[PATCH v3 0/3] hw/arm Add STM32F4 support and PWR device model

[PATCH v3 0/3] hw/arm Add STM32F4 support and PWR device model

[fanyihao]

From: Yihao Fan <fanyihao@rt-thread.org>

This patch series introduces basic support for the STM32F407 SoC and
a new STM32F4spark machine in QEMU, along with a PWR device model.

In addition, I have modified the header file referenced by the RCC
driver to STM32RCC in accordance with the suggestions.

This series includes:
- A new SoC model (STM32F407) with initial integration.
- A board model called STM32F4spark to instantiate and test the SoC.
- A PWR device implementation for STM32F4xx family.

Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
---

Yihao Fan (3):
  hw/arm: Add support for the STM32F407 SoC
  hw/arm: Add support for the STM32F407-RT-SPARk board
  hw/arm/stm32f407: Add PWR device to stm32f407 SoC

 MAINTAINERS                            |  14 ++
 docs/system/arm/STM32F407-RT-SPARK.rst |  41 +++++
 docs/system/arm/stm32.rst              |   2 +
 docs/system/target-arm.rst             |   1 +
 hw/arm/Kconfig                         |  13 ++
 hw/arm/meson.build                     |   2 +
 hw/arm/stm32f407_soc.c                 | 217 +++++++++++++++++++++++++
 hw/arm/stm32f4spark.c                  |  56 +++++++
 hw/misc/Kconfig                        |   3 +
 hw/misc/meson.build                    |   1 +
 hw/misc/stm32f4xx_pwr.c                | 111 +++++++++++++
 include/hw/arm/stm32f407_soc.h         |  77 +++++++++
 include/hw/misc/stm32f4xx_pwr.h        |  40 +++++
 13 files changed, 578 insertions(+)
 create mode 100644 docs/system/arm/STM32F407-RT-SPARK.rst
 create mode 100644 hw/arm/stm32f407_soc.c
 create mode 100644 hw/arm/stm32f4spark.c
 create mode 100644 hw/misc/stm32f4xx_pwr.c
 create mode 100644 include/hw/arm/stm32f407_soc.h
 create mode 100644 include/hw/misc/stm32f4xx_pwr.h

-- 
2.43.0

[PATCH v3 1/3] hw/arm: Add support for the STM32F407 SoC|

[fanyihao]

From: Yihao Fan <fanyihao@rt-thread.org>

This patch introduces a new QEMU machine type for the STM32F407 SoC featuring a Cortex-M4 core.
This will be used by the RT-Spark to create a machine.
Furthermore, I have updated the reusable USART, timer,
and RCC drivers to align with the existing driver implementations.

Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
---
 MAINTAINERS                    |   7 ++
 hw/arm/Kconfig                 |   6 +
 hw/arm/meson.build             |   1 +
 hw/arm/stm32f407_soc.c         | 208 +++++++++++++++++++++++++++++++++
 include/hw/arm/stm32f407_soc.h |  74 ++++++++++++
 5 files changed, 296 insertions(+)
 create mode 100644 hw/arm/stm32f407_soc.c
 create mode 100644 include/hw/arm/stm32f407_soc.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 36eef27b419..ceef177740b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1163,6 +1163,13 @@ F: hw/misc/stm32f4xx_exti.c
 F: hw/misc/stm32_rcc.c
 F: include/hw/misc/stm32_rcc.h
 
+STM32F407
+M: yanl1229 <yanl1229@rt-thread.org>
+M: Yihao Fan <fanyihao@rt-thread.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/stm32f407_soc.c
+
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index b44b85f4361..bbf675c158c 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -406,6 +406,12 @@ config STM32F405_SOC
     select STM32F4XX_SYSCFG
     select STM32F4XX_EXTI
 
