     clock_set_hz(s->sysclk, HCLK_FRQ);
+-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
++    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
+     /*
+      * This SoC has no systick device, so don't connect refclk.
+      * TODO: model the lack of systick (currently the armv7m object
+      * will always provide one).
+      */
+-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
++    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
+                              &error_abort);
+-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
++    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
+     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
+-                       qdev_get_gpio_in(DEVICE(&s->cpu),
++                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                        BASE_TO_IRQ(NRF51_UART_BASE)));
+     /* RNG */
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
+     memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
+-                       qdev_get_gpio_in(DEVICE(&s->cpu),
++                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                        BASE_TO_IRQ(NRF51_RNG_BASE)));
+     /* UICR, FICR, NVMC, FLASH */
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
+-                           qdev_get_gpio_in(DEVICE(&s->cpu),
++                           qdev_get_gpio_in(DEVICE(&s->armv7m),
+                                             BASE_TO_IRQ(base_addr)));
+     }
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
+     memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
+-    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
+-    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
++    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
++    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
+                          ARM_CPU_TYPE_NAME("cortex-m0"));
+-    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
++    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
+     object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
+     object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
+--
+.34.1

-New patch
+[PULL 02/36] hw/arm/stellaris: Add 'armv7m' local variable
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+While the TYPE_ARMV7M object forward its NVIC interrupt lines,
+it is somehow misleading to name it 'nvic'. Add the 'armv7m'
+local variable for clarity, but also keep the 'nvic' variable
+behaving like before when used for wiring IRQ lines.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20250112225614.33723-3-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/stellaris.c | 21 +++++++++++----------
+file changed, 11 insertions(+), 10 deletions(-)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+      */
+     Object *soc_container;
+-    DeviceState *gpio_dev[7], *nvic;
++    DeviceState *gpio_dev[7], *armv7m, *nvic;
+     qemu_irq gpio_in[7][8];
+     qemu_irq gpio_out[7][8];
+     qemu_irq adc;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+     qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
+-    nvic = qdev_new(TYPE_ARMV7M);
+-    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
+-    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
+-    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
+-    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
+-    qdev_prop_set_bit(nvic, "enable-bitband", true);
+-    qdev_connect_clock_in(nvic, "cpuclk",
++    armv7m = qdev_new(TYPE_ARMV7M);
++    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
++    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
++    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
++    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
++    qdev_prop_set_bit(armv7m, "enable-bitband", true);
++    qdev_connect_clock_in(armv7m, "cpuclk",
+                           qdev_get_clock_out(ssys_dev, "SYSCLK"));
+     /* This SoC does not connect the systick reference clock */
+-    object_property_set_link(OBJECT(nvic), "memory",
++    object_property_set_link(OBJECT(armv7m), "memory",
+                              OBJECT(get_system_memory()), &error_abort);
+     /* This will exit with an error if the user passed us a bad cpu_type */
+-    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
++    nvic = armv7m;
+     /* Now we can wire up the IRQ and MMIO of the system registers */
+     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
+--
+.34.1

-[Qemu-devel] [PULL 3/5] vmstate.h: Type check VMSTATE_STRUCT_VARRAY macros
+[PULL 03/36] hw/arm/v7m: Remove use of &first_cpu in machine_init()
-The VMSTATE_STRUCT_VARRAY_UINT32 macro is intended to handle
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 migrating a field which is an array of structs, but where instead of
 migrating the entire array we only migrate a variable number of
 elements of it.
-The VMSTATE_STRUCT_VARRAY_POINTER_UINT32 macro is intended to handle
+When instanciating the machine model, the machine_init()
-migrating a field which is of pointer type, and points to a
+implementations usually create the CPUs, so have access
-dynamically allocated array of structs of variable size.
+to its first CPU. Use that rather then the &first_cpu
 global.
-We weren't actually checking that the field passed to
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-VMSTATE_STRUCT_VARRAY_UINT32 really is an array, with the result that
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-accidentally using it where the _POINTER_ macro was intended would
+Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
-compile but silently corrupt memory on migration.
+Message-id: 20250112225614.33723-4-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/b-l475e-iot01a.c    | 2 +-
  hw/arm/microbit.c          | 2 +-
  hw/arm/mps2-tz.c           | 2 +-
  hw/arm/mps2.c              | 2 +-
  hw/arm/msf2-som.c          | 2 +-
  hw/arm/musca.c             | 2 +-
  hw/arm/netduino2.c         | 2 +-
  hw/arm/netduinoplus2.c     | 2 +-
  hw/arm/olimex-stm32-h405.c | 2 +-
  hw/arm/stellaris.c         | 2 +-
  hw/arm/stm32vldiscovery.c  | 2 +-
 files changed, 11 insertions(+), 11 deletions(-)
-Add type-checking that enforces that the field passed in is
+diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
 really of the right array type. This applies to all the VMSTATE
 macros which use flags including VMS_VARRAY_* but not VMS_POINTER.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
 Tested-by: Damien Hedde <damien.hedde@greensocs.com>
 Message-id: 20190725163710.11703-3-peter.maydell@linaro.org
 ---
  include/migration/vmstate.h | 30 ++++++++++++++++++++++++------
 file changed, 24 insertions(+), 6 deletions(-)
 diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/hw/arm/b-l475e-iot01a.c
-+++ b/include/migration/vmstate.h
++++ b/hw/arm/b-l475e-iot01a.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_bitmap;
+@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
- extern const VMStateInfo vmstate_info_qtailq;
+     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
- #define type_check_2darray(t1,t2,n,m) ((t1(*)[n][m])0 - (t2*)0)
+     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
-+/*
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
-+ * Check that type t2 is an array of type t1 of size n,
++    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
-+ * e.g. if t1 is 'foo' and n is 32 then t2 must be 'foo[32]'
+                        sc->flash_size);
-+ */
- #define type_check_array(t1,t2,n) ((t1(*)[n])0 - (t2*)0)
+     if (object_class_by_name(TYPE_DM163)) {
- #define type_check_pointer(t1,t2) ((t1**)0 - (t2*)0)
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
-+/*
+index XXXXXXX..XXXXXXX 100644
-+ * type of element 0 of the specified (array) field of the type.
+--- a/hw/arm/microbit.c
-+ * Note that if the field is a pointer then this will return the
++++ b/hw/arm/microbit.c
-+ * pointed-to type rather than complaining.
+@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
-+ */
+     memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
-+#define typeof_elt_of_field(type, field) typeof(((type *)0)->field[0])
+                                         mr, -1);
-+/* Check that field f in struct type t2 is an array of t1, of any size */
-+#define type_check_varray(t1, t2, f)                                 \
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-+    (type_check(t1, typeof_elt_of_field(t2, f))                      \
++    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
-+     + QEMU_BUILD_BUG_ON_ZERO(!QEMU_IS_ARRAY(((t2 *)0)->f)))
+, s->nrf51.flash_size);
  #define vmstate_offset_value(_state, _field, _type)                  \
      (offsetof(_state, _field) +                                      \
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
      vmstate_offset_array(_state, _field, uint8_t,                    \
                           sizeof(typeof_field(_state, _field)))
 +#define vmstate_offset_varray(_state, _field, _type)                 \
 +    (offsetof(_state, _field) +                                      \
 +     type_check_varray(_type, _state, _field))
 +
  /* In the macros below, if there is a _version, that means the macro's
   * field will be processed only if the version being received is >=
   * the _version specified.  In general, if you add a new field, you
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
      .info       = &(_info),                                          \
      .size       = sizeof(_type),                                     \
      .flags      = VMS_VARRAY_UINT32|VMS_MULTIPLY_ELEMENTS,           \
 -    .offset     = offsetof(_state, _field),                          \
 +    .offset     = vmstate_offset_varray(_state, _field, _type),      \
  }
- #define VMSTATE_ARRAY_TEST(_field, _state, _num, _test, _info, _type) {\
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+index XXXXXXX..XXXXXXX 100644
-     .info       = &(_info),                                          \
+--- a/hw/arm/mps2-tz.c
-     .size       = sizeof(_type),                                     \
++++ b/hw/arm/mps2-tz.c
-     .flags      = VMS_VARRAY_INT32,                                  \
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
--    .offset     = offsetof(_state, _field),                          \
+                                     mms->remap_irq);
-+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
+     }
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
 , boot_ram_size(mms));
  }
- #define VMSTATE_VARRAY_INT32(_field, _state, _field_num, _version, _info, _type) {\
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+index XXXXXXX..XXXXXXX 100644
-     .info       = &(_info),                                          \
+--- a/hw/arm/mps2.c
-     .size       = sizeof(_type),                                     \
++++ b/hw/arm/mps2.c
-     .flags      = VMS_VARRAY_UINT16,                                 \
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
--    .offset     = offsetof(_state, _field),                          \
+                  qdev_get_gpio_in(armv7m,
-+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
+                                   mmc->fpga_type == FPGA_AN511 ? 47 : 13));
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
 , 0x400000);
  }
- #define VMSTATE_VSTRUCT_TEST(_field, _state, _test, _version, _vmsd, _type, _struct_version) { \
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+index XXXXXXX..XXXXXXX 100644
-     .vmsd       = &(_vmsd),                                          \
+--- a/hw/arm/msf2-som.c
-     .size       = sizeof(_type),                                     \
++++ b/hw/arm/msf2-som.c
-     .flags      = VMS_STRUCT|VMS_VARRAY_UINT8,                       \
+@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
--    .offset     = offsetof(_state, _field),                          \
+     cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
-+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
+     sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
 , soc->envm_size);
  }
- /* a variable length array (i.e. _type *_field) but we know the
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+index XXXXXXX..XXXXXXX 100644
-     .vmsd       = &(_vmsd),                                          \
+--- a/hw/arm/musca.c
-     .size       = sizeof(_type),                                     \
++++ b/hw/arm/musca.c
-     .flags      = VMS_STRUCT|VMS_VARRAY_INT32,                       \
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
--    .offset     = offsetof(_state, _field),                          \
+                                                      "cfg_sec_resp", 0));
-+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
+     }
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
 , 0x2000000);
  }
- #define VMSTATE_STRUCT_VARRAY_UINT32(_field, _state, _field_num, _version, _vmsd, _type) { \
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+index XXXXXXX..XXXXXXX 100644
-     .vmsd       = &(_vmsd),                                          \
+--- a/hw/arm/netduino2.c
-     .size       = sizeof(_type),                                     \
++++ b/hw/arm/netduino2.c
-     .flags      = VMS_STRUCT|VMS_VARRAY_UINT32,                      \
+@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
--    .offset     = offsetof(_state, _field),                          \
+     qdev_connect_clock_in(dev, "sysclk", sysclk);
-+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
 , FLASH_SIZE);
  }
- #define VMSTATE_STRUCT_VARRAY_ALLOC(_field, _state, _field_num, _version, _vmsd, _type) {\
+diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduinoplus2.c
 +++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/olimex-stm32-h405.c
 +++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
      create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
 +    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
  }
  /* FIXME: Figure out how to generate these from stellaris_boards.  */
 diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32vldiscovery.c
 +++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 04/36] hw/char/imx_serial: Fix reset value of UFCR register
+From: Bernhard Beschow <shentey@gmail.com>
+The value of the UCFR register is respected when echoing characters to the
+terminal, but its reset value is reserved. Fix the reset value to the one
+documented in the datasheet.
+While at it move the related attribute out of the section of unimplemented
+registers since its value is actually respected.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/imx_serial.h | 2 +-
+ hw/char/imx_serial.c         | 1 +
+files changed, 2 insertions(+), 1 deletion(-)
+diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/imx_serial.h
++++ b/include/hw/char/imx_serial.h
+@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
+     uint32_t ucr1;
+     uint32_t ucr2;
+     uint32_t uts1;
++    uint32_t ufcr;
+     /*
+      * The registers below are implemented just so that the
+      * guest OS sees what it has written
+      */
+     uint32_t onems;
+-    uint32_t ufcr;
+     uint32_t ubmr;
+     uint32_t ubrc;
+     uint32_t ucr3;
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
+     s->ucr3 = 0x700;
+     s->ubmr = 0;
+     s->ubrc = 4;
++    s->ufcr = BIT(11) | BIT(0);
+     fifo32_reset(&s->rx_fifo);
+     timer_del(&s->ageing_timer);
+--
+.34.1

-New patch
+[PULL 05/36] hw/char/imx_serial: Update all state before restarting ageing timer
+From: Bernhard Beschow <shentey@gmail.com>
+Fixes characters to be "echoed" after each keystroke rather than after every
+other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
+only after every other keystroke.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/char/imx_serial.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
+     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
+         s->usr1 |= USR1_RRDY;
+     }
+-
+-    imx_serial_rx_fifo_ageing_timer_restart(s);
+-
+     s->usr2 |= USR2_RDR;
+     s->uts1 &= ~UTS1_RXEMPTY;
+     if (value & URXD_BRK) {
+         s->usr2 |= USR2_BRCD;
+     }
++
++    imx_serial_rx_fifo_ageing_timer_restart(s);
++
+     imx_update(s);
+ }
+--
+.34.1

-New patch
+[PULL 06/36] hw/pci-host/designware: Expose MSI IRQ
+From: Bernhard Beschow <shentey@gmail.com>
+Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
+each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
+the MSI IRQ with the INTx lines, so expose it as a dedicated pin.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/fsl-imx6.h        |  4 +++-
+ include/hw/arm/fsl-imx7.h        |  4 +++-
+ include/hw/pci-host/designware.h |  1 +
+ hw/arm/fsl-imx6.c                | 13 ++++++++++++-
+ hw/arm/fsl-imx7.c                | 13 ++++++++++++-
+ hw/pci-host/designware.c         |  7 +++----
+ hw/arm/Kconfig                   |  2 ++
+files changed, 36 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/usb/chipidea.h"
+ #include "hw/usb/imx-usb-phy.h"
+ #include "hw/pci-host/designware.h"
++#include "hw/or-irq.h"
+ #include "exec/memory.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+     ChipideaState      usb[FSL_IMX6_NUM_USBS];
+     IMXFECState        eth;
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+ #define FSL_IMX6_PCIE1_IRQ 120
+ #define FSL_IMX6_PCIE2_IRQ 121
+ #define FSL_IMX6_PCIE3_IRQ 122
+-#define FSL_IMX6_PCIE4_IRQ 123
++#define FSL_IMX6_PCIE4_MSI_IRQ 123
+ #define FSL_IMX6_DCIC1_IRQ 124
+ #define FSL_IMX6_DCIC2_IRQ 125
+ #define FSL_IMX6_MLB150_HIGH_IRQ 126
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/imx_fec.h"
+ #include "hw/pci-host/designware.h"
+ #include "hw/usb/chipidea.h"
++#include "hw/or-irq.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+ #include "qemu/units.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
+     IMX7GPRState       gpr;
+     ChipideaState      usb[FSL_IMX7_NUM_USBS];
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
+     FSL_IMX7_PCI_INTA_IRQ = 125,
+     FSL_IMX7_PCI_INTB_IRQ = 124,
+     FSL_IMX7_PCI_INTC_IRQ = 123,
+-    FSL_IMX7_PCI_INTD_IRQ = 122,
++    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
+     FSL_IMX7_UART7_IRQ    = 126,
+diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/pci-host/designware.h
++++ b/include/hw/pci-host/designware.h
+@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
+         MemoryRegion io;
+         qemu_irq     irqs[4];
++        qemu_irq     msi;
+     } pci;
+     MemoryRegion mmio;
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx6.c
++++ b/hw/arm/fsl-imx6.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
+     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+ }
+ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * PCIe PHY
+diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx7.c
++++ b/hw/arm/fsl-imx7.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
+      * PCIE
+      */
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+     /*
+      * USBs
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * USBs
+diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/pci-host/designware.c
++++ b/hw/pci-host/designware.c
+@@ -XXX,XX +XXX,XX @@
+ #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
+ #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
+-#define DESIGNWARE_PCIE_IRQ_MSI                    3
+-
+ static DesignwarePCIEHost *
+ designware_pcie_root_to_host(DesignwarePCIERoot *root)
+ {
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
+     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
+     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
+-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
++        qemu_set_irq(host->pci.msi, 1);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
+     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
+         root->msi.intr[0].status ^= val;
+         if (!root->msi.intr[0].status) {
+-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
++            qemu_set_irq(host->pci.msi, 0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
+     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
+         sysbus_init_irq(sbd, &s->pci.irqs[i]);
+     }
++    sysbus_init_irq(sbd, &s->pci.msi);
+     memory_region_init_io(&s->mmio,
+                           OBJECT(s),
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
+     select PL310  # cache controller
+     select PCI_EXPRESS_DESIGNWARE
+     select SDHCI
++    select OR_IRQ
+ config ASPEED_SOC
+     bool
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
+     select WDT_IMX2
+     select PCI_EXPRESS_DESIGNWARE
+     select SDHCI
++    select OR_IRQ
+     select UNIMP
+ config ARM_SMMUV3
+--
+.34.1

