* [PATCH v2 1/9] target/arm/tcg/cpu-v7m.c: add cortex-m85 model
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
@ 2026-08-05 15:29 ` Simon Xu
2026-08-05 15:29 ` [PATCH v2 2/9] hw/arm/armsse: add Arm Corstone SSE-310 Simon Xu
` (7 subsequent siblings)
8 siblings, 0 replies; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:29 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add Arm Cortex-M85 CPU, modeld after the existing M55 CPU.
The new M85 feature PACBTI is not implemented in QEMU and the midr value
is based off the r1p1 product revision identifier.
Arm Cortex-M85 TRM:
https://developer.arm.com/documentation/101924/0101/
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
target/arm/tcg/cpu-v7m.c | 41 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 41 insertions(+)
diff --git a/target/arm/tcg/cpu-v7m.c b/target/arm/tcg/cpu-v7m.c
index dc249ce1f1..a1e62a20f8 100644
--- a/target/arm/tcg/cpu-v7m.c
+++ b/target/arm/tcg/cpu-v7m.c
@@ -237,6 +237,45 @@ static void cortex_m55_initfn(Object *obj)
cpu->ctr = 0x8303c003;
}
+static void cortex_m85_initfn(Object *obj)
+{
+ ARMCPU *cpu = ARM_CPU(obj);
+ ARMISARegisters *isar = &cpu->isar;
+
+ /* QEMU currently does not support the PACBTI feature */
+ set_feature(&cpu->env, ARM_FEATURE_V8);
+ set_feature(&cpu->env, ARM_FEATURE_V8_1M);
+ set_feature(&cpu->env, ARM_FEATURE_M);
+ set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
+ set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
+ set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
+ cpu->midr = 0x411fd231; /* r1p1 */
+ cpu->revidr = 0;
+ cpu->pmsav7_dregion = 16;
+ cpu->sau_sregion = 8;
+ /* These are the MVFR* values for the FPU + full MVE configuration */
+ cpu->isar.mvfr0 = 0x10110221;
+ cpu->isar.mvfr1 = 0x12100211;
+ cpu->isar.mvfr2 = 0x00000040;
+ SET_IDREG(isar, ID_PFR0, 0x20000030);
+ SET_IDREG(isar, ID_PFR1, 0x00000230);
+ SET_IDREG(isar, ID_DFR0, 0x10200000);
+ SET_IDREG(isar, ID_AFR0, 0x00000000);
+ SET_IDREG(isar, ID_MMFR0, 0x00111040);
+ SET_IDREG(isar, ID_MMFR1, 0x00000000);
+ SET_IDREG(isar, ID_MMFR2, 0x01000000);
+ SET_IDREG(isar, ID_MMFR3, 0x00000011);
+ SET_IDREG(isar, ID_ISAR0, 0x01103110);
+ SET_IDREG(isar, ID_ISAR1, 0x02212000);
+ SET_IDREG(isar, ID_ISAR2, 0x20232232);
+ SET_IDREG(isar, ID_ISAR3, 0x01111131);
+ SET_IDREG(isar, ID_ISAR4, 0x01310132);
+ SET_IDREG(isar, ID_ISAR5, 0x00000000);
+ SET_IDREG(isar, ID_ISAR6, 0x00000000);
+ SET_IDREG(isar, CLIDR, 0x00000000); /* caches not implemented */
+ cpu->ctr = 0x8303c003;
+}
+
static const TCGCPUOps arm_v7m_tcg_ops = {
/* ARM processors have a weak memory model */
.guest_default_memory_order = 0,
@@ -290,6 +329,8 @@ static const ARMCPUInfo arm_v7m_cpus[] = {
.class_init = arm_v7m_class_init },
{ .name = "cortex-m55", .initfn = cortex_m55_initfn,
.class_init = arm_v7m_class_init },
+ { .name = "cortex-m85", .initfn = cortex_m85_initfn,
+ .class_init = arm_v7m_class_init },
};
static void arm_v7m_cpu_register_types(void)
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 2/9] hw/arm/armsse: add Arm Corstone SSE-310
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
2026-08-05 15:29 ` [PATCH v2 1/9] target/arm/tcg/cpu-v7m.c: add cortex-m85 model Simon Xu
@ 2026-08-05 15:29 ` Simon Xu
2026-08-17 15:23 ` Peter Maydell
2026-08-05 15:29 ` [PATCH v2 3/9] hw/misc/iotkit-sysctl.c: add SSE-310 support Simon Xu
` (6 subsequent siblings)
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:29 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add baseline Arm Corstone SSE-310 model.
Device list changes between SSE-310 and SSE-300:
New NPU0 Power Policy Unit and Configuration interface.
All other devices are the same.
Update comments in include/hw/arm/armsse.h to include SSE-300 and
SSE-310 and their respective documentations. New SSE-310 IRQ mapping.
sys_version and iidr values from the "SSE-310 with M85 and U55 FPGA"
documentation for the mps3-an555. Refractor comments and code
pertaining to both the SSE-300 and SSE-310.
Arm Corstone SSE-310 TRM:
https://developer.arm.com/documentation/102778/0000/
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Split v1 armsse patch into multiple patches for armsse and iotkit files
Update comments in armsse.h to include SSE-300 and SSE-310
Remove sys_config2 property
Add SSE-310 to iotkit files in next few patches
---
hw/arm/armsse.c | 208 +++++++++++++++++++++++++++++++-
include/hw/arm/armsse-version.h | 2 +
include/hw/arm/armsse.h | 9 +-
3 files changed, 211 insertions(+), 8 deletions(-)
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index ddb210c895..1847c73322 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -26,7 +26,7 @@
#include "hw/core/qdev-clock.h"
/*
- * The SSE-300 puts some devices in different places to the
+ * The SSE-300 and SSE-310 put some devices in different places to the
* SSE-200 (and original IoTKit). We use an array of these structs
* to define how each variant lays out these devices. (Parts of the
* SoC that are the same for all variants aren't handled via these
@@ -118,6 +118,18 @@ static const Property sse300_properties[] = {
DEFINE_PROP_UINT32("CPU0_MPU_S", ARMSSE, cpu_mpu_s[0], 8),
};
+static const Property sse310_properties[] = {
+ DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+ MemoryRegion *),
+ DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+ DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 21),
+ DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+ DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+ DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+ DEFINE_PROP_UINT32("CPU0_MPU_NS", ARMSSE, cpu_mpu_ns[0], 8),
+ DEFINE_PROP_UINT32("CPU0_MPU_S", ARMSSE, cpu_mpu_s[0], 8),
+};
+
static const ARMSSEDeviceInfo iotkit_devices[] = {
{
.name = "timer0",
@@ -480,6 +492,146 @@ static const ARMSSEDeviceInfo sse300_devices[] = {
}
};
+static const ARMSSEDeviceInfo sse310_devices[] = {
+ {
+ .name = "timer0",
+ .type = TYPE_SSE_TIMER,
+ .index = 0,
+ .addr = 0x48000000,
+ .ppc = 0,
+ .ppc_port = 0,
+ .irq = 3,
+ },
+ {
+ .name = "timer1",
+ .type = TYPE_SSE_TIMER,
+ .index = 1,
+ .addr = 0x48001000,
+ .ppc = 0,
+ .ppc_port = 1,
+ .irq = 4,
+ },
+ {
+ .name = "timer2",
+ .type = TYPE_SSE_TIMER,
+ .index = 2,
+ .addr = 0x48002000,
+ .ppc = 0,
+ .ppc_port = 2,
+ .irq = 5,
+ },
+ {
+ .name = "timer3",
+ .type = TYPE_SSE_TIMER,
+ .index = 3,
+ .addr = 0x48003000,
+ .ppc = 0,
+ .ppc_port = 5,
+ .irq = 27,
+ },
+ {
+ .name = "s32ktimer",
+ .type = TYPE_CMSDK_APB_TIMER,
+ .index = 0,
+ .addr = 0x4802f000,
+ .ppc = 1,
+ .ppc_port = 0,
+ .irq = 2,
+ .slowclk = true,
+ },
+ {
+ .name = "s32kwatchdog",
+ .type = TYPE_CMSDK_APB_WATCHDOG,
+ .index = 0,
+ .addr = 0x5802e000,
+ .ppc = NO_PPC,
+ .irq = NMI_0,
+ .slowclk = true,
+ },
+ {
+ .name = "watchdog",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 0,
+ .addr = 0x48040000,
+ .size = 0x2000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "armsse-sysinfo",
+ .type = TYPE_IOTKIT_SYSINFO,
+ .index = 0,
+ .addr = 0x48020000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "armsse-sysctl",
+ .type = TYPE_IOTKIT_SYSCTL,
+ .index = 0,
+ .addr = 0x58021000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "SYS_PPU",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 1,
+ .addr = 0x58022000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "CPU0CORE_PPU",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 2,
+ .addr = 0x58023000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "MGMT_PPU",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 3,