+config STM32F407_SOC
+    bool
+    select ARM_V7M
+    select STM32F4XX_SYSCFG
+    select STM32F4XX_EXTI
+
 config B_L475E_IOT01A
     bool
     default y
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index b88b5b06d7e..1de2642620a 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -33,6 +33,7 @@ arm_common_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2
 arm_common_ss.add(when: 'CONFIG_STM32F100_SOC', if_true: files('stm32f100_soc.c'))
 arm_common_ss.add(when: 'CONFIG_STM32F205_SOC', if_true: files('stm32f205_soc.c'))
 arm_common_ss.add(when: 'CONFIG_STM32F405_SOC', if_true: files('stm32f405_soc.c'))
+arm_common_ss.add(when: 'CONFIG_STM32F407_SOC', if_true: files('stm32f407_soc.c'))
 arm_common_ss.add(when: 'CONFIG_B_L475E_IOT01A', if_true: files('b-l475e-iot01a.c'))
 arm_common_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_soc.c'))
 arm_common_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp.c', 'xlnx-zcu102.c'))
diff --git a/hw/arm/stm32f407_soc.c b/hw/arm/stm32f407_soc.c
new file mode 100644
index 00000000000..8e20ddcd5b1
--- /dev/null
+++ b/hw/arm/stm32f407_soc.c
@@ -0,0 +1,208 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * Copyright (c) liang yan <yanl1229@rt-thread.org>
+ * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
+ * The reference used is the STMicroElectronics RM0090 Reference manual
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "system/address-spaces.h"
+#include "system/system.h"
+#include "hw/arm/stm32f407_soc.h"
+#include "hw/qdev-clock.h"
+#include "hw/misc/unimp.h"
+#include "hw/sd/sd.h"
+#include "hw/boards.h"
+#include "qom/object.h"
+
+static const uint32_t syscfg_addr = 0x40013800;
+static const uint32_t exti_addr = 0x40013C00;
+static const uint32_t usart_addr[STM_NUM_USARTS] = {
+    STM32F407_USART1, STM32F407_USART2, STM32F407_USART3,
+    STM32F407_USART6
+};
+/* At the moment only Timer 2 to 5 are modelled */
+static const uint32_t timer_addr[STM_NUM_TIMERS] = {
+    STM32F407_TIM2, STM32F407_TIM3, STM32F407_TIM4,
+    STM32F407_TIM5
+};
+static const int syscfg_irq = 71;
+static const int exti_irq[] = {
+    6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
+    40, 40, 40, 40, 40
+};
+static const int usart_irq[STM_NUM_USARTS] = {
+    37, 38, 39, 71
+};
+static const int timer_irq[STM_NUM_TIMERS] = {
+    28, 29, 30, 50
+};
+
+static void stm32f407_soc_initfn(Object *obj)
+{
+    int i;
+
+    STM32F407State *s = STM32F407_SOC(obj);
+
+    object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
+    object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32F4XX_SYSCFG);
+    object_initialize_child(obj, "exti", &s->exti, TYPE_STM32F4XX_EXTI);
+    object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32_RCC);
+
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        object_initialize_child(obj, "usart[*]", &s->usart[i],
+                                TYPE_STM32F2XX_USART);
+    }
+
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        object_initialize_child(obj, "timer[*]", &s->timer[i],
+                                TYPE_STM32F2XX_TIMER);
+    }
+
+    s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
+    s->refclk = qdev_init_clock_in(DEVICE(s), "refclk", NULL, NULL, 0);
+}
+
+static void stm32f407_soc_realize(DeviceState *dev_soc, Error **errp)