-New patch
+[PULL 07/36] hw/arm/stellaris: Link each board schematic
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Board schematic is useful to corroborate GPIOs/IRQs wiring.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-2-philmd@linaro.org
+[PMM: Use https:// URLs]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/stellaris.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
+     stellaris_init(machine, &stellaris_boards[1]);
+ }
++/*
++ * Stellaris LM3S811 Evaluation Board Schematics:
++ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
++ */
+ static void lm3s811evb_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
+     .class_init = lm3s811evb_class_init,
+ };
++/*
++ * Stellaris: LM3S6965 Evaluation Board Schematics:
++ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
++ */
+ static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
+--
+.34.1

-New patch
+[PULL 08/36] hw/arm/stellaris: Constify read-only arrays
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-3-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/stellaris.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
+   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
+ }
+-static uint32_t pllcfg_sandstorm[16] = {
++static const uint32_t pllcfg_sandstorm[16] = {
+x31c0, /* 1 Mhz */
+x1ae0, /* 1.8432 Mhz */
+x18c0, /* 2 Mhz */
+@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
+x585b /* 8.192 Mhz */
+ };
+-static uint32_t pllcfg_fury[16] = {
++static const uint32_t pllcfg_fury[16] = {
+x3200, /* 1 Mhz */
+x1b20, /* 1.8432 Mhz */
+x1900, /* 2 Mhz */
+@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
+ }
+ /* Board init.  */
+-static stellaris_board_info stellaris_boards[] = {
++static const stellaris_board_info stellaris_boards[] = {
+   { "LM3S811EVB",
+,
+x0032000e,
+--
+.34.1

-New patch
+[PULL 09/36] hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+There is nothing mapped at 0x40002000.
+I2C#0 is already mapped at 0x40021000.
+Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-4-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/stellaris.c | 2 --
+file changed, 2 deletions(-)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
+      *
+      * 40000000 wdtimer
+-     * 40002000 i2c (unimplemented)
+      * 40004000 GPIO
+      * 40005000 GPIO
+      * 40006000 GPIO
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+     /* Add dummy regions for the devices we don't implement yet,
+      * so guest accesses don't cause unlogged crashes.
+      */
+-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
+     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
+     create_unimplemented_device("PWM", 0x40028000, 0x1000);
+     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
+--
+.34.1

-[Qemu-devel] [PULL 5/5] hw/arm/boot: Further improve initrd positioning code
+[PULL 10/36] hw/arm/stellaris: Replace magic numbers by definitions
-In commit e6b2b20d9735d4ef we made the boot loader code try to avoid
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 putting the initrd on top of the kernel.  However the expression used
 to calculate the start of the initrd:
-    info->initrd_start = info->loader_start +
+Add definitions for the number of controllers.
         MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
-incorrectly uses 'kernel_size' as the offset within RAM of the
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-highest address to avoid.  This is incorrect because the kernel
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-doesn't start at address 0, but slightly higher than that.  This
+Message-id: 20250110160204.74997-5-philmd@linaro.org
-means that we can still incorrectly end up overlaying the initrd on
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-the kernel in some cases, for example:
+---
  hw/arm/stellaris.c | 25 +++++++++++++++----------
 file changed, 15 insertions(+), 10 deletions(-)
-* The kernel's image_size is 0x0a7a8000
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 * The kernel was loaded at   0x40080000
 * The end of the kernel is   0x4A828000
 * The DTB was loaded at      0x4a800000
 To get this right we need to track the actual highest address used
 by the kernel and use that rather than kernel_size. We already
 set image_low_addr and image_high_addr for ELF images; set them
 also for the various other image types we support, and then use
 image_high_addr as the lowest allowed address for the initrd.
 (We don't use image_low_addr, but we set it for consistency
 with the existing code path for ELF files.)
 Fixes: e6b2b20d9735d4ef
 Reported-by: Mark Rutland <mark.rutland@arm.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Mark Rutland <mark.rutland@arm.com>
 Message-id: 20190722151804.25467-3-peter.maydell@linaro.org
 ---
  hw/arm/boot.c | 19 +++++++++++++++++--
 file changed, 17 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/arm/boot.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@
-     int is_linux = 0;
+ #define NUM_IRQ_LINES 64
-     uint64_t elf_entry;
+ #define NUM_PRIO_BITS 3
-     /* Addresses of first byte used and first byte not used by the image */
--    uint64_t image_low_addr, image_high_addr;
++#define NUM_GPIO    7
-+    uint64_t image_low_addr = 0, image_high_addr = 0;
++#define NUM_UART    4
-     int elf_machine;
++#define NUM_GPTM    4
-     hwaddr entry;
++#define NUM_I2C     2
-     static const ARMInsnFixup *primary_loader;
++
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+ typedef const struct {
-         uint64_t loadaddr = info->loader_start + KERNEL_NOLOAD_ADDR;
+     const char *name;
-         kernel_size = load_uimage_as(info->kernel_filename, &entry, &loadaddr,
+     uint32_t did0;
-                                      &is_linux, NULL, NULL, as);
+@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
-+        if (kernel_size >= 0) {
-+            image_low_addr = loadaddr;
+ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+            image_high_addr = image_low_addr + kernel_size;
+ {
-+        }
+-    static const int uart_irq[] = {5, 6, 33, 34};
 -    static const int timer_irq[] = {19, 21, 23, 35};
 -    static const uint32_t gpio_addr[7] =
 +    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
 +    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
 +    static const uint32_t gpio_addr[NUM_GPIO] =
        { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
 x40024000, 0x40025000, 0x40026000};
 -    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
 +    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
      /* Memory map of SoC devices, from
       * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
       */
      Object *soc_container;
 -    DeviceState *gpio_dev[7], *armv7m, *nvic;
 -    qemu_irq gpio_in[7][8];
 -    qemu_irq gpio_out[7][8];
 +    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
 +    qemu_irq gpio_in[NUM_GPIO][8];
 +    qemu_irq gpio_out[NUM_GPIO][8];
      qemu_irq adc;
      int sram_size;
      int flash_size;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      } else {
          adc = NULL;
      }
-     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
+-    for (i = 0; i < 4; i++) {
-         kernel_size = load_aarch64_image(info->kernel_filename,
++    for (i = 0; i < NUM_GPTM; i++) {
-                                          info->loader_start, &entry, as);
+         if (board->dc2 & (0x10000 << i)) {
-         is_linux = 1;
+             SysBusDevice *sbd;
-+        if (kernel_size >= 0) {
-+            image_low_addr = entry;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 +            image_high_addr = image_low_addr + kernel_size;
 +        }
      } else if (kernel_size < 0) {
          /* 32-bit ARM */
          entry = info->loader_start + KERNEL_LOAD_ADDR;
          kernel_size = load_image_targphys_as(info->kernel_filename, entry,
                                               ram_end - KERNEL_LOAD_ADDR, as);
          is_linux = 1;
 +        if (kernel_size >= 0) {
 +            image_low_addr = entry;
 +            image_high_addr = image_low_addr + kernel_size;
 +        }
      }
-     if (kernel_size < 0) {
-         error_report("could not load kernel '%s'", info->kernel_filename);
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+-    for (i = 0; i < 7; i++) {
-      * we might still make a bad choice here.
++    for (i = 0; i < NUM_GPIO; i++) {
-      */
+         if (board->dc4 & (1 << i)) {
-     info->initrd_start = info->loader_start +
+             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
--        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+                                                qdev_get_gpio_in(nvic,
-+        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+    if (image_high_addr) {
+         }
-+        info->initrd_start = MAX(info->initrd_start, image_high_addr);
+     }
-+    }
-     info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
+-    for (i = 0; i < 4; i++) {
++    for (i = 0; i < NUM_UART; i++) {
-     if (is_linux) {
+         if (board->dc2 & (1 << i)) {
              SysBusDevice *sbd;
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 2/5] stellaris_input: Fix vmstate description of buttons field
+[PULL 11/36] hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
-gamepad_state::buttons is a pointer to an array of structs,
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 not an array of structs, so should be declared in the vmstate
 with VMSTATE_STRUCT_VARRAY_POINTER_INT32; otherwise we
 corrupt memory on incoming migration.
-We bump the vmstate version field as the easiest way to
+Add definitions (DCx_periph) for the DeviceCapability bits,
-deal with the migration break, since migration wouldn't have
+replace direct bitmask checks with the DEV_CAP() macro,
-worked reliably before anyway.
+which use the extract/deposit API.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-6-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
-Message-id: 20190725163710.11703-2-peter.maydell@linaro.org
 ---
- hw/input/stellaris_input.c | 10 ++++++----
+ hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
-file changed, 6 insertions(+), 4 deletions(-)
+file changed, 29 insertions(+), 8 deletions(-)
-diff --git a/hw/input/stellaris_input.c b/hw/input/stellaris_input.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/input/stellaris_input.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/input/stellaris_input.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_button = {
+@@ -XXX,XX +XXX,XX @@
+  */
- static const VMStateDescription vmstate_stellaris_gamepad = {
-     .name = "stellaris_gamepad",
+ #include "qemu/osdep.h"
--    .version_id = 1,
++#include "qemu/bitops.h"
--    .minimum_version_id = 1,
+ #include "qapi/error.h"
-+    .version_id = 2,
+ #include "hw/core/split-irq.h"
-+    .minimum_version_id = 2,
+ #include "hw/sysbus.h"
-     .fields = (VMStateField[]) {
+@@ -XXX,XX +XXX,XX @@
-         VMSTATE_INT32(extension, gamepad_state),
+ #define NUM_GPTM    4
--        VMSTATE_STRUCT_VARRAY_INT32(buttons, gamepad_state, num_buttons, 0,
+ #define NUM_I2C     2
--                              vmstate_stellaris_button, gamepad_button),
-+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(buttons, gamepad_state,
++/*
-+                                            num_buttons,
++ * See Stellaris Data Sheet chapter 5.2.5 "System Control",
-+                                            vmstate_stellaris_button,
++ * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
-+                                            gamepad_button),
++ */
-         VMSTATE_END_OF_LIST()
++#define DC1_WDT          3
 +#define DC1_HIB          6
 +#define DC1_MPU          7
 +#define DC1_ADC          16
 +#define DC1_PWM          20
 +#define DC2_UART(n)     (n)
 +#define DC2_SSI          4
 +#define DC2_QEI(n)      (8 + n)
 +#define DC2_I2C(n)      (12 + 2 * n)
 +#define DC2_GPTM(n)     (16 + n)
 +#define DC2_COMP(n)     (24 + n)
 +#define DC4_GPIO(n)     (n)
 +#define DC4_EMAC         28
 +
 +#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
 +
  typedef const struct {
      const char *name;
      uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
      sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
 -    if (board->dc1 & (1 << 16)) {
 +    if (DEV_CAP(1, ADC)) {
          dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                      qdev_get_gpio_in(nvic, 14),
                                      qdev_get_gpio_in(nvic, 15),
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          adc = NULL;
      }
- };
+     for (i = 0; i < NUM_GPTM; i++) {
 -        if (board->dc2 & (0x10000 << i)) {
 +        if (DEV_CAP(2, GPTM(i))) {
              SysBusDevice *sbd;
              dev = qdev_new(TYPE_STELLARIS_GPTM);
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          }
      }
 -    if (board->dc1 & (1 << 3)) { /* watchdog present */
 +    if (DEV_CAP(1, WDT)) {
          dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
          object_property_add_child(soc_container, "wdg", OBJECT(dev));
          qdev_connect_clock_in(dev, "WDOGCLK",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      for (i = 0; i < NUM_GPIO; i++) {
 -        if (board->dc4 & (1 << i)) {
 +        if (DEV_CAP(4, GPIO(i))) {
              gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                 qdev_get_gpio_in(nvic,
                                                                  gpio_irq[i]));
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          }
      }
 -    if (board->dc2 & (1 << 12)) {
 +    if (DEV_CAP(2, I2C(0))) {
          dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
                                     qdev_get_gpio_in(nvic, 8));
          i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      }
      for (i = 0; i < NUM_UART; i++) {
 -        if (board->dc2 & (1 << i)) {
 +        if (DEV_CAP(2, UART(i))) {
              SysBusDevice *sbd;
              dev = qdev_new("pl011_luminary");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
              sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
          }
      }
 -    if (board->dc2 & (1 << 4)) {
 +    if (DEV_CAP(2, SSI)) {
          dev = sysbus_create_simple("pl022", 0x40008000,
                                     qdev_get_gpio_in(nvic, 7));
          if (board->peripherals & BP_OLED_SSI) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
              qemu_irq_raise(gpio_out[GPIO_D][0]);
          }
      }
 -    if (board->dc4 & (1 << 28)) {
 +    if (DEV_CAP(4, EMAC)) {
          DeviceState *enet;
          enet = qdev_new("stellaris_enet");
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 4/5] hw/arm/boot: Rename elf_{low, high}_addr to image_{low, high}_addr
+[PULL 12/36] hw/arm/stellaris: Map both I2C controllers
-Rename the elf_low_addr and elf_high_addr variables to image_low_addr
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 and image_high_addr -- in the next commit we will extend them to
 be set for other kinds of image file and not just ELF files.
+There are 2 I2C controllers, map them both, removing
+the unimplemented one. Keep the OLED controller on the
+first I2C bus.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-7-philmd@linaro.org
+[PMM: tweak to appease maybe-use-uninitialized warning]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Message-id: 20190722151804.25467-2-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 20 +++++++++++---------
+ hw/arm/stellaris.c | 21 +++++++++++++--------
-file changed, 11 insertions(+), 9 deletions(-)
+file changed, 13 insertions(+), 8 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/arm/boot.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     int kernel_size;
+       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
-     int initrd_size;
+x40024000, 0x40025000, 0x40026000};
-     int is_linux = 0;
+     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
--    uint64_t elf_entry, elf_low_addr, elf_high_addr;
++    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
-+    uint64_t elf_entry;
++    static const int i2c_irq[NUM_I2C] = {8, 37};
-+    /* Addresses of first byte used and first byte not used by the image */
-+    uint64_t image_low_addr, image_high_addr;
+     /* Memory map of SoC devices, from
-     int elf_machine;
+      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
-     hwaddr entry;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     static const ARMInsnFixup *primary_loader;
+     qemu_irq adc;
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     int sram_size;
-         info->nb_cpus = 1;
+     int flash_size;
+-    I2CBus *i2c;
-     /* Assume that raw images are linux kernels, and ELF images are not.  */
++    DeviceState *i2c_dev[NUM_I2C] = { };
--    kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
+     DeviceState *dev;
--                               &elf_high_addr, elf_machine, as);
+     DeviceState *ssys_dev;
-+    kernel_size = arm_load_elf(info, &elf_entry, &image_low_addr,
+     int i;
-+                               &image_high_addr, elf_machine, as);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      if (kernel_size > 0 && have_dtb(info)) {
          /*
           * If there is still some room left at the base of RAM, try and put
           * the DTB there like we do for images loaded with -bios or -pflash.
           */
 -        if (elf_low_addr > info->loader_start
 -            || elf_high_addr < info->loader_start) {
 +        if (image_low_addr > info->loader_start
 +            || image_high_addr < info->loader_start) {
              /*
 -             * Set elf_low_addr as address limit for arm_load_dtb if it may be
 +             * Set image_low_addr as address limit for arm_load_dtb if it may be
               * pointing into RAM, otherwise pass '0' (no limit)
               */
 -            if (elf_low_addr < info->loader_start) {
 -                elf_low_addr = 0;
 +            if (image_low_addr < info->loader_start) {
 +                image_low_addr = 0;
              }
              info->dtb_start = info->loader_start;
 -            info->dtb_limit = elf_low_addr;
 +            info->dtb_limit = image_low_addr;
          }
      }
-     entry = elf_entry;
 -    if (DEV_CAP(2, I2C(0))) {
 -        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
 -                                   qdev_get_gpio_in(nvic, 8));
 -        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
 -        if (board->peripherals & BP_OLED_I2C) {
 -            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
 +    for (i = 0; i < NUM_I2C; i++) {
 +        if (DEV_CAP(2, I2C(i))) {
 +            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
 +                                              qdev_get_gpio_in(nvic,
 +                                                               i2c_irq[i]));
          }
      }
 +    if (board->peripherals & BP_OLED_I2C) {
 +        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
 +
 +        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
 +    }
      for (i = 0; i < NUM_UART; i++) {
          if (DEV_CAP(2, UART(i))) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      /* Add dummy regions for the devices we don't implement yet,
       * so guest accesses don't cause unlogged crashes.
       */
 -    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
      create_unimplemented_device("PWM", 0x40028000, 0x1000);
      create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
      create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 1/5] pl330: fix vmstate description
+[PULL 13/36] tests/functional: Add a test for the arm microbit machine
-From: Damien Hedde <damien.hedde@greensocs.com>
+From: Thomas Huth <thuth@redhat.com>
-Fix the pl330 main and queue vmstate description.
+We don't have any functional tests for this machine yet, thus let's
-There were missing POINTER flags causing crashes during
+add a test with a MicroPython binary that is available online
-incoming migration because:
+(thanks to Joel Stanley for providing it, see:
-+ PL330State chan field is a pointer to an array
+ https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).
 + PL330Queue queue field is a pointer to an array
-Also bump corresponding vmsd version numbers.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
+Message-id: 20250124101709.1591761-1-thuth@redhat.com
 Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
 Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Message-id: 20190724143553.21557-1-damien.hedde@greensocs.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/pl330.c | 17 +++++++++--------
+ MAINTAINERS                           |  1 +
-file changed, 9 insertions(+), 8 deletions(-)
+ tests/functional/meson.build          |  1 +
  tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
 files changed, 33 insertions(+)
  create mode 100755 tests/functional/test_arm_microbit.py
-diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/pl330.c
+--- a/MAINTAINERS
-+++ b/hw/dma/pl330.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ typedef struct PL330Queue {
+@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
+ F: include/hw/*/nrf51*.h
- static const VMStateDescription vmstate_pl330_queue = {
+ F: include/hw/*/microbit*.h
-     .name = "pl330_queue",
+ F: tests/qtest/microbit-test.c
--    .version_id = 1,
++F: tests/functional/test_arm_microbit.py
--    .minimum_version_id = 1,
+ F: docs/system/arm/nrf.rst
-+    .version_id = 2,
-+    .minimum_version_id = 2,
+ ARM PL011 Rust device
-     .fields = (VMStateField[]) {
+diff --git a/tests/functional/meson.build b/tests/functional/meson.build
--        VMSTATE_STRUCT_VARRAY_UINT32(queue, PL330Queue, queue_size, 1,
+index XXXXXXX..XXXXXXX 100644
--                                 vmstate_pl330_queue_entry, PL330QueueEntry),
+--- a/tests/functional/meson.build
-+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue, PL330Queue, queue_size,
++++ b/tests/functional/meson.build
-+                                             vmstate_pl330_queue_entry,
+@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
-+                                             PL330QueueEntry),
+   'arm_cubieboard',
-         VMSTATE_END_OF_LIST()
+   'arm_emcraft_sf2',
-     }
+   'arm_integratorcp',
- };
++  'arm_microbit',
-@@ -XXX,XX +XXX,XX @@ struct PL330State {
+   'arm_orangepi',
+   'arm_quanta_gsj',
- static const VMStateDescription vmstate_pl330 = {
+   'arm_raspi2',
-     .name = "pl330",
+diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
--    .version_id = 1,
+new file mode 100755
--    .minimum_version_id = 1,
+index XXXXXXX..XXXXXXX
-+    .version_id = 2,
+--- /dev/null
-+    .minimum_version_id = 2,
++++ b/tests/functional/test_arm_microbit.py
-     .fields = (VMStateField[]) {
+@@ -XXX,XX +XXX,XX @@
-         VMSTATE_STRUCT(manager, PL330State, 0, vmstate_pl330_chan, PL330Chan),
++#!/usr/bin/env python3
--        VMSTATE_STRUCT_VARRAY_UINT32(chan, PL330State, num_chnls, 0,
++#
--                                     vmstate_pl330_chan, PL330Chan),
++# SPDX-License-Identifier: GPL-2.0-or-later
-+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan, PL330State, num_chnls,
++#
-+                                             vmstate_pl330_chan, PL330Chan),
++# Copyright 2025, The QEMU Project Developers.
-         VMSTATE_VBUFFER_UINT32(lo_seqn, PL330State, 1, NULL, num_chnls),
++#
-         VMSTATE_VBUFFER_UINT32(hi_seqn, PL330State, 1, NULL, num_chnls),
++# A functional test that runs MicroPython on the arm microbit machine.
-         VMSTATE_STRUCT(fifo, PL330State, 0, vmstate_pl330_fifo, PL330Fifo),
++
 +from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
 +from qemu_test import wait_for_console_pattern
 +
 +
 +class MicrobitMachine(QemuSystemTest):
 +
 +    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
 +        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
 +
 +    def test_arm_microbit(self):
 +        self.set_machine('microbit')
 +
 +        micropython = self.ASSET_MICRO.fetch()
 +        self.vm.set_console()
 +        self.vm.add_args('-device', f'loader,file={micropython}')
 +        self.vm.launch()
 +        wait_for_console_pattern(self, 'Type "help()" for more information.')
 +        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
 +        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
 +        wait_for_console_pattern(self, '>>>')
 +
 +if __name__ == '__main__':
 +    QemuSystemTest.main()
 --
-.20.1
+.34.1