+ .addr = 0x58028000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "DEBUG_PPU",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 4,
+ .addr = 0x58029000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "NPU0_PPU",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 5,
+ .addr = 0x5802a000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = "NPU0_CFG",
+ .type = TYPE_UNIMPLEMENTED_DEVICE,
+ .index = 6,
+ .addr = 0x40004000,
+ .size = 0x1000,
+ .ppc = NO_PPC,
+ .irq = NO_IRQ,
+ },
+ {
+ .name = NULL,
+ }
+};
+
/* Is internal IRQ n shared between CPUs in a multi-core SSE ? */
static const bool sse200_irq_is_common[32] = {
[0 ... 5] = true,
@@ -507,6 +659,20 @@ static const bool sse300_irq_is_common[32] = {
/* 30, 31: reserved */
};
+static const bool sse310_irq_is_common[32] = {
+ [0 ... 5] = true,
+ /* 6-8: reserved */
+ [9 ... 12] = true,
+ /* 13: reserved */
+ [14] = true,
+ /* 15: reserved */
+ [16] = true,
+ /* 17-26: reserved */
+ [27] = true,
+ /* 28, 29: per-CPU CTI interrupts */
+ /* 30, 31: reserved */
+};
+
static const ARMSSEInfo armsse_variants[] = {
{
.name = TYPE_IOTKIT,
@@ -574,6 +740,28 @@ static const ARMSSEInfo armsse_variants[] = {
.devinfo = sse300_devices,
.irq_is_common = sse300_irq_is_common,
},
+ {
+ .name = TYPE_SSE310,
+ .sse_version = ARMSSE_SSE310,
+ .cpu_type = ARM_CPU_TYPE_NAME("cortex-m85"),
+ .sram_banks = 2,
+ .sram_bank_base = 0x21000000,
+ .num_cpus = 1,
+ .sys_version = 0x7e10043b,
+ .iidr = 0x74e0043b,
+ .cpuwait_rst = 0,
+ .has_mhus = false,
+ .has_cachectrl = false,
+ .has_cpusecctrl = true,
+ .has_cpuid = true,
+ .has_cpu_pwrctrl = true,
+ .has_sse_counter = true,
+ .has_tcms = true,
+ .props = sse310_properties,
+ .props_count = ARRAY_SIZE(sse310_properties),
+ .devinfo = sse310_devices,
+ .irq_is_common = sse310_irq_is_common,
+ }
};
static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info)
@@ -604,6 +792,14 @@ static uint32_t armsse_sys_config_value(ARMSSE *s, const ARMSSEInfo *info)
sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
sys_config = deposit32(sys_config, 16, 3, 3); /* CPU0 = Cortex-M55 */
break;
+ case ARMSSE_SSE310:
+ sys_config = 0;
+ sys_config = deposit32(sys_config, 0, 4, info->sram_banks);
+ sys_config = deposit32(sys_config, 4, 5, s->sram_addr_width);
+ sys_config = deposit32(sys_config, 10, 1, 0); /* No CoreSight SoC */
+ sys_config = deposit32(sys_config, 11, 2, 0); /* Basic level PI */
+ sys_config = deposit32(sys_config, 16, 3, 4); /* CPU0 = Cortex-M85 */
+ break;
default:
g_assert_not_reached();
}
@@ -1205,7 +1401,7 @@ static void armsse_realize(DeviceState *dev, Error **errp)
qdev_connect_gpio_out(DEVICE(&s->nmi_orgate), 0,
qdev_get_gpio_in_named(DEVICE(&s->armv7m), "NMI", 0));
- /* The SSE-300 has a System Counter / System Timestamp Generator */
+ /* The SSE-300/SSE-310 has a System Counter / System Timestamp Generator */
if (info->has_sse_counter) {
SysBusDevice *sbd = SYS_BUS_DEVICE(&s->sse_counter);
@@ -1225,12 +1421,12 @@ static void armsse_realize(DeviceState *dev, Error **errp)
}
if (info->has_tcms) {
- /* The SSE-300 has an ITCM at 0x0000_0000 and a DTCM at 0x2000_0000 */
- memory_region_init_ram(&s->itcm, NULL, "sse300-itcm", 512 * KiB, errp);
+ /* The SSE-300/SSE-310 has an ITCM at 0x0000_0000 and a DTCM at 0x2000_0000 */
+ memory_region_init_ram(&s->itcm, NULL, "itcm", 512 * KiB, errp);
if (*errp) {
return;
}
- memory_region_init_ram(&s->dtcm, NULL, "sse300-dtcm", 512 * KiB, errp);
+ memory_region_init_ram(&s->dtcm, NULL, "dtcm", 512 * KiB, errp);
if (*errp) {
return;
}
@@ -1461,7 +1657,7 @@ static void armsse_realize(DeviceState *dev, Error **errp)
* 0x50010000: L1 icache control registers
* 0x50011000: CPUSECCTRL (CPU local security control registers)
* 0x4001f000 and 0x5001f000: CPU_IDENTITY register block
- * The SSE-300 has an extra:
+ * The SSE-300 and SSE-310 have an extra:
* 0x40012000 and 0x50012000: CPU_PWRCTRL register block
*/
if (info->has_cachectrl) {
diff --git a/include/hw/arm/armsse-version.h b/include/hw/arm/armsse-version.h
index 60780fa984..6b498cb334 100644
--- a/include/hw/arm/armsse-version.h
+++ b/include/hw/arm/armsse-version.h
@@ -25,6 +25,7 @@ enum {
ARMSSE_IOTKIT = 0,
ARMSSE_SSE200 = 200,
ARMSSE_SSE300 = 300,
+ ARMSSE_SSE310 = 310
};
static inline bool armsse_version_valid(uint32_t sse_version)
@@ -33,6 +34,7 @@ static inline bool armsse_version_valid(uint32_t sse_version)
case ARMSSE_IOTKIT:
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
return true;
default:
return false;
diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index bdf2d4db8e..6aa1363ccf 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -11,12 +11,16 @@
/*
* This is a model of the Arm "Subsystems for Embedded" family of
- * hardware, which include the IoT Kit and the SSE-050, SSE-100 and
- * SSE-200. Currently we model:
+ * hardware, which include the IoT Kit and the SSE-050, SSE-100,
+ * SSE-200, SSE-300, and SSE-310. Currently we model:
* - the Arm IoT Kit which is documented in
* https://developer.arm.com/documentation/ecm0601256/latest
* - the SSE-200 which is documented in
* https://developer.arm.com/documentation/101104/latest/
+ * - the SSE-300 which is documented in
+ * https://support.arm.com/documentation/101773/latest/
+ * - the SSE-310 which is documented in
+ * https://support.arm.com/documentation/102778/latest/
*
* The IoTKit contains:
* a Cortex-M33
@@ -127,6 +131,7 @@ OBJECT_DECLARE_TYPE(ARMSSE, ARMSSEClass,
#define TYPE_IOTKIT "iotkit"
#define TYPE_SSE200 "sse-200"
#define TYPE_SSE300 "sse-300"
+#define TYPE_SSE310 "sse-310"
/* We have an IRQ splitter and an OR gate input for each external PPC
* and the 2 internal PPCs
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 2/9] hw/arm/armsse: add Arm Corstone SSE-310
2026-08-05 15:29 ` [PATCH v2 2/9] hw/arm/armsse: add Arm Corstone SSE-310 Simon Xu
@ 2026-08-17 15:23 ` Peter Maydell
0 siblings, 0 replies; 18+ messages in thread
From: Peter Maydell @ 2026-08-17 15:23 UTC (permalink / raw)
To: Simon Xu; +Cc: qemu-devel, qemu-arm, Owen Giles, Pierrick Bouvier,
Robert Elliott
On Wed, 5 Aug 2026 at 16:30, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> Add baseline Arm Corstone SSE-310 model.
>
> Device list changes between SSE-310 and SSE-300:
> New NPU0 Power Policy Unit and Configuration interface.
> All other devices are the same.
>
> Update comments in include/hw/arm/armsse.h to include SSE-300 and
> SSE-310 and their respective documentations. New SSE-310 IRQ mapping.
> sys_version and iidr values from the "SSE-310 with M85 and U55 FPGA"
> documentation for the mps3-an555. Refractor comments and code
> pertaining to both the SSE-300 and SSE-310.
>
> Arm Corstone SSE-310 TRM:
> https://developer.arm.com/documentation/102778/0000/
>
> Reviewed-by: Owen Giles <owen.giles@hpe.com>
> Reviewed-by: Robert Elliott <elliott@hpe.com>
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
> ---
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2 3/9] hw/misc/iotkit-sysctl.c: add SSE-310 support
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
2026-08-05 15:29 ` [PATCH v2 1/9] target/arm/tcg/cpu-v7m.c: add cortex-m85 model Simon Xu
2026-08-05 15:29 ` [PATCH v2 2/9] hw/arm/armsse: add Arm Corstone SSE-310 Simon Xu
@ 2026-08-05 15:29 ` Simon Xu
2026-08-17 15:30 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 4/9] hw/misc/iotkit-secctl.c: fix AHB secure read Simon Xu
` (5 subsequent siblings)
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:29 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add SSE-310 case statements for reads and writes.
Add new SSE-310 PIDR and CLIDR values.