+{
+    STM32F407State *s = STM32F407_SOC(dev_soc);
+    DeviceState *dev, *armv7m;
+    SysBusDevice *busdev;
+    DriveInfo *dinfo;
+    int i, j;
+
+    MemoryRegion *system_memory = get_system_memory();
+
+    /*
+     * We use s->refclk internally and only define it with qdev_init_clock_in()
+     * so it is correctly parented and not leaked on an init/deinit; it is not
+     * intended as an externally exposed clock.
+     */
+    if (clock_has_source(s->refclk)) {
+        error_setg(errp, "refclk clock must not be wired up by the board code");
+        return;
+    }
+
+    if (!clock_has_source(s->sysclk)) {
+        error_setg(errp, "sysclk clock must be wired up by the board code");
+        return;
+    }
+
+    /*
+     * TODO: ideally we should model the SoC RCC and its ability to
+     * change the sysclk frequency and define different sysclk sources.
+     */
+
+    /* The refclk always runs at frequency HCLK / 8 */
+    clock_set_mul_div(s->refclk, 8, 1);
+    clock_set_source(s->refclk, s->sysclk);
+
+    memory_region_init_rom(&s->flash, OBJECT(dev_soc), "STM32F407.flash",
+                           FLASH_SIZE, &error_fatal);
+    memory_region_init_alias(&s->flash_alias, OBJECT(dev_soc),
+                             "STM32F407.flash.alias", &s->flash, 0, FLASH_SIZE);
+
+    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
+    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
+
+    memory_region_init_ram(&s->sram, NULL, "STM32F407.sram", SRAM_SIZE,
+                           &error_fatal);
+    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
+
+    memory_region_init_ram(&s->ccm, NULL, "STM32F407.ccm", CCM_SIZE,
+                           &error_fatal);
+    memory_region_add_subregion(system_memory, CCM_BASE_ADDRESS, &s->ccm);
+
+    armv7m = DEVICE(&s->armv7m);
+    qdev_prop_set_uint32(armv7m, "num-irq", 98);
+    qdev_prop_set_string(armv7m, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
+    qdev_connect_clock_in(armv7m, "refclk", s->refclk);
+    object_property_set_link(OBJECT(&s->armv7m), "memory",
+                             OBJECT(system_memory), &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
+        return;
+    }
+
+    /* Reset and clock controller */
+    dev = DEVICE(&s->rcc);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->rcc), errp)) {
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, RCC_BASE_ADDR);
+
+    /* System configuration controller */
+    dev = DEVICE(&s->syscfg);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->syscfg), errp)) {
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, syscfg_addr);
+    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, syscfg_irq));
+
+    /* EXTI device */
+    dev = DEVICE(&s->exti);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->exti), errp)) {
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, exti_addr);
+    for (i = 0; i < 16; i++) {
+        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
+    }
+    for (i = 0; i < 16; i++) {
+        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
+    }
+
+    /* Attach UART (uses USART registers) and USART controllers */
+    for (i = 0; i < STM_NUM_USARTS; i++) {
+        dev = DEVICE(&(s->usart[i]));
