Series comparison

-[PULL 0/9] target-arm queue
+[PULL 00/36] target-arm queue
-Arm queue; bugfixes only.
+Hi; here's another arm pullreq; by volume most of this is
 refactoring from me, but there are also some bugfixes and
 other bits and pieces here.
 thanks
 -- PMM
-The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:
+The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)
+  Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1
-for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:
+for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:
-  tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)
+  hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/virt: ARM_VIRT must select ARM_GIC
+ * hw/arm: Remove various uses of first_cpu global
- * exynos: Fix bad printf format specifiers
+ * hw/char/imx_serial: Fix reset value of UFCR register
- * hw/input/ps2.c: Remove remnants of printf debug
+ * hw/char/imx_serial: Update all state before restarting ageing timer
- * target/openrisc: Remove dead code attempting to check "is timer disabled"
+ * hw/pci-host/designware: Expose MSI IRQ
- * register: Remove unnecessary NULL check
+ * hw/arm/stellaris: refactoring, cleanup
- * util/cutils: Fix Coverity array overrun in freq_to_str()
+ * hw/arm/stellaris: map both I2C controllers
- * configure: Make "does libgio work" test pull in some actual functions
+ * tests/functional: Add a test for the arm microbit machine
- * tmp105: reset the T_low and T_High registers
+ * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
- * tmp105: Correct handling of temperature limit checks
+ * target/arm: refactorings preparatory to FEAT_AFP implementation
  * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
  * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
  * hw/usb/canokey: Fix buffer overflow for OUT packet
 ----------------------------------------------------------------
-Alex Chen (1):
+Bernhard Beschow (3):
-      exynos: Fix bad printf format specifiers
+      hw/char/imx_serial: Fix reset value of UFCR register
       hw/char/imx_serial: Update all state before restarting ageing timer
       hw/pci-host/designware: Expose MSI IRQ
-Alistair Francis (1):
+Hongren Zheng (1):
-      register: Remove unnecessary NULL check
+      hw/usb/canokey: Fix buffer overflow for OUT packet
-Andrew Jones (1):
+Peter Maydell (22):
-      hw/arm/virt: ARM_VIRT must select ARM_GIC
+      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
       target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
       target/arm: Use uint32_t in vfp_exceptbits_from_host()
       target/arm: Define new fp_status_a32 and fp_status_a64
       target/arm: Use vfp.fp_status_a64 in A64-only helper functions
       target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
       target/arm: Use fp_status_a32 in vjvct helper
       target/arm: Use fp_status_a32 in vfp_cmp helpers
       target/arm: Use FPST_A32 in A32 decoder
       target/arm: Use FPST_A64 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
       target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
       target/arm: Use fp_status_f16_a32 in AArch32-only helpers
       target/arm: Use fp_status_f16_a64 in AArch64-only helpers
       target/arm: Use FPST_A32_F16 in A32 decoder
       target/arm: Use FPST_A64_F16 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
       fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
       fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
       fpu: Fix a comment in softfloat-types.h
       target/arm: Remove redundant advsimd float16 helpers
       target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
-Peter Maydell (5):
+Philippe Mathieu-Daudé (9):
-      hw/input/ps2.c: Remove remnants of printf debug
+      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
-      target/openrisc: Remove dead code attempting to check "is timer disabled"
+      hw/arm/stellaris: Add 'armv7m' local variable
-      configure: Make "does libgio work" test pull in some actual functions
+      hw/arm/v7m: Remove use of &first_cpu in machine_init()
-      hw/misc/tmp105: reset the T_low and T_High registers
+      hw/arm/stellaris: Link each board schematic
-      tmp105: Correct handling of temperature limit checks
+      hw/arm/stellaris: Constify read-only arrays
       hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
       hw/arm/stellaris: Replace magic numbers by definitions
       hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
       hw/arm/stellaris: Map both I2C controllers
-Philippe Mathieu-Daudé (1):
+Thomas Huth (1):
-      util/cutils: Fix Coverity array overrun in freq_to_str()
+      tests/functional: Add a test for the arm microbit machine
- configure                    | 11 +++++--
+ MAINTAINERS                           |   1 +
- hw/misc/tmp105.h             |  7 +++++
+ hw/usb/canokey.h                      |   4 --
- hw/core/register.c           |  4 ---
+ include/fpu/softfloat-types.h         |  10 +--
- hw/input/ps2.c               |  9 ------
+ include/hw/arm/fsl-imx6.h             |   4 +-
- hw/misc/tmp105.c             | 73 ++++++++++++++++++++++++++++++++++++++------
+ include/hw/arm/fsl-imx7.h             |   4 +-
- hw/timer/exynos4210_mct.c    |  4 +--
+ include/hw/arm/nrf51_soc.h            |   2 +-
- hw/timer/exynos4210_pwm.c    |  8 ++---
+ include/hw/char/imx_serial.h          |   2 +-
- target/openrisc/sys_helper.c |  3 --
+ include/hw/pci-host/designware.h      |   1 +
- util/cutils.c                |  3 +-
+ target/arm/cpu.h                      |  12 ++--
- hw/arm/Kconfig               |  1 +
+ target/arm/tcg/helper-a64.h           |   8 ---
-files changed, 89 insertions(+), 34 deletions(-)
+ target/arm/tcg/translate.h            |  32 ++++++---
  fpu/softfloat.c                       |   6 +-
  hw/arm/b-l475e-iot01a.c               |   2 +-
  hw/arm/fsl-imx6.c                     |  13 +++-
  hw/arm/fsl-imx7.c                     |  13 +++-
  hw/arm/microbit.c                     |   2 +-
  hw/arm/mps2-tz.c                      |   2 +-
  hw/arm/mps2.c                         |   2 +-
  hw/arm/msf2-som.c                     |   2 +-
  hw/arm/musca.c                        |   2 +-
  hw/arm/netduino2.c                    |   2 +-
  hw/arm/netduinoplus2.c                |   2 +-
  hw/arm/nrf51_soc.c                    |  18 ++---
  hw/arm/olimex-stm32-h405.c            |   2 +-
  hw/arm/stellaris.c                    | 118 +++++++++++++++++++-----------
  hw/arm/stm32vldiscovery.c             |   2 +-
  hw/char/imx_serial.c                  |   7 +-
  hw/pci-host/designware.c              |   7 +-
  hw/usb/canokey.c                      |   6 +-
  target/arm/cpu.c                      |   6 +-
  target/arm/helper.c                   |   2 +-
  target/arm/tcg/helper-a64.c           |   9 ---
  target/arm/tcg/sme_helper.c           |   6 +-
  target/arm/tcg/sve_helper.c           |   6 +-
  target/arm/tcg/translate-a64.c        | 103 ++++++++++++++-------------
  target/arm/tcg/translate-sme.c        |   4 +-
  target/arm/tcg/translate-sve.c        | 130 +++++++++++++++++-----------------
  target/arm/tcg/translate-vfp.c        |  78 ++++++++++----------
  target/arm/tcg/vec_helper.c           |  22 +++---
  target/arm/vfp_helper.c               |  73 +++++++++++--------
  target/i386/tcg/fpu_helper.c          |   8 +--
  target/m68k/fpu_helper.c              |   2 +-
  target/mips/tcg/msa_helper.c          |   4 +-
  target/rx/op_helper.c                 |   4 +-
  target/tricore/fpu_helper.c           |   6 +-
  fpu/softfloat-parts.c.inc             |   4 +-
  hw/arm/Kconfig                        |   2 +
  tests/functional/meson.build          |   1 +
  tests/functional/test_arm_microbit.py |  31 ++++++++
 files changed, 452 insertions(+), 337 deletions(-)
  create mode 100755 tests/functional/test_arm_microbit.py

-New patch
+[PULL 01/36] hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+The ARMv7MState object is not simply a CPU, it also
+contains the NVIC, SysTick timer, and various MemoryRegions.
+Rename the field as 'armv7m', like other Cortex-M boards.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20250112225614.33723-2-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/nrf51_soc.h |  2 +-
+ hw/arm/nrf51_soc.c         | 18 +++++++++---------
+files changed, 10 insertions(+), 10 deletions(-)
+diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/nrf51_soc.h
++++ b/include/hw/arm/nrf51_soc.h
+@@ -XXX,XX +XXX,XX @@ struct NRF51State {
+     SysBusDevice parent_obj;
+     /*< public >*/
+-    ARMv7MState cpu;
++    ARMv7MState armv7m;
+     NRF51UARTState uart;
+     NRF51RNGState rng;
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/nrf51_soc.c
++++ b/hw/arm/nrf51_soc.c
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     }
+     /* This clock doesn't need migration because it is fixed-frequency */
+     clock_set_hz(s->sysclk, HCLK_FRQ);
+-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
++    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
+     /*
+      * This SoC has no systick device, so don't connect refclk.
+      * TODO: model the lack of systick (currently the armv7m object
+      * will always provide one).
+      */
+-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
++    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
+                              &error_abort);
+-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
++    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
+     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
+-                       qdev_get_gpio_in(DEVICE(&s->cpu),
++                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                        BASE_TO_IRQ(NRF51_UART_BASE)));
+     /* RNG */
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
+     memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
+-                       qdev_get_gpio_in(DEVICE(&s->cpu),
++                       qdev_get_gpio_in(DEVICE(&s->armv7m),
+                        BASE_TO_IRQ(NRF51_RNG_BASE)));
+     /* UICR, FICR, NVMC, FLASH */
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
+         sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
+         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
+-                           qdev_get_gpio_in(DEVICE(&s->cpu),
++                           qdev_get_gpio_in(DEVICE(&s->armv7m),
+                                             BASE_TO_IRQ(base_addr)));
+     }
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
+     memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
+-    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
+-    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
++    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
++    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
+                          ARM_CPU_TYPE_NAME("cortex-m0"));
+-    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
++    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
+     object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
+     object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
+--
+.34.1

-New patch
+[PULL 02/36] hw/arm/stellaris: Add 'armv7m' local variable
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+While the TYPE_ARMV7M object forward its NVIC interrupt lines,
+it is somehow misleading to name it 'nvic'. Add the 'armv7m'
+local variable for clarity, but also keep the 'nvic' variable
+behaving like before when used for wiring IRQ lines.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20250112225614.33723-3-philmd@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/stellaris.c | 21 +++++++++++----------
+file changed, 11 insertions(+), 10 deletions(-)
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/stellaris.c
++++ b/hw/arm/stellaris.c
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+      */
+     Object *soc_container;
+-    DeviceState *gpio_dev[7], *nvic;
++    DeviceState *gpio_dev[7], *armv7m, *nvic;
+     qemu_irq gpio_in[7][8];
+     qemu_irq gpio_out[7][8];
+     qemu_irq adc;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+     qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
+-    nvic = qdev_new(TYPE_ARMV7M);
+-    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
+-    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
+-    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
+-    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
+-    qdev_prop_set_bit(nvic, "enable-bitband", true);
+-    qdev_connect_clock_in(nvic, "cpuclk",
++    armv7m = qdev_new(TYPE_ARMV7M);
++    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
++    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
++    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
++    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
++    qdev_prop_set_bit(armv7m, "enable-bitband", true);
++    qdev_connect_clock_in(armv7m, "cpuclk",
+                           qdev_get_clock_out(ssys_dev, "SYSCLK"));
+     /* This SoC does not connect the systick reference clock */
+-    object_property_set_link(OBJECT(nvic), "memory",
++    object_property_set_link(OBJECT(armv7m), "memory",
+                              OBJECT(get_system_memory()), &error_abort);
+     /* This will exit with an error if the user passed us a bad cpu_type */
+-    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
++    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
++    nvic = armv7m;
+     /* Now we can wire up the IRQ and MMIO of the system registers */
+     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
+--
+.34.1

-[PULL 6/9] util/cutils: Fix Coverity array overrun in freq_to_str()
+[PULL 03/36] hw/arm/v7m: Remove use of &first_cpu in machine_init()
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):
+When instanciating the machine model, the machine_init()
 implementations usually create the CPUs, so have access
 to its first CPU. Use that rather then the &first_cpu
 global.
->>> Overrunning array "suffixes" of 7 8-byte elements at element
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-    index 7 (byte offset 63) using index "idx" (which evaluates to 7).
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
-Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
+Message-id: 20250112225614.33723-4-philmd@linaro.org
 which is ~18.446 EHz, less than 1000 EHz.
 Reported-by: Eduardo Habkost <ehabkost@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20201101215755.2021421-1-f4bug@amsat.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- util/cutils.c | 3 ++-
+ hw/arm/b-l475e-iot01a.c    | 2 +-
-file changed, 2 insertions(+), 1 deletion(-)
+ hw/arm/microbit.c          | 2 +-
  hw/arm/mps2-tz.c           | 2 +-
  hw/arm/mps2.c              | 2 +-
  hw/arm/msf2-som.c          | 2 +-
  hw/arm/musca.c             | 2 +-
  hw/arm/netduino2.c         | 2 +-
  hw/arm/netduinoplus2.c     | 2 +-
  hw/arm/olimex-stm32-h405.c | 2 +-
  hw/arm/stellaris.c         | 2 +-
  hw/arm/stm32vldiscovery.c  | 2 +-
 files changed, 11 insertions(+), 11 deletions(-)
-diff --git a/util/cutils.c b/util/cutils.c
+diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/cutils.c
+--- a/hw/arm/b-l475e-iot01a.c
-+++ b/util/cutils.c
++++ b/hw/arm/b-l475e-iot01a.c
-@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
+@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
-     double freq = freq_hz;
+     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
-     size_t idx = 0;
+     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
--    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
-+    while (freq >= 1000.0) {
++    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
-         freq /= 1000.0;
+                        sc->flash_size);
-         idx++;
      if (object_class_by_name(TYPE_DM163)) {
 diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/microbit.c
 +++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
      memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
                                          mr, -1);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
 , s->nrf51.flash_size);
  }
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                                      mms->remap_irq);
      }
-+    assert(idx < ARRAY_SIZE(suffixes));
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
++    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
 , boot_ram_size(mms));
  }
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                   qdev_get_gpio_in(armv7m,
                                    mmc->fpga_type == FPGA_AN511 ? 47 : 13));
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
 , 0x400000);
  }
 diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-som.c
 +++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
      cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
      sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
 , soc->envm_size);
  }
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
                                                       "cfg_sec_resp", 0));
      }
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
 , 0x2000000);
  }
 diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduino2.c
 +++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduinoplus2.c
 +++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/olimex-stm32-h405.c
 +++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
      create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
 +    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
  }
  /* FIXME: Figure out how to generate these from stellaris_boards.  */
 diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32vldiscovery.c
 +++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 04/36] hw/char/imx_serial: Fix reset value of UFCR register
+From: Bernhard Beschow <shentey@gmail.com>
+The value of the UCFR register is respected when echoing characters to the
+terminal, but its reset value is reserved. Fix the reset value to the one
+documented in the datasheet.
+While at it move the related attribute out of the section of unimplemented
+registers since its value is actually respected.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/imx_serial.h | 2 +-
+ hw/char/imx_serial.c         | 1 +
+files changed, 2 insertions(+), 1 deletion(-)
+diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/imx_serial.h
++++ b/include/hw/char/imx_serial.h
+@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
+     uint32_t ucr1;
+     uint32_t ucr2;
+     uint32_t uts1;
++    uint32_t ufcr;
+     /*
+      * The registers below are implemented just so that the
+      * guest OS sees what it has written
+      */
+     uint32_t onems;
+-    uint32_t ufcr;
+     uint32_t ubmr;
+     uint32_t ubrc;
+     uint32_t ucr3;
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
+     s->ucr3 = 0x700;
+     s->ubmr = 0;
+     s->ubrc = 4;
++    s->ufcr = BIT(11) | BIT(0);
+     fifo32_reset(&s->rx_fifo);
+     timer_del(&s->ageing_timer);
+--
+.34.1

-New patch
+[PULL 05/36] hw/char/imx_serial: Update all state before restarting ageing timer
+From: Bernhard Beschow <shentey@gmail.com>
+Fixes characters to be "echoed" after each keystroke rather than after every
+other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
+only after every other keystroke.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/char/imx_serial.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
+     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
+         s->usr1 |= USR1_RRDY;
+     }
+-
+-    imx_serial_rx_fifo_ageing_timer_restart(s);
+-
+     s->usr2 |= USR2_RDR;
+     s->uts1 &= ~UTS1_RXEMPTY;
+     if (value & URXD_BRK) {
+         s->usr2 |= USR2_BRCD;
+     }
++
++    imx_serial_rx_fifo_ageing_timer_restart(s);
++
+     imx_update(s);
+ }
+--
+.34.1