Add new SSE-310 PPUINTSTAT register as RAZ with LOG_UMIMP on reads and
RO on writes.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Add PPUINTSTAT register
Make sure comments don't separate case statements
---
hw/misc/iotkit-sysctl.c | 89 ++++++++++++++++++++++++++++++---
include/hw/misc/iotkit-sysctl.h | 1 +
2 files changed, 82 insertions(+), 8 deletions(-)
diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index dff89c677f..bdf59b5f85 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -51,6 +51,7 @@ REG32(CPUWAIT, 0x118)
REG32(NMI_ENABLE, 0x11c) /* BUSWAIT in IoTKit */
REG32(WICCTRL, 0x120)
REG32(EWCTRL, 0x124)
+REG32(PPUINTSTAT, 0x128)
REG32(PWRCTRL, 0x1fc)
FIELD(PWRCTRL, PPU_ACCESS_UNLOCK, 0, 1)
FIELD(PWRCTRL, PPU_ACCESS_FILTER, 1, 1)
@@ -87,6 +88,12 @@ static const int sse200_sysctl_id[] = {
0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
};
+static const int sse310_sysctl_id[] = {
+ 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+ 0x54, 0xb8, 0x4b, 0x00, /* PID0..PID3 */
+ 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
/*
* Set the initial secure vector table offset address for the core.
* This will take effect when the CPU next resets.
@@ -118,6 +125,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->scsecctrl;
break;
default:
@@ -130,6 +138,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->fclk_div;
break;
default:
@@ -142,6 +151,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->sysclk_div;
break;
default:
@@ -154,6 +164,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->clock_force;
break;
default:
@@ -180,6 +191,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->initsvtor1;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -192,6 +204,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->cpuwait;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
/* In SSE300 this is reserved (for INITSVTOR2) */
goto bad_offset;
default:
@@ -208,6 +221,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->nmi_enable;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
/* In SSE300 this is reserved (for INITSVTOR3) */
goto bad_offset;
default:
@@ -221,7 +235,8 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->wicctrl;
break;
case ARMSSE_SSE300:
- /* In SSE300 this offset is CPUWAIT */
+ case ARMSSE_SSE310:
+ /* In SSE300 and SSE310 this offset is CPUWAIT */
r = s->cpuwait;
break;
default:
@@ -236,19 +251,36 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->ewctrl;
break;
case ARMSSE_SSE300:
- /* In SSE300 this offset is NMI_ENABLE */
+ case ARMSSE_SSE310:
+ /* In SSE300 and SSE310 this offset is NMI_ENABLE */
r = s->nmi_enable;
break;
default:
g_assert_not_reached();
}
break;
+ case A_PPUINTSTAT:
+ switch (s->sse_version) {
+ case ARMSSE_IOTKIT:
+ case ARMSSE_SSE200:
+ case ARMSSE_SSE300:
+ goto bad_offset;
+ case ARMSSE_SSE310:
+ qemu_log_mask(LOG_UNIMP,
+ "IoTKit SysCtl PPUINTSTAT unimplemented\n");
+ r = s->ppuintstat;
+ break;
+ default:
+ g_assert_not_reached();
+ }
+ break;
case A_PWRCTRL:
switch (s->sse_version) {
case ARMSSE_IOTKIT:
case ARMSSE_SSE200:
goto bad_offset;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->pwrctrl;
break;
default:
@@ -261,6 +293,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->pdcm_pd_sys_sense;
break;
default:
@@ -273,7 +306,8 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
case ARMSSE_SSE200:
goto bad_offset;
case ARMSSE_SSE300:
- r = s->pdcm_pd_cpu0_sense;
+ case ARMSSE_SSE310:
+ r = s->pdcm_pd_cpu0_sense;
break;
default:
g_assert_not_reached();
@@ -287,6 +321,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->pdcm_pd_sram0_sense;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -300,6 +335,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->pdcm_pd_sram1_sense;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -313,6 +349,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->pdcm_pd_sram2_sense;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->pdcm_pd_vmr0_sense;
break;
default:
@@ -327,6 +364,7 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
r = s->pdcm_pd_sram3_sense;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
r = s->pdcm_pd_vmr1_sense;
break;
default:
@@ -342,6 +380,9 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
case ARMSSE_SSE300:
r = sse200_sysctl_id[(offset - A_PID4) / 4];
break;
+ case ARMSSE_SSE310:
+ r = sse310_sysctl_id[(offset - A_PID4) / 4];
+ break;
default:
g_assert_not_reached();
}
@@ -367,7 +408,8 @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
static void cpuwait_write(IoTKitSysCtl *s, uint32_t value)
{
- int num_cpus = (s->sse_version == ARMSSE_SSE300) ? 1 : 2;
+ int num_cpus = (s->sse_version == ARMSSE_SSE300 ||
+ s->sse_version == ARMSSE_SSE310) ? 1 : 2;
int i;
for (i = 0; i < num_cpus; i++) {
@@ -418,7 +460,8 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
case A_INITSVTOR0:
switch (s->sse_version) {
case ARMSSE_SSE300:
- /* SSE300 has a LOCK bit which prevents further writes when set */
+ case ARMSSE_SSE310:
+ /* SSE300 and SSE310 have a LOCK bit which prevents further writes */
if (s->initsvtor0 & R_INITSVTOR0_LOCK_MASK) {
qemu_log_mask(LOG_GUEST_ERROR,
"IoTKit INITSVTOR0 write when register locked\n");
@@ -443,6 +486,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
cpuwait_write(s, value);
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
/* In SSE300 this is reserved (for INITSVTOR2) */
goto bad_offset;
default:
@@ -457,7 +501,8 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->wicctrl = value;
break;
case ARMSSE_SSE300:
- /* In SSE300 this offset is CPUWAIT */
+ case ARMSSE_SSE310:
+ /* In SSE300 and SSE310 this offset is CPUWAIT */
cpuwait_write(s, value);
break;
default:
@@ -485,6 +530,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n");
s->scsecctrl = value;
break;
@@ -498,6 +544,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n");
s->fclk_div = value;
break;
@@ -511,6 +558,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n");
s->sysclk_div = value;
break;
@@ -524,6 +572,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n");
s->clock_force = value;
break;
@@ -540,6 +589,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
set_init_vtor(1, s->initsvtor1);
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -554,7 +604,8 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->ewctrl = value;
break;
case ARMSSE_SSE300:
- /* In SSE300 this offset is NMI_ENABLE */
+ case ARMSSE_SSE310:
+ /* In SSE300 and SSE310 this offset is NMI_ENABLE */
qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n");
s->nmi_enable = value;
break;
@@ -562,12 +613,25 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
g_assert_not_reached();
}
break;
+ case A_PPUINTSTAT:
+ switch (s->sse_version) {
+ case ARMSSE_IOTKIT:
+ case ARMSSE_SSE200:
+ case ARMSSE_SSE300:
+ goto bad_offset;
+ case ARMSSE_SSE310:
+ goto ro_offset;
+ default:
+ g_assert_not_reached();
+ }
+ break;
case A_PWRCTRL:
switch (s->sse_version) {
case ARMSSE_IOTKIT:
case ARMSSE_SSE200:
goto bad_offset;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
if (!(s->pwrctrl & R_PWRCTRL_PPU_ACCESS_UNLOCK_MASK)) {
qemu_log_mask(LOG_GUEST_ERROR,
"IoTKit PWRCTRL write when register locked\n");
@@ -585,6 +649,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
goto bad_offset;
case ARMSSE_SSE200:
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP,
"IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n");
s->pdcm_pd_sys_sense = value;
@@ -599,6 +664,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
case ARMSSE_SSE200:
goto bad_offset;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP,
"IoTKit SysCtl PDCM_PD_CPU0_SENSE unimplemented\n");
s->pdcm_pd_cpu0_sense = value;
@@ -617,6 +683,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->pdcm_pd_sram0_sense = value;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -632,6 +699,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->pdcm_pd_sram1_sense = value;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
goto bad_offset;
default:
g_assert_not_reached();
@@ -647,6 +715,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->pdcm_pd_sram2_sense = value;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP,
"IoTKit SysCtl PDCM_PD_VMR0_SENSE unimplemented\n");
s->pdcm_pd_vmr0_sense = value;
@@ -665,6 +734,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->pdcm_pd_sram3_sense = value;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
qemu_log_mask(LOG_UNIMP,
"IoTKit SysCtl PDCM_PD_VMR1_SENSE unimplemented\n");
s->pdcm_pd_vmr1_sense = value;
@@ -683,6 +753,7 @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
s->nmi_enable = value;
break;
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
/* In SSE300 this is reserved (for INITSVTOR3) */
goto bad_offset;
default:
@@ -734,6 +805,7 @@ static void iotkit_sysctl_reset(DeviceState *dev)
s->clock_force = 0;
s->nmi_enable = 0;
s->ewctrl = 0;
+ s->ppuintstat = 0;
s->pwrctrl = 0x3;
s->pdcm_pd_sys_sense = 0x7f;
s->pdcm_pd_sram0_sense = 0;
@@ -769,7 +841,8 @@ static bool sse300_needed(void *opaque)
{
IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque);
- return s->sse_version == ARMSSE_SSE300;
+ return s->sse_version == ARMSSE_SSE300 ||
+ s->sse_version == ARMSSE_SSE310;
}
static const VMStateDescription iotkit_sysctl_sse300_vmstate = {
diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
index ce72258a84..8e1cf0012d 100644
--- a/include/hw/misc/iotkit-sysctl.h
+++ b/include/hw/misc/iotkit-sysctl.h
@@ -53,6 +53,7 @@ struct IoTKitSysCtl {
uint32_t initsvtor1;
uint32_t nmi_enable;
uint32_t ewctrl;
+ uint32_t ppuintstat;
uint32_t pwrctrl;
uint32_t pdcm_pd_sys_sense;
uint32_t pdcm_pd_sram0_sense;
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 3/9] hw/misc/iotkit-sysctl.c: add SSE-310 support
2026-08-05 15:29 ` [PATCH v2 3/9] hw/misc/iotkit-sysctl.c: add SSE-310 support Simon Xu
@ 2026-08-17 15:30 ` Peter Maydell
0 siblings, 0 replies; 18+ messages in thread
From: Peter Maydell @ 2026-08-17 15:30 UTC (permalink / raw)
To: Simon Xu; +Cc: qemu-devel, qemu-arm, Owen Giles, Pierrick Bouvier,
Robert Elliott
On Wed, 5 Aug 2026 at 16:30, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> Add SSE-310 case statements for reads and writes.