+        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->usart[i]), errp)) {
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, usart_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
+    }
+
+    /* Timer 2 to 5 contoller */
+    for (i = 0; i < STM_NUM_TIMERS; i++) {
+        dev = DEVICE(&(s->timer[i]));
+        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer[i]), errp)) {
+            return;
+        }
+        busdev = SYS_BUS_DEVICE(dev);
+        sysbus_mmio_map(busdev, 0, timer_addr[i]);
+        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
+    }
+
+}
+
+static void stm32f407_soc_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = stm32f407_soc_realize;
+}
+
+static const TypeInfo stm32f407_soc_info = {
+    .name          = TYPE_STM32F407_SOC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F407State),
+    .instance_init = stm32f407_soc_initfn,
+    .class_init    = stm32f407_soc_class_init,
+};
+
+static void stm32f407_soc_types(void)
+{
+    type_register_static(&stm32f407_soc_info);
+}
+
+type_init(stm32f407_soc_types)
diff --git a/include/hw/arm/stm32f407_soc.h b/include/hw/arm/stm32f407_soc.h
new file mode 100644
index 00000000000..3497e91aa1c
--- /dev/null
+++ b/include/hw/arm/stm32f407_soc.h
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * Copyright (c) liang yan <yanl1229@rt-thread.org>
+ * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
+ * The reference used is the STMicroElectronics RM0090 Reference manual
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
+ */
+
+#ifndef STM32F407_SOC_H
+#define STM32F407_SOC_H
+
+#include "hw/or-irq.h"
+#include "hw/arm/armv7m.h"
+#include "hw/misc/stm32f4xx_syscfg.h"
+#include "hw/misc/stm32f4xx_exti.h"
+#include "hw/char/stm32f2xx_usart.h"
+#include "hw/timer/stm32f2xx_timer.h"
+#include "hw/misc/stm32_rcc.h"
+#include "qom/object.h"
+
+#define TYPE_STM32F407_SOC "stm32f407-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(STM32F407State, STM32F407_SOC)
+
+#define STM_NUM_USARTS      4
+#define STM32F407_USART1    0x40011000
+#define STM32F407_USART2    0x40004400
+#define STM32F407_USART3    0x40004800
+#define STM32F407_USART6    0x40011400
+
+#define STM_NUM_TIMERS      4
+#define STM32F407_TIM1      0x40010000
+#define STM32F407_TIM2      0x40000000
+#define STM32F407_TIM3      0x40000400
+#define STM32F407_TIM4      0x40000800
+#define STM32F407_TIM5      0x40000c00
+
+#define RCC_BASE_ADDR       0x40023800
+#define SYSCFG_BASE_ADDRESS 0x40013800
+#define SYSCFG_IRQ  71
+#define EXIT_BASE_ADDRESS 0x40013C00
+
+#define FLASH_BASE_ADDRESS  0x8000000
+#define FLASH_SIZE          0x100000
+#define SRAM_BASE_ADDRESS   0x20000000
+#define SRAM_SIZE           (192 * 1024)
+#define CCM_BASE_ADDRESS    0x10000000
+#define CCM_SIZE            (64 * 1024)
+
+typedef struct STM32F407State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
+
+    ARMv7MState armv7m;
+
+    STM32RccState rcc;
+    STM32F4xxSyscfgState syscfg;
+    STM32F4xxExtiState exti;
+    STM32F2XXUsartState usart[STM_NUM_USARTS];
+    STM32F2XXTimerState timer[STM_NUM_TIMERS];
+
+    MemoryRegion ccm;
+    MemoryRegion sram;
+    MemoryRegion flash;
+    MemoryRegion flash_alias;
+
+    Clock *sysclk;
+    Clock *refclk;
+
+
+} STM32F407State;
+
+#endif
-- 
2.43.0