-[PULL 1/9] hw/arm/virt: ARM_VIRT must select ARM_GIC
+[PULL 06/36] hw/pci-host/designware: Expose MSI IRQ
-From: Andrew Jones <drjones@redhat.com>
+From: Bernhard Beschow <shentey@gmail.com>
-The removal of the selection of A15MPCORE from ARM_VIRT also
+Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
-removed what A15MPCORE selects, ARM_GIC. We still need ARM_GIC.
+each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
 the MSI IRQ with the INTx lines, so expose it as a dedicated pin.
-Fixes: bec3c97e0cf9 ("hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals")
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20201111143440.112763-1-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 +
+ include/hw/arm/fsl-imx6.h        |  4 +++-
-file changed, 1 insertion(+)
+ include/hw/arm/fsl-imx7.h        |  4 +++-
  include/hw/pci-host/designware.h |  1 +
  hw/arm/fsl-imx6.c                | 13 ++++++++++++-
  hw/arm/fsl-imx7.c                | 13 ++++++++++++-
  hw/pci-host/designware.c         |  7 +++----
  hw/arm/Kconfig                   |  2 ++
 files changed, 36 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/usb/chipidea.h"
+ #include "hw/usb/imx-usb-phy.h"
+ #include "hw/pci-host/designware.h"
++#include "hw/or-irq.h"
+ #include "exec/memory.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+     ChipideaState      usb[FSL_IMX6_NUM_USBS];
+     IMXFECState        eth;
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+ #define FSL_IMX6_PCIE1_IRQ 120
+ #define FSL_IMX6_PCIE2_IRQ 121
+ #define FSL_IMX6_PCIE3_IRQ 122
+-#define FSL_IMX6_PCIE4_IRQ 123
++#define FSL_IMX6_PCIE4_MSI_IRQ 123
+ #define FSL_IMX6_DCIC1_IRQ 124
+ #define FSL_IMX6_DCIC2_IRQ 125
+ #define FSL_IMX6_MLB150_HIGH_IRQ 126
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/imx_fec.h"
+ #include "hw/pci-host/designware.h"
+ #include "hw/usb/chipidea.h"
++#include "hw/or-irq.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+ #include "qemu/units.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
+     IMX7GPRState       gpr;
+     ChipideaState      usb[FSL_IMX7_NUM_USBS];
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
+     FSL_IMX7_PCI_INTA_IRQ = 125,
+     FSL_IMX7_PCI_INTB_IRQ = 124,
+     FSL_IMX7_PCI_INTC_IRQ = 123,
+-    FSL_IMX7_PCI_INTD_IRQ = 122,
++    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
+     FSL_IMX7_UART7_IRQ    = 126,
+diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/pci-host/designware.h
++++ b/include/hw/pci-host/designware.h
+@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
+         MemoryRegion io;
+         qemu_irq     irqs[4];
++        qemu_irq     msi;
+     } pci;
+     MemoryRegion mmio;
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx6.c
++++ b/hw/arm/fsl-imx6.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
+     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+ }
+ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * PCIe PHY
+diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx7.c
++++ b/hw/arm/fsl-imx7.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
+      * PCIE
+      */
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+     /*
+      * USBs
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * USBs
+diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/pci-host/designware.c
++++ b/hw/pci-host/designware.c
+@@ -XXX,XX +XXX,XX @@
+ #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
+ #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
+-#define DESIGNWARE_PCIE_IRQ_MSI                    3
+-
+ static DesignwarePCIEHost *
+ designware_pcie_root_to_host(DesignwarePCIERoot *root)
+ {
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
+     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
+     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
+-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
++        qemu_set_irq(host->pci.msi, 1);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
+     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
+         root->msi.intr[0].status ^= val;
+         if (!root->msi.intr[0].status) {
+-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
++            qemu_set_irq(host->pci.msi, 0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
+     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
+         sysbus_init_irq(sbd, &s->pci.irqs[i]);
+     }
++    sysbus_init_irq(sbd, &s->pci.msi);
+     memory_region_init_io(&s->mmio,
+                           OBJECT(s),
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
-     imply VFIO_PLATFORM
+     select PL310  # cache controller
-     imply VFIO_XGMAC
+     select PCI_EXPRESS_DESIGNWARE
-     imply TPM_TIS_SYSBUS
+     select SDHCI
-+    select ARM_GIC
++    select OR_IRQ
-     select ACPI
-     select ARM_SMMUV3
+ config ASPEED_SOC
-     select GPIO_KEY
+     bool
@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
      select WDT_IMX2
      select PCI_EXPRESS_DESIGNWARE
      select SDHCI
 +    select OR_IRQ
      select UNIMP
  config ARM_SMMUV3
 --
-.20.1
+.34.1

-[PULL 8/9] hw/misc/tmp105: reset the T_low and T_High registers
+[PULL 07/36] hw/arm/stellaris: Link each board schematic
-The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 power-up reset values for the T_low and T_high registers are 80 degrees C
 and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
 values are then shifted right by four bits to give the register reset
 values, since both registers store the 12 bits of temperature data in bits
 [15..4] of a 16 bit register.
-We were resetting these registers to zero, which is problematic for Linux
+Board schematic is useful to corroborate GPIOs/IRQs wiring.
 guests which enable the alert interrupt and then immediately take an
 unexpected overtemperature alert because the current temperature is above
 freezing...
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-2-philmd@linaro.org
+[PMM: Use https:// URLs]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
 ---
- hw/misc/tmp105.c | 3 +++
+ hw/arm/stellaris.c | 8 ++++++++
-file changed, 3 insertions(+)
+file changed, 8 insertions(+)
-diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/misc/tmp105.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
+@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
-     s->faults = tmp105_faultq[(s->config >> 3) & 3];
+     stellaris_init(machine, &stellaris_boards[1]);
      s->alarm = 0;
 +    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
 +    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 +
      tmp105_interrupt_update(s);
  }
++/*
++ * Stellaris LM3S811 Evaluation Board Schematics:
++ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
++ */
+ static void lm3s811evb_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
+     .class_init = lm3s811evb_class_init,
+ };
++/*
++ * Stellaris: LM3S6965 Evaluation Board Schematics:
++ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
++ */
+ static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
+ {
+     MachineClass *mc = MACHINE_CLASS(oc);
 --
-.20.1
+.34.1

-[PULL 9/9] tmp105: Correct handling of temperature limit checks
+[PULL 08/36] hw/arm/stellaris: Constify read-only arrays
-The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 signals an alert when the temperature equals or exceeds the T_high value and
 then remains high until a device register is read or the device responds to
 the SMBUS Alert Response address, or the device is put into Shutdown Mode.
 Thereafter the Alert pin will only be re-signalled when temperature falls
 below T_low; alert can then be cleared in the same set of ways, and the
 device returns to its initial "alert when temperature goes above T_high"
 mode. (If this textual description is confusing, see figure 3 in the
 TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)
-We were misimplementing this as a simple "always alert if temperature is
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-above T_high or below T_low" condition, which gives a spurious alert on
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
+Message-id: 20250110160204.74997-3-philmd@linaro.org
-limit values.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/stellaris.c | 6 +++---
 file changed, 3 insertions(+), 3 deletions(-)
-Implement the correct (hysteresis) behaviour by tracking whether we
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 are currently looking for the temperature to rise over T_high or
 for it to fall below T_low. Our implementation of the comparator
 mode (TM==0) wasn't wrong, but rephrase it to match the way that
 interrupt mode is now handled for clarity.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
 ---
  hw/misc/tmp105.h |  7 +++++
  hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 files changed, 68 insertions(+), 9 deletions(-)
 diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/tmp105.h
+--- a/hw/arm/stellaris.c
-+++ b/hw/misc/tmp105.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ struct TMP105State {
+@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
-     int16_t limit[2];
+   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
-     int faults;
+ }
-     uint8_t alarm;
-+    /*
+-static uint32_t pllcfg_sandstorm[16] = {
-+     * The TMP105 initially looks for a temperature rising above T_high;
++static const uint32_t pllcfg_sandstorm[16] = {
-+     * once this is detected, the condition it looks for next is the
+x31c0, /* 1 Mhz */
-+     * temperature falling below T_low. This flag is false when initially
+x1ae0, /* 1.8432 Mhz */
-+     * looking for T_high, true when looking for T_low.
+x18c0, /* 2 Mhz */
-+     */
+@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
-+    bool detect_falling;
+x585b /* 8.192 Mhz */
  };
- #endif
+-static uint32_t pllcfg_fury[16] = {
-diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
++static const uint32_t pllcfg_fury[16] = {
-index XXXXXXX..XXXXXXX 100644
+x3200, /* 1 Mhz */
---- a/hw/misc/tmp105.c
+x1b20, /* 1.8432 Mhz */
-+++ b/hw/misc/tmp105.c
+x1900, /* 2 Mhz */
-@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
              return;
      }
 -    if ((s->config >> 1) & 1) {                    /* TM */
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 1;
 +    if (s->config >> 1 & 1) {
 +        /*
 +         * TM == 1 : Interrupt mode. We signal Alert when the
 +         * temperature rises above T_high, and expect the guest to clear
 +         * it (eg by reading a device register).
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 1;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      } else {
 -        if (s->temperature >= s->limit[1])
 -            s->alarm = 1;
 -        else if (s->temperature < s->limit[0])
 -            s->alarm = 0;
 +        /*
 +         * TM == 0 : Comparator mode. We signal Alert when the temperature
 +         * rises above T_high, and stop signalling it when the temperature
 +         * falls below T_low.
 +         */
 +        if (s->detect_falling) {
 +            if (s->temperature < s->limit[0]) {
 +                s->alarm = 0;
 +                s->detect_falling = false;
 +            }
 +        } else {
 +            if (s->temperature >= s->limit[1]) {
 +                s->alarm = 1;
 +                s->detect_falling = true;
 +            }
 +        }
      }
      tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
      return 0;
  }
-+static bool detect_falling_needed(void *opaque)
+ /* Board init.  */
-+{
+-static stellaris_board_info stellaris_boards[] = {
-+    TMP105State *s = opaque;
++static const stellaris_board_info stellaris_boards[] = {
-+
+   { "LM3S811EVB",
-+    /*
+,
-+     * We only need to migrate the detect_falling bool if it's set;
+x0032000e,
 +     * for migration from older machines we assume that it is false
 +     * (ie temperature is not out of range).
 +     */
 +    return s->detect_falling;
 +}
 +
 +static const VMStateDescription vmstate_tmp105_detect_falling = {
 +    .name = "TMP105/detect-falling",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = detect_falling_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_BOOL(detect_falling, TMP105State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_tmp105 = {
      .name = "TMP105",
      .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
          VMSTATE_UINT8(alarm, TMP105State),
          VMSTATE_I2C_SLAVE(i2c, TMP105State),
          VMSTATE_END_OF_LIST()
 +    },
 +    .subsections = (const VMStateDescription*[]) {
 +        &vmstate_tmp105_detect_falling,
 +        NULL
      }
  };
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
      s->config = 0;
      s->faults = tmp105_faultq[(s->config >> 3) & 3];
      s->alarm = 0;
 +    s->detect_falling = false;
      s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
      s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
 --
-.20.1
+.34.1

-[PULL 7/9] configure: Make "does libgio work" test pull in some actual functions
+[PULL 09/36] hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
-In commit 76346b6264a9b01979 we tried to add a configure check that
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 the libgio pkg-config data was correct, which builds an executable
 linked against it.  Unfortunately this doesn't catch the problem
 (missing static library dependency info), because a "do nothing" test
 source file doesn't have any symbol references that cause the linker
 to pull in .o files from libgio.a, and so we don't see the "missing
 symbols from libmount" error that a full QEMU link triggers.
-(The ineffective test went unnoticed because of a typo that
+There is nothing mapped at 0x40002000.
 effectively disabled libgio unconditionally, but after commit
 a5dfc11f2 fixed that, a static link of the system emulator on
 Ubuntu stopped working again.)
-Improve the gio test by having the test source fragment reference a
+I2C#0 is already mapped at 0x40021000.
 g_dbus function (which is what is indirectly causing us to end up
 wanting functions from libmount).
+Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-4-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
 ---
- configure | 11 +++++++++--
+ hw/arm/stellaris.c | 2 --
-file changed, 9 insertions(+), 2 deletions(-)
+file changed, 2 deletions(-)
-diff --git a/configure b/configure
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/hw/arm/stellaris.c
-+++ b/configure
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     # Check that the libraries actually work -- Ubuntu 18.04 ships
+      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
-     # with pkg-config --static --libs data for gio-2.0 that is missing
+      *
-     # -lblkid and will give a link error.
+      * 40000000 wdtimer
--    write_c_skeleton
+-     * 40002000 i2c (unimplemented)
--    if compile_prog "" "$gio_libs" ; then
+      * 40004000 GPIO
-+    cat > $TMPC <<EOF
+      * 40005000 GPIO
-+#include <gio/gio.h>
+      * 40006000 GPIO
-+int main(void)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+{
+     /* Add dummy regions for the devices we don't implement yet,
-+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+      * so guest accesses don't cause unlogged crashes.
-+    return 0;
+      */
-+}
+-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
-+EOF
+     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
-+    if compile_prog "$gio_cflags" "$gio_libs" ; then
+     create_unimplemented_device("PWM", 0x40028000, 0x1000);
-         gio=yes
+     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
      else
          gio=no
 --
-.20.1
+.34.1

-[PULL 5/9] register: Remove unnecessary NULL check
+[PULL 10/36] hw/arm/stellaris: Replace magic numbers by definitions
-From: Alistair Francis <alistair.francis@wdc.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-This patch fixes CID 1432800 by removing an unnecessary check.
+Add definitions for the number of controllers.
-Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-5-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/core/register.c | 4 ----
+ hw/arm/stellaris.c | 25 +++++++++++++++----------
-file changed, 4 deletions(-)
+file changed, 15 insertions(+), 10 deletions(-)
-diff --git a/hw/core/register.c b/hw/core/register.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/register.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/core/register.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
+@@ -XXX,XX +XXX,XX @@
-         int index = rae[i].addr / data_size;
+ #define NUM_IRQ_LINES 64
-         RegisterInfo *r = &ri[index];
+ #define NUM_PRIO_BITS 3
--        if (data + data_size * index == 0 || !&rae[i]) {
++#define NUM_GPIO    7
--            continue;
++#define NUM_UART    4
--        }
++#define NUM_GPTM    4
--
++#define NUM_I2C     2
-         /* Init the register, this will zero it. */
++
-         object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
+ typedef const struct {
      const char *name;
      uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
  static void stellaris_init(MachineState *ms, stellaris_board_info *board)
  {
 -    static const int uart_irq[] = {5, 6, 33, 34};
 -    static const int timer_irq[] = {19, 21, 23, 35};
 -    static const uint32_t gpio_addr[7] =
 +    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
 +    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
 +    static const uint32_t gpio_addr[NUM_GPIO] =
        { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
 x40024000, 0x40025000, 0x40026000};
 -    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
 +    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
      /* Memory map of SoC devices, from
       * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
       */
      Object *soc_container;
 -    DeviceState *gpio_dev[7], *armv7m, *nvic;
 -    qemu_irq gpio_in[7][8];
 -    qemu_irq gpio_out[7][8];
 +    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
 +    qemu_irq gpio_in[NUM_GPIO][8];
 +    qemu_irq gpio_out[NUM_GPIO][8];
      qemu_irq adc;
      int sram_size;
      int flash_size;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      } else {
          adc = NULL;
      }
 -    for (i = 0; i < 4; i++) {
 +    for (i = 0; i < NUM_GPTM; i++) {
          if (board->dc2 & (0x10000 << i)) {
              SysBusDevice *sbd;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      }
 -    for (i = 0; i < 7; i++) {
 +    for (i = 0; i < NUM_GPIO; i++) {
          if (board->dc4 & (1 << i)) {
              gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                 qdev_get_gpio_in(nvic,
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          }
      }
 -    for (i = 0; i < 4; i++) {
 +    for (i = 0; i < NUM_UART; i++) {
          if (board->dc2 & (1 << i)) {
              SysBusDevice *sbd;
 --
-.20.1
+.34.1