> Add new SSE-310 PIDR and CLIDR values.
> Add new SSE-310 PPUINTSTAT register as RAZ with LOG_UMIMP on reads and
> RO on writes.
>
> Reviewed-by: Owen Giles <owen.giles@hpe.com>
> Reviewed-by: Robert Elliott <elliott@hpe.com>
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
> ---
> v1 -> v2
> Add PPUINTSTAT register
> Make sure comments don't separate case statements
> static const VMStateDescription iotkit_sysctl_sse300_vmstate = {
> diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
> index ce72258a84..8e1cf0012d 100644
> --- a/include/hw/misc/iotkit-sysctl.h
> +++ b/include/hw/misc/iotkit-sysctl.h
> @@ -53,6 +53,7 @@ struct IoTKitSysCtl {
> uint32_t initsvtor1;
> uint32_t nmi_enable;
> uint32_t ewctrl;
> + uint32_t ppuintstat;
> uint32_t pwrctrl;
> uint32_t pdcm_pd_sys_sense;
> uint32_t pdcm_pd_sram0_sense;
If we add a new field to the state struct here, we need to
add it to the vmstate data structures for migration. That
means a new subsection with an sse310_needed() function
so we migrate the field for SSE310 only.
But since this field is only ever zero because the register
is read-only, I think it's simpler to just have "r = 0;" in the
register-read codepath, and drop the field entirely. If anybody
ever needs to implement the register to have real functionality
they can add whatever fields/migration handling they need for it
then; we don't need to try to guess now what that will be.
thanks
-- PMM
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2 4/9] hw/misc/iotkit-secctl.c: fix AHB secure read
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (2 preceding siblings ...)
2026-08-05 15:29 ` [PATCH v2 3/9] hw/misc/iotkit-sysctl.c: add SSE-310 support Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:33 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 5/9] hw/misc/iotkit-secctl.c: add SSE-310 support Simon Xu
` (4 subsequent siblings)
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Fix AHB secure privilege to read AHB instead of APB.
Fixes: b3717c23e1c0 ("hw/misc/iotkit-secctl: Add handling for PPCs")
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Noticed this bug in the secure read function
---
hw/misc/iotkit-secctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 54bfe1ba59..93753c2ced 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -195,7 +195,7 @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
case A_AHBSPPPCEXP1:
case A_AHBSPPPCEXP2:
case A_AHBSPPPCEXP3:
- r = s->apbexp[offset_to_ppc_idx(offset)].sp;
+ r = s->ahbexp[offset_to_ppc_idx(offset)].sp;
break;
case A_APBSPPPC0:
case A_APBSPPPC1:
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 4/9] hw/misc/iotkit-secctl.c: fix AHB secure read
2026-08-05 15:30 ` [PATCH v2 4/9] hw/misc/iotkit-secctl.c: fix AHB secure read Simon Xu
@ 2026-08-17 15:33 ` Peter Maydell
0 siblings, 0 replies; 18+ messages in thread
From: Peter Maydell @ 2026-08-17 15:33 UTC (permalink / raw)
To: Simon Xu; +Cc: qemu-devel, qemu-arm, Owen Giles, Pierrick Bouvier,
Robert Elliott
On Wed, 5 Aug 2026 at 16:30, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> Fix AHB secure privilege to read AHB instead of APB.
>
> Fixes: b3717c23e1c0 ("hw/misc/iotkit-secctl: Add handling for PPCs")
> Reviewed-by: Owen Giles <owen.giles@hpe.com>
> Reviewed-by: Robert Elliott <elliott@hpe.com>
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
> ---
> v1 -> v2
> Noticed this bug in the secure read function
> ---
> hw/misc/iotkit-secctl.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
As this is a bugfix I've applied it to target-arm.next.
thanks
-- PMM
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2 5/9] hw/misc/iotkit-secctl.c: add SSE-310 support
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (3 preceding siblings ...)
2026-08-05 15:30 ` [PATCH v2 4/9] hw/misc/iotkit-secctl.c: fix AHB secure read Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:34 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 6/9] hw/misc/iotkit-secctl.c: use GNU C case ranges Simon Xu
` (3 subsequent siblings)
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add SSE-310 secure and non-secure ID registers.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
With the bug fix from the previous patch
---
hw/misc/iotkit-secctl.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 93753c2ced..9f6fb81088 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -109,6 +109,18 @@ static const uint8_t iotkit_secctl_ns_sse300_idregs[] = {
0x0d, 0xf0, 0x05, 0xb1,
};
+static const uint8_t iotkit_secctl_s_sse310_idregs[] = {
+ 0x04, 0x00, 0x00, 0x00,
+ 0x52, 0xb8, 0x3b, 0x00,
+ 0x0d, 0xf0, 0x05, 0xb1,
+};
+
+static const uint8_t iotkit_secctl_ns_sse310_idregs[] = {
+ 0x04, 0x00, 0x00, 0x00,
+ 0x53, 0xb8, 0x3b, 0x00,
+ 0x0d, 0xf0, 0x05, 0xb1,
+};
+
/* The register sets for the various PPCs (AHB internal, APB internal,
* AHB expansion, APB expansion) are all set up so that they are
@@ -232,6 +244,9 @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
case ARMSSE_SSE300:
r = iotkit_secctl_s_sse300_idregs[(offset - A_PID4) / 4];
break;
+ case ARMSSE_SSE310:
+ r = iotkit_secctl_s_sse310_idregs[(offset - A_PID4) / 4];
+ break;
default:
r = iotkit_secctl_s_idregs[(offset - A_PID4) / 4];
break;
@@ -499,6 +514,9 @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
case ARMSSE_SSE300:
r = iotkit_secctl_ns_sse300_idregs[(offset - A_PID4) / 4];
break;
+ case ARMSSE_SSE310:
+ r = iotkit_secctl_ns_sse310_idregs[(offset - A_PID4) / 4];
+ break;
default:
r = iotkit_secctl_ns_idregs[(offset - A_PID4) / 4];
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 6/9] hw/misc/iotkit-secctl.c: use GNU C case ranges
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (4 preceding siblings ...)