-New patch
+[PULL 14/36] target/arm: arm_reset_sve_state() should set FPSR, not FPCR
+The pseudocode ResetSVEState() does:
+    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
+but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.
+Before the advent of FEAT_AFP, this was only setting a collection of
+RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
+was that we didn't actually set the FPSR the way we are supposed to
+do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
+will change the floating point behaviour.
+Call vfp_set_fpsr(), as we ought to.
+(Note for stable backports: commit 7f2a01e7368f9 moved this function
+from sme_helper.c to helper.c, but it had the same bug before the
+move too.)
+Cc: qemu-stable@nongnu.org
+Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
+     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
+     /* Recall that FFR is stored as pregs[16]. */
+     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
+-    vfp_set_fpcr(env, 0x0800009f);
++    vfp_set_fpsr(env, 0x0800009f);
+ }
+ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
+--
+.34.1

-New patch
+[PULL 15/36] target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
+Use the FPSR_ named constants in vfp_exceptbits_from_host(),
+rather than hardcoded magic numbers.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 12 ++++++------
+file changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
+     int target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+-        target_bits |= 1;
++        target_bits |= FPSR_IOC;
+     }
+     if (host_bits & float_flag_divbyzero) {
+-        target_bits |= 2;
++        target_bits |= FPSR_DZC;
+     }
+     if (host_bits & float_flag_overflow) {
+-        target_bits |= 4;
++        target_bits |= FPSR_OFC;
+     }
+     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+-        target_bits |= 8;
++        target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+-        target_bits |= 0x10;
++        target_bits |= FPSR_IXC;
+     }
+     if (host_bits & float_flag_input_denormal) {
+-        target_bits |= 0x80;
++        target_bits |= FPSR_IDC;
+     }
+     return target_bits;
+ }
+--
+.34.1

-New patch
+[PULL 16/36] target/arm: Use uint32_t in vfp_exceptbits_from_host()
+In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
+an "int", and our return type is also "int". However, the only
+callsite returns the same information as a uint32_t, and
+more generally we handle FPSR values in the code as uint32_t,
+not int. Bring this function in to line with that convention.
+There is no behaviour change because none of the FPSR bits
+we set in this function are bit 31. The input argument to
+the function remains 'int' because that is the return type
+of the softfloat get_float_exception_flags().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #ifdef CONFIG_TCG
+ /* Convert host exception flags to vfp form.  */
+-static inline int vfp_exceptbits_from_host(int host_bits)
++static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ {
+-    int target_bits = 0;
++    uint32_t target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+         target_bits |= FPSR_IOC;
+--
+.34.1

-New patch
+[PULL 17/36] target/arm: Define new fp_status_a32 and fp_status_a64
+We want to split the existing fp_status in the Arm CPUState into
+separate float_status fields for AArch32 and AArch64.  (This is
+because new control bits defined by FEAT_AFP only have an effect for
+AArch64, not AArch32.) To make this split we will:
+ * define new fp_status_a32 and fp_status_a64 which have
+   identical behaviour to the existing fp_status
+ * move existing uses of fp_status to fp_status_a32 or
+   fp_status_a64 as appropriate
+ * delete the old fp_status when it has no uses left
+In this patch we add the new float_status fields.
+We will also need to split fp_status_f16, but we will do that
+as a separate series of patches.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           |  4 ++++
+ target/arm/tcg/translate.h | 12 ++++++++++++
+ target/arm/cpu.c           |  2 ++
+ target/arm/vfp_helper.c    | 12 ++++++++++++
+files changed, 30 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+          *  fp_status: is the "normal" fp status.
++         *  fp_status_a32: is the "normal" fp status for AArch32 insns
++         *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+          *  standard_fp_status_fp16 : used for half-precision
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * an explicit FPSCR read.
+          */
+         float_status fp_status;
++        float_status fp_status_a32;
++        float_status fp_status_a64;
+         float_status fp_status_f16;
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  */
+ typedef enum ARMFPStatusFlavour {
+     FPST_FPCR,
++    FPST_A32,
++    FPST_A64,
+     FPST_FPCR_F16,
+     FPST_STD,
+     FPST_STD_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *
+  * FPST_FPCR
+  *   for non-FP16 operations controlled by the FPCR
++ * FPST_A32
++ *   for AArch32 non-FP16 operations controlled by the FPCR
++ * FPST_A64
++ *   for AArch64 non-FP16 operations controlled by the FPCR
+  * FPST_FPCR_F16
+  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_STD
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_FPCR:
+         offset = offsetof(CPUARMState, vfp.fp_status);
+         break;
++    case FPST_A32:
++        offset = offsetof(CPUARMState, vfp.fp_status_a32);
++        break;
++    case FPST_A64:
++        offset = offsetof(CPUARMState, vfp.fp_status_a64);
++        break;
+     case FPST_FPCR_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     uint32_t i;
+     i = get_float_exception_flags(&env->vfp.fp_status);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * be the architecturally up-to-date exception flag information first.
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status);
++    set_float_exception_flags(0, &env->vfp.fp_status_a32);
++    set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             break;
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+     }
+     if (changed & FPCR_FZ16) {
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool ftz_enabled = val & FPCR_FZ;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+     }
+ }
+--
+.34.1

-New patch
+[PULL 18/36] target/arm: Use vfp.fp_status_a64 in A64-only helper functions
+Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
+ * directly reference an fp_status field
+ * are called only from the A64 decoder
+ * are not called inside a set_rmode/restore_rmode sequence
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/sme_helper.c | 2 +-
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 5 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+      * round-to-odd -- see above.
+      */
+     fpst_f16 = env->vfp.fp_status_f16;
+-    fpst_std = env->vfp.fp_status;
++    fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+     fpst_odd = fpst_std;
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t i, oprsz = simd_oprsz(desc);
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += 16) {
+--
+.34.1

-New patch
+[PULL 19/36] target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
+In is_ebf(), we might be called for A64 or A32, but we have
+the CPUARMState* so we can select fp_status_a64 or
+fp_status_a32 accordingly.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/vec_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
+      */
+     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
+-    *statusp = env->vfp.fp_status;
++    *statusp = is_a64(env) ? env->vfp.fp_status_a64 : env->vfp.fp_status_a32;
+     set_default_nan_mode(true, statusp);
+     if (ebf) {
+--
+.34.1

-New patch
+[PULL 20/36] target/arm: Use fp_status_a32 in vjvct helper
+Use fp_status_a32 in the vjcvt helper function; this is called only
+from the A32/T32 decoder and is not used inside a
+set_rmode/restore_rmode sequence.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-9-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
+ uint32_t HELPER(vjcvt)(float64 value, CPUARMState *env)
+ {
+-    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status);
++    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status_a32);
+     uint32_t result = pair;
+     uint32_t z = (pair >> 32) == 0;
+--
+.34.1

-New patch
+[PULL 21/36] target/arm: Use fp_status_a32 in vfp_cmp helpers
+The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
+the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
+(because for A64 we update the main NZCV flags and for A32 we update
+the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
+field instead of fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+ DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+-DO_VFP_cmp(s, float32, float32, fp_status)
+-DO_VFP_cmp(d, float64, float64, fp_status)
++DO_VFP_cmp(s, float32, float32, fp_status_a32)
++DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+ /* Integer to float and float to integer conversions */
+--
+.34.1

-New patch
+[PULL 22/36] target/arm: Use FPST_A32 in A32 decoder
+In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
+file changed, 27 insertions(+), 27 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_rmode = gen_set_rmode(rounding, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_shift = tcg_constant_i32(0);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg32(f0, vn);
+     vfp_load_reg32(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
+     f0 = tcg_temp_new_i64();
+     f1 = tcg_temp_new_i64();
+     fd = tcg_temp_new_i64();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg64(f0, vn);
+     vfp_load_reg64(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negs(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negd(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
+     vfp_store_reg64(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
+ {
+-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rints(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rintd(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd_exact(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg64(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
+     vd = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+     vfp_load_reg64(vm, a->vm);
+-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg32(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f32 */
+         gen_helper_vfp_sitos(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f64 */
+         gen_helper_vfp_sitod(vd, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
+     vd = tcg_temp_new_i64();
+     vfp_load_reg64(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i64();
+     vd = tcg_temp_new_i32();
+     vfp_load_reg64(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 23/36] target/arm: Use FPST_A64 in A64 decoder
+In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
+ target/arm/tcg/translate-sme.c |   4 +-
+ target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
+files changed, 90 insertions(+), 90 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = tcg_constant_i64(0);
+             if (swap) {
+-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_dreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i64 t1 = tcg_temp_new_i64();
+             read_vec_element(s, t1, a->rm, a->idx, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negd(t1, t1);
+             }
+-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negs(t1, t1);
+             }
+-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element(s, t0, a->rn, 0, MO_64);
+             read_vec_element(s, t1, a->rn, 1, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negd(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
+             write_fp_dreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negs(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
+         write_fp_dreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of result is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
+         write_fp_sreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
+     }
+     if (fp_access_check(s)) {
+         TCGv_i64 t = read_fp_dreg(s, a->rn);
+-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
+         gen_helper_fjcvtzs(t, t, fpstatus);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
+      * with von Neumann rounding (round to odd)
+      */
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
++    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
+     tcg_gen_extu_i32_i64(d, tmp);
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tcg_lo = tcg_temp_new_i32();
+     TCGv_i32 tcg_hi = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 ahp = get_ahp_flag();
+     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     gen_helper_vfp_fcvtsd(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
+ static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 tmp = tcg_temp_new_i32();
+     gen_helper_bfcvt_pair(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sme.c
++++ b/target/arm/tcg/translate-sme.c
+@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
+ TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
+            MO_32, gen_helper_sme_fmopa_h)
+ TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
+-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
++           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
+ TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
+-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
++           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
+ TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+  */
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
+ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
+ /*
+  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
+@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
+ TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
+     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
+                         gen_gvec_rax1, a)
+ TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
+            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
+ static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
+-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
++                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
+@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
+                               a->rd, a->rn, a->rm, a->ra,
+-                              (a->index << 1) | sel, FPST_FPCR);
++                              (a->index << 1) | sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
+--
+.34.1

-New patch
+[PULL 24/36] target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
+Now we have moved all the uses of vfp.fp_status and FPST_FPCR
+to either the A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 8 +-------
+files changed, 1 insertion(+), 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+-         *  fp_status: is the "normal" fp status.
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * only thing which needs to read the exception flags being
+          * an explicit FPSCR read.
+          */
+-        float_status fp_status;
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+         float_status fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  * Enum for argument to fpstatus_ptr().
+  */
+ typedef enum ARMFPStatusFlavour {
+-    FPST_FPCR,
+     FPST_A32,
+     FPST_A64,
+     FPST_FPCR_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  * been set up to point to the requested field in the CPU state struct.
+  * The options are:
+  *
+- * FPST_FPCR
+- *   for non-FP16 operations controlled by the FPCR
+  * FPST_A32
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     int offset;
+     switch (flavour) {
+-    case FPST_FPCR:
+-        offset = offsetof(CPUARMState, vfp.fp_status);
+-        break;
+     case FPST_A32:
+         offset = offsetof(CPUARMState, vfp.fp_status_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+ {
+-    uint32_t i;
++    uint32_t i = 0;
+-    i = get_float_exception_flags(&env->vfp.fp_status);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * values. The caller should have arranged for env->vfp.fpsr to
+      * be the architecturally up-to-date exception flag information first.
+      */
+-    set_float_exception_flags(0, &env->vfp.fp_status);
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             i = float_round_to_zero;
+             break;
+         }
+-        set_float_rounding_mode(i, &env->vfp.fp_status);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_FZ) {
+         bool ftz_enabled = val & FPCR_FZ;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+--
+.34.1