Re: [PATCH v3 1/3] hw/arm: Add support for the STM32F407 SoC|

[Peter Maydell]

On Sun, 26 Oct 2025 at 10:53, <fanyihao@rt-thread.org> wrote:
>
> From: Yihao Fan <fanyihao@rt-thread.org>
>
> This patch introduces a new QEMU machine type for the STM32F407 SoC featuring a Cortex-M4 core.
> This will be used by the RT-Spark to create a machine.
> Furthermore, I have updated the reusable USART, timer,
> and RCC drivers to align with the existing driver implementations.
>
> Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>

> +
> +    /* Timer 2 to 5 contoller */

"controller"

Otherwise
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM

Re: [PATCH v3 1/3] hw/arm: Add support for the STM32F407 SoC|

[Alistair Francis]

On Sun, Oct 26, 2025 at 9:02 PM <fanyihao@rt-thread.org> wrote:
>
> From: Yihao Fan <fanyihao@rt-thread.org>
>
> This patch introduces a new QEMU machine type for the STM32F407 SoC featuring a Cortex-M4 core.
> This will be used by the RT-Spark to create a machine.
> Furthermore, I have updated the reusable USART, timer,
> and RCC drivers to align with the existing driver implementations.
>
> Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  MAINTAINERS                    |   7 ++
>  hw/arm/Kconfig                 |   6 +
>  hw/arm/meson.build             |   1 +
>  hw/arm/stm32f407_soc.c         | 208 +++++++++++++++++++++++++++++++++
>  include/hw/arm/stm32f407_soc.h |  74 ++++++++++++
>  5 files changed, 296 insertions(+)
>  create mode 100644 hw/arm/stm32f407_soc.c
>  create mode 100644 include/hw/arm/stm32f407_soc.h
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 36eef27b419..ceef177740b 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -1163,6 +1163,13 @@ F: hw/misc/stm32f4xx_exti.c
>  F: hw/misc/stm32_rcc.c
>  F: include/hw/misc/stm32_rcc.h
>
> +STM32F407
> +M: yanl1229 <yanl1229@rt-thread.org>
> +M: Yihao Fan <fanyihao@rt-thread.org>
> +L: qemu-arm@nongnu.org
> +S: Maintained
> +F: hw/arm/stm32f407_soc.c
> +
>  Netduino 2
>  M: Alistair Francis <alistair@alistair23.me>
>  M: Peter Maydell <peter.maydell@linaro.org>
> diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
> index b44b85f4361..bbf675c158c 100644
> --- a/hw/arm/Kconfig
> +++ b/hw/arm/Kconfig
> @@ -406,6 +406,12 @@ config STM32F405_SOC
>      select STM32F4XX_SYSCFG
>      select STM32F4XX_EXTI
>
> +config STM32F407_SOC
> +    bool
> +    select ARM_V7M
> +    select STM32F4XX_SYSCFG
> +    select STM32F4XX_EXTI
> +
>  config B_L475E_IOT01A
>      bool
>      default y
> diff --git a/hw/arm/meson.build b/hw/arm/meson.build
> index b88b5b06d7e..1de2642620a 100644
> --- a/hw/arm/meson.build
> +++ b/hw/arm/meson.build
> @@ -33,6 +33,7 @@ arm_common_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2
>  arm_common_ss.add(when: 'CONFIG_STM32F100_SOC', if_true: files('stm32f100_soc.c'))
>  arm_common_ss.add(when: 'CONFIG_STM32F205_SOC', if_true: files('stm32f205_soc.c'))
>  arm_common_ss.add(when: 'CONFIG_STM32F405_SOC', if_true: files('stm32f405_soc.c'))
> +arm_common_ss.add(when: 'CONFIG_STM32F407_SOC', if_true: files('stm32f407_soc.c'))
>  arm_common_ss.add(when: 'CONFIG_B_L475E_IOT01A', if_true: files('b-l475e-iot01a.c'))
>  arm_common_ss.add(when: 'CONFIG_STM32L4X5_SOC', if_true: files('stm32l4x5_soc.c'))
>  arm_common_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp.c', 'xlnx-zcu102.c'))
> diff --git a/hw/arm/stm32f407_soc.c b/hw/arm/stm32f407_soc.c
> new file mode 100644
> index 00000000000..8e20ddcd5b1
> --- /dev/null
> +++ b/hw/arm/stm32f407_soc.c
> @@ -0,0 +1,208 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
> +
> +/*
> + * Copyright (c) liang yan <yanl1229@rt-thread.org>
> + * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