2026-08-05 15:30 ` [PATCH v2 5/9] hw/misc/iotkit-secctl.c: add SSE-310 support Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:38 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 7/9] hw/misc/iotkit-sysinfo.c: add SSE-310 support Simon Xu
` (2 subsequent siblings)
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Replace case fall throughs with case ranges when register addresses
are continous.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Make long case statemens consistent with other iotkit files
---
hw/misc/iotkit-secctl.c | 112 ++++++----------------------------------
1 file changed, 16 insertions(+), 96 deletions(-)
diff --git a/hw/misc/iotkit-secctl.c b/hw/misc/iotkit-secctl.c
index 9f6fb81088..2d06d6f80f 100644
--- a/hw/misc/iotkit-secctl.c
+++ b/hw/misc/iotkit-secctl.c
@@ -187,36 +187,24 @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
case A_BRGINTEN:
r = s->brginten;
break;
- case A_AHBNSPPCEXP0:
- case A_AHBNSPPCEXP1:
- case A_AHBNSPPCEXP2:
- case A_AHBNSPPCEXP3:
+ case A_AHBNSPPCEXP0 ... A_AHBNSPPCEXP3:
r = s->ahbexp[offset_to_ppc_idx(offset)].ns;
break;
case A_APBNSPPC0:
case A_APBNSPPC1:
r = s->apb[offset_to_ppc_idx(offset)].ns;
break;
- case A_APBNSPPCEXP0:
- case A_APBNSPPCEXP1:
- case A_APBNSPPCEXP2:
- case A_APBNSPPCEXP3:
+ case A_APBNSPPCEXP0 ... A_APBNSPPCEXP3:
r = s->apbexp[offset_to_ppc_idx(offset)].ns;
break;
- case A_AHBSPPPCEXP0:
- case A_AHBSPPPCEXP1:
- case A_AHBSPPPCEXP2:
- case A_AHBSPPPCEXP3:
+ case A_AHBSPPPCEXP0 ... A_AHBSPPPCEXP3:
r = s->ahbexp[offset_to_ppc_idx(offset)].sp;
break;
case A_APBSPPPC0:
case A_APBSPPPC1:
r = s->apb[offset_to_ppc_idx(offset)].sp;
break;
- case A_APBSPPPCEXP0:
- case A_APBSPPPCEXP1:
- case A_APBSPPPCEXP2:
- case A_APBSPPPCEXP3:
+ case A_APBSPPPCEXP0 ... A_APBSPPPCEXP3:
r = s->apbexp[offset_to_ppc_idx(offset)].sp;
break;
case A_SECMSCINTSTAT:
@@ -228,18 +216,7 @@ static MemTxResult iotkit_secctl_s_read(void *opaque, hwaddr addr,
case A_NSMSCEXP:
r = s->nsmscexp;
break;
- case A_PID4:
- case A_PID5:
- case A_PID6:
- case A_PID7:
- case A_PID0:
- case A_PID1:
- case A_PID2:
- case A_PID3:
- case A_CID0:
- case A_CID1:
- case A_CID2:
- case A_CID3:
+ case A_PID4 ... A_CID3:
switch (s->sse_version) {
case ARMSSE_SSE300:
r = iotkit_secctl_s_sse300_idregs[(offset - A_PID4) / 4];
@@ -389,10 +366,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
case A_BRGINTEN:
s->brginten = value & 0xffff0000;
break;
- case A_AHBNSPPCEXP0:
- case A_AHBNSPPCEXP1:
- case A_AHBNSPPCEXP2:
- case A_AHBNSPPCEXP3:
+ case A_AHBNSPPCEXP0 ... A_AHBNSPPCEXP3:
ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_ns_write(ppc, value);
break;
@@ -401,17 +375,11 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
ppc = &s->apb[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_ns_write(ppc, value);
break;
- case A_APBNSPPCEXP0:
- case A_APBNSPPCEXP1:
- case A_APBNSPPCEXP2:
- case A_APBNSPPCEXP3:
+ case A_APBNSPPCEXP0 ... A_APBNSPPCEXP3:
ppc = &s->apbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_ns_write(ppc, value);
break;
- case A_AHBSPPPCEXP0:
- case A_AHBSPPPCEXP1:
- case A_AHBSPPPCEXP2:
- case A_AHBSPPPCEXP3:
+ case A_AHBSPPPCEXP0 ... A_AHBSPPPCEXP3:
ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_sp_write(ppc, value);
break;
@@ -420,10 +388,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
ppc = &s->apb[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_sp_write(ppc, value);
break;
- case A_APBSPPPCEXP0:
- case A_APBSPPPCEXP1:
- case A_APBSPPPCEXP2:
- case A_APBSPPPCEXP3:
+ case A_APBSPPPCEXP0 ... A_APBSPPPCEXP3:
ppc = &s->apbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_sp_write(ppc, value);
break;
@@ -444,18 +409,7 @@ static MemTxResult iotkit_secctl_s_write(void *opaque, hwaddr addr,
case A_BRGINTSTAT:
case A_AHBNSPPC0:
case A_AHBSPPPC0:
- case A_PID4:
- case A_PID5:
- case A_PID6:
- case A_PID7:
- case A_PID0:
- case A_PID1:
- case A_PID2:
- case A_PID3:
- case A_CID0:
- case A_CID1:
- case A_CID2:
- case A_CID3:
+ case A_PID4 ... A_CID3:
qemu_log_mask(LOG_GUEST_ERROR,
"IoTKit SecCtl S block write: "
"read-only offset 0x%x\n", offset);
@@ -482,34 +436,17 @@ static MemTxResult iotkit_secctl_ns_read(void *opaque, hwaddr addr,
case A_AHBNSPPPC0:
r = 0;
break;
- case A_AHBNSPPPCEXP0:
- case A_AHBNSPPPCEXP1:
- case A_AHBNSPPPCEXP2:
- case A_AHBNSPPPCEXP3:
+ case A_AHBNSPPPCEXP0 ... A_AHBNSPPPCEXP3:
r = s->ahbexp[offset_to_ppc_idx(offset)].nsp;
break;
case A_APBNSPPPC0:
case A_APBNSPPPC1:
r = s->apb[offset_to_ppc_idx(offset)].nsp;
break;
- case A_APBNSPPPCEXP0:
- case A_APBNSPPPCEXP1:
- case A_APBNSPPPCEXP2:
- case A_APBNSPPPCEXP3:
+ case A_APBNSPPPCEXP0 ... A_APBNSPPPCEXP3:
r = s->apbexp[offset_to_ppc_idx(offset)].nsp;
break;
- case A_PID4:
- case A_PID5:
- case A_PID6:
- case A_PID7:
- case A_PID0:
- case A_PID1:
- case A_PID2:
- case A_PID3:
- case A_CID0:
- case A_CID1:
- case A_CID2:
- case A_CID3:
+ case A_PID4 ... A_CID3:
switch (s->sse_version) {
case ARMSSE_SSE300:
r = iotkit_secctl_ns_sse300_idregs[(offset - A_PID4) / 4];
@@ -560,10 +497,7 @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
}
switch (offset) {
- case A_AHBNSPPPCEXP0:
- case A_AHBNSPPPCEXP1:
- case A_AHBNSPPPCEXP2:
- case A_AHBNSPPPCEXP3:
+ case A_AHBNSPPPCEXP0 ... A_AHBNSPPPCEXP3:
ppc = &s->ahbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_nsp_write(ppc, value);
break;
@@ -572,26 +506,12 @@ static MemTxResult iotkit_secctl_ns_write(void *opaque, hwaddr addr,
ppc = &s->apb[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_nsp_write(ppc, value);
break;
- case A_APBNSPPPCEXP0:
- case A_APBNSPPPCEXP1:
- case A_APBNSPPPCEXP2:
- case A_APBNSPPPCEXP3:
+ case A_APBNSPPPCEXP0 ... A_APBNSPPPCEXP3:
ppc = &s->apbexp[offset_to_ppc_idx(offset)];
iotkit_secctl_ppc_nsp_write(ppc, value);
break;
case A_AHBNSPPPC0:
- case A_PID4:
- case A_PID5:
- case A_PID6:
- case A_PID7:
- case A_PID0:
- case A_PID1:
- case A_PID2:
- case A_PID3:
- case A_CID0:
- case A_CID1:
- case A_CID2:
- case A_CID3:
+ case A_PID4 ... A_CID3:
qemu_log_mask(LOG_GUEST_ERROR,
"IoTKit SecCtl NS block write: "
"read-only offset 0x%x\n", offset);
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 7/9] hw/misc/iotkit-sysinfo.c: add SSE-310 support
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (5 preceding siblings ...)
2026-08-05 15:30 ` [PATCH v2 6/9] hw/misc/iotkit-secctl.c: use GNU C case ranges Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:38 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 8/9] hw/arm/mps2-tz.c add Arm mps3-an555 board Simon Xu
2026-08-05 15:30 ` [PATCH v2 9/9] hw/misc/mps2-fpgaio.c: add GPIOALT2 register Simon Xu
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add SSE-310 PIDR and CIDR registers. Add sys_config2 register and
always report 0 on read as we do not implement the NPU.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Hard code sys_config2 to return 0 as we don't implement NPU0
---
hw/misc/iotkit-sysinfo.c | 22 +++++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/hw/misc/iotkit-sysinfo.c b/hw/misc/iotkit-sysinfo.c
index 19f089e6ee..f3d07f3247 100644
--- a/hw/misc/iotkit-sysinfo.c
+++ b/hw/misc/iotkit-sysinfo.c
@@ -31,6 +31,7 @@
REG32(SYS_VERSION, 0x0)
REG32(SYS_CONFIG, 0x4)
REG32(SYS_CONFIG1, 0x8)
+REG32(SYS_CONFIG2, 0xc)
REG32(IIDR, 0xfc8)
REG32(PID4, 0xfd0)
REG32(PID5, 0xfd4)
@@ -58,6 +59,12 @@ static const int sysinfo_sse300_id[] = {
0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
};
+static const int sysinfo_sse310_id[] = {
+ 0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+ 0x58, 0xb8, 0x2b, 0x00, /* PID0..PID3 */
+ 0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -68,13 +75,22 @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset,
case A_SYS_VERSION:
r = s->sys_version;
break;
-
case A_SYS_CONFIG:
r = s->sys_config;
break;
case A_SYS_CONFIG1:
switch (s->sse_version) {
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
+ return 0;
+ break;
+ default:
+ goto bad_read;
+ }
+ break;
+ case A_SYS_CONFIG2:
+ switch (s->sse_version) {
+ case ARMSSE_SSE310:
return 0;
break;
default:
@@ -84,6 +100,7 @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset,
case A_IIDR:
switch (s->sse_version) {
case ARMSSE_SSE300:
+ case ARMSSE_SSE310:
return s->iidr;
break;
default:
@@ -95,6 +112,9 @@ static uint64_t iotkit_sysinfo_read(void *opaque, hwaddr offset,
case ARMSSE_SSE300:
r = sysinfo_sse300_id[(offset - A_PID4) / 4];
break;
+ case ARMSSE_SSE310:
+ r = sysinfo_sse310_id[(offset - A_PID4) / 4];
+ break;
default:
r = sysinfo_id[(offset - A_PID4) / 4];
break;
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH v2 8/9] hw/arm/mps2-tz.c add Arm mps3-an555 board
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (6 preceding siblings ...)
2026-08-05 15:30 ` [PATCH v2 7/9] hw/misc/iotkit-sysinfo.c: add SSE-310 support Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:50 ` Peter Maydell
2026-08-05 15:30 ` [PATCH v2 9/9] hw/misc/mps2-fpgaio.c: add GPIOALT2 register Simon Xu
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add mps3-an555 board modeled after the existing mps3-an547 board.