-New patch
+[PULL 25/36] target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
+As the first part of splitting the existing fp_status_f16
+into separate float_status fields for AArch32 and AArch64
+(so that we can make FEAT_AFP control bits apply only
+for AArch64), define the two new fp_status_f16_a32 and
+fp_status_f16_a64 fields, but don't use them yet.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           |  4 ++++
+ target/arm/tcg/translate.h | 12 ++++++++++++
+ target/arm/cpu.c           |  2 ++
+ target/arm/vfp_helper.c    | 14 ++++++++++++++
+files changed, 32 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
++         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
++         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+          *  standard_fp_status_fp16 : used for half-precision
+          *       calculations with the ARM "Standard FPSCR Value"
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+         float_status fp_status_f16;
++        float_status fp_status_f16_a32;
++        float_status fp_status_f16_a64;
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+     FPST_A32,
+     FPST_A64,
+     FPST_FPCR_F16,
++    FPST_A32_F16,
++    FPST_A64_F16,
+     FPST_STD,
+     FPST_STD_F16,
+ } ARMFPStatusFlavour;
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *   for AArch64 non-FP16 operations controlled by the FPCR
+  * FPST_FPCR_F16
+  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
++ * FPST_A32_F16
++ *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
++ * FPST_A64_F16
++ *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_STD
+  *   for A32/T32 Neon operations using the "standard FPSCR value"
+  * FPST_STD_F16
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_FPCR_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16);
+         break;
++    case FPST_A32_F16:
++        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
++        break;
++    case FPST_A64_F16:
++        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
++        break;
+     case FPST_STD:
+         offset = offsetof(CPUARMState, vfp.standard_fp_status);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+ #ifndef CONFIG_USER_ONLY
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     /* FZ16 does not generate an input denormal exception.  */
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+           & ~float_flag_input_denormal);
++    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
++          & ~float_flag_input_denormal);
++    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
++          & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
+           & ~float_flag_input_denormal);
+     return vfp_exceptbits_from_host(i);
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
++    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
++    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+ }
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
++        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
++        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
+     }
+     if (changed & FPCR_FZ16) {
+         bool ftz_enabled = val & FPCR_FZ16;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+     }
+     if (changed & FPCR_FZ) {
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
+ }
+--
+.34.1

-New patch
+[PULL 26/36] target/arm: Use fp_status_f16_a32 in AArch32-only helpers
+We directly use fp_status_f16 in a handful of helpers that
+are AArch32-specific; switch to fp_status_f16_a32 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
+---
+ target/arm/tcg/vec_helper.c | 4 ++--
+ target/arm/vfp_helper.c     | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+     softfloat_to_vfp_compare(env, \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
++DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
+ DO_VFP_cmp(s, float32, float32, fp_status_a32)
+ DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+--
+.34.1

-New patch
+[PULL 27/36] target/arm: Use fp_status_f16_a64 in AArch64-only helpers
+We directly use fp_status_f16 in a handful of helpers that are
+AArch64-specific; switch to fp_status_f16_a64 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
+---
+ target/arm/tcg/sme_helper.c | 4 ++--
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+     float_status fpst_odd, fpst_std, fpst_f16;
+     /*
+-     * Make copies of fp_status and fp_status_f16, because this operation
++     * Make copies of the fp status fields we use, because this operation
+      * does not update the cumulative fp exception status.  It also
+      * produces default NaNs. We also need a second copy of fp_status with
+      * round-to-odd -- see above.
+      */
+-    fpst_f16 = env->vfp.fp_status_f16;
++    fpst_f16 = env->vfp.fp_status_f16_a64;
+     fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += 16) {
+         float16 mm_16 = *(float16 *)(vm + i + idx);
+--
+.34.1

-New patch
+[PULL 28/36] target/arm: Use FPST_A32_F16 in A32 decoder
+In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
+file changed, 12 insertions(+), 12 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     /*
+      * Do a half-precision operation. Functionally this is
+      * the same as do_vfp_3op_sp(), except:
+-     *  - it uses the FPST_FPCR_F16
++     *  - it uses the FPST_A32_F16
+      *  - it doesn't need the VFP vector handling (fp16 is a
+      *    v8 feature, and in v8 VFP vectors don't exist)
+      *  - it does the aa32_fp16_arith feature test
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vfp_load_reg16(f0, vn);
+     vfp_load_reg16(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_hp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negh(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_vfp_muladdh(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ DO_VFP_2OP(VNEG, dp, gen_vfp_negd, aa32_fpdp_v2)
+ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_FPCR_F16));
++    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_A32_F16));
+ }
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_hp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_hp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rinth(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_hp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_hp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     if (a->s) {
+         /* i32 -> f16 */
+         gen_helper_vfp_sitoh(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_hp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_hp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg16(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 29/36] target/arm: Use FPST_A64_F16 in A64 decoder
+In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 32 ++++++++---------
+ target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
+files changed, 49 insertions(+), 49 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_hreg(s, a->rm);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_A64_F16));
+             } else {
+-                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+                 gen_vfp_negh(t1, t1);
+             }
+             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
+-                                       fpstatus_ptr(FPST_FPCR_F16));
++                                       fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_16);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negh(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR_F16);
++            fpst = fpstatus_ptr(FPST_A64_F16);
+             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                             a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++                        a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+--
+.34.1

-New patch
+[PULL 30/36] target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
+Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
+to the new A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 7 -------
+files changed, 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          *
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+-         *  fp_status_fp16: used for half-precision calculations
+          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          */
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+-        float_status fp_status_f16;
+         float_status fp_status_f16_a32;
+         float_status fp_status_f16_a64;
+         float_status standard_fp_status;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+ typedef enum ARMFPStatusFlavour {
+     FPST_A32,
+     FPST_A64,
+-    FPST_FPCR_F16,
+     FPST_A32_F16,
+     FPST_A64_F16,
+     FPST_STD,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+  *   for AArch64 non-FP16 operations controlled by the FPCR
+- * FPST_FPCR_F16
+- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A32_F16
+  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A64_F16
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_A64:
+         offset = offsetof(CPUARMState, vfp.fp_status_a64);
+         break;
+-    case FPST_FPCR_F16:
+-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
+-        break;
+     case FPST_A32_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+-          & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+           & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
+     }
+     if (changed & FPCR_FZ16) {
+         bool ftz_enabled = val & FPCR_FZ16;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
+--
+.34.1

-New patch
+[PULL 31/36] fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
+Our float_flag_input_denormal exception flag is set when the fpu code
 flushes an input denormal to zero.  This is what many guest
 architectures (eg classic Arm behaviour) require, but it is not the
 only donarmal-related reason we might want to set an exception flag.
 The x86 behaviour (which we do not currently model correctly) wants
 to see an exception flag when a denormal input is *not* flushed to
 zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
 also wants these semantics.
 Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 to make it clearer when it is set and to allow us to add a new
 float_flag_input_denormal_used next to it for the x86/FEAT_AFP
 semantics.
 Commit created with
  for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done
 and manual editing of softfloat-types.h and softfloat.c to clean
 up the indentation afterwards and to fix a comment which wasn't
 using the full name of the flag.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
 ---
  include/fpu/softfloat-types.h |  5 +++--
  fpu/softfloat.c               |  4 ++--
  target/arm/tcg/sve_helper.c   |  6 +++---
  target/arm/vfp_helper.c       | 10 +++++-----
  target/i386/tcg/fpu_helper.c  |  6 +++---
  target/mips/tcg/msa_helper.c  |  2 +-
  target/rx/op_helper.c         |  2 +-
  fpu/softfloat-parts.c.inc     |  2 +-
 files changed, 19 insertions(+), 18 deletions(-)
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
      float_flag_overflow        = 0x0004,
      float_flag_underflow       = 0x0008,
      float_flag_inexact         = 0x0010,
 -    float_flag_input_denormal  = 0x0020,
 +    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
 +    float_flag_input_denormal_flushed = 0x0020,
      float_flag_output_denormal = 0x0040,
      float_flag_invalid_isi     = 0x0080,  /* inf - inf */
      float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set the inexact flag? */
      bool flush_to_zero;
 -    /* should denormalised inputs go to zero and set the input_denormal flag? */
 +    /* should denormalised inputs go to zero and set input_denormal_flushed? */
      bool flush_inputs_to_zero;
      bool default_nan_mode;
      /*
 diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat.c
 +++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
          if (unlikely(soft_t ## _is_denormal(*a))) {                     \
              *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                       soft_t ## _is_neg(*a));            \
 -            float_raise(float_flag_input_denormal, s);                  \
 +            float_raise(float_flag_input_denormal_flushed, s);          \
          }                                                               \
      }
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
  static bool parts_squash_denormal(FloatParts64 p, float_status *status)
  {
      if (p.exp == 0 && p.frac != 0) {
 -        float_raise(float_flag_input_denormal, status);
 +        float_raise(float_flag_input_denormal_flushed, status);
          return true;
      }
 diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sve_helper.c
 +++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                  return -15 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x1f)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                  return -127 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0xff)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                  return -1023 - clz64(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x7ff)) {
          if (frac == 0) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
      if (host_bits & float_flag_inexact) {
          target_bits |= FPSR_IXC;
      }
 -    if (host_bits & float_flag_input_denormal) {
 +    if (host_bits & float_flag_input_denormal_flushed) {
          target_bits |= FPSR_IDC;
      }
      return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      i |= get_float_exception_flags(&env->vfp.standard_fp_status);
      /* FZ16 does not generate an input denormal exception.  */
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      return vfp_exceptbits_from_host(i);
  }
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
      /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
      inexact = e_new & (float_flag_inexact |
 -                       float_flag_input_denormal |
 +                       float_flag_input_denormal_flushed |
                         float_flag_invalid);
      /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
 diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/fpu_helper.c
 +++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                         (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                         (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                         (new_flags & float_flag_inexact ? FPUS_PE : 0) |
 -                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
 +                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
  }
  static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
              int shift = clz64(temp.l.lower);
              temp.l.lower <<= shift;
              expdif = 1 - EXPBIAS - shift;
 -            float_raise(float_flag_input_denormal, &env->fp_status);
 +            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
          } else {
              expdif = EXPD(temp) - EXPBIAS;
          }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
      uint8_t flags = get_float_exception_flags(&env->sse_status);
      /*
       * The MXCSR denormal flag has opposite semantics to
 -     * float_flag_input_denormal (the softfloat code sets that flag
 +     * float_flag_input_denormal_flushed (the softfloat code sets that flag
       * only when flushing input denormals to zero, but SSE sets it
       * only when not flushing them to zero), so is not converted
       * here.
 diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/msa_helper.c
 +++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
      enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
      /* Set Inexact (I) when flushing inputs to zero */
 -    if ((ieee_exception_flags & float_flag_input_denormal) &&
 +    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
              (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
          if (action & CLEAR_IS_INEXACT) {
              mips_exception_flags &= ~FP_INEXACT;
 diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/op_helper.c
 +++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
          if (xcpt & float_flag_inexact) {
              SET_FPSW(X);
          }
 -        if ((xcpt & (float_flag_input_denormal
 +        if ((xcpt & (float_flag_input_denormal_flushed
                       | float_flag_output_denormal))
              && !FIELD_EX32(env->fpsw, FPSW, DN)) {
              env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
          if (likely(frac_eqz(p))) {
              p->cls = float_class_zero;
          } else if (status->flush_inputs_to_zero) {
 -            float_raise(float_flag_input_denormal, status);
 +            float_raise(float_flag_input_denormal_flushed, status);
              p->cls = float_class_zero;
              frac_clear(p);
          } else {
 --
 .34.1

-New patch
+[PULL 32/36] fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
+Our float_flag_output_denormal exception flag is set when
+the fpu code flushes an output denormal to zero. Rename
+it to float_flag_output_denormal_flushed:
+ * this keeps it parallel with the flag for flushing
+   input denormals, which we just renamed
+ * it makes it clearer that it doesn't mean "set when
+   the output is a denormal"
+Commit created with
+ for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 3 ++-
+ fpu/softfloat.c               | 2 +-
+ target/arm/vfp_helper.c       | 2 +-
+ target/i386/tcg/fpu_helper.c  | 2 +-
+ target/m68k/fpu_helper.c      | 2 +-
+ target/mips/tcg/msa_helper.c  | 2 +-
+ target/rx/op_helper.c         | 2 +-
+ target/tricore/fpu_helper.c   | 6 +++---
+ fpu/softfloat-parts.c.inc     | 2 +-
+files changed, 12 insertions(+), 11 deletions(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ enum {
+     float_flag_inexact         = 0x0010,
+     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+     float_flag_input_denormal_flushed = 0x0020,
+-    float_flag_output_denormal = 0x0040,
++    /* We flushed an output denormal to 0 (because of flush_to_zero) */
++    float_flag_output_denormal_flushed = 0x0040,
+     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
+     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
+     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
+         }
+         if ( zExp <= 0 ) {
+             if (status->flush_to_zero) {
+-                float_raise(float_flag_output_denormal, status);
++                float_raise(float_flag_output_denormal_flushed, status);
+                 return packFloatx80(zSign, 0, 0);
+             }
+             isTiny = status->tininess_before_rounding
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= FPSR_OFC;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
+                    (flags & float_flag_overflow ? FPUS_OE : 0) |
+                    (flags & float_flag_underflow ? FPUS_UE : 0) |
+                    (flags & float_flag_inexact ? FPUS_PE : 0) |
+-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
++                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
+));
+ }
+diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/fpu_helper.c
++++ b/target/m68k/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= 0x40;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= 0x20;
+     }
+     if (host_bits & float_flag_divbyzero) {
+diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/msa_helper.c
++++ b/target/mips/tcg/msa_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
+     }
+     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
+-    if ((ieee_exception_flags & float_flag_output_denormal) &&
++    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
+             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
+         mips_exception_flags |= FP_INEXACT;
+         if (action & CLEAR_FS_UNDERFLOW) {
+diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/op_helper.c
++++ b/target/rx/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
+             SET_FPSW(X);
+         }
+         if ((xcpt & (float_flag_input_denormal_flushed
+-                     | float_flag_output_denormal))
++                     | float_flag_output_denormal_flushed))
+             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
+             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
+         }
+diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/fpu_helper.c
++++ b/target/tricore/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
+            & (float_flag_invalid
+               | float_flag_overflow
+               | float_flag_underflow
+-              | float_flag_output_denormal
++              | float_flag_output_denormal_flushed
+               | float_flag_divbyzero
+               | float_flag_inexact);
+ }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
++    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
+         env->FPU_FU = 1 << 31;
+         some_excp = 1;
+     }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
++    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
+         env->PSW |= 1 << 26;
+         some_excp = 1;
+     }
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
+         }
+         frac_shr(p, frac_shift);
+     } else if (s->flush_to_zero) {
+-        flags |= float_flag_output_denormal;
++        flags |= float_flag_output_denormal_flushed;
+         p->cls = float_class_zero;
+         exp = 0;
+         frac_clear(p);
+--
+.34.1

-New patch
+[PULL 33/36] fpu: Fix a comment in softfloat-types.h
+In softfloat-types.h a comment documents that if the float_status
+field flush_to_zero is set then we flush denormalised results to 0
+and set the inexact flag.  This isn't correct: the status flag that
+we set when flush_to_zero causes us to flush an output to zero is
+float_flag_output_denormal_flushed.
+Correct the comment.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
+     Float3NaNPropRule float_3nan_prop_rule;
+     FloatInfZeroNaNRule float_infzeronan_rule;
+     bool tininess_before_rounding;
+-    /* should denormalised results go to zero and set the inexact flag? */
++    /* should denormalised results go to zero and set output_denormal_flushed? */
+     bool flush_to_zero;
+     /* should denormalised inputs go to zero and set input_denormal_flushed? */
+     bool flush_inputs_to_zero;
+--
+.34.1