-[PULL 2/9] exynos: Fix bad printf format specifiers
+[PULL 11/36] hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
-From: Alex Chen <alex.chen@huawei.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-We should use printf format specifier "%u" instead of "%d" for
+Add definitions (DCx_periph) for the DeviceCapability bits,
-argument of type "unsigned int".
+replace direct bitmask checks with the DEV_CAP() macro,
 which use the extract/deposit API.
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Alex Chen <alex.chen@huawei.com>
 Message-id: 20201111073651.72804-1-alex.chen@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-6-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/exynos4210_mct.c | 4 ++--
+ hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
- hw/timer/exynos4210_pwm.c | 8 ++++----
+file changed, 29 insertions(+), 8 deletions(-)
 files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/exynos4210_mct.c
+--- a/hw/arm/stellaris.c
-+++ b/hw/timer/exynos4210_mct.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
+@@ -XXX,XX +XXX,XX @@
-     /* If CSTAT is pending and IRQ is enabled */
+  */
-     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
-             (s->reg.int_enb & G_INT_ENABLE(id))) {
+ #include "qemu/osdep.h"
--        DPRINTF("gcmp timer[%d] IRQ\n", id);
++#include "qemu/bitops.h"
-+        DPRINTF("gcmp timer[%u] IRQ\n", id);
+ #include "qapi/error.h"
-         qemu_irq_raise(s->irq[id]);
+ #include "hw/core/split-irq.h"
  #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
  #define NUM_GPTM    4
  #define NUM_I2C     2
 +/*
 + * See Stellaris Data Sheet chapter 5.2.5 "System Control",
 + * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
 + */
 +#define DC1_WDT          3
 +#define DC1_HIB          6
 +#define DC1_MPU          7
 +#define DC1_ADC          16
 +#define DC1_PWM          20
 +#define DC2_UART(n)     (n)
 +#define DC2_SSI          4
 +#define DC2_QEI(n)      (8 + n)
 +#define DC2_I2C(n)      (12 + 2 * n)
 +#define DC2_GPTM(n)     (16 + n)
 +#define DC2_COMP(n)     (24 + n)
 +#define DC4_GPIO(n)     (n)
 +#define DC4_EMAC         28
 +
 +#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
 +
  typedef const struct {
      const char *name;
      uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
      sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
 -    if (board->dc1 & (1 << 16)) {
 +    if (DEV_CAP(1, ADC)) {
          dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                      qdev_get_gpio_in(nvic, 14),
                                      qdev_get_gpio_in(nvic, 15),
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          adc = NULL;
      }
- }
+     for (i = 0; i < NUM_GPTM; i++) {
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
+-        if (board->dc2 & (0x10000 << i)) {
-                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
++        if (DEV_CAP(2, GPTM(i))) {
+             SysBusDevice *sbd;
-     if (freq != s->freq) {
--        DPRINTF("freq=%dHz\n", s->freq);
+             dev = qdev_new(TYPE_STELLARIS_GPTM);
-+        DPRINTF("freq=%uHz\n", s->freq);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+         }
          /* global timer */
          tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
 diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/timer/exynos4210_pwm.c
 +++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
      if (freq != s->timer[id].freq) {
          ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
 -        DPRINTF("freq=%dHz\n", s->timer[id].freq);
 +        DPRINTF("freq=%uHz\n", s->timer[id].freq);
      }
- }
+-    if (board->dc1 & (1 << 3)) { /* watchdog present */
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
++    if (DEV_CAP(1, WDT)) {
-     uint32_t id = s->id;
+         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
-     bool cmp;
+         object_property_add_child(soc_container, "wdg", OBJECT(dev));
+         qdev_connect_clock_in(dev, "WDOGCLK",
--    DPRINTF("timer %d tick\n", id);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+    DPRINTF("timer %u tick\n", id);
-     /* set irq status */
+     for (i = 0; i < NUM_GPIO; i++) {
-     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
+-        if (board->dc4 & (1 << i)) {
++        if (DEV_CAP(4, GPIO(i))) {
-     /* raise IRQ */
+             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
-     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
+                                                qdev_get_gpio_in(nvic,
--        DPRINTF("timer %d IRQ\n", id);
+                                                                 gpio_irq[i]));
-+        DPRINTF("timer %u IRQ\n", id);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-         qemu_irq_raise(p->timer[id].irq);
+         }
      }
-@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
+-    if (board->dc2 & (1 << 12)) {
 +    if (DEV_CAP(2, I2C(0))) {
          dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
                                     qdev_get_gpio_in(nvic, 8));
          i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      }
-     if (cmp) {
+     for (i = 0; i < NUM_UART; i++) {
--        DPRINTF("auto reload timer %d count to %x\n", id,
+-        if (board->dc2 & (1 << i)) {
-+        DPRINTF("auto reload timer %u count to %x\n", id,
++        if (DEV_CAP(2, UART(i))) {
-                 p->timer[id].reg_tcntb);
+             SysBusDevice *sbd;
-         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
-         ptimer_run(p->timer[id].ptimer, 1);
+             dev = qdev_new("pl011_luminary");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
              sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
          }
      }
 -    if (board->dc2 & (1 << 4)) {
 +    if (DEV_CAP(2, SSI)) {
          dev = sysbus_create_simple("pl022", 0x40008000,
                                     qdev_get_gpio_in(nvic, 7));
          if (board->peripherals & BP_OLED_SSI) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
              qemu_irq_raise(gpio_out[GPIO_D][0]);
          }
      }
 -    if (board->dc4 & (1 << 28)) {
 +    if (DEV_CAP(4, EMAC)) {
          DeviceState *enet;
          enet = qdev_new("stellaris_enet");
 --
-.20.1
+.34.1

-[PULL 4/9] target/openrisc: Remove dead code attempting to check "is timer disabled"
+[PULL 12/36] hw/arm/stellaris: Map both I2C controllers
-In the mtspr helper we attempt to check for "is the timer disabled"
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
 with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
 is zero and the condition is always false (Coverity complains about
 the dead code.)
-The correct check would be to test whether the TTMR_M field in the
+There are 2 I2C controllers, map them both, removing
-register is equal to TIMER_NONE instead.  However, the
+the unimplemented one. Keep the OLED controller on the
-cpu_openrisc_timer_update() function checks whether the timer is
+first I2C bus.
 enabled (it looks at cpu->env.is_counting, which is set to 0 via
 cpu_openrisc_count_stop() when the TTMR_M field is set to
 TIMER_NONE), so there's no need to check for "timer disabled" in the
 target/openrisc code.  Instead, simply remove the dead code.
-Fixes: Coverity CID 1005812
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20250110160204.74997-7-philmd@linaro.org
 [PMM: tweak to appease maybe-use-uninitialized warning]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Stafford Horne <shorne@gmail.com>
-Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
 ---
- target/openrisc/sys_helper.c | 3 ---
+ hw/arm/stellaris.c | 21 +++++++++++++--------
-file changed, 3 deletions(-)
+file changed, 13 insertions(+), 8 deletions(-)
-diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/openrisc/sys_helper.c
+--- a/hw/arm/stellaris.c
-+++ b/target/openrisc/sys_helper.c
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
-     case TO_SPR(10, 1): /* TTCR */
+x40024000, 0x40025000, 0x40026000};
-         cpu_openrisc_count_set(cpu, rb);
+     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
--        if (env->ttmr & TIMER_NONE) {
++    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
--            return;
++    static const int i2c_irq[NUM_I2C] = {8, 37};
--        }
-         cpu_openrisc_timer_update(cpu);
+     /* Memory map of SoC devices, from
-         break;
+      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
- #endif
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      qemu_irq adc;
      int sram_size;
      int flash_size;
 -    I2CBus *i2c;
 +    DeviceState *i2c_dev[NUM_I2C] = { };
      DeviceState *dev;
      DeviceState *ssys_dev;
      int i;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
          }
      }
 -    if (DEV_CAP(2, I2C(0))) {
 -        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
 -                                   qdev_get_gpio_in(nvic, 8));
 -        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
 -        if (board->peripherals & BP_OLED_I2C) {
 -            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
 +    for (i = 0; i < NUM_I2C; i++) {
 +        if (DEV_CAP(2, I2C(i))) {
 +            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
 +                                              qdev_get_gpio_in(nvic,
 +                                                               i2c_irq[i]));
          }
      }
 +    if (board->peripherals & BP_OLED_I2C) {
 +        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
 +
 +        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
 +    }
      for (i = 0; i < NUM_UART; i++) {
          if (DEV_CAP(2, UART(i))) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      /* Add dummy regions for the devices we don't implement yet,
       * so guest accesses don't cause unlogged crashes.
       */
 -    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
      create_unimplemented_device("PWM", 0x40028000, 0x1000);
      create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
      create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
 --
-.20.1
+.34.1

-[PULL 3/9] hw/input/ps2.c: Remove remnants of printf debug
+[PULL 13/36] tests/functional: Add a test for the arm microbit machine
-In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
+From: Thomas Huth <thuth@redhat.com>
 and mouse emulation. However we didn't remove all the debug-by-printf
 support. In fact there is only one printf() remaining, and it is
 redundant with the trace_ps2_write_mouse() event next to it.
 Remove the printf() and the now-unused DEBUG* macros.
+We don't have any functional tests for this machine yet, thus let's
+add a test with a MicroPython binary that is available online
+(thanks to Joel Stanley for providing it, see:
+ https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20250124101709.1591761-1-thuth@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
 ---
- hw/input/ps2.c | 9 ---------
+ MAINTAINERS                           |  1 +
-file changed, 9 deletions(-)
+ tests/functional/meson.build          |  1 +
  tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
 files changed, 33 insertions(+)
  create mode 100755 tests/functional/test_arm_microbit.py
-diff --git a/hw/input/ps2.c b/hw/input/ps2.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/input/ps2.c
+--- a/MAINTAINERS
-+++ b/hw/input/ps2.c
++++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
  F: include/hw/*/nrf51*.h
  F: include/hw/*/microbit*.h
  F: tests/qtest/microbit-test.c
 +F: tests/functional/test_arm_microbit.py
  F: docs/system/arm/nrf.rst
  ARM PL011 Rust device
 diff --git a/tests/functional/meson.build b/tests/functional/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/functional/meson.build
 +++ b/tests/functional/meson.build
@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
    'arm_cubieboard',
    'arm_emcraft_sf2',
    'arm_integratorcp',
 +  'arm_microbit',
    'arm_orangepi',
    'arm_quanta_gsj',
    'arm_raspi2',
 diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
 new file mode 100755
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/functional/test_arm_microbit.py
 @@ -XXX,XX +XXX,XX @@
++#!/usr/bin/env python3
- #include "trace.h"
++#
++# SPDX-License-Identifier: GPL-2.0-or-later
--/* debug PC keyboard */
++#
--//#define DEBUG_KBD
++# Copyright 2025, The QEMU Project Developers.
--
++#
--/* debug PC keyboard : only mouse */
++# A functional test that runs MicroPython on the arm microbit machine.
--//#define DEBUG_MOUSE
++
--
++from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
- /* Keyboard Commands */
++from qemu_test import wait_for_console_pattern
- #define KBD_CMD_SET_LEDS    0xED    /* Set keyboard leds */
++
- #define KBD_CMD_ECHO         0xEE
++
-@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
++class MicrobitMachine(QemuSystemTest):
-     PS2MouseState *s = (PS2MouseState *)opaque;
++
++    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
-     trace_ps2_write_mouse(opaque, val);
++        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
--#ifdef DEBUG_MOUSE
++
--    printf("kbd: write mouse 0x%02x\n", val);
++    def test_arm_microbit(self):
--#endif
++        self.set_machine('microbit')
-     switch(s->common.write_cmd) {
++
-     default:
++        micropython = self.ASSET_MICRO.fetch()
-     case -1:
++        self.vm.set_console()
 +        self.vm.add_args('-device', f'loader,file={micropython}')
 +        self.vm.launch()
 +        wait_for_console_pattern(self, 'Type "help()" for more information.')
 +        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
 +        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
 +        wait_for_console_pattern(self, '>>>')
 +
 +if __name__ == '__main__':
 +    QemuSystemTest.main()
 --
-.20.1
+.34.1

-New patch
+[PULL 14/36] target/arm: arm_reset_sve_state() should set FPSR, not FPCR
+The pseudocode ResetSVEState() does:
+    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
+but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.
+Before the advent of FEAT_AFP, this was only setting a collection of
+RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
+was that we didn't actually set the FPSR the way we are supposed to
+do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
+will change the floating point behaviour.
+Call vfp_set_fpsr(), as we ought to.
+(Note for stable backports: commit 7f2a01e7368f9 moved this function
+from sme_helper.c to helper.c, but it had the same bug before the
+move too.)
+Cc: qemu-stable@nongnu.org
+Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
+     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
+     /* Recall that FFR is stored as pregs[16]. */
+     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
+-    vfp_set_fpcr(env, 0x0800009f);
++    vfp_set_fpsr(env, 0x0800009f);
+ }
+ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
+--
+.34.1

-New patch
+[PULL 15/36] target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
+Use the FPSR_ named constants in vfp_exceptbits_from_host(),
+rather than hardcoded magic numbers.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 12 ++++++------
+file changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
+     int target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+-        target_bits |= 1;
++        target_bits |= FPSR_IOC;
+     }
+     if (host_bits & float_flag_divbyzero) {
+-        target_bits |= 2;
++        target_bits |= FPSR_DZC;
+     }
+     if (host_bits & float_flag_overflow) {
+-        target_bits |= 4;
++        target_bits |= FPSR_OFC;
+     }
+     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+-        target_bits |= 8;
++        target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+-        target_bits |= 0x10;
++        target_bits |= FPSR_IXC;
+     }
+     if (host_bits & float_flag_input_denormal) {
+-        target_bits |= 0x80;
++        target_bits |= FPSR_IDC;
+     }
+     return target_bits;
+ }
+--
+.34.1

-New patch
+[PULL 16/36] target/arm: Use uint32_t in vfp_exceptbits_from_host()
+In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
+an "int", and our return type is also "int". However, the only
+callsite returns the same information as a uint32_t, and
+more generally we handle FPSR values in the code as uint32_t,
+not int. Bring this function in to line with that convention.
+There is no behaviour change because none of the FPSR bits
+we set in this function are bit 31. The input argument to
+the function remains 'int' because that is the return type
+of the softfloat get_float_exception_flags().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #ifdef CONFIG_TCG
+ /* Convert host exception flags to vfp form.  */
+-static inline int vfp_exceptbits_from_host(int host_bits)
++static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ {
+-    int target_bits = 0;
++    uint32_t target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+         target_bits |= FPSR_IOC;
+--
+.34.1

-New patch
+[PULL 17/36] target/arm: Define new fp_status_a32 and fp_status_a64
+We want to split the existing fp_status in the Arm CPUState into
+separate float_status fields for AArch32 and AArch64.  (This is
+because new control bits defined by FEAT_AFP only have an effect for
+AArch64, not AArch32.) To make this split we will:
+ * define new fp_status_a32 and fp_status_a64 which have
+   identical behaviour to the existing fp_status
+ * move existing uses of fp_status to fp_status_a32 or
+   fp_status_a64 as appropriate
+ * delete the old fp_status when it has no uses left
+In this patch we add the new float_status fields.
+We will also need to split fp_status_f16, but we will do that
+as a separate series of patches.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           |  4 ++++
+ target/arm/tcg/translate.h | 12 ++++++++++++
+ target/arm/cpu.c           |  2 ++
+ target/arm/vfp_helper.c    | 12 ++++++++++++
+files changed, 30 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+          *  fp_status: is the "normal" fp status.
++         *  fp_status_a32: is the "normal" fp status for AArch32 insns
++         *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+          *  standard_fp_status_fp16 : used for half-precision
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * an explicit FPSCR read.
+          */
+         float_status fp_status;
++        float_status fp_status_a32;
++        float_status fp_status_a64;
+         float_status fp_status_f16;
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  */
+ typedef enum ARMFPStatusFlavour {
+     FPST_FPCR,
++    FPST_A32,
++    FPST_A64,
+     FPST_FPCR_F16,
+     FPST_STD,
+     FPST_STD_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *
+  * FPST_FPCR
+  *   for non-FP16 operations controlled by the FPCR
++ * FPST_A32
++ *   for AArch32 non-FP16 operations controlled by the FPCR
++ * FPST_A64
++ *   for AArch64 non-FP16 operations controlled by the FPCR
+  * FPST_FPCR_F16
+  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_STD
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_FPCR:
+         offset = offsetof(CPUARMState, vfp.fp_status);
+         break;
++    case FPST_A32:
++        offset = offsetof(CPUARMState, vfp.fp_status_a32);
++        break;
++    case FPST_A64:
++        offset = offsetof(CPUARMState, vfp.fp_status_a64);
++        break;
+     case FPST_FPCR_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     uint32_t i;
+     i = get_float_exception_flags(&env->vfp.fp_status);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * be the architecturally up-to-date exception flag information first.
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status);
++    set_float_exception_flags(0, &env->vfp.fp_status_a32);
++    set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             break;
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+     }
+     if (changed & FPCR_FZ16) {
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool ftz_enabled = val & FPCR_FZ;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+     }
+ }
+--
+.34.1

-New patch
+[PULL 18/36] target/arm: Use vfp.fp_status_a64 in A64-only helper functions
+Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
+ * directly reference an fp_status field
+ * are called only from the A64 decoder
+ * are not called inside a set_rmode/restore_rmode sequence
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/sme_helper.c | 2 +-
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 5 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+      * round-to-odd -- see above.
+      */
+     fpst_f16 = env->vfp.fp_status_f16;
+-    fpst_std = env->vfp.fp_status;
++    fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+     fpst_odd = fpst_std;
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t i, oprsz = simd_oprsz(desc);
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += 16) {
+--
+.34.1

-New patch
+[PULL 19/36] target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
+In is_ebf(), we might be called for A64 or A32, but we have
+the CPUARMState* so we can select fp_status_a64 or
+fp_status_a32 accordingly.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/vec_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
+      */
+     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
+-    *statusp = env->vfp.fp_status;
++    *statusp = is_a64(env) ? env->vfp.fp_status_a64 : env->vfp.fp_status_a32;
+     set_default_nan_mode(true, statusp);
+     if (ebf) {
+--
+.34.1

-New patch
+[PULL 20/36] target/arm: Use fp_status_a32 in vjvct helper
+Use fp_status_a32 in the vjcvt helper function; this is called only
+from the A32/T32 decoder and is not used inside a
+set_rmode/restore_rmode sequence.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-9-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
+ uint32_t HELPER(vjcvt)(float64 value, CPUARMState *env)
+ {
+-    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status);
++    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status_a32);
+     uint32_t result = pair;
+     uint32_t z = (pair >> 32) == 0;
+--
+.34.1

-New patch
+[PULL 21/36] target/arm: Use fp_status_a32 in vfp_cmp helpers
+The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
+the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
+(because for A64 we update the main NZCV flags and for A32 we update
+the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
+field instead of fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+ DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+-DO_VFP_cmp(s, float32, float32, fp_status)
+-DO_VFP_cmp(d, float64, float64, fp_status)
++DO_VFP_cmp(s, float32, float32, fp_status_a32)
++DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+ /* Integer to float and float to integer conversions */
+--
+.34.1