Add UnimplementedDeivceState for timing adapters and qspi controllers
in MPS2TZMachineState.
Changes in AN555:
Timing adapters in APB PPC EX0 instead of MPC.
Additional QSPI controllers in AHB PPC EX0.
Additional AHB PPC EX1 with DMA.
Create standalone unimplemented devices for MPC instead of timing adapters.
Include documentation for SSE-310 and mps3-an555.
Arm mps3-an555 TRM: https://developer.arm.com/documentation/107642/latest/
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
v1 -> v2
Move board and application note documentation locations
Revert MPS2TZ_NUMIRQ_MAX to 96 from 100
Fix timing adapter and MPC creation location
Add QSPI controller to AHB PPC EX0
Add GPIOALT2 register to FPGAIO block in next patch
---
docs/system/arm/mps2.rst | 6 +-
hw/arm/mps2-tz.c | 153 ++++++++++++++++++++++++++++++++++++++-
2 files changed, 154 insertions(+), 5 deletions(-)
diff --git a/docs/system/arm/mps2.rst b/docs/system/arm/mps2.rst
index a305935cc4..489a8b0fa7 100644
--- a/docs/system/arm/mps2.rst
+++ b/docs/system/arm/mps2.rst
@@ -1,5 +1,5 @@
-Arm MPS2 and MPS3 boards (``mps2-an385``, ``mps2-an386``, ``mps2-an500``, ``mps2-an505``, ``mps2-an511``, ``mps2-an521``, ``mps3-an524``, ``mps3-an536``, ``mps3-an547``)
-=========================================================================================================================================================================
+Arm MPS2 and MPS3 boards (``mps2-an385``, ``mps2-an386``, ``mps2-an500``, ``mps2-an505``, ``mps2-an511``, ``mps2-an521``, ``mps3-an524``, ``mps3-an536``, ``mps3-an547``, ``mps3-an555``)
+=========================================================================================================================================================================================
These board models use Arm M-profile or R-profile CPUs.
@@ -31,6 +31,8 @@ FPGA images using M-profile CPUs:
Dual Cortex-M33 on an MPS3, as documented in Arm Application Note AN524
``mps3-an547``
Cortex-M55 on an MPS3, as documented in Arm Application Note AN547
+``mps3-an555``
+ Cortex-M85 on an MPS3, as documented in Arm Application Note AN555
FPGA images using R-profile CPUs:
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index f101c1b7c3..2cb461ca71 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -1,5 +1,5 @@
/*
- * ARM V2M MPS2 board emulation, trustzone aware FPGA images
+ * Arm V2M MPS2 and MPS3 board emulation, trustzone aware FPGA images
*
* Copyright (c) 2017 Linaro Limited
* Written by Peter Maydell
@@ -18,13 +18,17 @@
* "mps2-an521" -- Dual Cortex-M33 as documented in Application Note AN521
* "mps2-an524" -- Dual Cortex-M33 as documented in Application Note AN524
* "mps2-an547" -- Single Cortex-M55 as documented in Application Note AN547
+ * "mps3-an555" -- Single Cortex-M85 as documented in Application Note AN555
*
* Links to the TRM for the board itself and to the various Application
* Notes which document the FPGA images can be found here:
* https://developer.arm.com/products/system-design/development-boards/fpga-prototyping-boards/mps2
*
- * Board TRM:
+ * MPS2 and MPS2+ Board TRM:
* https://developer.arm.com/documentation/100112/latest/
+ * MPS3 Board TRM:
+ * https://developer.arm.com/documentation/100765/latest/
+ *
* Application Note AN505:
* https://developer.arm.com/documentation/dai0505/latest/
* Application Note AN521:
@@ -33,6 +37,8 @@
* https://developer.arm.com/documentation/dai0524/latest/
* Application Note AN547:
* https://developer.arm.com/documentation/dai0547/latest/
+ * Application Note AN555:
+ * https://developer.arm.com/documentation/107642/latest/
*
* The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
* (ARM ECM0601256) for the details of some of the device layout:
@@ -42,6 +48,8 @@
* https://developer.arm.com/documentation/101104/latest/
* and the AN547 uses the SSE-300, whose layout is in the SSE-300 TRM:
* https://developer.arm.com/documentation/101773/latest/
+ * and the AN555 uses the SSE-310, whose layout is in the SSE-310 TRM:
+ * https://developer.arm.com/documentation/102778/latest/
*/
#include "qemu/osdep.h"
@@ -85,6 +93,7 @@ typedef enum MPS2TZFPGAType {
FPGA_AN521,
FPGA_AN524,
FPGA_AN547,
+ FPGA_AN555,
} MPS2TZFPGAType;
/*
@@ -153,6 +162,8 @@ struct MPS2TZMachineState {
UnimplementedDeviceState gfx;
UnimplementedDeviceState cldc;
UnimplementedDeviceState usb;
+ UnimplementedDeviceState ta[3]; /* timing adatper */
+ UnimplementedDeviceState qspi_controller[3];
PL031State rtc;
PL080State dma[4];
TZMSC msc[4];
@@ -173,6 +184,7 @@ struct MPS2TZMachineState {
#define TYPE_MPS2TZ_AN521_MACHINE MACHINE_TYPE_NAME("mps2-an521")
#define TYPE_MPS3TZ_AN524_MACHINE MACHINE_TYPE_NAME("mps3-an524")
#define TYPE_MPS3TZ_AN547_MACHINE MACHINE_TYPE_NAME("mps3-an547")
+#define TYPE_MPS3TZ_AN555_MACHINE MACHINE_TYPE_NAME("mps3-an555")
OBJECT_DECLARE_TYPE(MPS2TZMachineState, MPS2TZMachineClass, MPS2TZ_MACHINE)
@@ -207,6 +219,15 @@ static const uint32_t an524_oscclk[] = {
23750000,
};
+static const uint32_t an555_oscclk[] = {
+ 24000000,
+ 25000000,
+ 30000000,
+ 50000000,
+ 24576000,
+ 23750000,
+};
+
static const RAMInfo an505_raminfo[] = { {
.name = "ssram-0",
.base = 0x00000000,
@@ -1028,7 +1049,6 @@ static void mps2tz_common_init(MachineState *machine)
{ "uart3", make_uart, &mms->uart[3], 0x41306000, 0x1000, { 38, 39, 45 } },
{ "uart4", make_uart, &mms->uart[4], 0x41307000, 0x1000, { 40, 41, 46 } },
{ "uart5", make_uart, &mms->uart[5], 0x41308000, 0x1000, { 124, 125, 126 } },
-
{ /* port 9 reserved */ },
{ "clcd", make_unimp_dev, &mms->cldc, 0x4130a000, 0x1000 },
{ "rtc", make_rtc, &mms->rtc, 0x4130b000, 0x1000 },
@@ -1082,7 +1102,63 @@ static void mps2tz_common_init(MachineState *machine)
{ "uart3", make_uart, &mms->uart[3], 0x49306000, 0x1000, { 39, 40, 46 } },
{ "uart4", make_uart, &mms->uart[4], 0x49307000, 0x1000, { 41, 42, 47 } },
{ "uart5", make_uart, &mms->uart[5], 0x49308000, 0x1000, { 125, 126, 127 } },
+ { /* port 9 reserved */ },
+ { "clcd", make_unimp_dev, &mms->cldc, 0x4930a000, 0x1000 },
+ { "rtc", make_rtc, &mms->rtc, 0x4930b000, 0x1000 },
+ },
+ }, {
+ .name = "ahb_ppcexp0",
+ .ports = {
+ { "gpio0", make_unimp_dev, &mms->gpio[0], 0x41100000, 0x1000 },
+ { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 },
+ { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 },
+ { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 },
+ { /* port 4 USER AHB interface 0 */ },
+ { /* port 5 USER AHB interface 1 */ },
+ { /* port 6 USER AHB interface 2 */ },
+ { /* port 7 USER AHB interface 3 */ },
+ { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } },
+ },
+ },
+ };
+ const PPCInfo an555_ppcs[] = { {
+ .name = "apb_ppcexp0",
+ .ports = {
+ { "sram-timing-adapter", make_unimp_dev, &mms->ta[0], 0x41700000, 0x1000 },
+ { "qspi-timing-adapter", make_unimp_dev, &mms->ta[1], 0x41701000, 0x1000 },
+ { "ddr4-timing-adapter", make_unimp_dev, &mms->ta[2], 0x41702000, 0x1000 },
+ },
+ }, {
+ .name = "apb_ppcexp1",
+ .ports = {
+ { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
+ { .i2c_internal = true /* touchscreen */ } },
+ { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
+ { .i2c_internal = true /* audio conf */ } },
+ { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
+ { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
+ { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
+ { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
+ { .i2c_internal = false /* shield 0 */ } },
+ { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
+ { .i2c_internal = false /* shield 1 */ } },
+ { /* port 7 reserved */ },
+ { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
+ { .i2c_internal = true /* DDR4 EEPROM */ } },
+ },
+ }, {
+ .name = "apb_ppcexp2",
+ .ports = {
+ { "scc", make_scc, &mms->scc, 0x49300000, 0x1000 },
+ { "i2s-audio", make_unimp_dev, &mms->i2s_audio, 0x49301000, 0x1000 },
+ { "fpgaio", make_fpgaio, &mms->fpgaio, 0x49302000, 0x1000 },
+ { "uart0", make_uart, &mms->uart[0], 0x49303000, 0x1000, { 33, 34, 43 } },
+ { "uart1", make_uart, &mms->uart[1], 0x49304000, 0x1000, { 35, 36, 44 } },
+ { "uart2", make_uart, &mms->uart[2], 0x49305000, 0x1000, { 37, 38, 45 } },
+ { "uart3", make_uart, &mms->uart[3], 0x49306000, 0x1000, { 39, 40, 46 } },
+ { "uart4", make_uart, &mms->uart[4], 0x49307000, 0x1000, { 41, 42, 47 } },
+ { "uart5", make_uart, &mms->uart[5], 0x49308000, 0x1000, { 125, 126, 127 } },
{ /* port 9 reserved */ },
{ "clcd", make_unimp_dev, &mms->cldc, 0x4930a000, 0x1000 },
{ "rtc", make_rtc, &mms->rtc, 0x4930b000, 0x1000 },
@@ -1099,6 +1175,24 @@ static void mps2tz_common_init(MachineState *machine)
{ /* port 6 USER AHB interface 2 */ },
{ /* port 7 USER AHB interface 3 */ },
{ "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } },
+ { /* port 9 reserved */ },
+ { /* port 10 reserved */ },
+ { /* port 11 reserved */ },
+ { /* port 12 reserved */ },
+ { "qspi-controller0", make_unimp_dev, &mms->qspi_controller[0],
+ 0x41800000, 0x1000 },
+ { "qspi-controller1", make_unimp_dev, &mms->qspi_controller[1],
+ 0x41801000, 0x1000 },
+ { "qspi-controller2", make_unimp_dev, &mms->qspi_controller[2],
+ 0x41802000, 0x1000 },
+ },
+ }, {
+ .name = "ahb_ppcexp1",
+ .ports = {
+ { "dma0", make_dma, &mms->dma[0], 0x41200000, 0x1000, { 59, 57, 58 } },
+ { "dma1", make_dma, &mms->dma[1], 0x41201000, 0x1000, { 62, 60, 61 } },
+ { "dma2", make_dma, &mms->dma[2], 0x41202000, 0x1000, { 65, 63, 64 } },
+ { "dma3", make_dma, &mms->dma[3], 0x41203000, 0x1000, { 68, 66, 67 } },
},
},
};
@@ -1117,6 +1211,10 @@ static void mps2tz_common_init(MachineState *machine)
ppcs = an547_ppcs;
num_ppcs = ARRAY_SIZE(an547_ppcs);
break;
+ case FPGA_AN555:
+ ppcs = an555_ppcs;
+ num_ppcs = ARRAY_SIZE(an555_ppcs);
+ break;
default:
g_assert_not_reached();
}
@@ -1200,6 +1298,12 @@ static void mps2tz_common_init(MachineState *machine)
create_unimplemented_device("U55 timing adapter 1", 0x48103000, 0x1000);
}
+ if (mmc->fpga_type == FPGA_AN555) {
+ create_unimplemented_device("SRAM MPC", 0x57000000, 0x1000);
+ create_unimplemented_device("QSPI MPC", 0x57001000, 0x1000);
+ create_unimplemented_device("DDR4 MPC", 0x57002000, 0x1000);
+ }
+
create_non_mpc_ram(mms);
if (mmc->fpga_type == FPGA_AN524) {
@@ -1447,6 +1551,41 @@ static void mps3tz_an547_class_init(ObjectClass *oc, const void *data)
mps2tz_set_default_ram_info(mmc);
}
+static void mps3tz_an555_class_init(ObjectClass *oc, const void *data)
+{
+ MachineClass *mc = MACHINE_CLASS(oc);
+ MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_CLASS(oc);
+ static const char * const valid_cpu_types[] = {
+ ARM_CPU_TYPE_NAME("cortex-m85"),
+ NULL
+ };
+
+ mc->desc = "ARM MPS3 with AN555 FPGA image for Cortex-M85";
+ mc->default_cpus = 1;
+ mc->min_cpus = mc->default_cpus;
+ mc->max_cpus = mc->default_cpus;
+ mmc->fpga_type = FPGA_AN555;
+ mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-m85");
+ mc->valid_cpu_types = valid_cpu_types;
+ mmc->scc_id = 0x41055551;
+ mmc->sysclk_frq = 25 * 1000 * 1000; /* 25MHz */
+ mmc->apb_periph_frq = 25 * 1000 * 1000; /* 25MHz */
+ mmc->oscclk = an555_oscclk;
+ mmc->len_oscclk = ARRAY_SIZE(an555_oscclk);
+ mmc->fpgaio_num_leds = 10;
+ mmc->fpgaio_has_switches = true;
+ mmc->fpgaio_has_dbgctrl = true;
+ mmc->numirq = 96;
+ mmc->uart_overflow_irq = 48;
+ mmc->init_svtor = 0x00000000;
+ mmc->cpu0_mpu_s = mmc->cpu0_mpu_ns = 8;
+ mmc->sram_addr_width = 21;
+ mmc->raminfo = an547_raminfo; /* same as AN547*/
+ mmc->armsse_type = TYPE_SSE310;
+ mmc->boot_ram_size = 512 * KiB;
+ mps2tz_set_default_ram_info(mmc);
+}
+
static const TypeInfo mps2tz_info = {
.name = TYPE_MPS2TZ_MACHINE,
.parent = TYPE_MACHINE,
@@ -1488,6 +1627,13 @@ static const TypeInfo mps3tz_an547_info = {
.interfaces = arm_machine_interfaces,
};
+static const TypeInfo mps3tz_an555_info = {
+ .name = TYPE_MPS3TZ_AN555_MACHINE,
+ .parent = TYPE_MPS2TZ_MACHINE,
+ .class_init = mps3tz_an555_class_init,
+ .interfaces = arm_machine_interfaces,
+};
+
static void mps2tz_machine_init(void)
{
type_register_static(&mps2tz_info);
@@ -1495,6 +1641,7 @@ static void mps2tz_machine_init(void)
type_register_static(&mps2tz_an521_info);
type_register_static(&mps3tz_an524_info);
type_register_static(&mps3tz_an547_info);
+ type_register_static(&mps3tz_an555_info);
}
type_init(mps2tz_machine_init);
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 8/9] hw/arm/mps2-tz.c add Arm mps3-an555 board
2026-08-05 15:30 ` [PATCH v2 8/9] hw/arm/mps2-tz.c add Arm mps3-an555 board Simon Xu
@ 2026-08-17 15:50 ` Peter Maydell
0 siblings, 0 replies; 18+ messages in thread
From: Peter Maydell @ 2026-08-17 15:50 UTC (permalink / raw)
To: Simon Xu; +Cc: qemu-devel, qemu-arm, Owen Giles, Pierrick Bouvier,
Robert Elliott
On Wed, 5 Aug 2026 at 16:30, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> Add mps3-an555 board modeled after the existing mps3-an547 board.
> Add UnimplementedDeivceState for timing adapters and qspi controllers
> in MPS2TZMachineState.
>
> Changes in AN555:
> Timing adapters in APB PPC EX0 instead of MPC.
> Additional QSPI controllers in AHB PPC EX0.
> Additional AHB PPC EX1 with DMA.
> Create standalone unimplemented devices for MPC instead of timing adapters.
>
> Include documentation for SSE-310 and mps3-an555.
>
> Arm mps3-an555 TRM: https://developer.arm.com/documentation/107642/latest/
>
> Reviewed-by: Owen Giles <owen.giles@hpe.com>
> Reviewed-by: Robert Elliott <elliott@hpe.com>
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
> ---
> v1 -> v2
> Move board and application note documentation locations
> Revert MPS2TZ_NUMIRQ_MAX to 96 from 100
> Fix timing adapter and MPC creation location
> Add QSPI controller to AHB PPC EX0
> Add GPIOALT2 register to FPGAIO block in next patch
> ---
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
thanks
-- PMM
^ permalink raw reply [flat|nested] 18+ messages in thread
* [PATCH v2 9/9] hw/misc/mps2-fpgaio.c: add GPIOALT2 register
2026-08-05 15:29 [PATCH v2 0/9] arm: add Cortex-M85, SSE-310, and mps3-an555 Simon Xu
` (7 preceding siblings ...)
2026-08-05 15:30 ` [PATCH v2 8/9] hw/arm/mps2-tz.c add Arm mps3-an555 board Simon Xu
@ 2026-08-05 15:30 ` Simon Xu
2026-08-17 15:49 ` Peter Maydell
8 siblings, 1 reply; 18+ messages in thread
From: Simon Xu @ 2026-08-05 15:30 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Owen Giles, Peter Maydell, Pierrick Bouvier,
Robert Elliott, Simon Xu
Add GPIOALT2 register for new an555 board.
Implement register access as RW with LOG_UNIMP for writes.
Add "has-gpioalt2" property to make each board configurable.