-New patch
+[PULL 34/36] target/arm: Remove redundant advsimd float16 helpers
+The advsimd_addh etc helpers defined in helper-a64.c are identical to
+the vfp_addh etc helpers defined in helper-vfp.c: both take two
+float16 inputs (in a uint32_t type) plus a float_status* and are
+simple wrappers around the softfloat float16_* functions.
+(The duplication seems to be a historical accident: we added the
+advsimd helpers in 2018 as part of the A64 implementation, and at
+that time there was no f16 emulation in A32.  Then later we added the
+A32 f16 handling by extending the existing VFP helper macros to
+generate f16 versions as well as f32 and f64, and didn't realise we
+could clean things up.)
+Remove the now-unnecessary advsimd helpers and make the places that
+generated calls to them use the vfp helpers instead. Many of the
+helper functions were already unused.
+(The remaining advsimd_ helpers are those which don't have vfp
+versions.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
+---
+ target/arm/tcg/helper-a64.h    |  8 --------
+ target/arm/tcg/helper-a64.c    |  9 ---------
+ target/arm/tcg/translate-a64.c | 16 ++++++++--------
+files changed, 8 insertions(+), 25 deletions(-)
+diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.h
++++ b/target/arm/tcg/helper-a64.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+ DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
+ DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+ DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.c
++++ b/target/arm/tcg/helper-a64.c
+@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
+     return float16_ ## name(a, b, fpst);    \
+ }
+-ADVSIMD_HALFOP(add)
+-ADVSIMD_HALFOP(sub)
+-ADVSIMD_HALFOP(mul)
+-ADVSIMD_HALFOP(div)
+-ADVSIMD_HALFOP(min)
+-ADVSIMD_HALFOP(max)
+-ADVSIMD_HALFOP(minnum)
+-ADVSIMD_HALFOP(maxnum)
+-
+ #define ADVSIMD_TWOHALFOP(name)                                         \
+ uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
+                                   float_status *fpst)                   \
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
+ TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
+ static const FPScalar f_scalar_fmax = {
+-    gen_helper_advsimd_maxh,
++    gen_helper_vfp_maxh,
+     gen_helper_vfp_maxs,
+     gen_helper_vfp_maxd,
+ };
+ TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
+ static const FPScalar f_scalar_fmin = {
+-    gen_helper_advsimd_minh,
++    gen_helper_vfp_minh,
+     gen_helper_vfp_mins,
+     gen_helper_vfp_mind,
+ };
+ TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
+ static const FPScalar f_scalar_fmaxnm = {
+-    gen_helper_advsimd_maxnumh,
++    gen_helper_vfp_maxnumh,
+     gen_helper_vfp_maxnums,
+     gen_helper_vfp_maxnumd,
+ };
+ TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
+ static const FPScalar f_scalar_fminnm = {
+-    gen_helper_advsimd_minnumh,
++    gen_helper_vfp_minnumh,
+     gen_helper_vfp_minnums,
+     gen_helper_vfp_minnumd,
+ };
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     return true;
+ }
+-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
+-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
+-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
+-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
++TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
++TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
++TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
++TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
+ TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
+ TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
+--
+.34.1

-New patch
+[PULL 35/36] target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
+We should be using the F16-specific float_status for conversions from
+half-precision, because halfprec inputs never set Input Denormal.
+Without FEAT_AHP, using the wrong fpst here had no effect, because
+the only difference between the A64_F16 and A64 fpst is its handling
+of flush-to-zero on input and output, and the helper functions
+vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
+relevant flushing flags, and flush_inputs_to_zero was the only way
+that IDC could be set.
+With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
+input_denormal_used, which we will only ignore in
+vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
+use that one for f16 inputs (and the normal one for single/double to
+f16 conversions).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 9 ++++++---
+ target/arm/tcg/translate-sve.c | 4 ++--
+files changed, 8 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+         TCGv_i32 tcg_op = tcg_temp_new_i32();
+         int srcelt = a->q ? 2 : 0;
++        fpst = fpstatus_ptr(FPST_A64);
++
+         for (pass = 0; pass < 2; pass++) {
+             tcg_res[pass] = tcg_temp_new_i64();
+             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         TCGv_i32 tcg_res[4];
+         TCGv_i32 ahp = get_ahp_flag();
++        fpst = fpstatus_ptr(FPST_A64_F16);
++
+         for (pass = 0; pass < 4; pass++) {
+             tcg_res[pass] = tcg_temp_new_i32();
+             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_bfcvt, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+--
+.34.1

-New patch
+[PULL 36/36] hw/usb/canokey: Fix buffer overflow for OUT packet
+From: Hongren Zheng <i@zenithal.me>
+When USBPacket in OUT direction has larger payload
+than the ep_out_buffer (of size 512), a buffer overflow
+would occur.
+It could be fixed by limiting the size of usb_packet_copy
+to be at most buffer size. Further optimization gets rid
+of the ep_out_buffer and directly uses ep_out as the target
+buffer.
+This is reported by a security researcher who artificially
+constructed an OUT packet of size 2047. The report has gone
+through the QEMU security process, and as this device is for
+testing purpose and no deployment of it in virtualization
+environment is observed, it is triaged not to be a security bug.
+Cc: qemu-stable@nongnu.org
+Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
+Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
+Signed-off-by: Hongren Zheng <i@zenithal.me>
+Message-id: Z4TfMOrZz6IQYl_h@Sun
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/usb/canokey.h | 4 ----
+ hw/usb/canokey.c | 6 +++---
+files changed, 3 insertions(+), 7 deletions(-)
+diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/usb/canokey.h
++++ b/hw/usb/canokey.h
+@@ -XXX,XX +XXX,XX @@
+ #define CANOKEY_EP_NUM 3
+ /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
+ #define CANOKEY_EP_IN_BUFFER_SIZE 2048
+-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
+-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
+ typedef enum {
+     CANOKEY_EP_IN_WAIT,
+@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
+     /* OUT pointer to canokey recv buffer */
+     uint8_t *ep_out[CANOKEY_EP_NUM];
+     uint32_t ep_out_size[CANOKEY_EP_NUM];
+-    /* For large BULK OUT, multiple write to ep_out is needed */
+-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
+     /* Properties */
+     char *file; /* canokey-file */
+diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/usb/canokey.c
++++ b/hw/usb/canokey.c
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
+     switch (p->pid) {
+     case USB_TOKEN_OUT:
+         trace_canokey_handle_data_out(ep_out, p->iov.size);
+-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
+         out_pos = 0;
++        /* segment packet into (possibly multiple) ep_out */
+         while (out_pos != p->iov.size) {
+             /*
+              * key->ep_out[ep_out] set by prepare_receive
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
+              * to be the buffer length
+              */
+             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
+-            memcpy(key->ep_out[ep_out],
+-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
++            /* usb_packet_copy would update the pos offset internally */
++            usb_packet_copy(p, key->ep_out[ep_out], out_len);
+             out_pos += out_len;
+             /* update ep_out_size to actual len */
+             key->ep_out_size[ep_out] = out_len;
+--
+.34.1

Handful of bug fixes to sneak in before rc3.

thanks
-- PMM

The following changes since commit c985266ea5b50e46e07b3568c1346e10064205c9:

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20190726' into staging (2019-07-26 13:52:06 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190726

for you to fetch changes up to 67505c114e6acc26f3a1a2b74833c61b6a34ff95:

hw/arm/boot: Further improve initrd positioning code (2019-07-26 16:17:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix broken migration on pl330 device
 * Fix broken migration on stellaris-input device
 * Add type checks to vmstate varry macros to avoid this class of bugs
 * hw/arm/boot: Fix some remaining cases where we would put the
   initrd on top of the kernel image

----------------------------------------------------------------
Damien Hedde (1):
      pl330: fix vmstate description

Peter Maydell (4):
      stellaris_input: Fix vmstate description of buttons field
      vmstate.h: Type check VMSTATE_STRUCT_VARRAY macros
      hw/arm/boot: Rename elf_{low, high}_addr to image_{low, high}_addr
      hw/arm/boot: Further improve initrd positioning code

include/migration/vmstate.h | 30 ++++++++++++++++++++++++------
 hw/arm/boot.c               | 37 +++++++++++++++++++++++++++----------
 hw/dma/pl330.c              | 17 +++++++++--------
 hw/input/stellaris_input.c  | 10 ++++++----
 4 files changed, 66 insertions(+), 28 deletions(-)

From: Damien Hedde <damien.hedde@greensocs.com>

Fix the pl330 main and queue vmstate description.
There were missing POINTER flags causing crashes during
incoming migration because:
+ PL330State chan field is a pointer to an array
+ PL330Queue queue field is a pointer to an array

Also bump corresponding vmsd version numbers.

Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@redhat.com>
Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-id: 20190724143553.21557-1-damien.hedde@greensocs.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/pl330.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -XXX,XX +XXX,XX @@ typedef struct PL330Queue {
 
 static const VMStateDescription vmstate_pl330_queue = {
     .name = "pl330_queue",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
-        VMSTATE_STRUCT_VARRAY_UINT32(queue, PL330Queue, queue_size, 1,
-                                 vmstate_pl330_queue_entry, PL330QueueEntry),
+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(queue, PL330Queue, queue_size,
+                                             vmstate_pl330_queue_entry,
+                                             PL330QueueEntry),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -XXX,XX +XXX,XX @@ struct PL330State {
 
 static const VMStateDescription vmstate_pl330 = {
     .name = "pl330",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_STRUCT(manager, PL330State, 0, vmstate_pl330_chan, PL330Chan),
-        VMSTATE_STRUCT_VARRAY_UINT32(chan, PL330State, num_chnls, 0,
-                                     vmstate_pl330_chan, PL330Chan),
+        VMSTATE_STRUCT_VARRAY_POINTER_UINT32(chan, PL330State, num_chnls,
+                                             vmstate_pl330_chan, PL330Chan),
         VMSTATE_VBUFFER_UINT32(lo_seqn, PL330State, 1, NULL, num_chnls),
         VMSTATE_VBUFFER_UINT32(hi_seqn, PL330State, 1, NULL, num_chnls),
         VMSTATE_STRUCT(fifo, PL330State, 0, vmstate_pl330_fifo, PL330Fifo),
-- 
2.20.1

gamepad_state::buttons is a pointer to an array of structs,
not an array of structs, so should be declared in the vmstate
with VMSTATE_STRUCT_VARRAY_POINTER_INT32; otherwise we
corrupt memory on incoming migration.

We bump the vmstate version field as the easiest way to
deal with the migration break, since migration wouldn't have
worked reliably before anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
Message-id: 20190725163710.11703-2-peter.maydell@linaro.org
---
 hw/input/stellaris_input.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/input/stellaris_input.c b/hw/input/stellaris_input.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/stellaris_input.c
+++ b/hw/input/stellaris_input.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_stellaris_button = {
 
 static const VMStateDescription vmstate_stellaris_gamepad = {
     .name = "stellaris_gamepad",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(extension, gamepad_state),
-        VMSTATE_STRUCT_VARRAY_INT32(buttons, gamepad_state, num_buttons, 0,
-                              vmstate_stellaris_button, gamepad_button),
+        VMSTATE_STRUCT_VARRAY_POINTER_INT32(buttons, gamepad_state,
+                                            num_buttons,
+                                            vmstate_stellaris_button,
+                                            gamepad_button),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.20.1

The VMSTATE_STRUCT_VARRAY_UINT32 macro is intended to handle
migrating a field which is an array of structs, but where instead of
migrating the entire array we only migrate a variable number of
elements of it.

The VMSTATE_STRUCT_VARRAY_POINTER_UINT32 macro is intended to handle
migrating a field which is of pointer type, and points to a
dynamically allocated array of structs of variable size.

We weren't actually checking that the field passed to
VMSTATE_STRUCT_VARRAY_UINT32 really is an array, with the result that
accidentally using it where the _POINTER_ macro was intended would
compile but silently corrupt memory on migration.

Add type-checking that enforces that the field passed in is
really of the right array type. This applies to all the VMSTATE
macros which use flags including VMS_VARRAY_* but not VMS_POINTER.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Damien Hedde <damien.hedde@greensocs.com>
Tested-by: Damien Hedde <damien.hedde@greensocs.com>
Message-id: 20190725163710.11703-3-peter.maydell@linaro.org
---
 include/migration/vmstate.h | 30 ++++++++++++++++++++++++------
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_bitmap;
 extern const VMStateInfo vmstate_info_qtailq;
 
 #define type_check_2darray(t1,t2,n,m) ((t1(*)[n][m])0 - (t2*)0)
+/*
+ * Check that type t2 is an array of type t1 of size n,
+ * e.g. if t1 is 'foo' and n is 32 then t2 must be 'foo[32]'
+ */
 #define type_check_array(t1,t2,n) ((t1(*)[n])0 - (t2*)0)
 #define type_check_pointer(t1,t2) ((t1**)0 - (t2*)0)
+/*
+ * type of element 0 of the specified (array) field of the type.
+ * Note that if the field is a pointer then this will return the
+ * pointed-to type rather than complaining.
+ */
+#define typeof_elt_of_field(type, field) typeof(((type *)0)->field[0])
+/* Check that field f in struct type t2 is an array of t1, of any size */
+#define type_check_varray(t1, t2, f)                                 \
+    (type_check(t1, typeof_elt_of_field(t2, f))                      \
+     + QEMU_BUILD_BUG_ON_ZERO(!QEMU_IS_ARRAY(((t2 *)0)->f)))
 
 #define vmstate_offset_value(_state, _field, _type)                  \
     (offsetof(_state, _field) +                                      \
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     vmstate_offset_array(_state, _field, uint8_t,                    \
                          sizeof(typeof_field(_state, _field)))
 
+#define vmstate_offset_varray(_state, _field, _type)                 \
+    (offsetof(_state, _field) +                                      \
+     type_check_varray(_type, _state, _field))
+
 /* In the macros below, if there is a _version, that means the macro's
  * field will be processed only if the version being received is >=
  * the _version specified.  In general, if you add a new field, you
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .info       = &(_info),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_VARRAY_UINT32|VMS_MULTIPLY_ELEMENTS,           \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 #define VMSTATE_ARRAY_TEST(_field, _state, _num, _test, _info, _type) {\
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .info       = &(_info),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_VARRAY_INT32,                                  \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 #define VMSTATE_VARRAY_INT32(_field, _state, _field_num, _version, _info, _type) {\
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .info       = &(_info),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_VARRAY_UINT16,                                 \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 #define VMSTATE_VSTRUCT_TEST(_field, _state, _test, _version, _vmsd, _type, _struct_version) { \
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .vmsd       = &(_vmsd),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_STRUCT|VMS_VARRAY_UINT8,                       \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 /* a variable length array (i.e. _type *_field) but we know the
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .vmsd       = &(_vmsd),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_STRUCT|VMS_VARRAY_INT32,                       \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 #define VMSTATE_STRUCT_VARRAY_UINT32(_field, _state, _field_num, _version, _vmsd, _type) { \
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
     .vmsd       = &(_vmsd),                                          \
     .size       = sizeof(_type),                                     \
     .flags      = VMS_STRUCT|VMS_VARRAY_UINT32,                      \
-    .offset     = offsetof(_state, _field),                          \
+    .offset     = vmstate_offset_varray(_state, _field, _type),      \
 }
 
 #define VMSTATE_STRUCT_VARRAY_ALLOC(_field, _state, _field_num, _version, _vmsd, _type) {\
-- 
2.20.1

Rename the elf_low_addr and elf_high_addr variables to image_low_addr
and image_high_addr -- in the next commit we will extend them to
be set for other kinds of image file and not just ELF files.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190722151804.25467-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int kernel_size;
     int initrd_size;
     int is_linux = 0;
-    uint64_t elf_entry, elf_low_addr, elf_high_addr;
+    uint64_t elf_entry;
+    /* Addresses of first byte used and first byte not used by the image */
+    uint64_t image_low_addr, image_high_addr;
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         info->nb_cpus = 1;
 
     /* Assume that raw images are linux kernels, and ELF images are not.  */
-    kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
-                               &elf_high_addr, elf_machine, as);
+    kernel_size = arm_load_elf(info, &elf_entry, &image_low_addr,
+                               &image_high_addr, elf_machine, as);
     if (kernel_size > 0 && have_dtb(info)) {
         /*
          * If there is still some room left at the base of RAM, try and put
          * the DTB there like we do for images loaded with -bios or -pflash.
          */
-        if (elf_low_addr > info->loader_start
-            || elf_high_addr < info->loader_start) {
+        if (image_low_addr > info->loader_start
+            || image_high_addr < info->loader_start) {
             /*
-             * Set elf_low_addr as address limit for arm_load_dtb if it may be
+             * Set image_low_addr as address limit for arm_load_dtb if it may be
              * pointing into RAM, otherwise pass '0' (no limit)
              */
-            if (elf_low_addr < info->loader_start) {
-                elf_low_addr = 0;
+            if (image_low_addr < info->loader_start) {
+                image_low_addr = 0;
             }
             info->dtb_start = info->loader_start;
-            info->dtb_limit = elf_low_addr;
+            info->dtb_limit = image_low_addr;
         }
     }
     entry = elf_entry;
-- 
2.20.1

In commit e6b2b20d9735d4ef we made the boot loader code try to avoid
putting the initrd on top of the kernel.  However the expression used
to calculate the start of the initrd:

info->initrd_start = info->loader_start +
        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);

incorrectly uses 'kernel_size' as the offset within RAM of the
highest address to avoid.  This is incorrect because the kernel
doesn't start at address 0, but slightly higher than that.  This
means that we can still incorrectly end up overlaying the initrd on
the kernel in some cases, for example:

* The kernel's image_size is 0x0a7a8000
* The kernel was loaded at   0x40080000
* The end of the kernel is   0x4A828000
* The DTB was loaded at      0x4a800000

To get this right we need to track the actual highest address used
by the kernel and use that rather than kernel_size. We already
set image_low_addr and image_high_addr for ELF images; set them
also for the various other image types we support, and then use
image_high_addr as the lowest allowed address for the initrd.
(We don't use image_low_addr, but we set it for consistency
with the existing code path for ELF files.)

