diff --git a/qemu/target/arm/translate-vfp.inc.c b/qemu/target/arm/translate-vfp.inc.c
index 4c25d172..1e9493d1 100644
--- a/qemu/target/arm/translate-vfp.inc.c
+++ b/qemu/target/arm/translate-vfp.inc.c
@@ -673,6 +673,14 @@ static FPSysRegCheckResult fp_sysreg_checks(DisasContext *s, int regno)
             return false;
         }
         break;
+    case ARM_VFP_FPCXT_S:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+            return false;
+        }
+        if (!s->v8m_secure) {
+            return false;
+        }
+        break;
     default:
         return FPSysRegCheckFailed;
     }
@@ -724,6 +732,26 @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         tcg_temp_free_i32(tcg_ctx, tmp);
         break;
     }
+    case ARM_VFP_FPCXT_S:
+    {
+        TCGv_i32 sfpa, control, fpscr;
+        /* Set FPSCR[27:0] and CONTROL.SFPA from value */
+        tmp = loadfn(s, opaque);
+        sfpa = tcg_temp_new_i32(tcg_ctx);
+        tcg_gen_shri_i32(tcg_ctx, sfpa, tmp, 31);
+        control = load_cpu_field(s, v7m.control[M_REG_S]);
+        tcg_gen_deposit_i32(tcg_ctx, control, control, sfpa,
+                            R_V7M_CONTROL_SFPA_SHIFT, 1);
+        store_cpu_field(s, control, v7m.control[M_REG_S]);
+        fpscr = load_cpu_field(s, vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_gen_andi_i32(tcg_ctx, fpscr, fpscr, FPCR_NZCV_MASK);
+        tcg_gen_andi_i32(tcg_ctx, tmp, tmp, ~FPCR_NZCV_MASK);
+        tcg_gen_or_i32(tcg_ctx, fpscr, fpscr, tmp);
+        store_cpu_field(s, fpscr, vfp.xregs[ARM_VFP_FPSCR]);
+        tcg_temp_free_i32(tcg_ctx, tmp);
+        tcg_temp_free_i32(tcg_ctx, sfpa);
+        break;
+    }
     default:
         g_assert_not_reached();
     }
@@ -768,6 +796,36 @@ static bool gen_M_fp_sysreg_read(DisasContext *s, int regno,
         tcg_gen_andi_i32(tcg_ctx, tmp, tmp, FPCR_NZCV_MASK);
         storefn(s, opaque, tmp);
         break;
+    case ARM_VFP_FPCXT_S:
+    {
+        TCGv_i32 control, sfpa, fpscr;
+        /* Bits [27:0] from FPSCR, bit [31] from CONTROL.SFPA */
+        tmp = tcg_temp_new_i32(tcg_ctx);
+        sfpa = tcg_temp_new_i32(tcg_ctx);
+        gen_helper_vfp_get_fpscr(tcg_ctx, tmp, tcg_ctx->cpu_env);
+        tcg_gen_andi_i32(tcg_ctx, tmp, tmp, ~FPCR_NZCV_MASK);
+        control = load_cpu_field(s, v7m.control[M_REG_S]);
+        tcg_gen_andi_i32(tcg_ctx, sfpa, control, R_V7M_CONTROL_SFPA_MASK);
+        tcg_gen_shli_i32(tcg_ctx, sfpa, sfpa, 31 - R_V7M_CONTROL_SFPA_SHIFT);
+        tcg_gen_or_i32(tcg_ctx, tmp, tmp, sfpa);
+        tcg_temp_free_i32(tcg_ctx, sfpa);
+        /*
+         * Store result before updating FPSCR etc, in case
+         * it is a memory write which causes an exception.
+         */
+        storefn(s, opaque, tmp);
+        /*
+         * Now we must reset FPSCR from FPDSCR_NS, and clear
+         * CONTROL.SFPA; so we'll end the TB here.
+         */
+        tcg_gen_andi_i32(tcg_ctx, control, control, ~R_V7M_CONTROL_SFPA_MASK);
+        store_cpu_field(s, control, v7m.control[M_REG_S]);
+        fpscr = load_cpu_field(s, v7m.fpdscr[M_REG_NS]);
+        gen_helper_vfp_set_fpscr(tcg_ctx, tcg_ctx->cpu_env, fpscr);
+        tcg_temp_free_i32(tcg_ctx, fpscr);
+        gen_lookup_tb(s);
+        break;
+    }
     default:
         g_assert_not_reached();
     }