> + * The reference used is the STMicroElectronics RM0090 Reference manual
> + * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "system/address-spaces.h"
> +#include "system/system.h"
> +#include "hw/arm/stm32f407_soc.h"
> +#include "hw/qdev-clock.h"
> +#include "hw/misc/unimp.h"
> +#include "hw/sd/sd.h"
> +#include "hw/boards.h"
> +#include "qom/object.h"
> +
> +static const uint32_t syscfg_addr = 0x40013800;
> +static const uint32_t exti_addr = 0x40013C00;
> +static const uint32_t usart_addr[STM_NUM_USARTS] = {
> +    STM32F407_USART1, STM32F407_USART2, STM32F407_USART3,
> +    STM32F407_USART6
> +};
> +/* At the moment only Timer 2 to 5 are modelled */
> +static const uint32_t timer_addr[STM_NUM_TIMERS] = {
> +    STM32F407_TIM2, STM32F407_TIM3, STM32F407_TIM4,
> +    STM32F407_TIM5
> +};
> +static const int syscfg_irq = 71;
> +static const int exti_irq[] = {
> +    6, 7, 8, 9, 10, 23, 23, 23, 23, 23, 40,
> +    40, 40, 40, 40, 40
> +};
> +static const int usart_irq[STM_NUM_USARTS] = {
> +    37, 38, 39, 71
> +};
> +static const int timer_irq[STM_NUM_TIMERS] = {
> +    28, 29, 30, 50
> +};
> +
> +static void stm32f407_soc_initfn(Object *obj)
> +{
> +    int i;
> +
> +    STM32F407State *s = STM32F407_SOC(obj);
> +
> +    object_initialize_child(obj, "armv7m", &s->armv7m, TYPE_ARMV7M);
> +    object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32F4XX_SYSCFG);
> +    object_initialize_child(obj, "exti", &s->exti, TYPE_STM32F4XX_EXTI);
> +    object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32_RCC);
> +
> +    for (i = 0; i < STM_NUM_USARTS; i++) {
> +        object_initialize_child(obj, "usart[*]", &s->usart[i],
> +                                TYPE_STM32F2XX_USART);
> +    }
> +
> +    for (i = 0; i < STM_NUM_TIMERS; i++) {
> +        object_initialize_child(obj, "timer[*]", &s->timer[i],
> +                                TYPE_STM32F2XX_TIMER);
> +    }
> +
> +    s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
> +    s->refclk = qdev_init_clock_in(DEVICE(s), "refclk", NULL, NULL, 0);
> +}
> +
> +static void stm32f407_soc_realize(DeviceState *dev_soc, Error **errp)
> +{
> +    STM32F407State *s = STM32F407_SOC(dev_soc);
> +    DeviceState *dev, *armv7m;
> +    SysBusDevice *busdev;
> +    DriveInfo *dinfo;
> +    int i, j;
> +
> +    MemoryRegion *system_memory = get_system_memory();
> +
> +    /*
> +     * We use s->refclk internally and only define it with qdev_init_clock_in()
> +     * so it is correctly parented and not leaked on an init/deinit; it is not
> +     * intended as an externally exposed clock.
> +     */
> +    if (clock_has_source(s->refclk)) {
> +        error_setg(errp, "refclk clock must not be wired up by the board code");
> +        return;
> +    }
> +
> +    if (!clock_has_source(s->sysclk)) {
> +        error_setg(errp, "sysclk clock must be wired up by the board code");
> +        return;
> +    }
> +
> +    /*
> +     * TODO: ideally we should model the SoC RCC and its ability to
> +     * change the sysclk frequency and define different sysclk sources.
> +     */
> +
> +    /* The refclk always runs at frequency HCLK / 8 */
> +    clock_set_mul_div(s->refclk, 8, 1);
> +    clock_set_source(s->refclk, s->sysclk);
> +
> +    memory_region_init_rom(&s->flash, OBJECT(dev_soc), "STM32F407.flash",
> +                           FLASH_SIZE, &error_fatal);
> +    memory_region_init_alias(&s->flash_alias, OBJECT(dev_soc),
> +                             "STM32F407.flash.alias", &s->flash, 0, FLASH_SIZE);
> +
> +    memory_region_add_subregion(system_memory, FLASH_BASE_ADDRESS, &s->flash);
> +    memory_region_add_subregion(system_memory, 0, &s->flash_alias);