Fixes: e6b2b20d9735d4ef
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190722151804.25467-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int is_linux = 0;
     uint64_t elf_entry;
     /* Addresses of first byte used and first byte not used by the image */
-    uint64_t image_low_addr, image_high_addr;
+    uint64_t image_low_addr = 0, image_high_addr = 0;
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         uint64_t loadaddr = info->loader_start + KERNEL_NOLOAD_ADDR;
         kernel_size = load_uimage_as(info->kernel_filename, &entry, &loadaddr,
                                      &is_linux, NULL, NULL, as);
+        if (kernel_size >= 0) {
+            image_low_addr = loadaddr;
+            image_high_addr = image_low_addr + kernel_size;
+        }
     }
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64) && kernel_size < 0) {
         kernel_size = load_aarch64_image(info->kernel_filename,
                                          info->loader_start, &entry, as);
         is_linux = 1;
+        if (kernel_size >= 0) {
+            image_low_addr = entry;
+            image_high_addr = image_low_addr + kernel_size;
+        }
     } else if (kernel_size < 0) {
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
                                              ram_end - KERNEL_LOAD_ADDR, as);
         is_linux = 1;
+        if (kernel_size >= 0) {
+            image_low_addr = entry;
+            image_high_addr = image_low_addr + kernel_size;
+        }
     }
     if (kernel_size < 0) {
         error_report("could not load kernel '%s'", info->kernel_filename);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
      * we might still make a bad choice here.
      */
     info->initrd_start = info->loader_start +
-        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+    if (image_high_addr) {
+        info->initrd_start = MAX(info->initrd_start, image_high_addr);
+    }
     info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
 
     if (is_linux) {
-- 
2.20.1

Hi; here's another arm pullreq; by volume most of this is
refactoring from me, but there are also some bugfixes and
other bits and pieces here.

thanks
-- PMM

The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:

Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1

for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:

hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Remove various uses of first_cpu global
 * hw/char/imx_serial: Fix reset value of UFCR register
 * hw/char/imx_serial: Update all state before restarting ageing timer
 * hw/pci-host/designware: Expose MSI IRQ
 * hw/arm/stellaris: refactoring, cleanup
 * hw/arm/stellaris: map both I2C controllers
 * tests/functional: Add a test for the arm microbit machine
 * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
 * target/arm: refactorings preparatory to FEAT_AFP implementation
 * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
 * hw/usb/canokey: Fix buffer overflow for OUT packet

----------------------------------------------------------------
Bernhard Beschow (3):
      hw/char/imx_serial: Fix reset value of UFCR register
      hw/char/imx_serial: Update all state before restarting ageing timer
      hw/pci-host/designware: Expose MSI IRQ

Hongren Zheng (1):
      hw/usb/canokey: Fix buffer overflow for OUT packet

Peter Maydell (22):
      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
      target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
      target/arm: Use uint32_t in vfp_exceptbits_from_host()
      target/arm: Define new fp_status_a32 and fp_status_a64
      target/arm: Use vfp.fp_status_a64 in A64-only helper functions
      target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
      target/arm: Use fp_status_a32 in vjvct helper
      target/arm: Use fp_status_a32 in vfp_cmp helpers
      target/arm: Use FPST_A32 in A32 decoder
      target/arm: Use FPST_A64 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
      target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
      target/arm: Use fp_status_f16_a32 in AArch32-only helpers
      target/arm: Use fp_status_f16_a64 in AArch64-only helpers
      target/arm: Use FPST_A32_F16 in A32 decoder
      target/arm: Use FPST_A64_F16 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
      fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
      fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
      fpu: Fix a comment in softfloat-types.h
      target/arm: Remove redundant advsimd float16 helpers
      target/arm: Use FPST_A64_F16 for halfprec-to-other conversions

Philippe Mathieu-Daudé (9):
      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
      hw/arm/stellaris: Add 'armv7m' local variable
      hw/arm/v7m: Remove use of &first_cpu in machine_init()
      hw/arm/stellaris: Link each board schematic
      hw/arm/stellaris: Constify read-only arrays
      hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
      hw/arm/stellaris: Replace magic numbers by definitions
      hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
      hw/arm/stellaris: Map both I2C controllers

Thomas Huth (1):
      tests/functional: Add a test for the arm microbit machine

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The ARMv7MState object is not simply a CPU, it also
contains the NVIC, SysTick timer, and various MemoryRegions.

Rename the field as 'armv7m', like other Cortex-M boards.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/nrf51_soc.h |  2 +-
 hw/arm/nrf51_soc.c         | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/nrf51_soc.h
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@ struct NRF51State {
     SysBusDevice parent_obj;
 
     /*< public >*/
-    ARMv7MState cpu;
+    ARMv7MState armv7m;
 
     NRF51UARTState uart;
     NRF51RNGState rng;
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     /* This clock doesn't need migration because it is fixed-frequency */
     clock_set_hz(s->sysclk, HCLK_FRQ);
-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
+    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
     /*
      * This SoC has no systick device, so don't connect refclk.
      * TODO: model the lack of systick (currently the armv7m object
      * will always provide one).
      */
 
-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
+    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
                              &error_abort);
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_UART_BASE)));
 
     /* RNG */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_RNG_BASE)));
 
     /* UICR, FICR, NVMC, FLASH */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->cpu),
+                           qdev_get_gpio_in(DEVICE(&s->armv7m),
                                             BASE_TO_IRQ(base_addr)));
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
 
     memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
 
-    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
-    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
+    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
+    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
                          ARM_CPU_TYPE_NAME("cortex-m0"));
-    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
 
     object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
     object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

While the TYPE_ARMV7M object forward its NVIC interrupt lines,
it is somehow misleading to name it 'nvic'. Add the 'armv7m'
local variable for clarity, but also keep the 'nvic' variable
behaving like before when used for wiring IRQ lines.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *nvic;
+    DeviceState *gpio_dev[7], *armv7m, *nvic;
     qemu_irq gpio_in[7][8];
     qemu_irq gpio_out[7][8];
     qemu_irq adc;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
 
-    nvic = qdev_new(TYPE_ARMV7M);
-    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
-    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
-    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
-    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
-    qdev_prop_set_bit(nvic, "enable-bitband", true);
-    qdev_connect_clock_in(nvic, "cpuclk",
+    armv7m = qdev_new(TYPE_ARMV7M);
+    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
+    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
+    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
+    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    qdev_connect_clock_in(armv7m, "cpuclk",
                           qdev_get_clock_out(ssys_dev, "SYSCLK"));
     /* This SoC does not connect the systick reference clock */
-    object_property_set_link(OBJECT(nvic), "memory",
+    object_property_set_link(OBJECT(armv7m), "memory",
                              OBJECT(get_system_memory()), &error_abort);
     /* This will exit with an error if the user passed us a bad cpu_type */
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
+    nvic = armv7m;
 
     /* Now we can wire up the IRQ and MMIO of the system registers */
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

When instanciating the machine model, the machine_init()
implementations usually create the CPUs, so have access
to its first CPU. Use that rather then the &first_cpu
global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
Message-id: 20250112225614.33723-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/b-l475e-iot01a.c    | 2 +-
 hw/arm/microbit.c          | 2 +-
 hw/arm/mps2-tz.c           | 2 +-
 hw/arm/mps2.c              | 2 +-
 hw/arm/msf2-som.c          | 2 +-
 hw/arm/musca.c             | 2 +-
 hw/arm/netduino2.c         | 2 +-
 hw/arm/netduinoplus2.c     | 2 +-
 hw/arm/olimex-stm32-h405.c | 2 +-
 hw/arm/stellaris.c         | 2 +-
 hw/arm/stm32vldiscovery.c  | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/b-l475e-iot01a.c
+++ b/hw/arm/b-l475e-iot01a.c
@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
 
     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
+    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
                        sc->flash_size);
 
     if (object_class_by_name(TYPE_DM163)) {
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
     memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
                                         mr, -1);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
                        0, s->nrf51.flash_size);
 }
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                                     mms->remap_irq);
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
                        0, boot_ram_size(mms));
 }
 
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                  qdev_get_gpio_in(armv7m,
                                   mmc->fpga_type == FPGA_AN511 ? 47 : 13));
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
                        0, 0x400000);
 }
 
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
     cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
                        0, soc->envm_size);
 }
 
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
                                                      "cfg_sec_resp", 0));
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
                        0, 0x2000000);
 }
 
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
                        0, FLASH_SIZE);
 }
 
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/olimex-stm32-h405.c
+++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
     create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
+    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
 }
 
 /* FIXME: Figure out how to generate these from stellaris_boards.  */
diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32vldiscovery.c
+++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

The value of the UCFR register is respected when echoing characters to the
terminal, but its reset value is reserved. Fix the reset value to the one
documented in the datasheet.

While at it move the related attribute out of the section of unimplemented
registers since its value is actually respected.

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
     uint32_t ucr1;
     uint32_t ucr2;
     uint32_t uts1;
+    uint32_t ufcr;
 
     /*
      * The registers below are implemented just so that the
      * guest OS sees what it has written
      */
     uint32_t onems;
-    uint32_t ufcr;
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
     s->ucr3 = 0x700;
     s->ubmr = 0;
     s->ubrc = 4;
+    s->ufcr = BIT(11) | BIT(0);
 
     fifo32_reset(&s->rx_fifo);
     timer_del(&s->ageing_timer);
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes characters to be "echoed" after each keystroke rather than after every
other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
only after every other keystroke.

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
         s->usr1 |= USR1_RRDY;
     }
-
-    imx_serial_rx_fifo_ageing_timer_restart(s);
-
     s->usr2 |= USR2_RDR;
     s->uts1 &= ~UTS1_RXEMPTY;
     if (value & URXD_BRK) {
         s->usr2 |= USR2_BRCD;
     }
+
+    imx_serial_rx_fifo_ageing_timer_restart(s);
+
     imx_update(s);
 }
 
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
the MSI IRQ with the INTx lines, so expose it as a dedicated pin.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h        |  4 +++-
 include/hw/arm/fsl-imx7.h        |  4 +++-
 include/hw/pci-host/designware.h |  1 +
 hw/arm/fsl-imx6.c                | 13 ++++++++++++-
 hw/arm/fsl-imx7.c                | 13 ++++++++++++-
 hw/pci-host/designware.c         |  7 +++----
 hw/arm/Kconfig                   |  2 ++
 7 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/usb/chipidea.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "hw/pci-host/designware.h"
+#include "hw/or-irq.h"
 #include "exec/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     ChipideaState      usb[FSL_IMX6_NUM_USBS];
     IMXFECState        eth;
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
-#define FSL_IMX6_PCIE4_IRQ 123
+#define FSL_IMX6_PCIE4_MSI_IRQ 123
 #define FSL_IMX6_DCIC1_IRQ 124
 #define FSL_IMX6_DCIC2_IRQ 125
 #define FSL_IMX6_MLB150_HIGH_IRQ 126
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/imx_fec.h"
 #include "hw/pci-host/designware.h"
 #include "hw/usb/chipidea.h"
+#include "hw/or-irq.h"
 #include "cpu.h"
 #include "qom/object.h"
 #include "qemu/units.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
     FSL_IMX7_PCI_INTA_IRQ = 125,
     FSL_IMX7_PCI_INTB_IRQ = 124,
     FSL_IMX7_PCI_INTC_IRQ = 123,
-    FSL_IMX7_PCI_INTD_IRQ = 122,
+    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
 
     FSL_IMX7_UART7_IRQ    = 126,
 
diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/designware.h
+++ b/include/hw/pci-host/designware.h
@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
         MemoryRegion io;
 
         qemu_irq     irqs[4];
+        qemu_irq     msi;
     } pci;
 
     MemoryRegion mmio;
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
 
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 }
 
 static void fsl_imx6_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * PCIe PHY
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
      * PCIE
      */
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 
     /*
      * USBs
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * USBs
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -XXX,XX +XXX,XX @@
 #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
 #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
 
-#define DESIGNWARE_PCIE_IRQ_MSI                    3
-
 static DesignwarePCIEHost *
 designware_pcie_root_to_host(DesignwarePCIERoot *root)
 {
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
 
     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
+        qemu_set_irq(host->pci.msi, 1);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
         root->msi.intr[0].status ^= val;
         if (!root->msi.intr[0].status) {
-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
+            qemu_set_irq(host->pci.msi, 0);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
         sysbus_init_irq(sbd, &s->pci.irqs[i]);
     }
+    sysbus_init_irq(sbd, &s->pci.msi);
 
     memory_region_init_io(&s->mmio,
                           OBJECT(s),
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
     select PL310  # cache controller
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
 
 config ASPEED_SOC
     bool
@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
     select WDT_IMX2
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
     select UNIMP
 
 config ARM_SMMUV3
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Board schematic is useful to corroborate GPIOs/IRQs wiring.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-2-philmd@linaro.org
[PMM: Use https:// URLs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
     stellaris_init(machine, &stellaris_boards[1]);
 }
 
+/*
+ * Stellaris LM3S811 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
+ */
 static void lm3s811evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
     .class_init = lm3s811evb_class_init,
 };
 
+/*
+ * Stellaris: LM3S6965 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
+ */
 static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
 }
 
-static uint32_t pllcfg_sandstorm[16] = {
+static const uint32_t pllcfg_sandstorm[16] = {
     0x31c0, /* 1 Mhz */
     0x1ae0, /* 1.8432 Mhz */
     0x18c0, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
     0x585b /* 8.192 Mhz */
 };
 
-static uint32_t pllcfg_fury[16] = {
+static const uint32_t pllcfg_fury[16] = {
     0x3200, /* 1 Mhz */
     0x1b20, /* 1.8432 Mhz */
     0x1900, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
 }
 
 /* Board init.  */
-static stellaris_board_info stellaris_boards[] = {
+static const stellaris_board_info stellaris_boards[] = {
   { "LM3S811EVB",
     0,
     0x0032000e,
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There is nothing mapped at 0x40002000.

I2C#0 is already mapped at 0x40021000.

Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
      *
      * 40000000 wdtimer
-     * 40002000 i2c (unimplemented)
      * 40004000 GPIO
      * 40005000 GPIO
      * 40006000 GPIO
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions for the number of controllers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #define NUM_IRQ_LINES 64
 #define NUM_PRIO_BITS 3
 
+#define NUM_GPIO    7
+#define NUM_UART    4
+#define NUM_GPTM    4
+#define NUM_I2C     2
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
 
 static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 {
-    static const int uart_irq[] = {5, 6, 33, 34};
-    static const int timer_irq[] = {19, 21, 23, 35};
-    static const uint32_t gpio_addr[7] =
+    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
+    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
+    static const uint32_t gpio_addr[NUM_GPIO] =
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
-    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *armv7m, *nvic;
-    qemu_irq gpio_in[7][8];
-    qemu_irq gpio_out[7][8];
+    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
+    qemu_irq gpio_in[NUM_GPIO][8];
+    qemu_irq gpio_out[NUM_GPIO][8];
     qemu_irq adc;
     int sram_size;
     int flash_size;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     } else {
         adc = NULL;
     }
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_GPTM; i++) {
         if (board->dc2 & (0x10000 << i)) {
             SysBusDevice *sbd;
 
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
 
-    for (i = 0; i < 7; i++) {
+    for (i = 0; i < NUM_GPIO; i++) {
         if (board->dc4 & (1 << i)) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_UART; i++) {
         if (board->dc2 & (1 << i)) {
             SysBusDevice *sbd;
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions (DCx_periph) for the DeviceCapability bits,
replace direct bitmask checks with the DEV_CAP() macro,
which use the extract/deposit API.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "qapi/error.h"
 #include "hw/core/split-irq.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
 #define NUM_GPTM    4
 #define NUM_I2C     2
 
+/*
+ * See Stellaris Data Sheet chapter 5.2.5 "System Control",
+ * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
+ */
+#define DC1_WDT          3
+#define DC1_HIB          6
+#define DC1_MPU          7
+#define DC1_ADC          16
+#define DC1_PWM          20
+#define DC2_UART(n)     (n)
+#define DC2_SSI          4
+#define DC2_QEI(n)      (8 + n)
+#define DC2_I2C(n)      (12 + 2 * n)
+#define DC2_GPTM(n)     (16 + n)
+#define DC2_COMP(n)     (24 + n)
+#define DC4_GPIO(n)     (n)
+#define DC4_EMAC         28
+
+#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
     sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
 
-    if (board->dc1 & (1 << 16)) {
+    if (DEV_CAP(1, ADC)) {
         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     qdev_get_gpio_in(nvic, 14),
                                     qdev_get_gpio_in(nvic, 15),
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         adc = NULL;
     }
     for (i = 0; i < NUM_GPTM; i++) {
-        if (board->dc2 & (0x10000 << i)) {
+        if (DEV_CAP(2, GPTM(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new(TYPE_STELLARIS_GPTM);
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc1 & (1 << 3)) { /* watchdog present */
+    if (DEV_CAP(1, WDT)) {
         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
         object_property_add_child(soc_container, "wdg", OBJECT(dev));
         qdev_connect_clock_in(dev, "WDOGCLK",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 
 
     for (i = 0; i < NUM_GPIO; i++) {
-        if (board->dc4 & (1 << i)) {
+        if (DEV_CAP(4, GPIO(i))) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
                                                                 gpio_irq[i]));
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc2 & (1 << 12)) {
+    if (DEV_CAP(2, I2C(0))) {
         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
                                    qdev_get_gpio_in(nvic, 8));
         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
     for (i = 0; i < NUM_UART; i++) {
-        if (board->dc2 & (1 << i)) {
+        if (DEV_CAP(2, UART(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new("pl011_luminary");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
         }
     }
-    if (board->dc2 & (1 << 4)) {
+    if (DEV_CAP(2, SSI)) {
         dev = sysbus_create_simple("pl022", 0x40008000,
                                    qdev_get_gpio_in(nvic, 7));
         if (board->peripherals & BP_OLED_SSI) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             qemu_irq_raise(gpio_out[GPIO_D][0]);
         }
     }
-    if (board->dc4 & (1 << 28)) {
+    if (DEV_CAP(4, EMAC)) {
         DeviceState *enet;
 
         enet = qdev_new("stellaris_enet");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There are 2 I2C controllers, map them both, removing
the unimplemented one. Keep the OLED controller on the
first I2C bus.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-7-philmd@linaro.org
[PMM: tweak to appease maybe-use-uninitialized warning]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
+    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
+    static const int i2c_irq[NUM_I2C] = {8, 37};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qemu_irq adc;
     int sram_size;
     int flash_size;
-    I2CBus *i2c;
+    DeviceState *i2c_dev[NUM_I2C] = { };
     DeviceState *dev;
     DeviceState *ssys_dev;
     int i;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (DEV_CAP(2, I2C(0))) {
-        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
-                                   qdev_get_gpio_in(nvic, 8));
-        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-        if (board->peripherals & BP_OLED_I2C) {
-            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
+    for (i = 0; i < NUM_I2C; i++) {
+        if (DEV_CAP(2, I2C(i))) {
+            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
+                                              qdev_get_gpio_in(nvic,
+                                                               i2c_irq[i]));
         }
     }
+    if (board->peripherals & BP_OLED_I2C) {
+        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
+
+        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
+    }
 
     for (i = 0; i < NUM_UART; i++) {
         if (DEV_CAP(2, UART(i))) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

We don't have any functional tests for this machine yet, thus let's
add a test with a MicroPython binary that is available online
(thanks to Joel Stanley for providing it, see:
 https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250124101709.1591761-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                           |  1 +
 tests/functional/meson.build          |  1 +
 tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100755 tests/functional/test_arm_microbit.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
 F: include/hw/*/nrf51*.h
 F: include/hw/*/microbit*.h
 F: tests/qtest/microbit-test.c
+F: tests/functional/test_arm_microbit.py
 F: docs/system/arm/nrf.rst
 
 ARM PL011 Rust device
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
   'arm_cubieboard',
   'arm_emcraft_sf2',
   'arm_integratorcp',
+  'arm_microbit',
   'arm_orangepi',
   'arm_quanta_gsj',
   'arm_raspi2',
diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/functional/test_arm_microbit.py
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright 2025, The QEMU Project Developers.
+#
+# A functional test that runs MicroPython on the arm microbit machine.
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class MicrobitMachine(QemuSystemTest):
+
+    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
+        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
+
+    def test_arm_microbit(self):
+        self.set_machine('microbit')
+
+        micropython = self.ASSET_MICRO.fetch()
+        self.vm.set_console()
+        self.vm.add_args('-device', f'loader,file={micropython}')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Type "help()" for more information.')
+        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
+        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
+        wait_for_console_pattern(self, '>>>')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
-- 
2.34.1

The pseudocode ResetSVEState() does:
    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.

Before the advent of FEAT_AFP, this was only setting a collection of
RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
was that we didn't actually set the FPSR the way we are supposed to
do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
will change the floating point behaviour.

Call vfp_set_fpsr(), as we ought to.

(Note for stable backports: commit 7f2a01e7368f9 moved this function
from sme_helper.c to helper.c, but it had the same bug before the
move too.)

Cc: qemu-stable@nongnu.org
Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
     /* Recall that FFR is stored as pregs[16]. */
     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
-    vfp_set_fpcr(env, 0x0800009f);
+    vfp_set_fpsr(env, 0x0800009f);
 }
 
 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
-- 
2.34.1

Use the FPSR_ named constants in vfp_exceptbits_from_host(),
rather than hardcoded magic numbers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
     int target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
-        target_bits |= 1;
+        target_bits |= FPSR_IOC;
     }
     if (host_bits & float_flag_divbyzero) {
-        target_bits |= 2;
+        target_bits |= FPSR_DZC;
     }
     if (host_bits & float_flag_overflow) {
-        target_bits |= 4;
+        target_bits |= FPSR_OFC;
     }
     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
-        target_bits |= 8;
+        target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
-        target_bits |= 0x10;
+        target_bits |= FPSR_IXC;
     }
     if (host_bits & float_flag_input_denormal) {
-        target_bits |= 0x80;
+        target_bits |= FPSR_IDC;
     }
     return target_bits;
 }
-- 
2.34.1

In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
an "int", and our return type is also "int". However, the only
callsite returns the same information as a uint32_t, and
more generally we handle FPSR values in the code as uint32_t,
not int. Bring this function in to line with that convention.

There is no behaviour change because none of the FPSR bits
we set in this function are bit 31. The input argument to
the function remains 'int' because that is the return type
of the softfloat get_float_exception_flags().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_TCG
 
 /* Convert host exception flags to vfp form.  */
-static inline int vfp_exceptbits_from_host(int host_bits)
+static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 {
-    int target_bits = 0;
+    uint32_t target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
         target_bits |= FPSR_IOC;
-- 
2.34.1

We want to split the existing fp_status in the Arm CPUState into
separate float_status fields for AArch32 and AArch64.  (This is
because new control bits defined by FEAT_AFP only have an effect for
AArch64, not AArch32.) To make this split we will:
 * define new fp_status_a32 and fp_status_a64 which have
   identical behaviour to the existing fp_status
 * move existing uses of fp_status to fp_status_a32 or
   fp_status_a64 as appropriate
 * delete the old fp_status when it has no uses left

In this patch we add the new float_status fields.

We will also need to split fp_status_f16, but we will do that
as a separate series of patches.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 12 ++++++++++++
 4 files changed, 30 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         /* There are a number of distinct float control structures:
          *
          *  fp_status: is the "normal" fp status.
+         *  fp_status_a32: is the "normal" fp status for AArch32 insns
+         *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * an explicit FPSCR read.
          */
         float_status fp_status;
+        float_status fp_status_a32;
+        float_status fp_status_a64;
         float_status fp_status_f16;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  */
 typedef enum ARMFPStatusFlavour {
     FPST_FPCR,
+    FPST_A32,
+    FPST_A64,
     FPST_FPCR_F16,
     FPST_STD,
     FPST_STD_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *
  * FPST_FPCR
  *   for non-FP16 operations controlled by the FPCR
+ * FPST_A32
+ *   for AArch32 non-FP16 operations controlled by the FPCR
+ * FPST_A64
+ *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR:
         offset = offsetof(CPUARMState, vfp.fp_status);
         break;
+    case FPST_A32:
+        offset = offsetof(CPUARMState, vfp.fp_status_a32);
+        break;
+    case FPST_A64:
+        offset = offsetof(CPUARMState, vfp.fp_status_a64);
+        break;
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     uint32_t i;
 
     i = get_float_exception_flags(&env->vfp.fp_status);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * be the architecturally up-to-date exception flag information first.
      */
     set_float_exception_flags(0, &env->vfp.fp_status);
+    set_float_exception_flags(0, &env->vfp.fp_status_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             break;
         }
         set_float_rounding_mode(i, &env->vfp.fp_status);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
     }
     if (changed & FPCR_FZ16) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool ftz_enabled = val & FPCR_FZ;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
     }
 }
-- 
2.34.1

Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
 * directly reference an fp_status field
 * are called only from the A64 decoder
 * are not called inside a set_rmode/restore_rmode sequence

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/sme_helper.c | 2 +-
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
      * round-to-odd -- see above.
      */
     fpst_f16 = env->vfp.fp_status_f16;
-    fpst_std = env->vfp.fp_status;
+    fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
     fpst_odd = fpst_std;
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t i, oprsz = simd_oprsz(desc);
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += 16) {
-- 
2.34.1

The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
(because for A64 we update the main NZCV flags and for A32 we update
the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
field instead of fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
 DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
-DO_VFP_cmp(s, float32, float32, fp_status)
-DO_VFP_cmp(d, float64, float64, fp_status)
+DO_VFP_cmp(s, float32, float32, fp_status_a32)
+DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
 
 /* Integer to float and float to integer conversions */
-- 
2.34.1

In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-vfp.c
+++ b/target/arm/tcg/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_rmode = gen_set_rmode(rounding, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_shift = tcg_constant_i32(0);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
     f0 = tcg_temp_new_i32();
     f1 = tcg_temp_new_i32();
     fd = tcg_temp_new_i32();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg32(f0, vn);
     vfp_load_reg32(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
     f0 = tcg_temp_new_i64();
     f1 = tcg_temp_new_i64();
     fd = tcg_temp_new_i64();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg64(f0, vn);
     vfp_load_reg64(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negs(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
     vfp_store_reg32(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negd(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
     vfp_store_reg64(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
 
 static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
 {
-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
 {
-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tmp = tcg_temp_new_i32();
 
     vfp_load_reg32(tmp, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rints(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rintd(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints_exact(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd_exact(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg64(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
     vd = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
     vfp_load_reg64(vm, a->vm);
-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg32(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
 
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f32 */
         gen_helper_vfp_sitos(vm, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f64 */
         gen_helper_vfp_sitod(vd, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
     vd = tcg_temp_new_i32();
     vfp_load_reg32(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
     vd = tcg_temp_new_i64();
     vfp_load_reg64(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i64();
     vd = tcg_temp_new_i32();
     vfp_load_reg64(vm, a->vm);
-- 
2.34.1

In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with

perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
 target/arm/tcg/translate-sme.c |   4 +-
 target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
 3 files changed, 90 insertions(+), 90 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, bool is_fp16, int data,
                               gen_helper_gvec_3_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm), fpst,
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, int ra, bool is_fp16, int data,
                               gen_helper_gvec_4_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm),
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = tcg_constant_i64(0);
             if (swap) {
-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_dreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = tcg_constant_i32(0);
             if (swap) {
-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_sreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i64 t1 = tcg_temp_new_i64();
 
             read_vec_element(s, t1, a->rm, a->idx, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i32 t1 = tcg_temp_new_i32();
 
             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negd(t1, t1);
             }
-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negs(t1, t1);
             }
-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element(s, t0, a->rn, 0, MO_64);
             read_vec_element(s, t1, a->rn, 1, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negd(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
             write_fp_dreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negs(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
             write_fp_sreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     if (fp_access_check(s)) {
         MemOp esz = a->esz;
         int elts = (a->q ? 16 : 8) >> esz;
-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
         write_fp_sreg(s, a->rd, res);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
         write_fp_dreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
         /* write_fp_sreg is OK here because top half of result is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
         write_fp_sreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
     TCGv_i32 tcg_shift, tcg_single;
     TCGv_i64 tcg_double;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
 
     switch (esz) {
@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
     TCGv_ptr tcg_fpstatus;
     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
     }
     if (fp_access_check(s)) {
         TCGv_i64 t = read_fp_dreg(s, a->rn);
-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
 
         gen_helper_fjcvtzs(t, t, fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
      * with von Neumann rounding (round to odd)
      */
     TCGv_i32 tmp = tcg_temp_new_i32();
-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
+    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
     tcg_gen_extu_i32_i64(d, tmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tcg_lo = tcg_temp_new_i32();
     TCGv_i32 tcg_hi = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 ahp = get_ahp_flag();
 
     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
     gen_helper_vfp_fcvtsd(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
 
 static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 tmp = tcg_temp_new_i32();
     gen_helper_bfcvt_pair(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn), fpst,
                        is_q ? 16 : 8, vec_full_reg_size(s),
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
 TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
            MO_32, gen_helper_sme_fmopa_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
+           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
+           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
 
 TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
                                  arg_rr_esz *a, int data)
 {
     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 3 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
                                   arg_rrr_esz *a, int data)
 {
     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 4 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
                                    arg_rprr_esz *a)
 {
     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke a vector expander on two Zregs and an immediate.  */
@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
     };
     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
                               (a->index << 1) | sub,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
 };
 TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Fast Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
 
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     fn(temp, t_zn, t_pg, status, t_desc);
 
@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
         TCGv_ptr status =
-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
 };
 TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Accumulating Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
     t_pg = tcg_temp_new_ptr();
     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
 
     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
 
-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
     fn(t_zd, t_zn, t_pg, scalar, status, desc);
 }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
     }
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
                            vec_full_reg_offset(s, a->rm),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
 };
 TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
            a->rd, a->rn, a->rm, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 #define DO_FMLA(NAME, name) \
     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
     };                                                                  \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
 DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
 };
 TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
 };
 TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Unary Operations Predicated Group
  */
 
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frint_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
     gen_helper_sve_frint_d
 };
 TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     gen_helper_sve_frintx_d
 };
 TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
 static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
     }
 
     vsz = vec_full_reg_size(s);
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tmode = gen_set_rmode(mode, status);
 
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
 };
 TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
     NULL,                   gen_helper_sve_fsqrt_h,
     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
 };
 TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
 
 /*
  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
 
 TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 
 static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
                         gen_gvec_rax1, a)
 
 TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
 TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
     gen_helper_flogb_s, gen_helper_flogb_d
 };
 TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
 {
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
 static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
+                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
                               a->rd, a->rn, a->rm, a->ra,
-                              (a->index << 1) | sel, FPST_FPCR);
+                              (a->index << 1) | sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
-- 
2.34.1

Now we have moved all the uses of vfp.fp_status and FPST_FPCR
to either the A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 8 +-------
 4 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
 
         /* There are a number of distinct float control structures:
          *
-         *  fp_status: is the "normal" fp status.
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * only thing which needs to read the exception flags being
          * an explicit FPSCR read.
          */
-        float_status fp_status;
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  * Enum for argument to fpstatus_ptr().
  */
 typedef enum ARMFPStatusFlavour {
-    FPST_FPCR,
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  * been set up to point to the requested field in the CPU state struct.
  * The options are:
  *
- * FPST_FPCR
- *   for non-FP16 operations controlled by the FPCR
  * FPST_A32
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     int offset;
 
     switch (flavour) {
-    case FPST_FPCR:
-        offset = offsetof(CPUARMState, vfp.fp_status);
-        break;
     case FPST_A32:
         offset = offsetof(CPUARMState, vfp.fp_status_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 
 static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 {
-    uint32_t i;
+    uint32_t i = 0;
 
-    i = get_float_exception_flags(&env->vfp.fp_status);
     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * values. The caller should have arranged for env->vfp.fpsr to
      * be the architecturally up-to-date exception flag information first.
      */
-    set_float_exception_flags(0, &env->vfp.fp_status);
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             i = float_round_to_zero;
             break;
         }
-        set_float_rounding_mode(i, &env->vfp.fp_status);
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
-- 
2.34.1

As the first part of splitting the existing fp_status_f16
into separate float_status fields for AArch32 and AArch64
(so that we can make FEAT_AFP control bits apply only
for AArch64), define the two new fp_status_f16_a32 and
fp_status_f16_a64 fields, but don't use them yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 14 ++++++++++++++
 4 files changed, 32 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
+         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
          *       calculations with the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
+        float_status fp_status_f16_a32;
+        float_status fp_status_f16_a64;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
 