Reviewed-by: Owen Giles <owen.giles@hpe.com>
Reviewed-by: Robert Elliott <elliott@hpe.com>
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
hw/arm/mps2-tz.c | 7 +++++++
hw/misc/mps2-fpgaio.c | 13 +++++++++++++
include/hw/misc/mps2-fpgaio.h | 2 ++
3 files changed, 22 insertions(+)
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 2cb461ca71..d9f64880f8 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -131,6 +131,7 @@ struct MPS2TZMachineClass {
uint32_t fpgaio_num_leds; /* Number of LEDs in FPGAIO LED0 register */
bool fpgaio_has_switches; /* Does FPGAIO have SWITCH register? */
bool fpgaio_has_dbgctrl; /* Does FPGAIO have DBGCTRL register? */
+ bool fpgaio_has_gpioalt2; /* Does FPGAIO have GPIOALT2 register? */
int numirq; /* Number of external interrupts */
int uart_overflow_irq; /* number of the combined UART overflow IRQ */
uint32_t init_svtor; /* init-svtor setting for SSE */
@@ -515,6 +516,7 @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
qdev_prop_set_uint32(DEVICE(fpgaio), "num-leds", mmc->fpgaio_num_leds);
qdev_prop_set_bit(DEVICE(fpgaio), "has-switches", mmc->fpgaio_has_switches);
qdev_prop_set_bit(DEVICE(fpgaio), "has-dbgctrl", mmc->fpgaio_has_dbgctrl);
+ qdev_prop_set_bit(DEVICE(fpgaio), "has-gpioalt2", mmc->fpgaio_has_gpioalt2);
sysbus_realize(SYS_BUS_DEVICE(fpgaio), &error_fatal);
return sysbus_mmio_get_region(SYS_BUS_DEVICE(fpgaio), 0);
}
@@ -1433,6 +1435,7 @@ static void mps2tz_an505_class_init(ObjectClass *oc, const void *data)
mmc->fpgaio_num_leds = 2;
mmc->fpgaio_has_switches = false;
mmc->fpgaio_has_dbgctrl = false;
+ mmc->fpgaio_has_gpioalt2 = false;
mmc->numirq = 92;
mmc->uart_overflow_irq = 47;
mmc->init_svtor = 0x10000000;
@@ -1467,6 +1470,7 @@ static void mps2tz_an521_class_init(ObjectClass *oc, const void *data)
mmc->fpgaio_num_leds = 2;
mmc->fpgaio_has_switches = false;
mmc->fpgaio_has_dbgctrl = false;
+ mmc->fpgaio_has_gpioalt2 = false;
mmc->numirq = 92;
mmc->uart_overflow_irq = 47;
mmc->init_svtor = 0x10000000;
@@ -1501,6 +1505,7 @@ static void mps3tz_an524_class_init(ObjectClass *oc, const void *data)
mmc->fpgaio_num_leds = 10;
mmc->fpgaio_has_switches = true;
mmc->fpgaio_has_dbgctrl = false;
+ mmc->fpgaio_has_gpioalt2 = false;
mmc->numirq = 95;
mmc->uart_overflow_irq = 47;
mmc->init_svtor = 0x10000000;
@@ -1540,6 +1545,7 @@ static void mps3tz_an547_class_init(ObjectClass *oc, const void *data)
mmc->fpgaio_num_leds = 10;
mmc->fpgaio_has_switches = true;
mmc->fpgaio_has_dbgctrl = true;
+ mmc->fpgaio_has_gpioalt2 = false;
mmc->numirq = 96;
mmc->uart_overflow_irq = 48;
mmc->init_svtor = 0x00000000;
@@ -1575,6 +1581,7 @@ static void mps3tz_an555_class_init(ObjectClass *oc, const void *data)
mmc->fpgaio_num_leds = 10;
mmc->fpgaio_has_switches = true;
mmc->fpgaio_has_dbgctrl = true;
+ mmc->fpgaio_has_gpioalt2 = true;
mmc->numirq = 96;
mmc->uart_overflow_irq = 48;
mmc->init_svtor = 0x00000000;
diff --git a/hw/misc/mps2-fpgaio.c b/hw/misc/mps2-fpgaio.c
index da78cb6070..6696384a25 100644
--- a/hw/misc/mps2-fpgaio.c
+++ b/hw/misc/mps2-fpgaio.c
@@ -31,6 +31,7 @@
REG32(LED0, 0)
REG32(DBGCTRL, 4)
REG32(BUTTON, 8)
+REG32(GPIOALT2, 0xc)
REG32(CLK1HZ, 0x10)
REG32(CLK100HZ, 0x14)
REG32(COUNTER, 0x18)
@@ -142,6 +143,9 @@ static uint64_t mps2_fpgaio_read(void *opaque, hwaddr offset, unsigned size)
*/
r = 0;
break;
+ case A_GPIOALT2:
+ r = s->gpioalt2;
+ break;
case A_PRESCALE:
r = s->prescale;
break;
@@ -210,6 +214,14 @@ static void mps2_fpgaio_write(void *opaque, hwaddr offset, uint64_t value,
"MPS2 FPGAIO: DBGCTRL unimplemented\n");
s->dbgctrl = value;
break;
+ case A_GPIOALT2:
+ if (!s->has_gpioalt2) {
+ goto bad_offset;
+ }
+ qemu_log_mask(LOG_UNIMP,
+ "MPS2 FPGAIO: GPIOALT2 unimplemented\n");
+ s->gpioalt2 = value;
+ break;
case A_PRESCALE:
resync_counter(s);
s->prescale = value;
@@ -326,6 +338,7 @@ static const Property mps2_fpgaio_properties[] = {
DEFINE_PROP_UINT32("num-leds", MPS2FPGAIO, num_leds, 2),
DEFINE_PROP_BOOL("has-switches", MPS2FPGAIO, has_switches, false),
DEFINE_PROP_BOOL("has-dbgctrl", MPS2FPGAIO, has_dbgctrl, false),
+ DEFINE_PROP_BOOL("has-gpioalt2", MPS2FPGAIO, has_gpioalt2, false),
};
static void mps2_fpgaio_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h
index edd9f23121..7512686616 100644
--- a/include/hw/misc/mps2-fpgaio.h
+++ b/include/hw/misc/mps2-fpgaio.h
@@ -40,11 +40,13 @@ struct MPS2FPGAIO {
uint32_t num_leds;
bool has_switches;
bool has_dbgctrl;
+ bool has_gpioalt2;
uint32_t led0;
uint32_t prescale;
uint32_t misc;
uint32_t dbgctrl;
+ uint32_t gpioalt2;
/* QEMU_CLOCK_VIRTUAL time at which counter and pscntr were last synced */
int64_t pscntr_sync_ticks;
--
2.53.0
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH v2 9/9] hw/misc/mps2-fpgaio.c: add GPIOALT2 register
2026-08-05 15:30 ` [PATCH v2 9/9] hw/misc/mps2-fpgaio.c: add GPIOALT2 register Simon Xu
@ 2026-08-17 15:49 ` Peter Maydell
0 siblings, 0 replies; 18+ messages in thread
From: Peter Maydell @ 2026-08-17 15:49 UTC (permalink / raw)
To: Simon Xu; +Cc: qemu-devel, qemu-arm, Owen Giles, Pierrick Bouvier,
Robert Elliott
On Wed, 5 Aug 2026 at 16:30, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> Add GPIOALT2 register for new an555 board.
> Implement register access as RW with LOG_UNIMP for writes.
> Add "has-gpioalt2" property to make each board configurable.
>
> Reviewed-by: Owen Giles <owen.giles@hpe.com>
> Reviewed-by: Robert Elliott <elliott@hpe.com>
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
This patch should go in the series before the one where we add
the an555 board, so that all the features it's supposed to have
are implemented before we expose it to users.
> static void mps2_fpgaio_class_init(ObjectClass *klass, const void *data)
> diff --git a/include/hw/misc/mps2-fpgaio.h b/include/hw/misc/mps2-fpgaio.h
> index edd9f23121..7512686616 100644
> --- a/include/hw/misc/mps2-fpgaio.h
> +++ b/include/hw/misc/mps2-fpgaio.h
> @@ -40,11 +40,13 @@ struct MPS2FPGAIO {
> uint32_t num_leds;
> bool has_switches;
> bool has_dbgctrl;
> + bool has_gpioalt2;
>
> uint32_t led0;
> uint32_t prescale;
> uint32_t misc;
> uint32_t dbgctrl;
> + uint32_t gpioalt2;
We need to migrate this new device state. To do that we'll have to
add a new vmstate subsection to the mps2_fpgaio_vmstate. If
you look at iotkit-sysctl.c you can see an example of how this
is done: you add a new .subsections to the vmstate, which
contains &mps2_fpgaio_gpioalt2_vmstate, plus a NULL terminator.
That new mps2_fpgaio_gpioalt2_vmstate should look like this:
static const VMStateDescription mps2_fpgaio_gpioalt2_vmstate = {
.name = "mps2-fpgaio/gpioalt2",
.version_id = 1,
.minimum_version_id = 1,
.needed = needed_gpioalt2,
.fields = (const VMStateField[]) {
VMSTATE_UINT32(gpioalt2, MPS2FPGAIO),
VMSTATE_END_OF_LIST()
}
};
The needed_gpioalt2 function should return true if has_gpioalt2.
(It gets passed the MPS2FPGAIO* as a void*, so you need to
cast it to the right type with the QOM macro.)
thanks
-- PMM
^ permalink raw reply [flat|nested] 18+ messages in thread