-New patch
+[PULL 22/36] target/arm: Use FPST_A32 in A32 decoder
+In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
+file changed, 27 insertions(+), 27 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_rmode = gen_set_rmode(rounding, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_shift = tcg_constant_i32(0);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg32(f0, vn);
+     vfp_load_reg32(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
+     f0 = tcg_temp_new_i64();
+     f1 = tcg_temp_new_i64();
+     fd = tcg_temp_new_i64();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg64(f0, vn);
+     vfp_load_reg64(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negs(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negd(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
+     vfp_store_reg64(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
+ {
+-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rints(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rintd(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd_exact(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg64(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
+     vd = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+     vfp_load_reg64(vm, a->vm);
+-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg32(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f32 */
+         gen_helper_vfp_sitos(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f64 */
+         gen_helper_vfp_sitod(vd, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
+     vd = tcg_temp_new_i64();
+     vfp_load_reg64(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i64();
+     vd = tcg_temp_new_i32();
+     vfp_load_reg64(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 23/36] target/arm: Use FPST_A64 in A64 decoder
+In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
+ target/arm/tcg/translate-sme.c |   4 +-
+ target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
+files changed, 90 insertions(+), 90 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = tcg_constant_i64(0);
+             if (swap) {
+-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_dreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i64 t1 = tcg_temp_new_i64();
+             read_vec_element(s, t1, a->rm, a->idx, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negd(t1, t1);
+             }
+-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negs(t1, t1);
+             }
+-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element(s, t0, a->rn, 0, MO_64);
+             read_vec_element(s, t1, a->rn, 1, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negd(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
+             write_fp_dreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negs(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
+         write_fp_dreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of result is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
+         write_fp_sreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
+     }
+     if (fp_access_check(s)) {
+         TCGv_i64 t = read_fp_dreg(s, a->rn);
+-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
+         gen_helper_fjcvtzs(t, t, fpstatus);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
+      * with von Neumann rounding (round to odd)
+      */
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
++    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
+     tcg_gen_extu_i32_i64(d, tmp);
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tcg_lo = tcg_temp_new_i32();
+     TCGv_i32 tcg_hi = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 ahp = get_ahp_flag();
+     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     gen_helper_vfp_fcvtsd(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
+ static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 tmp = tcg_temp_new_i32();
+     gen_helper_bfcvt_pair(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sme.c
++++ b/target/arm/tcg/translate-sme.c
+@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
+ TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
+            MO_32, gen_helper_sme_fmopa_h)
+ TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
+-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
++           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
+ TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
+-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
++           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
+ TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+  */
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
+ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
+ /*
+  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
+@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
+ TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
+     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
+                         gen_gvec_rax1, a)
+ TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
+            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
+ static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
+-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
++                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
+@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
+                               a->rd, a->rn, a->rm, a->ra,
+-                              (a->index << 1) | sel, FPST_FPCR);
++                              (a->index << 1) | sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
+--
+.34.1

-New patch
+[PULL 24/36] target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
+Now we have moved all the uses of vfp.fp_status and FPST_FPCR
+to either the A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 8 +-------
+files changed, 1 insertion(+), 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+-         *  fp_status: is the "normal" fp status.
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * only thing which needs to read the exception flags being
+          * an explicit FPSCR read.
+          */
+-        float_status fp_status;
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+         float_status fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  * Enum for argument to fpstatus_ptr().
+  */
+ typedef enum ARMFPStatusFlavour {
+-    FPST_FPCR,
+     FPST_A32,
+     FPST_A64,
+     FPST_FPCR_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  * been set up to point to the requested field in the CPU state struct.
+  * The options are:
+  *
+- * FPST_FPCR
+- *   for non-FP16 operations controlled by the FPCR
+  * FPST_A32
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     int offset;
+     switch (flavour) {
+-    case FPST_FPCR:
+-        offset = offsetof(CPUARMState, vfp.fp_status);
+-        break;
+     case FPST_A32:
+         offset = offsetof(CPUARMState, vfp.fp_status_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+ {
+-    uint32_t i;
++    uint32_t i = 0;
+-    i = get_float_exception_flags(&env->vfp.fp_status);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * values. The caller should have arranged for env->vfp.fpsr to
+      * be the architecturally up-to-date exception flag information first.
+      */
+-    set_float_exception_flags(0, &env->vfp.fp_status);
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             i = float_round_to_zero;
+             break;
+         }
+-        set_float_rounding_mode(i, &env->vfp.fp_status);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_FZ) {
+         bool ftz_enabled = val & FPCR_FZ;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+--
+.34.1

-New patch
+[PULL 25/36] target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
+As the first part of splitting the existing fp_status_f16
+into separate float_status fields for AArch32 and AArch64
+(so that we can make FEAT_AFP control bits apply only
+for AArch64), define the two new fp_status_f16_a32 and
+fp_status_f16_a64 fields, but don't use them yet.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           |  4 ++++
+ target/arm/tcg/translate.h | 12 ++++++++++++
+ target/arm/cpu.c           |  2 ++
+ target/arm/vfp_helper.c    | 14 ++++++++++++++
+files changed, 32 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
++         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
++         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+          *  standard_fp_status_fp16 : used for half-precision
+          *       calculations with the ARM "Standard FPSCR Value"
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+         float_status fp_status_f16;
++        float_status fp_status_f16_a32;
++        float_status fp_status_f16_a64;
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+     FPST_A32,
+     FPST_A64,
+     FPST_FPCR_F16,
++    FPST_A32_F16,
++    FPST_A64_F16,
+     FPST_STD,
+     FPST_STD_F16,
+ } ARMFPStatusFlavour;
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *   for AArch64 non-FP16 operations controlled by the FPCR
+  * FPST_FPCR_F16
+  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
++ * FPST_A32_F16
++ *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
++ * FPST_A64_F16
++ *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_STD
+  *   for A32/T32 Neon operations using the "standard FPSCR value"
+  * FPST_STD_F16
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_FPCR_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16);
+         break;
++    case FPST_A32_F16:
++        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
++        break;
++    case FPST_A64_F16:
++        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
++        break;
+     case FPST_STD:
+         offset = offsetof(CPUARMState, vfp.standard_fp_status);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+ #ifndef CONFIG_USER_ONLY
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     /* FZ16 does not generate an input denormal exception.  */
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+           & ~float_flag_input_denormal);
++    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
++          & ~float_flag_input_denormal);
++    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
++          & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
+           & ~float_flag_input_denormal);
+     return vfp_exceptbits_from_host(i);
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
++    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
++    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+ }
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
++        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
++        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
+     }
+     if (changed & FPCR_FZ16) {
+         bool ftz_enabled = val & FPCR_FZ16;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+     }
+     if (changed & FPCR_FZ) {
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
+ }
+--
+.34.1

-New patch
+[PULL 26/36] target/arm: Use fp_status_f16_a32 in AArch32-only helpers
+We directly use fp_status_f16 in a handful of helpers that
+are AArch32-specific; switch to fp_status_f16_a32 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
+---
+ target/arm/tcg/vec_helper.c | 4 ++--
+ target/arm/vfp_helper.c     | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+     softfloat_to_vfp_compare(env, \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
++DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
+ DO_VFP_cmp(s, float32, float32, fp_status_a32)
+ DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+--
+.34.1

-New patch
+[PULL 27/36] target/arm: Use fp_status_f16_a64 in AArch64-only helpers
+We directly use fp_status_f16 in a handful of helpers that are
+AArch64-specific; switch to fp_status_f16_a64 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
+---
+ target/arm/tcg/sme_helper.c | 4 ++--
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+     float_status fpst_odd, fpst_std, fpst_f16;
+     /*
+-     * Make copies of fp_status and fp_status_f16, because this operation
++     * Make copies of the fp status fields we use, because this operation
+      * does not update the cumulative fp exception status.  It also
+      * produces default NaNs. We also need a second copy of fp_status with
+      * round-to-odd -- see above.
+      */
+-    fpst_f16 = env->vfp.fp_status_f16;
++    fpst_f16 = env->vfp.fp_status_f16_a64;
+     fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += 16) {
+         float16 mm_16 = *(float16 *)(vm + i + idx);
+--
+.34.1

-New patch
+[PULL 28/36] target/arm: Use FPST_A32_F16 in A32 decoder
+In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
+file changed, 12 insertions(+), 12 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     /*
+      * Do a half-precision operation. Functionally this is
+      * the same as do_vfp_3op_sp(), except:
+-     *  - it uses the FPST_FPCR_F16
++     *  - it uses the FPST_A32_F16
+      *  - it doesn't need the VFP vector handling (fp16 is a
+      *    v8 feature, and in v8 VFP vectors don't exist)
+      *  - it does the aa32_fp16_arith feature test
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vfp_load_reg16(f0, vn);
+     vfp_load_reg16(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_hp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negh(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_vfp_muladdh(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ DO_VFP_2OP(VNEG, dp, gen_vfp_negd, aa32_fpdp_v2)
+ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_FPCR_F16));
++    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_A32_F16));
+ }
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_hp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_hp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rinth(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_hp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_hp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     if (a->s) {
+         /* i32 -> f16 */
+         gen_helper_vfp_sitoh(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_hp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_hp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg16(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 29/36] target/arm: Use FPST_A64_F16 in A64 decoder
+In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 32 ++++++++---------
+ target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
+files changed, 49 insertions(+), 49 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_hreg(s, a->rm);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_A64_F16));
+             } else {
+-                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+                 gen_vfp_negh(t1, t1);
+             }
+             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
+-                                       fpstatus_ptr(FPST_FPCR_F16));
++                                       fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_16);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negh(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR_F16);
++            fpst = fpstatus_ptr(FPST_A64_F16);
+             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                             a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++                        a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+--
+.34.1

-New patch
+[PULL 30/36] target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
+Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
+to the new A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 7 -------
+files changed, 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          *
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+-         *  fp_status_fp16: used for half-precision calculations
+          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          */
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+-        float_status fp_status_f16;
+         float_status fp_status_f16_a32;
+         float_status fp_status_f16_a64;
+         float_status standard_fp_status;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+ typedef enum ARMFPStatusFlavour {
+     FPST_A32,
+     FPST_A64,
+-    FPST_FPCR_F16,
+     FPST_A32_F16,
+     FPST_A64_F16,
+     FPST_STD,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+  *   for AArch64 non-FP16 operations controlled by the FPCR
+- * FPST_FPCR_F16
+- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A32_F16
+  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A64_F16
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_A64:
+         offset = offsetof(CPUARMState, vfp.fp_status_a64);
+         break;
+-    case FPST_FPCR_F16:
+-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
+-        break;
+     case FPST_A32_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+-          & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+           & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
+     }
+     if (changed & FPCR_FZ16) {
+         bool ftz_enabled = val & FPCR_FZ16;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
+--
+.34.1

-New patch
+[PULL 31/36] fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
+Our float_flag_input_denormal exception flag is set when the fpu code
 flushes an input denormal to zero.  This is what many guest
 architectures (eg classic Arm behaviour) require, but it is not the
 only donarmal-related reason we might want to set an exception flag.
 The x86 behaviour (which we do not currently model correctly) wants
 to see an exception flag when a denormal input is *not* flushed to
 zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
 also wants these semantics.
 Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 to make it clearer when it is set and to allow us to add a new
 float_flag_input_denormal_used next to it for the x86/FEAT_AFP
 semantics.
 Commit created with
  for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done
 and manual editing of softfloat-types.h and softfloat.c to clean
 up the indentation afterwards and to fix a comment which wasn't
 using the full name of the flag.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
 ---
  include/fpu/softfloat-types.h |  5 +++--
  fpu/softfloat.c               |  4 ++--
  target/arm/tcg/sve_helper.c   |  6 +++---
  target/arm/vfp_helper.c       | 10 +++++-----
  target/i386/tcg/fpu_helper.c  |  6 +++---
  target/mips/tcg/msa_helper.c  |  2 +-
  target/rx/op_helper.c         |  2 +-
  fpu/softfloat-parts.c.inc     |  2 +-
 files changed, 19 insertions(+), 18 deletions(-)
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
      float_flag_overflow        = 0x0004,
      float_flag_underflow       = 0x0008,
      float_flag_inexact         = 0x0010,
 -    float_flag_input_denormal  = 0x0020,
 +    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
 +    float_flag_input_denormal_flushed = 0x0020,
      float_flag_output_denormal = 0x0040,
      float_flag_invalid_isi     = 0x0080,  /* inf - inf */
      float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set the inexact flag? */
      bool flush_to_zero;
 -    /* should denormalised inputs go to zero and set the input_denormal flag? */
 +    /* should denormalised inputs go to zero and set input_denormal_flushed? */
      bool flush_inputs_to_zero;
      bool default_nan_mode;
      /*
 diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat.c
 +++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
          if (unlikely(soft_t ## _is_denormal(*a))) {                     \
              *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                       soft_t ## _is_neg(*a));            \
 -            float_raise(float_flag_input_denormal, s);                  \
 +            float_raise(float_flag_input_denormal_flushed, s);          \
          }                                                               \
      }
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
  static bool parts_squash_denormal(FloatParts64 p, float_status *status)
  {
      if (p.exp == 0 && p.frac != 0) {
 -        float_raise(float_flag_input_denormal, status);
 +        float_raise(float_flag_input_denormal_flushed, status);
          return true;
      }
 diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sve_helper.c
 +++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                  return -15 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x1f)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                  return -127 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0xff)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                  return -1023 - clz64(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x7ff)) {
          if (frac == 0) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
      if (host_bits & float_flag_inexact) {
          target_bits |= FPSR_IXC;
      }
 -    if (host_bits & float_flag_input_denormal) {
 +    if (host_bits & float_flag_input_denormal_flushed) {
          target_bits |= FPSR_IDC;
      }
      return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      i |= get_float_exception_flags(&env->vfp.standard_fp_status);
      /* FZ16 does not generate an input denormal exception.  */
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      return vfp_exceptbits_from_host(i);
  }
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
      /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
      inexact = e_new & (float_flag_inexact |
 -                       float_flag_input_denormal |
 +                       float_flag_input_denormal_flushed |
                         float_flag_invalid);
      /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
 diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/fpu_helper.c
 +++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                         (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                         (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                         (new_flags & float_flag_inexact ? FPUS_PE : 0) |
 -                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
 +                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
  }
  static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
              int shift = clz64(temp.l.lower);
              temp.l.lower <<= shift;
              expdif = 1 - EXPBIAS - shift;
 -            float_raise(float_flag_input_denormal, &env->fp_status);
 +            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
          } else {
              expdif = EXPD(temp) - EXPBIAS;
          }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
      uint8_t flags = get_float_exception_flags(&env->sse_status);
      /*
       * The MXCSR denormal flag has opposite semantics to
 -     * float_flag_input_denormal (the softfloat code sets that flag
 +     * float_flag_input_denormal_flushed (the softfloat code sets that flag
       * only when flushing input denormals to zero, but SSE sets it
       * only when not flushing them to zero), so is not converted
       * here.
 diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/msa_helper.c
 +++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
      enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
      /* Set Inexact (I) when flushing inputs to zero */
 -    if ((ieee_exception_flags & float_flag_input_denormal) &&
 +    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
              (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
          if (action & CLEAR_IS_INEXACT) {
              mips_exception_flags &= ~FP_INEXACT;
 diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/op_helper.c
 +++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
          if (xcpt & float_flag_inexact) {
              SET_FPSW(X);
          }
 -        if ((xcpt & (float_flag_input_denormal
 +        if ((xcpt & (float_flag_input_denormal_flushed
                       | float_flag_output_denormal))
              && !FIELD_EX32(env->fpsw, FPSW, DN)) {
              env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
          if (likely(frac_eqz(p))) {
              p->cls = float_class_zero;
          } else if (status->flush_inputs_to_zero) {
 -            float_raise(float_flag_input_denormal, status);
 +            float_raise(float_flag_input_denormal_flushed, status);
              p->cls = float_class_zero;
              frac_clear(p);
          } else {
 --
 .34.1

-New patch
+[PULL 32/36] fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
+Our float_flag_output_denormal exception flag is set when
+the fpu code flushes an output denormal to zero. Rename
+it to float_flag_output_denormal_flushed:
+ * this keeps it parallel with the flag for flushing
+   input denormals, which we just renamed
+ * it makes it clearer that it doesn't mean "set when
+   the output is a denormal"
+Commit created with
+ for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 3 ++-
+ fpu/softfloat.c               | 2 +-
+ target/arm/vfp_helper.c       | 2 +-
+ target/i386/tcg/fpu_helper.c  | 2 +-
+ target/m68k/fpu_helper.c      | 2 +-
+ target/mips/tcg/msa_helper.c  | 2 +-
+ target/rx/op_helper.c         | 2 +-
+ target/tricore/fpu_helper.c   | 6 +++---
+ fpu/softfloat-parts.c.inc     | 2 +-
+files changed, 12 insertions(+), 11 deletions(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ enum {
+     float_flag_inexact         = 0x0010,
+     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+     float_flag_input_denormal_flushed = 0x0020,
+-    float_flag_output_denormal = 0x0040,
++    /* We flushed an output denormal to 0 (because of flush_to_zero) */
++    float_flag_output_denormal_flushed = 0x0040,
+     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
+     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
+     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
+         }
+         if ( zExp <= 0 ) {
+             if (status->flush_to_zero) {
+-                float_raise(float_flag_output_denormal, status);
++                float_raise(float_flag_output_denormal_flushed, status);
+                 return packFloatx80(zSign, 0, 0);
+             }
+             isTiny = status->tininess_before_rounding
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= FPSR_OFC;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
+                    (flags & float_flag_overflow ? FPUS_OE : 0) |
+                    (flags & float_flag_underflow ? FPUS_UE : 0) |
+                    (flags & float_flag_inexact ? FPUS_PE : 0) |
+-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
++                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
+));
+ }
+diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/fpu_helper.c
++++ b/target/m68k/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= 0x40;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= 0x20;
+     }
+     if (host_bits & float_flag_divbyzero) {
+diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/msa_helper.c
++++ b/target/mips/tcg/msa_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
+     }
+     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
+-    if ((ieee_exception_flags & float_flag_output_denormal) &&
++    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
+             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
+         mips_exception_flags |= FP_INEXACT;
+         if (action & CLEAR_FS_UNDERFLOW) {
+diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/op_helper.c
++++ b/target/rx/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
+             SET_FPSW(X);
+         }
+         if ((xcpt & (float_flag_input_denormal_flushed
+-                     | float_flag_output_denormal))
++                     | float_flag_output_denormal_flushed))
+             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
+             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
+         }
+diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/fpu_helper.c
++++ b/target/tricore/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
+            & (float_flag_invalid
+               | float_flag_overflow
+               | float_flag_underflow
+-              | float_flag_output_denormal
++              | float_flag_output_denormal_flushed
+               | float_flag_divbyzero
+               | float_flag_inexact);
+ }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
++    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
+         env->FPU_FU = 1 << 31;
+         some_excp = 1;
+     }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
++    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
+         env->PSW |= 1 << 26;
+         some_excp = 1;
+     }
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
+         }
+         frac_shr(p, frac_shift);
+     } else if (s->flush_to_zero) {
+-        flags |= float_flag_output_denormal;
++        flags |= float_flag_output_denormal_flushed;
+         p->cls = float_class_zero;
+         exp = 0;
+         frac_clear(p);
+--
+.34.1