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
+    FPST_A32_F16,
+    FPST_A64_F16,
     FPST_STD,
     FPST_STD_F16,
 } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A32_F16
+ *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A64_F16
+ *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
  *   for A32/T32 Neon operations using the "standard FPSCR value"
  * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
+    case FPST_A32_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+        break;
+    case FPST_A64_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
+        break;
     case FPST_STD:
         offset = offsetof(CPUARMState, vfp.standard_fp_status);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
           & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+          & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
           & ~float_flag_input_denormal);
     return vfp_exceptbits_from_host(i);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
     }
     if (changed & FPCR_FZ) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
 }
 
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that
are AArch32-specific; switch to fp_status_f16_a32 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
---
 target/arm/tcg/vec_helper.c | 4 ++--
 target/arm/vfp_helper.c     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
     softfloat_to_vfp_compare(env, \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
 DO_VFP_cmp(s, float32, float32, fp_status_a32)
 DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that are
AArch64-specific; switch to fp_status_f16_a64 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
---
 target/arm/tcg/sme_helper.c | 4 ++--
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
     float_status fpst_odd, fpst_std, fpst_f16;
 
     /*
-     * Make copies of fp_status and fp_status_f16, because this operation
+     * Make copies of the fp status fields we use, because this operation
      * does not update the cumulative fp exception status.  It also
      * produces default NaNs. We also need a second copy of fp_status with
      * round-to-odd -- see above.
      */
-    fpst_f16 = env->vfp.fp_status_f16;
+    fpst_f16 = env->vfp.fp_status_f16_a64;
     fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += 16) {
         float16 mm_16 = *(float16 *)(vm + i + idx);
-- 
2.34.1

In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 32 ++++++++---------
 target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
 2 files changed, 49 insertions(+), 49 deletions(-)

Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
to the new A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 7 -------
 4 files changed, 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
-         *  fp_status_fp16: used for half-precision calculations
          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          */
         float_status fp_status_a32;
         float_status fp_status_a64;
-        float_status fp_status_f16;
         float_status fp_status_f16_a32;
         float_status fp_status_f16_a64;
         float_status standard_fp_status;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
 typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
-    FPST_FPCR_F16,
     FPST_A32_F16,
     FPST_A64_F16,
     FPST_STD,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
  *   for AArch64 non-FP16 operations controlled by the FPCR
- * FPST_FPCR_F16
- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A32_F16
  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A64_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_A64:
         offset = offsetof(CPUARMState, vfp.fp_status_a64);
         break;
-    case FPST_FPCR_F16:
-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
-        break;
     case FPST_A32_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
-          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      */
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         }
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
-- 
2.34.1

Our float_flag_input_denormal exception flag is set when the fpu code
flushes an input denormal to zero.  This is what many guest
architectures (eg classic Arm behaviour) require, but it is not the
only donarmal-related reason we might want to set an exception flag.
The x86 behaviour (which we do not currently model correctly) wants
to see an exception flag when a denormal input is *not* flushed to
zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
also wants these semantics.

Rename float_flag_input_denormal to float_flag_input_denormal_flushed
to make it clearer when it is set and to allow us to add a new
float_flag_input_denormal_used next to it for the x86/FEAT_AFP
semantics.

Commit created with
 for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done

and manual editing of softfloat-types.h and softfloat.c to clean
up the indentation afterwards and to fix a comment which wasn't
using the full name of the flag.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h |  5 +++--
 fpu/softfloat.c               |  4 ++--
 target/arm/tcg/sve_helper.c   |  6 +++---
 target/arm/vfp_helper.c       | 10 +++++-----
 target/i386/tcg/fpu_helper.c  |  6 +++---
 target/mips/tcg/msa_helper.c  |  2 +-
 target/rx/op_helper.c         |  2 +-
 fpu/softfloat-parts.c.inc     |  2 +-
 8 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_overflow        = 0x0004,
     float_flag_underflow       = 0x0008,
     float_flag_inexact         = 0x0010,
-    float_flag_input_denormal  = 0x0020,
+    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+    float_flag_input_denormal_flushed = 0x0020,
     float_flag_output_denormal = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
     bool flush_to_zero;
-    /* should denormalised inputs go to zero and set the input_denormal flag? */
+    /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
     bool default_nan_mode;
     /*
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
         if (unlikely(soft_t ## _is_denormal(*a))) {                     \
             *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                      soft_t ## _is_neg(*a));            \
-            float_raise(float_flag_input_denormal, s);                  \
+            float_raise(float_flag_input_denormal_flushed, s);          \
         }                                                               \
     }
 
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
 static bool parts_squash_denormal(FloatParts64 p, float_status *status)
 {
     if (p.exp == 0 && p.frac != 0) {
-        float_raise(float_flag_input_denormal, status);
+        float_raise(float_flag_input_denormal_flushed, status);
         return true;
     }
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                 return -15 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x1f)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                 return -127 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0xff)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                 return -1023 - clz64(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x7ff)) {
         if (frac == 0) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_inexact) {
         target_bits |= FPSR_IXC;
     }
-    if (host_bits & float_flag_input_denormal) {
+    if (host_bits & float_flag_input_denormal_flushed) {
         target_bits |= FPSR_IDC;
     }
     return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     return vfp_exceptbits_from_host(i);
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
 
     /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
     inexact = e_new & (float_flag_inexact |
-                       float_flag_input_denormal |
+                       float_flag_input_denormal_flushed |
                        float_flag_invalid);
 
     /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                        (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                        (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                        (new_flags & float_flag_inexact ? FPUS_PE : 0) |
-                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
+                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
 }
 
 static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
             int shift = clz64(temp.l.lower);
             temp.l.lower <<= shift;
             expdif = 1 - EXPBIAS - shift;
-            float_raise(float_flag_input_denormal, &env->fp_status);
+            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
         } else {
             expdif = EXPD(temp) - EXPBIAS;
         }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
     uint8_t flags = get_float_exception_flags(&env->sse_status);
     /*
      * The MXCSR denormal flag has opposite semantics to
-     * float_flag_input_denormal (the softfloat code sets that flag
+     * float_flag_input_denormal_flushed (the softfloat code sets that flag
      * only when flushing input denormals to zero, but SSE sets it
      * only when not flushing them to zero), so is not converted
      * here.
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
 
     /* Set Inexact (I) when flushing inputs to zero */
-    if ((ieee_exception_flags & float_flag_input_denormal) &&
+    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         if (action & CLEAR_IS_INEXACT) {
             mips_exception_flags &= ~FP_INEXACT;
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
         if (xcpt & float_flag_inexact) {
             SET_FPSW(X);
         }
-        if ((xcpt & (float_flag_input_denormal
+        if ((xcpt & (float_flag_input_denormal_flushed
                      | float_flag_output_denormal))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
         if (likely(frac_eqz(p))) {
             p->cls = float_class_zero;
         } else if (status->flush_inputs_to_zero) {
-            float_raise(float_flag_input_denormal, status);
+            float_raise(float_flag_input_denormal_flushed, status);
             p->cls = float_class_zero;
             frac_clear(p);
         } else {
-- 
2.34.1

Our float_flag_output_denormal exception flag is set when
the fpu code flushes an output denormal to zero. Rename
it to float_flag_output_denormal_flushed:
 * this keeps it parallel with the flag for flushing
   input denormals, which we just renamed
 * it makes it clearer that it doesn't mean "set when
   the output is a denormal"

Commit created with
 for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 3 ++-
 fpu/softfloat.c               | 2 +-
 target/arm/vfp_helper.c       | 2 +-
 target/i386/tcg/fpu_helper.c  | 2 +-
 target/m68k/fpu_helper.c      | 2 +-
 target/mips/tcg/msa_helper.c  | 2 +-
 target/rx/op_helper.c         | 2 +-
 target/tricore/fpu_helper.c   | 6 +++---
 fpu/softfloat-parts.c.inc     | 2 +-
 9 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_inexact         = 0x0010,
     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
     float_flag_input_denormal_flushed = 0x0020,
-    float_flag_output_denormal = 0x0040,
+    /* We flushed an output denormal to 0 (because of flush_to_zero) */
+    float_flag_output_denormal_flushed = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
         }
         if ( zExp <= 0 ) {
             if (status->flush_to_zero) {
-                float_raise(float_flag_output_denormal, status);
+                float_raise(float_flag_output_denormal_flushed, status);
                 return packFloatx80(zSign, 0, 0);
             }
             isTiny = status->tininess_before_rounding
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= FPSR_OFC;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
                    (flags & float_flag_overflow ? FPUS_OE : 0) |
                    (flags & float_flag_underflow ? FPUS_UE : 0) |
                    (flags & float_flag_inexact ? FPUS_PE : 0) |
-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
+                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
                     0));
 }
 
diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= 0x40;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= 0x20;
     }
     if (host_bits & float_flag_divbyzero) {
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     }
 
     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
-    if ((ieee_exception_flags & float_flag_output_denormal) &&
+    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         mips_exception_flags |= FP_INEXACT;
         if (action & CLEAR_FS_UNDERFLOW) {
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
             SET_FPSW(X);
         }
         if ((xcpt & (float_flag_input_denormal_flushed
-                     | float_flag_output_denormal))
+                     | float_flag_output_denormal_flushed))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
         }
diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/fpu_helper.c
+++ b/target/tricore/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
            & (float_flag_invalid
               | float_flag_overflow
               | float_flag_underflow
-              | float_flag_output_denormal
+              | float_flag_output_denormal_flushed
               | float_flag_divbyzero
               | float_flag_inexact);
 }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
+    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
         env->FPU_FU = 1 << 31;
         some_excp = 1;
     }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
+    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
         env->PSW |= 1 << 26;
         some_excp = 1;
     }
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
         }
         frac_shr(p, frac_shift);
     } else if (s->flush_to_zero) {
-        flags |= float_flag_output_denormal;
+        flags |= float_flag_output_denormal_flushed;
         p->cls = float_class_zero;
         exp = 0;
         frac_clear(p);
-- 
2.34.1

In softfloat-types.h a comment documents that if the float_status
field flush_to_zero is set then we flush denormalised results to 0
and set the inexact flag.  This isn't correct: the status flag that
we set when flush_to_zero causes us to flush an output to zero is
float_flag_output_denormal_flushed.

Correct the comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     Float3NaNPropRule float_3nan_prop_rule;
     FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
-    /* should denormalised results go to zero and set the inexact flag? */
+    /* should denormalised results go to zero and set output_denormal_flushed? */
     bool flush_to_zero;
     /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
-- 
2.34.1

The advsimd_addh etc helpers defined in helper-a64.c are identical to
the vfp_addh etc helpers defined in helper-vfp.c: both take two
float16 inputs (in a uint32_t type) plus a float_status* and are
simple wrappers around the softfloat float16_* functions.

(The duplication seems to be a historical accident: we added the
advsimd helpers in 2018 as part of the A64 implementation, and at
that time there was no f16 emulation in A32.  Then later we added the
A32 f16 handling by extending the existing VFP helper macros to
generate f16 versions as well as f32 and f64, and didn't realise we
could clean things up.)

Remove the now-unnecessary advsimd helpers and make the places that
generated calls to them use the vfp helpers instead. Many of the
helper functions were already unused.

(The remaining advsimd_ helpers are those which don't have vfp
versions.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
---
 target/arm/tcg/helper-a64.h    |  8 --------
 target/arm/tcg/helper-a64.c    |  9 ---------
 target/arm/tcg/translate-a64.c | 16 ++++++++--------
 3 files changed, 8 insertions(+), 25 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
 DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
 DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
 DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
 DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
     return float16_ ## name(a, b, fpst);    \
 }
 
-ADVSIMD_HALFOP(add)
-ADVSIMD_HALFOP(sub)
-ADVSIMD_HALFOP(mul)
-ADVSIMD_HALFOP(div)
-ADVSIMD_HALFOP(min)
-ADVSIMD_HALFOP(max)
-ADVSIMD_HALFOP(minnum)
-ADVSIMD_HALFOP(maxnum)
-
 #define ADVSIMD_TWOHALFOP(name)                                         \
 uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
                                   float_status *fpst)                   \
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
 TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
 
 static const FPScalar f_scalar_fmax = {
-    gen_helper_advsimd_maxh,
+    gen_helper_vfp_maxh,
     gen_helper_vfp_maxs,
     gen_helper_vfp_maxd,
 };
 TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
 
 static const FPScalar f_scalar_fmin = {
-    gen_helper_advsimd_minh,
+    gen_helper_vfp_minh,
     gen_helper_vfp_mins,
     gen_helper_vfp_mind,
 };
 TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
 
 static const FPScalar f_scalar_fmaxnm = {
-    gen_helper_advsimd_maxnumh,
+    gen_helper_vfp_maxnumh,
     gen_helper_vfp_maxnums,
     gen_helper_vfp_maxnumd,
 };
 TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
 
 static const FPScalar f_scalar_fminnm = {
-    gen_helper_advsimd_minnumh,
+    gen_helper_vfp_minnumh,
     gen_helper_vfp_minnums,
     gen_helper_vfp_minnumd,
 };
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     return true;
 }
 
-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
+TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
+TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
+TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
+TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
 
 TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
 TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
-- 
2.34.1

We should be using the F16-specific float_status for conversions from
half-precision, because halfprec inputs never set Input Denormal.

Without FEAT_AHP, using the wrong fpst here had no effect, because
the only difference between the A64_F16 and A64 fpst is its handling
of flush-to-zero on input and output, and the helper functions
vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
relevant flushing flags, and flush_inputs_to_zero was the only way
that IDC could be set.

With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
input_denormal_used, which we will only ignore in
vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
use that one for f16 inputs (and the normal one for single/double to
f16 conversions).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 9 ++++++---
 target/arm/tcg/translate-sve.c | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
         TCGv_i32 tcg_op = tcg_temp_new_i32();
         int srcelt = a->q ? 2 : 0;
 
+        fpst = fpstatus_ptr(FPST_A64);
+
         for (pass = 0; pass < 2; pass++) {
             tcg_res[pass] = tcg_temp_new_i64();
             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         TCGv_i32 tcg_res[4];
         TCGv_i32 ahp = get_ahp_flag();
 
+        fpst = fpstatus_ptr(FPST_A64_F16);
+
         for (pass = 0; pass < 4; pass++) {
             tcg_res[pass] = tcg_temp_new_i32();
             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_bfcvt, a, 0, FPST_A64)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-- 
2.34.1

From: Hongren Zheng <i@zenithal.me>

When USBPacket in OUT direction has larger payload
than the ep_out_buffer (of size 512), a buffer overflow
would occur.

It could be fixed by limiting the size of usb_packet_copy
to be at most buffer size. Further optimization gets rid
of the ep_out_buffer and directly uses ep_out as the target
buffer.

This is reported by a security researcher who artificially
constructed an OUT packet of size 2047. The report has gone
through the QEMU security process, and as this device is for
testing purpose and no deployment of it in virtualization
environment is observed, it is triaged not to be a security bug.

Cc: qemu-stable@nongnu.org
Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
Signed-off-by: Hongren Zheng <i@zenithal.me>
Message-id: Z4TfMOrZz6IQYl_h@Sun
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/canokey.h | 4 ----
 hw/usb/canokey.c | 6 +++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.h
+++ b/hw/usb/canokey.h
@@ -XXX,XX +XXX,XX @@
 #define CANOKEY_EP_NUM 3
 /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
 #define CANOKEY_EP_IN_BUFFER_SIZE 2048
-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
 
 typedef enum {
     CANOKEY_EP_IN_WAIT,
@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
     /* OUT pointer to canokey recv buffer */
     uint8_t *ep_out[CANOKEY_EP_NUM];
     uint32_t ep_out_size[CANOKEY_EP_NUM];
-    /* For large BULK OUT, multiple write to ep_out is needed */
-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
 
     /* Properties */
     char *file; /* canokey-file */
diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
     switch (p->pid) {
     case USB_TOKEN_OUT:
         trace_canokey_handle_data_out(ep_out, p->iov.size);
-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
         out_pos = 0;
+        /* segment packet into (possibly multiple) ep_out */
         while (out_pos != p->iov.size) {
             /*
              * key->ep_out[ep_out] set by prepare_receive
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
              * to be the buffer length
              */
             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
-            memcpy(key->ep_out[ep_out],
-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
+            /* usb_packet_copy would update the pos offset internally */
+            usb_packet_copy(p, key->ep_out[ep_out], out_len);
             out_pos += out_len;
             /* update ep_out_size to actual len */
             key->ep_out_size[ep_out] = out_len;
-- 
2.34.1