-New patch
+[PULL 33/36] fpu: Fix a comment in softfloat-types.h
+In softfloat-types.h a comment documents that if the float_status
+field flush_to_zero is set then we flush denormalised results to 0
+and set the inexact flag.  This isn't correct: the status flag that
+we set when flush_to_zero causes us to flush an output to zero is
+float_flag_output_denormal_flushed.
+Correct the comment.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
+     Float3NaNPropRule float_3nan_prop_rule;
+     FloatInfZeroNaNRule float_infzeronan_rule;
+     bool tininess_before_rounding;
+-    /* should denormalised results go to zero and set the inexact flag? */
++    /* should denormalised results go to zero and set output_denormal_flushed? */
+     bool flush_to_zero;
+     /* should denormalised inputs go to zero and set input_denormal_flushed? */
+     bool flush_inputs_to_zero;
+--
+.34.1

-New patch
+[PULL 34/36] target/arm: Remove redundant advsimd float16 helpers
+The advsimd_addh etc helpers defined in helper-a64.c are identical to
+the vfp_addh etc helpers defined in helper-vfp.c: both take two
+float16 inputs (in a uint32_t type) plus a float_status* and are
+simple wrappers around the softfloat float16_* functions.
+(The duplication seems to be a historical accident: we added the
+advsimd helpers in 2018 as part of the A64 implementation, and at
+that time there was no f16 emulation in A32.  Then later we added the
+A32 f16 handling by extending the existing VFP helper macros to
+generate f16 versions as well as f32 and f64, and didn't realise we
+could clean things up.)
+Remove the now-unnecessary advsimd helpers and make the places that
+generated calls to them use the vfp helpers instead. Many of the
+helper functions were already unused.
+(The remaining advsimd_ helpers are those which don't have vfp
+versions.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
+---
+ target/arm/tcg/helper-a64.h    |  8 --------
+ target/arm/tcg/helper-a64.c    |  9 ---------
+ target/arm/tcg/translate-a64.c | 16 ++++++++--------
+files changed, 8 insertions(+), 25 deletions(-)
+diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.h
++++ b/target/arm/tcg/helper-a64.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+ DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
+ DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+ DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.c
++++ b/target/arm/tcg/helper-a64.c
+@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
+     return float16_ ## name(a, b, fpst);    \
+ }
+-ADVSIMD_HALFOP(add)
+-ADVSIMD_HALFOP(sub)
+-ADVSIMD_HALFOP(mul)
+-ADVSIMD_HALFOP(div)
+-ADVSIMD_HALFOP(min)
+-ADVSIMD_HALFOP(max)
+-ADVSIMD_HALFOP(minnum)
+-ADVSIMD_HALFOP(maxnum)
+-
+ #define ADVSIMD_TWOHALFOP(name)                                         \
+ uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
+                                   float_status *fpst)                   \
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
+ TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
+ static const FPScalar f_scalar_fmax = {
+-    gen_helper_advsimd_maxh,
++    gen_helper_vfp_maxh,
+     gen_helper_vfp_maxs,
+     gen_helper_vfp_maxd,
+ };
+ TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
+ static const FPScalar f_scalar_fmin = {
+-    gen_helper_advsimd_minh,
++    gen_helper_vfp_minh,
+     gen_helper_vfp_mins,
+     gen_helper_vfp_mind,
+ };
+ TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
+ static const FPScalar f_scalar_fmaxnm = {
+-    gen_helper_advsimd_maxnumh,
++    gen_helper_vfp_maxnumh,
+     gen_helper_vfp_maxnums,
+     gen_helper_vfp_maxnumd,
+ };
+ TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
+ static const FPScalar f_scalar_fminnm = {
+-    gen_helper_advsimd_minnumh,
++    gen_helper_vfp_minnumh,
+     gen_helper_vfp_minnums,
+     gen_helper_vfp_minnumd,
+ };
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     return true;
+ }
+-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
+-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
+-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
+-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
++TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
++TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
++TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
++TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
+ TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
+ TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
+--
+.34.1

-New patch
+[PULL 35/36] target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
+We should be using the F16-specific float_status for conversions from
+half-precision, because halfprec inputs never set Input Denormal.
+Without FEAT_AHP, using the wrong fpst here had no effect, because
+the only difference between the A64_F16 and A64 fpst is its handling
+of flush-to-zero on input and output, and the helper functions
+vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
+relevant flushing flags, and flush_inputs_to_zero was the only way
+that IDC could be set.
+With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
+input_denormal_used, which we will only ignore in
+vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
+use that one for f16 inputs (and the normal one for single/double to
+f16 conversions).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 9 ++++++---
+ target/arm/tcg/translate-sve.c | 4 ++--
+files changed, 8 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+         TCGv_i32 tcg_op = tcg_temp_new_i32();
+         int srcelt = a->q ? 2 : 0;
++        fpst = fpstatus_ptr(FPST_A64);
++
+         for (pass = 0; pass < 2; pass++) {
+             tcg_res[pass] = tcg_temp_new_i64();
+             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         TCGv_i32 tcg_res[4];
+         TCGv_i32 ahp = get_ahp_flag();
++        fpst = fpstatus_ptr(FPST_A64_F16);
++
+         for (pass = 0; pass < 4; pass++) {
+             tcg_res[pass] = tcg_temp_new_i32();
+             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_bfcvt, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+--
+.34.1

-New patch
+[PULL 36/36] hw/usb/canokey: Fix buffer overflow for OUT packet
+From: Hongren Zheng <i@zenithal.me>
+When USBPacket in OUT direction has larger payload
+than the ep_out_buffer (of size 512), a buffer overflow
+would occur.
+It could be fixed by limiting the size of usb_packet_copy
+to be at most buffer size. Further optimization gets rid
+of the ep_out_buffer and directly uses ep_out as the target
+buffer.
+This is reported by a security researcher who artificially
+constructed an OUT packet of size 2047. The report has gone
+through the QEMU security process, and as this device is for
+testing purpose and no deployment of it in virtualization
+environment is observed, it is triaged not to be a security bug.
+Cc: qemu-stable@nongnu.org
+Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
+Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
+Signed-off-by: Hongren Zheng <i@zenithal.me>
+Message-id: Z4TfMOrZz6IQYl_h@Sun
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/usb/canokey.h | 4 ----
+ hw/usb/canokey.c | 6 +++---
+files changed, 3 insertions(+), 7 deletions(-)
+diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/usb/canokey.h
++++ b/hw/usb/canokey.h
+@@ -XXX,XX +XXX,XX @@
+ #define CANOKEY_EP_NUM 3
+ /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
+ #define CANOKEY_EP_IN_BUFFER_SIZE 2048
+-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
+-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
+ typedef enum {
+     CANOKEY_EP_IN_WAIT,
+@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
+     /* OUT pointer to canokey recv buffer */
+     uint8_t *ep_out[CANOKEY_EP_NUM];
+     uint32_t ep_out_size[CANOKEY_EP_NUM];
+-    /* For large BULK OUT, multiple write to ep_out is needed */
+-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
+     /* Properties */
+     char *file; /* canokey-file */
+diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/usb/canokey.c
++++ b/hw/usb/canokey.c
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
+     switch (p->pid) {
+     case USB_TOKEN_OUT:
+         trace_canokey_handle_data_out(ep_out, p->iov.size);
+-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
+         out_pos = 0;
++        /* segment packet into (possibly multiple) ep_out */
+         while (out_pos != p->iov.size) {
+             /*
+              * key->ep_out[ep_out] set by prepare_receive
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
+              * to be the buffer length
+              */
+             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
+-            memcpy(key->ep_out[ep_out],
+-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
++            /* usb_packet_copy would update the pos offset internally */
++            usb_packet_copy(p, key->ep_out[ep_out], out_len);
+             out_pos += out_len;
+             /* update ep_out_size to actual len */
+             key->ep_out_size[ep_out] = out_len;
+--
+.34.1

Arm queue; bugfixes only.

thanks
-- PMM

The following changes since commit 48aa8f0ac536db3550a35c295ff7de94e4c33739:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2020-11-16' into staging (2020-11-17 11:07:00 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201117

for you to fetch changes up to ab135622cf478585bdfcb68b85e4a817d74a0c42:

tmp105: Correct handling of temperature limit checks (2020-11-17 12:56:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: ARM_VIRT must select ARM_GIC
 * exynos: Fix bad printf format specifiers
 * hw/input/ps2.c: Remove remnants of printf debug
 * target/openrisc: Remove dead code attempting to check "is timer disabled"
 * register: Remove unnecessary NULL check
 * util/cutils: Fix Coverity array overrun in freq_to_str()
 * configure: Make "does libgio work" test pull in some actual functions
 * tmp105: reset the T_low and T_High registers
 * tmp105: Correct handling of temperature limit checks

----------------------------------------------------------------
Alex Chen (1):
      exynos: Fix bad printf format specifiers

Alistair Francis (1):
      register: Remove unnecessary NULL check

Andrew Jones (1):
      hw/arm/virt: ARM_VIRT must select ARM_GIC

Peter Maydell (5):
      hw/input/ps2.c: Remove remnants of printf debug
      target/openrisc: Remove dead code attempting to check "is timer disabled"
      configure: Make "does libgio work" test pull in some actual functions
      hw/misc/tmp105: reset the T_low and T_High registers
      tmp105: Correct handling of temperature limit checks

Philippe Mathieu-Daudé (1):
      util/cutils: Fix Coverity array overrun in freq_to_str()

From: Alex Chen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Message-id: 20201111073651.72804-1-alex.chen@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/exynos4210_mct.c | 4 ++--
 hw/timer/exynos4210_pwm.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/timer/exynos4210_mct.c b/hw/timer/exynos4210_mct.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_mct.c
+++ b/hw/timer/exynos4210_mct.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_gcomp_raise_irq(void *opaque, uint32_t id)
     /* If CSTAT is pending and IRQ is enabled */
     if ((s->reg.int_cstat & G_INT_CSTAT_COMP(id)) &&
             (s->reg.int_enb & G_INT_ENABLE(id))) {
-        DPRINTF("gcmp timer[%d] IRQ\n", id);
+        DPRINTF("gcmp timer[%u] IRQ\n", id);
         qemu_irq_raise(s->irq[id]);
     }
 }
@@ -XXX,XX +XXX,XX @@ static void exynos4210_mct_update_freq(Exynos4210MCTState *s)
                     MCT_CFG_GET_DIVIDER(s->reg_mct_cfg));
 
     if (freq != s->freq) {
-        DPRINTF("freq=%dHz\n", s->freq);
+        DPRINTF("freq=%uHz\n", s->freq);
 
         /* global timer */
         tx_ptimer_set_freq(s->g_timer.ptimer_frc, s->freq);
diff --git a/hw/timer/exynos4210_pwm.c b/hw/timer/exynos4210_pwm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/exynos4210_pwm.c
+++ b/hw/timer/exynos4210_pwm.c
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_update_freq(Exynos4210PWMState *s, uint32_t id)
 
     if (freq != s->timer[id].freq) {
         ptimer_set_freq(s->timer[id].ptimer, s->timer[id].freq);
-        DPRINTF("freq=%dHz\n", s->timer[id].freq);
+        DPRINTF("freq=%uHz\n", s->timer[id].freq);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     uint32_t id = s->id;
     bool cmp;
 
-    DPRINTF("timer %d tick\n", id);
+    DPRINTF("timer %u tick\n", id);
 
     /* set irq status */
     p->reg_tint_cstat |= TINT_CSTAT_STATUS(id);
 
     /* raise IRQ */
     if (p->reg_tint_cstat & TINT_CSTAT_ENABLE(id)) {
-        DPRINTF("timer %d IRQ\n", id);
+        DPRINTF("timer %u IRQ\n", id);
         qemu_irq_raise(p->timer[id].irq);
     }
 
@@ -XXX,XX +XXX,XX @@ static void exynos4210_pwm_tick(void *opaque)
     }
 
     if (cmp) {
-        DPRINTF("auto reload timer %d count to %x\n", id,
+        DPRINTF("auto reload timer %u count to %x\n", id,
                 p->timer[id].reg_tcntb);
         ptimer_set_count(p->timer[id].ptimer, p->timer[id].reg_tcntb);
         ptimer_run(p->timer[id].ptimer, 1);
-- 
2.20.1

In commit 5edab03d4040 we added tracepoints to the ps2 keyboard
and mouse emulation. However we didn't remove all the debug-by-printf
support. In fact there is only one printf() remaining, and it is
redundant with the trace_ps2_write_mouse() event next to it.
Remove the printf() and the now-unused DEBUG* macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20201101133258.4240-1-peter.maydell@linaro.org
---
 hw/input/ps2.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -XXX,XX +XXX,XX @@
 
 #include "trace.h"
 
-/* debug PC keyboard */
-//#define DEBUG_KBD
-
-/* debug PC keyboard : only mouse */
-//#define DEBUG_MOUSE
-
 /* Keyboard Commands */
 #define KBD_CMD_SET_LEDS	0xED	/* Set keyboard leds */
 #define KBD_CMD_ECHO     	0xEE
@@ -XXX,XX +XXX,XX @@ void ps2_write_mouse(void *opaque, int val)
     PS2MouseState *s = (PS2MouseState *)opaque;
 
     trace_ps2_write_mouse(opaque, val);
-#ifdef DEBUG_MOUSE
-    printf("kbd: write mouse 0x%02x\n", val);
-#endif
     switch(s->common.write_cmd) {
     default:
     case -1:
-- 
2.20.1

In the mtspr helper we attempt to check for "is the timer disabled"
with "if (env->ttmr & TIMER_NONE)".  This is wrong because TIMER_NONE
is zero and the condition is always false (Coverity complains about
the dead code.)

The correct check would be to test whether the TTMR_M field in the
register is equal to TIMER_NONE instead.  However, the
cpu_openrisc_timer_update() function checks whether the timer is
enabled (it looks at cpu->env.is_counting, which is set to 0 via
cpu_openrisc_count_stop() when the TTMR_M field is set to
TIMER_NONE), so there's no need to check for "timer disabled" in the
target/openrisc code.  Instead, simply remove the dead code.

Fixes: Coverity CID 1005812
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Stafford Horne <shorne@gmail.com>
Message-id: 20201103114654.18540-1-peter.maydell@linaro.org
---
 target/openrisc/sys_helper.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 
     case TO_SPR(10, 1): /* TTCR */
         cpu_openrisc_count_set(cpu, rb);
-        if (env->ttmr & TIMER_NONE) {
-            return;
-        }
         cpu_openrisc_timer_update(cpu);
         break;
 #endif
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix Coverity CID 1435957:  Memory - illegal accesses (OVERRUN):

>>> Overrunning array "suffixes" of 7 8-byte elements at element
    index 7 (byte offset 63) using index "idx" (which evaluates to 7).

Note, the biggest input value freq_to_str() can accept is UINT64_MAX,
which is ~18.446 EHz, less than 1000 EHz.

Reported-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20201101215755.2021421-1-f4bug@amsat.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cutils.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/util/cutils.c b/util/cutils.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cutils.c
+++ b/util/cutils.c
@@ -XXX,XX +XXX,XX @@ char *freq_to_str(uint64_t freq_hz)
     double freq = freq_hz;
     size_t idx = 0;
 
-    while (freq >= 1000.0 && idx < ARRAY_SIZE(suffixes)) {
+    while (freq >= 1000.0) {
         freq /= 1000.0;
         idx++;
     }
+    assert(idx < ARRAY_SIZE(suffixes));
 
     return g_strdup_printf("%0.3g %sHz", freq, suffixes[idx]);
 }
-- 
2.20.1

In commit 76346b6264a9b01979 we tried to add a configure check that
the libgio pkg-config data was correct, which builds an executable
linked against it.  Unfortunately this doesn't catch the problem
(missing static library dependency info), because a "do nothing" test
source file doesn't have any symbol references that cause the linker
to pull in .o files from libgio.a, and so we don't see the "missing
symbols from libmount" error that a full QEMU link triggers.

(The ineffective test went unnoticed because of a typo that
effectively disabled libgio unconditionally, but after commit
3569a5dfc11f2 fixed that, a static link of the system emulator on
Ubuntu stopped working again.)

Improve the gio test by having the test source fragment reference a
g_dbus function (which is what is indirectly causing us to end up
wanting functions from libmount).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20201116104617.18333-1-peter.maydell@linaro.org
---
 configure | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if $pkg_config --atleast-version=$glib_req_ver gio-2.0; then
     # Check that the libraries actually work -- Ubuntu 18.04 ships
     # with pkg-config --static --libs data for gio-2.0 that is missing
     # -lblkid and will give a link error.
-    write_c_skeleton
-    if compile_prog "" "$gio_libs" ; then
+    cat > $TMPC <<EOF
+#include <gio/gio.h>
+int main(void)
+{
+    g_dbus_proxy_new_sync(0, 0, 0, 0, 0, 0, 0, 0);
+    return 0;
+}
+EOF
+    if compile_prog "$gio_cflags" "$gio_libs" ; then
         gio=yes
     else
         gio=no
-- 
2.20.1

The TMP105 datasheet (https://www.ti.com/lit/gpn/tmp105) says that the
power-up reset values for the T_low and T_high registers are 80 degrees C
and 75 degrees C, which are 0x500 and 0x4B0 hex according to table 5.  These
values are then shifted right by four bits to give the register reset
values, since both registers store the 12 bits of temperature data in bits
[15..4] of a 16 bit register.

We were resetting these registers to zero, which is problematic for Linux
guests which enable the alert interrupt and then immediately take an
unexpected overtemperature alert because the current temperature is above
freezing...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-2-peter.maydell@linaro.org
---
 hw/misc/tmp105.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
 
+    s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
+    s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
+
     tmp105_interrupt_update(s);
 }
 
-- 
2.20.1

The TMP105 datasheet says that in Interrupt Mode (when TM==1) the device
signals an alert when the temperature equals or exceeds the T_high value and
then remains high until a device register is read or the device responds to
the SMBUS Alert Response address, or the device is put into Shutdown Mode.
Thereafter the Alert pin will only be re-signalled when temperature falls
below T_low; alert can then be cleared in the same set of ways, and the
device returns to its initial "alert when temperature goes above T_high"
mode. (If this textual description is confusing, see figure 3 in the
TI datasheet at https://www.ti.com/lit/gpn/tmp105 .)

We were misimplementing this as a simple "always alert if temperature is
above T_high or below T_low" condition, which gives a spurious alert on
startup if using the "T_high = 80 degrees C, T_low = 75 degrees C" reset
limit values.

Implement the correct (hysteresis) behaviour by tracking whether we
are currently looking for the temperature to rise over T_high or
for it to fall below T_low. Our implementation of the comparator
mode (TM==0) wasn't wrong, but rephrase it to match the way that
interrupt mode is now handled for clarity.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20201110150023.25533-3-peter.maydell@linaro.org
---
 hw/misc/tmp105.h |  7 +++++
 hw/misc/tmp105.c | 70 +++++++++++++++++++++++++++++++++++++++++-------
 2 files changed, 68 insertions(+), 9 deletions(-)

diff --git a/hw/misc/tmp105.h b/hw/misc/tmp105.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.h
+++ b/hw/misc/tmp105.h
@@ -XXX,XX +XXX,XX @@ struct TMP105State {
     int16_t limit[2];
     int faults;
     uint8_t alarm;
+    /*
+     * The TMP105 initially looks for a temperature rising above T_high;
+     * once this is detected, the condition it looks for next is the
+     * temperature falling below T_low. This flag is false when initially
+     * looking for T_high, true when looking for T_low.
+     */
+    bool detect_falling;
 };
 
 #endif
diff --git a/hw/misc/tmp105.c b/hw/misc/tmp105.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/tmp105.c
+++ b/hw/misc/tmp105.c
@@ -XXX,XX +XXX,XX @@ static void tmp105_alarm_update(TMP105State *s)
             return;
     }
 
-    if ((s->config >> 1) & 1) {					/* TM */
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 1;
+    if (s->config >> 1 & 1) {
+        /*
+         * TM == 1 : Interrupt mode. We signal Alert when the
+         * temperature rises above T_high, and expect the guest to clear
+         * it (eg by reading a device register).
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 1;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     } else {
-        if (s->temperature >= s->limit[1])
-            s->alarm = 1;
-        else if (s->temperature < s->limit[0])
-            s->alarm = 0;
+        /*
+         * TM == 0 : Comparator mode. We signal Alert when the temperature
+         * rises above T_high, and stop signalling it when the temperature
+         * falls below T_low.
+         */
+        if (s->detect_falling) {
+            if (s->temperature < s->limit[0]) {
+                s->alarm = 0;
+                s->detect_falling = false;
+            }
+        } else {
+            if (s->temperature >= s->limit[1]) {
+                s->alarm = 1;
+                s->detect_falling = true;
+            }
+        }
     }
 
     tmp105_interrupt_update(s);
@@ -XXX,XX +XXX,XX @@ static int tmp105_post_load(void *opaque, int version_id)
     return 0;
 }
 
+static bool detect_falling_needed(void *opaque)
+{
+    TMP105State *s = opaque;
+
+    /*
+     * We only need to migrate the detect_falling bool if it's set;
+     * for migration from older machines we assume that it is false
+     * (ie temperature is not out of range).
+     */
+    return s->detect_falling;
+}
+
+static const VMStateDescription vmstate_tmp105_detect_falling = {
+    .name = "TMP105/detect-falling",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = detect_falling_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(detect_falling, TMP105State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_tmp105 = {
     .name = "TMP105",
     .version_id = 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_tmp105 = {
         VMSTATE_UINT8(alarm, TMP105State),
         VMSTATE_I2C_SLAVE(i2c, TMP105State),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &vmstate_tmp105_detect_falling,
+        NULL
     }
 };
 
@@ -XXX,XX +XXX,XX @@ static void tmp105_reset(I2CSlave *i2c)
     s->config = 0;
     s->faults = tmp105_faultq[(s->config >> 3) & 3];
     s->alarm = 0;
+    s->detect_falling = false;
 
     s->limit[0] = 0x4b00; /* T_LOW, 75 degrees C */
     s->limit[1] = 0x5000; /* T_HIGH, 80 degrees C */
-- 
2.20.1

Hi; here's another arm pullreq; by volume most of this is
refactoring from me, but there are also some bugfixes and
other bits and pieces here.

thanks
-- PMM

The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:

Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1

for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:

hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Remove various uses of first_cpu global
 * hw/char/imx_serial: Fix reset value of UFCR register
 * hw/char/imx_serial: Update all state before restarting ageing timer
 * hw/pci-host/designware: Expose MSI IRQ
 * hw/arm/stellaris: refactoring, cleanup
 * hw/arm/stellaris: map both I2C controllers
 * tests/functional: Add a test for the arm microbit machine
 * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
 * target/arm: refactorings preparatory to FEAT_AFP implementation
 * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
 * hw/usb/canokey: Fix buffer overflow for OUT packet

----------------------------------------------------------------
Bernhard Beschow (3):
      hw/char/imx_serial: Fix reset value of UFCR register
      hw/char/imx_serial: Update all state before restarting ageing timer
      hw/pci-host/designware: Expose MSI IRQ

Hongren Zheng (1):
      hw/usb/canokey: Fix buffer overflow for OUT packet

Peter Maydell (22):
      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
      target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
      target/arm: Use uint32_t in vfp_exceptbits_from_host()
      target/arm: Define new fp_status_a32 and fp_status_a64
      target/arm: Use vfp.fp_status_a64 in A64-only helper functions
      target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
      target/arm: Use fp_status_a32 in vjvct helper
      target/arm: Use fp_status_a32 in vfp_cmp helpers
      target/arm: Use FPST_A32 in A32 decoder
      target/arm: Use FPST_A64 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
      target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
      target/arm: Use fp_status_f16_a32 in AArch32-only helpers
      target/arm: Use fp_status_f16_a64 in AArch64-only helpers
      target/arm: Use FPST_A32_F16 in A32 decoder
      target/arm: Use FPST_A64_F16 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
      fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
      fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
      fpu: Fix a comment in softfloat-types.h
      target/arm: Remove redundant advsimd float16 helpers
      target/arm: Use FPST_A64_F16 for halfprec-to-other conversions

Philippe Mathieu-Daudé (9):
      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
      hw/arm/stellaris: Add 'armv7m' local variable
      hw/arm/v7m: Remove use of &first_cpu in machine_init()
      hw/arm/stellaris: Link each board schematic
      hw/arm/stellaris: Constify read-only arrays
      hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
      hw/arm/stellaris: Replace magic numbers by definitions
      hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
      hw/arm/stellaris: Map both I2C controllers

Thomas Huth (1):
      tests/functional: Add a test for the arm microbit machine

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The ARMv7MState object is not simply a CPU, it also
contains the NVIC, SysTick timer, and various MemoryRegions.

Rename the field as 'armv7m', like other Cortex-M boards.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/nrf51_soc.h |  2 +-
 hw/arm/nrf51_soc.c         | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/nrf51_soc.h
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@ struct NRF51State {
     SysBusDevice parent_obj;
 
     /*< public >*/
-    ARMv7MState cpu;
+    ARMv7MState armv7m;
 
     NRF51UARTState uart;
     NRF51RNGState rng;
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     /* This clock doesn't need migration because it is fixed-frequency */
     clock_set_hz(s->sysclk, HCLK_FRQ);
-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
+    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
     /*
      * This SoC has no systick device, so don't connect refclk.
      * TODO: model the lack of systick (currently the armv7m object
      * will always provide one).
      */
 
-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
+    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
                              &error_abort);
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_UART_BASE)));
 
     /* RNG */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_RNG_BASE)));
 
     /* UICR, FICR, NVMC, FLASH */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->cpu),
+                           qdev_get_gpio_in(DEVICE(&s->armv7m),
                                             BASE_TO_IRQ(base_addr)));
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
 
     memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
 
-    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
-    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
+    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
+    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
                          ARM_CPU_TYPE_NAME("cortex-m0"));
-    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
 
     object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
     object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

While the TYPE_ARMV7M object forward its NVIC interrupt lines,
it is somehow misleading to name it 'nvic'. Add the 'armv7m'
local variable for clarity, but also keep the 'nvic' variable
behaving like before when used for wiring IRQ lines.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *nvic;
+    DeviceState *gpio_dev[7], *armv7m, *nvic;
     qemu_irq gpio_in[7][8];
     qemu_irq gpio_out[7][8];
     qemu_irq adc;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
 
-    nvic = qdev_new(TYPE_ARMV7M);
-    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
-    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
-    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
-    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
-    qdev_prop_set_bit(nvic, "enable-bitband", true);
-    qdev_connect_clock_in(nvic, "cpuclk",
+    armv7m = qdev_new(TYPE_ARMV7M);
+    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
+    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
+    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
+    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    qdev_connect_clock_in(armv7m, "cpuclk",
                           qdev_get_clock_out(ssys_dev, "SYSCLK"));
     /* This SoC does not connect the systick reference clock */
-    object_property_set_link(OBJECT(nvic), "memory",
+    object_property_set_link(OBJECT(armv7m), "memory",
                              OBJECT(get_system_memory()), &error_abort);
     /* This will exit with an error if the user passed us a bad cpu_type */
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
+    nvic = armv7m;
 
     /* Now we can wire up the IRQ and MMIO of the system registers */
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

When instanciating the machine model, the machine_init()
implementations usually create the CPUs, so have access
to its first CPU. Use that rather then the &first_cpu
global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
Message-id: 20250112225614.33723-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/b-l475e-iot01a.c    | 2 +-
 hw/arm/microbit.c          | 2 +-
 hw/arm/mps2-tz.c           | 2 +-
 hw/arm/mps2.c              | 2 +-
 hw/arm/msf2-som.c          | 2 +-
 hw/arm/musca.c             | 2 +-
 hw/arm/netduino2.c         | 2 +-
 hw/arm/netduinoplus2.c     | 2 +-
 hw/arm/olimex-stm32-h405.c | 2 +-
 hw/arm/stellaris.c         | 2 +-
 hw/arm/stm32vldiscovery.c  | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/b-l475e-iot01a.c
+++ b/hw/arm/b-l475e-iot01a.c
@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
 
     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
+    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
                        sc->flash_size);
 
     if (object_class_by_name(TYPE_DM163)) {
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
     memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
                                         mr, -1);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
                        0, s->nrf51.flash_size);
 }
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                                     mms->remap_irq);
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
                        0, boot_ram_size(mms));
 }
 
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                  qdev_get_gpio_in(armv7m,
                                   mmc->fpga_type == FPGA_AN511 ? 47 : 13));
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
                        0, 0x400000);
 }
 
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
     cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
                        0, soc->envm_size);
 }
 
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
                                                      "cfg_sec_resp", 0));
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
                        0, 0x2000000);
 }
 
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
                        0, FLASH_SIZE);
 }
 
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/olimex-stm32-h405.c
+++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
     create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
+    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
 }
 
 /* FIXME: Figure out how to generate these from stellaris_boards.  */
diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32vldiscovery.c
+++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

The value of the UCFR register is respected when echoing characters to the
terminal, but its reset value is reserved. Fix the reset value to the one
documented in the datasheet.

While at it move the related attribute out of the section of unimplemented
registers since its value is actually respected.

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
     uint32_t ucr1;
     uint32_t ucr2;
     uint32_t uts1;
+    uint32_t ufcr;
 
     /*
      * The registers below are implemented just so that the
      * guest OS sees what it has written
      */
     uint32_t onems;
-    uint32_t ufcr;
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
     s->ucr3 = 0x700;
     s->ubmr = 0;
     s->ubrc = 4;
+    s->ufcr = BIT(11) | BIT(0);
 
     fifo32_reset(&s->rx_fifo);
     timer_del(&s->ageing_timer);
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes characters to be "echoed" after each keystroke rather than after every
other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
only after every other keystroke.

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
         s->usr1 |= USR1_RRDY;
     }
-
-    imx_serial_rx_fifo_ageing_timer_restart(s);
-
     s->usr2 |= USR2_RDR;
     s->uts1 &= ~UTS1_RXEMPTY;
     if (value & URXD_BRK) {
         s->usr2 |= USR2_BRCD;
     }
+
+    imx_serial_rx_fifo_ageing_timer_restart(s);
+
     imx_update(s);
 }
 
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
the MSI IRQ with the INTx lines, so expose it as a dedicated pin.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h        |  4 +++-
 include/hw/arm/fsl-imx7.h        |  4 +++-
 include/hw/pci-host/designware.h |  1 +
 hw/arm/fsl-imx6.c                | 13 ++++++++++++-
 hw/arm/fsl-imx7.c                | 13 ++++++++++++-
 hw/pci-host/designware.c         |  7 +++----
 hw/arm/Kconfig                   |  2 ++
 7 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/usb/chipidea.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "hw/pci-host/designware.h"
+#include "hw/or-irq.h"
 #include "exec/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     ChipideaState      usb[FSL_IMX6_NUM_USBS];
     IMXFECState        eth;
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
-#define FSL_IMX6_PCIE4_IRQ 123
+#define FSL_IMX6_PCIE4_MSI_IRQ 123
 #define FSL_IMX6_DCIC1_IRQ 124
 #define FSL_IMX6_DCIC2_IRQ 125
 #define FSL_IMX6_MLB150_HIGH_IRQ 126
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/imx_fec.h"
 #include "hw/pci-host/designware.h"
 #include "hw/usb/chipidea.h"
+#include "hw/or-irq.h"
 #include "cpu.h"
 #include "qom/object.h"
 #include "qemu/units.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
     FSL_IMX7_PCI_INTA_IRQ = 125,
     FSL_IMX7_PCI_INTB_IRQ = 124,
     FSL_IMX7_PCI_INTC_IRQ = 123,
-    FSL_IMX7_PCI_INTD_IRQ = 122,
+    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
 
     FSL_IMX7_UART7_IRQ    = 126,
 
diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/designware.h
+++ b/include/hw/pci-host/designware.h
@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
         MemoryRegion io;
 
         qemu_irq     irqs[4];
+        qemu_irq     msi;
     } pci;
 
     MemoryRegion mmio;
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
 
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 }
 
 static void fsl_imx6_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * PCIe PHY
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
      * PCIE
      */
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 
     /*
      * USBs
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * USBs
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -XXX,XX +XXX,XX @@
 #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
 #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
 
-#define DESIGNWARE_PCIE_IRQ_MSI                    3
-
 static DesignwarePCIEHost *
 designware_pcie_root_to_host(DesignwarePCIERoot *root)
 {
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
 
     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
+        qemu_set_irq(host->pci.msi, 1);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
         root->msi.intr[0].status ^= val;
         if (!root->msi.intr[0].status) {
-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
+            qemu_set_irq(host->pci.msi, 0);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
         sysbus_init_irq(sbd, &s->pci.irqs[i]);
     }
+    sysbus_init_irq(sbd, &s->pci.msi);
 
     memory_region_init_io(&s->mmio,
                           OBJECT(s),
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
     select PL310  # cache controller
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
 
 config ASPEED_SOC
     bool
@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
     select WDT_IMX2
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
     select UNIMP
 
 config ARM_SMMUV3
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Board schematic is useful to corroborate GPIOs/IRQs wiring.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-2-philmd@linaro.org
[PMM: Use https:// URLs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
     stellaris_init(machine, &stellaris_boards[1]);
 }
 
+/*
+ * Stellaris LM3S811 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
+ */
 static void lm3s811evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
     .class_init = lm3s811evb_class_init,
 };
 
+/*
+ * Stellaris: LM3S6965 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
+ */
 static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
 }
 
-static uint32_t pllcfg_sandstorm[16] = {
+static const uint32_t pllcfg_sandstorm[16] = {
     0x31c0, /* 1 Mhz */
     0x1ae0, /* 1.8432 Mhz */
     0x18c0, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
     0x585b /* 8.192 Mhz */
 };
 
-static uint32_t pllcfg_fury[16] = {
+static const uint32_t pllcfg_fury[16] = {
     0x3200, /* 1 Mhz */
     0x1b20, /* 1.8432 Mhz */
     0x1900, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
 }
 
 /* Board init.  */
-static stellaris_board_info stellaris_boards[] = {
+static const stellaris_board_info stellaris_boards[] = {
   { "LM3S811EVB",
     0,
     0x0032000e,
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There is nothing mapped at 0x40002000.

I2C#0 is already mapped at 0x40021000.

Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
      *
      * 40000000 wdtimer
-     * 40002000 i2c (unimplemented)
      * 40004000 GPIO
      * 40005000 GPIO
      * 40006000 GPIO
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions for the number of controllers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #define NUM_IRQ_LINES 64
 #define NUM_PRIO_BITS 3
 
+#define NUM_GPIO    7
+#define NUM_UART    4
+#define NUM_GPTM    4
+#define NUM_I2C     2
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
 
 static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 {
-    static const int uart_irq[] = {5, 6, 33, 34};
-    static const int timer_irq[] = {19, 21, 23, 35};
-    static const uint32_t gpio_addr[7] =
+    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
+    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
+    static const uint32_t gpio_addr[NUM_GPIO] =
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
-    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *armv7m, *nvic;
-    qemu_irq gpio_in[7][8];
-    qemu_irq gpio_out[7][8];
+    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
+    qemu_irq gpio_in[NUM_GPIO][8];
+    qemu_irq gpio_out[NUM_GPIO][8];
     qemu_irq adc;
     int sram_size;
     int flash_size;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     } else {
         adc = NULL;
     }
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_GPTM; i++) {
         if (board->dc2 & (0x10000 << i)) {
             SysBusDevice *sbd;
 
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
 
-    for (i = 0; i < 7; i++) {
+    for (i = 0; i < NUM_GPIO; i++) {
         if (board->dc4 & (1 << i)) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_UART; i++) {
         if (board->dc2 & (1 << i)) {
             SysBusDevice *sbd;
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions (DCx_periph) for the DeviceCapability bits,
replace direct bitmask checks with the DEV_CAP() macro,
which use the extract/deposit API.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "qapi/error.h"
 #include "hw/core/split-irq.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
 #define NUM_GPTM    4
 #define NUM_I2C     2
 
+/*
+ * See Stellaris Data Sheet chapter 5.2.5 "System Control",
+ * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
+ */
+#define DC1_WDT          3
+#define DC1_HIB          6
+#define DC1_MPU          7
+#define DC1_ADC          16
+#define DC1_PWM          20
+#define DC2_UART(n)     (n)
+#define DC2_SSI          4
+#define DC2_QEI(n)      (8 + n)
+#define DC2_I2C(n)      (12 + 2 * n)
+#define DC2_GPTM(n)     (16 + n)
+#define DC2_COMP(n)     (24 + n)
+#define DC4_GPIO(n)     (n)
+#define DC4_EMAC         28
+
+#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
     sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
 
-    if (board->dc1 & (1 << 16)) {
+    if (DEV_CAP(1, ADC)) {
         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     qdev_get_gpio_in(nvic, 14),
                                     qdev_get_gpio_in(nvic, 15),
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         adc = NULL;
     }
     for (i = 0; i < NUM_GPTM; i++) {
-        if (board->dc2 & (0x10000 << i)) {
+        if (DEV_CAP(2, GPTM(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new(TYPE_STELLARIS_GPTM);
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc1 & (1 << 3)) { /* watchdog present */
+    if (DEV_CAP(1, WDT)) {
         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
         object_property_add_child(soc_container, "wdg", OBJECT(dev));
         qdev_connect_clock_in(dev, "WDOGCLK",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 
 
     for (i = 0; i < NUM_GPIO; i++) {
-        if (board->dc4 & (1 << i)) {
+        if (DEV_CAP(4, GPIO(i))) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
                                                                 gpio_irq[i]));
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc2 & (1 << 12)) {
+    if (DEV_CAP(2, I2C(0))) {
         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
                                    qdev_get_gpio_in(nvic, 8));
         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
     for (i = 0; i < NUM_UART; i++) {
-        if (board->dc2 & (1 << i)) {
+        if (DEV_CAP(2, UART(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new("pl011_luminary");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
         }
     }
-    if (board->dc2 & (1 << 4)) {
+    if (DEV_CAP(2, SSI)) {
         dev = sysbus_create_simple("pl022", 0x40008000,
                                    qdev_get_gpio_in(nvic, 7));
         if (board->peripherals & BP_OLED_SSI) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             qemu_irq_raise(gpio_out[GPIO_D][0]);
         }
     }
-    if (board->dc4 & (1 << 28)) {
+    if (DEV_CAP(4, EMAC)) {
         DeviceState *enet;
 
         enet = qdev_new("stellaris_enet");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There are 2 I2C controllers, map them both, removing
the unimplemented one. Keep the OLED controller on the
first I2C bus.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-7-philmd@linaro.org
[PMM: tweak to appease maybe-use-uninitialized warning]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
+    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
+    static const int i2c_irq[NUM_I2C] = {8, 37};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qemu_irq adc;
     int sram_size;
     int flash_size;
-    I2CBus *i2c;
+    DeviceState *i2c_dev[NUM_I2C] = { };
     DeviceState *dev;
     DeviceState *ssys_dev;
     int i;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (DEV_CAP(2, I2C(0))) {
-        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
-                                   qdev_get_gpio_in(nvic, 8));
-        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-        if (board->peripherals & BP_OLED_I2C) {
-            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
+    for (i = 0; i < NUM_I2C; i++) {
+        if (DEV_CAP(2, I2C(i))) {
+            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
+                                              qdev_get_gpio_in(nvic,
+                                                               i2c_irq[i]));
         }
     }
+    if (board->peripherals & BP_OLED_I2C) {
+        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
+
+        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
+    }
 
     for (i = 0; i < NUM_UART; i++) {
         if (DEV_CAP(2, UART(i))) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

We don't have any functional tests for this machine yet, thus let's
add a test with a MicroPython binary that is available online
(thanks to Joel Stanley for providing it, see:
 https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250124101709.1591761-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                           |  1 +
 tests/functional/meson.build          |  1 +
 tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100755 tests/functional/test_arm_microbit.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
 F: include/hw/*/nrf51*.h
 F: include/hw/*/microbit*.h
 F: tests/qtest/microbit-test.c
+F: tests/functional/test_arm_microbit.py
 F: docs/system/arm/nrf.rst
 
 ARM PL011 Rust device
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
   'arm_cubieboard',
   'arm_emcraft_sf2',
   'arm_integratorcp',
+  'arm_microbit',
   'arm_orangepi',
   'arm_quanta_gsj',
   'arm_raspi2',
diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/functional/test_arm_microbit.py
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright 2025, The QEMU Project Developers.
+#
+# A functional test that runs MicroPython on the arm microbit machine.
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class MicrobitMachine(QemuSystemTest):
+
+    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
+        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
+
+    def test_arm_microbit(self):
+        self.set_machine('microbit')
+
+        micropython = self.ASSET_MICRO.fetch()
+        self.vm.set_console()
+        self.vm.add_args('-device', f'loader,file={micropython}')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Type "help()" for more information.')
+        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
+        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
+        wait_for_console_pattern(self, '>>>')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
-- 
2.34.1

The pseudocode ResetSVEState() does:
    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.

Before the advent of FEAT_AFP, this was only setting a collection of
RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
was that we didn't actually set the FPSR the way we are supposed to
do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
will change the floating point behaviour.

Call vfp_set_fpsr(), as we ought to.

(Note for stable backports: commit 7f2a01e7368f9 moved this function
from sme_helper.c to helper.c, but it had the same bug before the
move too.)

Cc: qemu-stable@nongnu.org
Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
     /* Recall that FFR is stored as pregs[16]. */
     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
-    vfp_set_fpcr(env, 0x0800009f);
+    vfp_set_fpsr(env, 0x0800009f);
 }
 
 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
-- 
2.34.1

Use the FPSR_ named constants in vfp_exceptbits_from_host(),
rather than hardcoded magic numbers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
     int target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
-        target_bits |= 1;
+        target_bits |= FPSR_IOC;
     }
     if (host_bits & float_flag_divbyzero) {
-        target_bits |= 2;
+        target_bits |= FPSR_DZC;
     }
     if (host_bits & float_flag_overflow) {
-        target_bits |= 4;
+        target_bits |= FPSR_OFC;
     }
     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
-        target_bits |= 8;
+        target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
-        target_bits |= 0x10;
+        target_bits |= FPSR_IXC;
     }
     if (host_bits & float_flag_input_denormal) {
-        target_bits |= 0x80;
+        target_bits |= FPSR_IDC;
     }
     return target_bits;
 }
-- 
2.34.1

In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
an "int", and our return type is also "int". However, the only
callsite returns the same information as a uint32_t, and
more generally we handle FPSR values in the code as uint32_t,
not int. Bring this function in to line with that convention.

There is no behaviour change because none of the FPSR bits
we set in this function are bit 31. The input argument to
the function remains 'int' because that is the return type
of the softfloat get_float_exception_flags().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_TCG
 
 /* Convert host exception flags to vfp form.  */
-static inline int vfp_exceptbits_from_host(int host_bits)
+static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 {
-    int target_bits = 0;
+    uint32_t target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
         target_bits |= FPSR_IOC;
-- 
2.34.1

We want to split the existing fp_status in the Arm CPUState into
separate float_status fields for AArch32 and AArch64.  (This is
because new control bits defined by FEAT_AFP only have an effect for
AArch64, not AArch32.) To make this split we will:
 * define new fp_status_a32 and fp_status_a64 which have
   identical behaviour to the existing fp_status
 * move existing uses of fp_status to fp_status_a32 or
   fp_status_a64 as appropriate
 * delete the old fp_status when it has no uses left

In this patch we add the new float_status fields.

We will also need to split fp_status_f16, but we will do that
as a separate series of patches.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 12 ++++++++++++
 4 files changed, 30 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         /* There are a number of distinct float control structures:
          *
          *  fp_status: is the "normal" fp status.
+         *  fp_status_a32: is the "normal" fp status for AArch32 insns
+         *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * an explicit FPSCR read.
          */
         float_status fp_status;
+        float_status fp_status_a32;
+        float_status fp_status_a64;
         float_status fp_status_f16;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  */
 typedef enum ARMFPStatusFlavour {
     FPST_FPCR,
+    FPST_A32,
+    FPST_A64,
     FPST_FPCR_F16,
     FPST_STD,
     FPST_STD_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *
  * FPST_FPCR
  *   for non-FP16 operations controlled by the FPCR
+ * FPST_A32
+ *   for AArch32 non-FP16 operations controlled by the FPCR
+ * FPST_A64
+ *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR:
         offset = offsetof(CPUARMState, vfp.fp_status);
         break;
+    case FPST_A32:
+        offset = offsetof(CPUARMState, vfp.fp_status_a32);
+        break;
+    case FPST_A64:
+        offset = offsetof(CPUARMState, vfp.fp_status_a64);
+        break;
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     uint32_t i;
 
     i = get_float_exception_flags(&env->vfp.fp_status);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * be the architecturally up-to-date exception flag information first.
      */
     set_float_exception_flags(0, &env->vfp.fp_status);
+    set_float_exception_flags(0, &env->vfp.fp_status_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             break;
         }
         set_float_rounding_mode(i, &env->vfp.fp_status);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
     }
     if (changed & FPCR_FZ16) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool ftz_enabled = val & FPCR_FZ;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
     }
 }
-- 
2.34.1

Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
 * directly reference an fp_status field
 * are called only from the A64 decoder
 * are not called inside a set_rmode/restore_rmode sequence

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/sme_helper.c | 2 +-
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
      * round-to-odd -- see above.
      */
     fpst_f16 = env->vfp.fp_status_f16;
-    fpst_std = env->vfp.fp_status;
+    fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
     fpst_odd = fpst_std;
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t i, oprsz = simd_oprsz(desc);
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += 16) {
-- 
2.34.1

The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
(because for A64 we update the main NZCV flags and for A32 we update
the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
field instead of fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
 DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
-DO_VFP_cmp(s, float32, float32, fp_status)
-DO_VFP_cmp(d, float64, float64, fp_status)
+DO_VFP_cmp(s, float32, float32, fp_status_a32)
+DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
 
 /* Integer to float and float to integer conversions */
-- 
2.34.1

In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-vfp.c
+++ b/target/arm/tcg/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_rmode = gen_set_rmode(rounding, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_shift = tcg_constant_i32(0);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
     f0 = tcg_temp_new_i32();
     f1 = tcg_temp_new_i32();
     fd = tcg_temp_new_i32();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg32(f0, vn);
     vfp_load_reg32(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
     f0 = tcg_temp_new_i64();
     f1 = tcg_temp_new_i64();
     fd = tcg_temp_new_i64();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg64(f0, vn);
     vfp_load_reg64(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negs(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
     vfp_store_reg32(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negd(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
     vfp_store_reg64(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
 
 static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
 {
-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
 {
-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tmp = tcg_temp_new_i32();
 
     vfp_load_reg32(tmp, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rints(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rintd(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints_exact(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd_exact(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg64(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
     vd = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
     vfp_load_reg64(vm, a->vm);
-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg32(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
 
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f32 */
         gen_helper_vfp_sitos(vm, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f64 */
         gen_helper_vfp_sitod(vd, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
     vd = tcg_temp_new_i32();
     vfp_load_reg32(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
     vd = tcg_temp_new_i64();
     vfp_load_reg64(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i64();
     vd = tcg_temp_new_i32();
     vfp_load_reg64(vm, a->vm);
-- 
2.34.1

In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with

perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
 target/arm/tcg/translate-sme.c |   4 +-
 target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
 3 files changed, 90 insertions(+), 90 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, bool is_fp16, int data,
                               gen_helper_gvec_3_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm), fpst,
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, int ra, bool is_fp16, int data,
                               gen_helper_gvec_4_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm),
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = tcg_constant_i64(0);
             if (swap) {
-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_dreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = tcg_constant_i32(0);
             if (swap) {
-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_sreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i64 t1 = tcg_temp_new_i64();
 
             read_vec_element(s, t1, a->rm, a->idx, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i32 t1 = tcg_temp_new_i32();
 
             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negd(t1, t1);
             }
-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negs(t1, t1);
             }
-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element(s, t0, a->rn, 0, MO_64);
             read_vec_element(s, t1, a->rn, 1, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negd(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
             write_fp_dreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negs(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
             write_fp_sreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     if (fp_access_check(s)) {
         MemOp esz = a->esz;
         int elts = (a->q ? 16 : 8) >> esz;
-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
         write_fp_sreg(s, a->rd, res);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
         write_fp_dreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
         /* write_fp_sreg is OK here because top half of result is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
         write_fp_sreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
     TCGv_i32 tcg_shift, tcg_single;
     TCGv_i64 tcg_double;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
 
     switch (esz) {
@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
     TCGv_ptr tcg_fpstatus;
     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
     }
     if (fp_access_check(s)) {
         TCGv_i64 t = read_fp_dreg(s, a->rn);
-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
 
         gen_helper_fjcvtzs(t, t, fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
      * with von Neumann rounding (round to odd)
      */
     TCGv_i32 tmp = tcg_temp_new_i32();
-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
+    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
     tcg_gen_extu_i32_i64(d, tmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tcg_lo = tcg_temp_new_i32();
     TCGv_i32 tcg_hi = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 ahp = get_ahp_flag();
 
     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
     gen_helper_vfp_fcvtsd(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
 
 static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 tmp = tcg_temp_new_i32();
     gen_helper_bfcvt_pair(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn), fpst,
                        is_q ? 16 : 8, vec_full_reg_size(s),
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
 TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
            MO_32, gen_helper_sme_fmopa_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
+           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
+           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
 
 TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
                                  arg_rr_esz *a, int data)
 {
     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 3 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
                                   arg_rrr_esz *a, int data)
 {
     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 4 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
                                    arg_rprr_esz *a)
 {
     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke a vector expander on two Zregs and an immediate.  */
@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
     };
     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
                               (a->index << 1) | sub,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
 };
 TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Fast Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
 
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     fn(temp, t_zn, t_pg, status, t_desc);
 
@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
         TCGv_ptr status =
-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
 };
 TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Accumulating Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
     t_pg = tcg_temp_new_ptr();
     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
 
     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
 
-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
     fn(t_zd, t_zn, t_pg, scalar, status, desc);
 }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
     }
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
                            vec_full_reg_offset(s, a->rm),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
 };
 TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
            a->rd, a->rn, a->rm, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 #define DO_FMLA(NAME, name) \
     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
     };                                                                  \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
 DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
 };
 TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
 };
 TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Unary Operations Predicated Group
  */
 
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frint_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
     gen_helper_sve_frint_d
 };
 TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     gen_helper_sve_frintx_d
 };
 TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
 static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
     }
 
     vsz = vec_full_reg_size(s);
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tmode = gen_set_rmode(mode, status);
 
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
 };
 TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
     NULL,                   gen_helper_sve_fsqrt_h,
     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
 };
 TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
 
 /*
  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
 
 TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 
 static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
                         gen_gvec_rax1, a)
 
 TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
 TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
     gen_helper_flogb_s, gen_helper_flogb_d
 };
 TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
 {
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
 static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
+                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
                               a->rd, a->rn, a->rm, a->ra,
-                              (a->index << 1) | sel, FPST_FPCR);
+                              (a->index << 1) | sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
-- 
2.34.1

Now we have moved all the uses of vfp.fp_status and FPST_FPCR
to either the A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 8 +-------
 4 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
 
         /* There are a number of distinct float control structures:
          *
-         *  fp_status: is the "normal" fp status.
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * only thing which needs to read the exception flags being
          * an explicit FPSCR read.
          */
-        float_status fp_status;
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  * Enum for argument to fpstatus_ptr().
  */
 typedef enum ARMFPStatusFlavour {
-    FPST_FPCR,
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  * been set up to point to the requested field in the CPU state struct.
  * The options are:
  *
- * FPST_FPCR
- *   for non-FP16 operations controlled by the FPCR
  * FPST_A32
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     int offset;
 
     switch (flavour) {
-    case FPST_FPCR:
-        offset = offsetof(CPUARMState, vfp.fp_status);
-        break;
     case FPST_A32:
         offset = offsetof(CPUARMState, vfp.fp_status_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 
 static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 {
-    uint32_t i;
+    uint32_t i = 0;
 
-    i = get_float_exception_flags(&env->vfp.fp_status);
     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * values. The caller should have arranged for env->vfp.fpsr to
      * be the architecturally up-to-date exception flag information first.
      */
-    set_float_exception_flags(0, &env->vfp.fp_status);
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             i = float_round_to_zero;
             break;
         }
-        set_float_rounding_mode(i, &env->vfp.fp_status);
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
-- 
2.34.1

As the first part of splitting the existing fp_status_f16
into separate float_status fields for AArch32 and AArch64
(so that we can make FEAT_AFP control bits apply only
for AArch64), define the two new fp_status_f16_a32 and
fp_status_f16_a64 fields, but don't use them yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 14 ++++++++++++++
 4 files changed, 32 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
+         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
          *       calculations with the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
+        float_status fp_status_f16_a32;
+        float_status fp_status_f16_a64;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
 
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
+    FPST_A32_F16,
+    FPST_A64_F16,
     FPST_STD,
     FPST_STD_F16,
 } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A32_F16
+ *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A64_F16
+ *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
  *   for A32/T32 Neon operations using the "standard FPSCR value"
  * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
+    case FPST_A32_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+        break;
+    case FPST_A64_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
+        break;
     case FPST_STD:
         offset = offsetof(CPUARMState, vfp.standard_fp_status);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
           & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+          & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
           & ~float_flag_input_denormal);
     return vfp_exceptbits_from_host(i);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
     }
     if (changed & FPCR_FZ) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
 }
 
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that
are AArch32-specific; switch to fp_status_f16_a32 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
---
 target/arm/tcg/vec_helper.c | 4 ++--
 target/arm/vfp_helper.c     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
     softfloat_to_vfp_compare(env, \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
 DO_VFP_cmp(s, float32, float32, fp_status_a32)
 DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that are
AArch64-specific; switch to fp_status_f16_a64 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
---
 target/arm/tcg/sme_helper.c | 4 ++--
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
     float_status fpst_odd, fpst_std, fpst_f16;
 
     /*
-     * Make copies of fp_status and fp_status_f16, because this operation
+     * Make copies of the fp status fields we use, because this operation
      * does not update the cumulative fp exception status.  It also
      * produces default NaNs. We also need a second copy of fp_status with
      * round-to-odd -- see above.
      */
-    fpst_f16 = env->vfp.fp_status_f16;
+    fpst_f16 = env->vfp.fp_status_f16_a64;
     fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += 16) {
         float16 mm_16 = *(float16 *)(vm + i + idx);
-- 
2.34.1

In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 32 ++++++++---------
 target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
 2 files changed, 49 insertions(+), 49 deletions(-)

Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
to the new A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 7 -------
 4 files changed, 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
-         *  fp_status_fp16: used for half-precision calculations
          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          */
         float_status fp_status_a32;
         float_status fp_status_a64;
-        float_status fp_status_f16;
         float_status fp_status_f16_a32;
         float_status fp_status_f16_a64;
         float_status standard_fp_status;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
 typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
-    FPST_FPCR_F16,
     FPST_A32_F16,
     FPST_A64_F16,
     FPST_STD,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
  *   for AArch64 non-FP16 operations controlled by the FPCR
- * FPST_FPCR_F16
- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A32_F16
  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A64_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_A64:
         offset = offsetof(CPUARMState, vfp.fp_status_a64);
         break;
-    case FPST_FPCR_F16:
-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
-        break;
     case FPST_A32_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
-          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      */
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         }
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
-- 
2.34.1

Our float_flag_input_denormal exception flag is set when the fpu code
flushes an input denormal to zero.  This is what many guest
architectures (eg classic Arm behaviour) require, but it is not the
only donarmal-related reason we might want to set an exception flag.
The x86 behaviour (which we do not currently model correctly) wants
to see an exception flag when a denormal input is *not* flushed to
zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
also wants these semantics.

Rename float_flag_input_denormal to float_flag_input_denormal_flushed
to make it clearer when it is set and to allow us to add a new
float_flag_input_denormal_used next to it for the x86/FEAT_AFP
semantics.

Commit created with
 for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done

and manual editing of softfloat-types.h and softfloat.c to clean
up the indentation afterwards and to fix a comment which wasn't
using the full name of the flag.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h |  5 +++--
 fpu/softfloat.c               |  4 ++--
 target/arm/tcg/sve_helper.c   |  6 +++---
 target/arm/vfp_helper.c       | 10 +++++-----
 target/i386/tcg/fpu_helper.c  |  6 +++---
 target/mips/tcg/msa_helper.c  |  2 +-
 target/rx/op_helper.c         |  2 +-
 fpu/softfloat-parts.c.inc     |  2 +-
 8 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_overflow        = 0x0004,
     float_flag_underflow       = 0x0008,
     float_flag_inexact         = 0x0010,
-    float_flag_input_denormal  = 0x0020,
+    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+    float_flag_input_denormal_flushed = 0x0020,
     float_flag_output_denormal = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
     bool flush_to_zero;
-    /* should denormalised inputs go to zero and set the input_denormal flag? */
+    /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
     bool default_nan_mode;
     /*
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
         if (unlikely(soft_t ## _is_denormal(*a))) {                     \
             *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                      soft_t ## _is_neg(*a));            \
-            float_raise(float_flag_input_denormal, s);                  \
+            float_raise(float_flag_input_denormal_flushed, s);          \
         }                                                               \
     }
 
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
 static bool parts_squash_denormal(FloatParts64 p, float_status *status)
 {
     if (p.exp == 0 && p.frac != 0) {
-        float_raise(float_flag_input_denormal, status);
+        float_raise(float_flag_input_denormal_flushed, status);
         return true;
     }
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                 return -15 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x1f)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                 return -127 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0xff)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                 return -1023 - clz64(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x7ff)) {
         if (frac == 0) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_inexact) {
         target_bits |= FPSR_IXC;
     }
-    if (host_bits & float_flag_input_denormal) {
+    if (host_bits & float_flag_input_denormal_flushed) {
         target_bits |= FPSR_IDC;
     }
     return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     return vfp_exceptbits_from_host(i);
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
 
     /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
     inexact = e_new & (float_flag_inexact |
-                       float_flag_input_denormal |
+                       float_flag_input_denormal_flushed |
                        float_flag_invalid);
 
     /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                        (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                        (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                        (new_flags & float_flag_inexact ? FPUS_PE : 0) |
-                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
+                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
 }
 
 static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
             int shift = clz64(temp.l.lower);
             temp.l.lower <<= shift;
             expdif = 1 - EXPBIAS - shift;
-            float_raise(float_flag_input_denormal, &env->fp_status);
+            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
         } else {
             expdif = EXPD(temp) - EXPBIAS;
         }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
     uint8_t flags = get_float_exception_flags(&env->sse_status);
     /*
      * The MXCSR denormal flag has opposite semantics to
-     * float_flag_input_denormal (the softfloat code sets that flag
+     * float_flag_input_denormal_flushed (the softfloat code sets that flag
      * only when flushing input denormals to zero, but SSE sets it
      * only when not flushing them to zero), so is not converted
      * here.
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
 
     /* Set Inexact (I) when flushing inputs to zero */
-    if ((ieee_exception_flags & float_flag_input_denormal) &&
+    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         if (action & CLEAR_IS_INEXACT) {
             mips_exception_flags &= ~FP_INEXACT;
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
         if (xcpt & float_flag_inexact) {
             SET_FPSW(X);
         }
-        if ((xcpt & (float_flag_input_denormal
+        if ((xcpt & (float_flag_input_denormal_flushed
                      | float_flag_output_denormal))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
         if (likely(frac_eqz(p))) {
             p->cls = float_class_zero;
         } else if (status->flush_inputs_to_zero) {
-            float_raise(float_flag_input_denormal, status);
+            float_raise(float_flag_input_denormal_flushed, status);
             p->cls = float_class_zero;
             frac_clear(p);
         } else {
-- 
2.34.1

Our float_flag_output_denormal exception flag is set when
the fpu code flushes an output denormal to zero. Rename
it to float_flag_output_denormal_flushed:
 * this keeps it parallel with the flag for flushing
   input denormals, which we just renamed
 * it makes it clearer that it doesn't mean "set when
   the output is a denormal"

Commit created with
 for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 3 ++-
 fpu/softfloat.c               | 2 +-
 target/arm/vfp_helper.c       | 2 +-
 target/i386/tcg/fpu_helper.c  | 2 +-
 target/m68k/fpu_helper.c      | 2 +-
 target/mips/tcg/msa_helper.c  | 2 +-
 target/rx/op_helper.c         | 2 +-
 target/tricore/fpu_helper.c   | 6 +++---
 fpu/softfloat-parts.c.inc     | 2 +-
 9 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_inexact         = 0x0010,
     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
     float_flag_input_denormal_flushed = 0x0020,
-    float_flag_output_denormal = 0x0040,
+    /* We flushed an output denormal to 0 (because of flush_to_zero) */
+    float_flag_output_denormal_flushed = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
         }
         if ( zExp <= 0 ) {
             if (status->flush_to_zero) {
-                float_raise(float_flag_output_denormal, status);
+                float_raise(float_flag_output_denormal_flushed, status);
                 return packFloatx80(zSign, 0, 0);
             }
             isTiny = status->tininess_before_rounding
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= FPSR_OFC;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
                    (flags & float_flag_overflow ? FPUS_OE : 0) |
                    (flags & float_flag_underflow ? FPUS_UE : 0) |
                    (flags & float_flag_inexact ? FPUS_PE : 0) |
-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
+                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
                     0));
 }
 
diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= 0x40;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= 0x20;
     }
     if (host_bits & float_flag_divbyzero) {
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     }
 
     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
-    if ((ieee_exception_flags & float_flag_output_denormal) &&
+    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         mips_exception_flags |= FP_INEXACT;
         if (action & CLEAR_FS_UNDERFLOW) {
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
             SET_FPSW(X);
         }
         if ((xcpt & (float_flag_input_denormal_flushed
-                     | float_flag_output_denormal))
+                     | float_flag_output_denormal_flushed))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
         }
diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/fpu_helper.c
+++ b/target/tricore/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
            & (float_flag_invalid
               | float_flag_overflow
               | float_flag_underflow
-              | float_flag_output_denormal
+              | float_flag_output_denormal_flushed
               | float_flag_divbyzero
               | float_flag_inexact);
 }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
+    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
         env->FPU_FU = 1 << 31;
         some_excp = 1;
     }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
+    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
         env->PSW |= 1 << 26;
         some_excp = 1;
     }
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
         }
         frac_shr(p, frac_shift);
     } else if (s->flush_to_zero) {
-        flags |= float_flag_output_denormal;
+        flags |= float_flag_output_denormal_flushed;
         p->cls = float_class_zero;
         exp = 0;
         frac_clear(p);
-- 
2.34.1

In softfloat-types.h a comment documents that if the float_status
field flush_to_zero is set then we flush denormalised results to 0
and set the inexact flag.  This isn't correct: the status flag that
we set when flush_to_zero causes us to flush an output to zero is
float_flag_output_denormal_flushed.

Correct the comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     Float3NaNPropRule float_3nan_prop_rule;
     FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
-    /* should denormalised results go to zero and set the inexact flag? */
+    /* should denormalised results go to zero and set output_denormal_flushed? */
     bool flush_to_zero;
     /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
-- 
2.34.1

The advsimd_addh etc helpers defined in helper-a64.c are identical to
the vfp_addh etc helpers defined in helper-vfp.c: both take two
float16 inputs (in a uint32_t type) plus a float_status* and are
simple wrappers around the softfloat float16_* functions.

(The duplication seems to be a historical accident: we added the
advsimd helpers in 2018 as part of the A64 implementation, and at
that time there was no f16 emulation in A32.  Then later we added the
A32 f16 handling by extending the existing VFP helper macros to
generate f16 versions as well as f32 and f64, and didn't realise we
could clean things up.)

Remove the now-unnecessary advsimd helpers and make the places that
generated calls to them use the vfp helpers instead. Many of the
helper functions were already unused.

(The remaining advsimd_ helpers are those which don't have vfp
versions.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
---
 target/arm/tcg/helper-a64.h    |  8 --------
 target/arm/tcg/helper-a64.c    |  9 ---------
 target/arm/tcg/translate-a64.c | 16 ++++++++--------
 3 files changed, 8 insertions(+), 25 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
 DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
 DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
 DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
 DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
     return float16_ ## name(a, b, fpst);    \
 }
 
-ADVSIMD_HALFOP(add)
-ADVSIMD_HALFOP(sub)
-ADVSIMD_HALFOP(mul)
-ADVSIMD_HALFOP(div)
-ADVSIMD_HALFOP(min)
-ADVSIMD_HALFOP(max)
-ADVSIMD_HALFOP(minnum)
-ADVSIMD_HALFOP(maxnum)
-
 #define ADVSIMD_TWOHALFOP(name)                                         \
 uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
                                   float_status *fpst)                   \
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
 TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
 
 static const FPScalar f_scalar_fmax = {
-    gen_helper_advsimd_maxh,
+    gen_helper_vfp_maxh,
     gen_helper_vfp_maxs,
     gen_helper_vfp_maxd,
 };
 TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
 
 static const FPScalar f_scalar_fmin = {
-    gen_helper_advsimd_minh,
+    gen_helper_vfp_minh,
     gen_helper_vfp_mins,
     gen_helper_vfp_mind,
 };
 TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
 
 static const FPScalar f_scalar_fmaxnm = {
-    gen_helper_advsimd_maxnumh,
+    gen_helper_vfp_maxnumh,
     gen_helper_vfp_maxnums,
     gen_helper_vfp_maxnumd,
 };
 TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
 
 static const FPScalar f_scalar_fminnm = {
-    gen_helper_advsimd_minnumh,
+    gen_helper_vfp_minnumh,
     gen_helper_vfp_minnums,
     gen_helper_vfp_minnumd,
 };
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     return true;
 }
 
-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
+TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
+TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
+TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
+TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
 
 TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
 TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
-- 
2.34.1

We should be using the F16-specific float_status for conversions from
half-precision, because halfprec inputs never set Input Denormal.

Without FEAT_AHP, using the wrong fpst here had no effect, because
the only difference between the A64_F16 and A64 fpst is its handling
of flush-to-zero on input and output, and the helper functions
vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
relevant flushing flags, and flush_inputs_to_zero was the only way
that IDC could be set.

With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
input_denormal_used, which we will only ignore in
vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
use that one for f16 inputs (and the normal one for single/double to
f16 conversions).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 9 ++++++---
 target/arm/tcg/translate-sve.c | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
         TCGv_i32 tcg_op = tcg_temp_new_i32();
         int srcelt = a->q ? 2 : 0;
 
+        fpst = fpstatus_ptr(FPST_A64);
+
         for (pass = 0; pass < 2; pass++) {
             tcg_res[pass] = tcg_temp_new_i64();
             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         TCGv_i32 tcg_res[4];
         TCGv_i32 ahp = get_ahp_flag();
 
+        fpst = fpstatus_ptr(FPST_A64_F16);
+
         for (pass = 0; pass < 4; pass++) {
             tcg_res[pass] = tcg_temp_new_i32();
             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_bfcvt, a, 0, FPST_A64)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-- 
2.34.1

From: Hongren Zheng <i@zenithal.me>

When USBPacket in OUT direction has larger payload
than the ep_out_buffer (of size 512), a buffer overflow
would occur.

It could be fixed by limiting the size of usb_packet_copy
to be at most buffer size. Further optimization gets rid
of the ep_out_buffer and directly uses ep_out as the target
buffer.

This is reported by a security researcher who artificially
constructed an OUT packet of size 2047. The report has gone
through the QEMU security process, and as this device is for
testing purpose and no deployment of it in virtualization
environment is observed, it is triaged not to be a security bug.

Cc: qemu-stable@nongnu.org
Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
Signed-off-by: Hongren Zheng <i@zenithal.me>
Message-id: Z4TfMOrZz6IQYl_h@Sun
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/canokey.h | 4 ----
 hw/usb/canokey.c | 6 +++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.h
+++ b/hw/usb/canokey.h
@@ -XXX,XX +XXX,XX @@
 #define CANOKEY_EP_NUM 3
 /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
 #define CANOKEY_EP_IN_BUFFER_SIZE 2048
-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
 
 typedef enum {
     CANOKEY_EP_IN_WAIT,
@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
     /* OUT pointer to canokey recv buffer */
     uint8_t *ep_out[CANOKEY_EP_NUM];
     uint32_t ep_out_size[CANOKEY_EP_NUM];
-    /* For large BULK OUT, multiple write to ep_out is needed */
-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
 
     /* Properties */
     char *file; /* canokey-file */
diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
     switch (p->pid) {
     case USB_TOKEN_OUT:
         trace_canokey_handle_data_out(ep_out, p->iov.size);
-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
         out_pos = 0;
+        /* segment packet into (possibly multiple) ep_out */
         while (out_pos != p->iov.size) {
             /*
              * key->ep_out[ep_out] set by prepare_receive
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
              * to be the buffer length
              */
             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
-            memcpy(key->ep_out[ep_out],
-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
+            /* usb_packet_copy would update the pos offset internally */
+            usb_packet_copy(p, key->ep_out[ep_out], out_len);
             out_pos += out_len;
             /* update ep_out_size to actual len */
             key->ep_out_size[ep_out] = out_len;
-- 
2.34.1