> +
> +    memory_region_init_ram(&s->sram, NULL, "STM32F407.sram", SRAM_SIZE,
> +                           &error_fatal);
> +    memory_region_add_subregion(system_memory, SRAM_BASE_ADDRESS, &s->sram);
> +
> +    memory_region_init_ram(&s->ccm, NULL, "STM32F407.ccm", CCM_SIZE,
> +                           &error_fatal);
> +    memory_region_add_subregion(system_memory, CCM_BASE_ADDRESS, &s->ccm);
> +
> +    armv7m = DEVICE(&s->armv7m);
> +    qdev_prop_set_uint32(armv7m, "num-irq", 98);
> +    qdev_prop_set_string(armv7m, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
> +    qdev_prop_set_bit(armv7m, "enable-bitband", true);
> +    qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
> +    qdev_connect_clock_in(armv7m, "refclk", s->refclk);
> +    object_property_set_link(OBJECT(&s->armv7m), "memory",
> +                             OBJECT(system_memory), &error_abort);
> +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
> +        return;
> +    }
> +
> +    /* Reset and clock controller */
> +    dev = DEVICE(&s->rcc);
> +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->rcc), errp)) {
> +        return;
> +    }
> +    busdev = SYS_BUS_DEVICE(dev);
> +    sysbus_mmio_map(busdev, 0, RCC_BASE_ADDR);
> +
> +    /* System configuration controller */
> +    dev = DEVICE(&s->syscfg);
> +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->syscfg), errp)) {
> +        return;
> +    }
> +    busdev = SYS_BUS_DEVICE(dev);
> +    sysbus_mmio_map(busdev, 0, syscfg_addr);
> +    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, syscfg_irq));
> +
> +    /* EXTI device */
> +    dev = DEVICE(&s->exti);
> +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->exti), errp)) {
> +        return;
> +    }
> +    busdev = SYS_BUS_DEVICE(dev);
> +    sysbus_mmio_map(busdev, 0, exti_addr);
> +    for (i = 0; i < 16; i++) {
> +        sysbus_connect_irq(busdev, i, qdev_get_gpio_in(armv7m, exti_irq[i]));
> +    }
> +    for (i = 0; i < 16; i++) {
> +        qdev_connect_gpio_out(DEVICE(&s->syscfg), i, qdev_get_gpio_in(dev, i));
> +    }
> +
> +    /* Attach UART (uses USART registers) and USART controllers */
> +    for (i = 0; i < STM_NUM_USARTS; i++) {
> +        dev = DEVICE(&(s->usart[i]));
> +        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
> +        if (!sysbus_realize(SYS_BUS_DEVICE(&s->usart[i]), errp)) {
> +            return;
> +        }
> +        busdev = SYS_BUS_DEVICE(dev);
> +        sysbus_mmio_map(busdev, 0, usart_addr[i]);
> +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, usart_irq[i]));
> +    }
> +
> +    /* Timer 2 to 5 contoller */
> +    for (i = 0; i < STM_NUM_TIMERS; i++) {
> +        dev = DEVICE(&(s->timer[i]));
> +        qdev_prop_set_uint64(dev, "clock-frequency", 1000000000);
> +        if (!sysbus_realize(SYS_BUS_DEVICE(&s->timer[i]), errp)) {
> +            return;
> +        }
> +        busdev = SYS_BUS_DEVICE(dev);
> +        sysbus_mmio_map(busdev, 0, timer_addr[i]);
> +        sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
> +    }
> +
> +}
> +
> +static void stm32f407_soc_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +
> +    dc->realize = stm32f407_soc_realize;
> +}
> +
> +static const TypeInfo stm32f407_soc_info = {
> +    .name          = TYPE_STM32F407_SOC,
> +    .parent        = TYPE_SYS_BUS_DEVICE,
> +    .instance_size = sizeof(STM32F407State),
> +    .instance_init = stm32f407_soc_initfn,
> +    .class_init    = stm32f407_soc_class_init,
> +};
> +
> +static void stm32f407_soc_types(void)
> +{
> +    type_register_static(&stm32f407_soc_info);
> +}
> +
> +type_init(stm32f407_soc_types)
> diff --git a/include/hw/arm/stm32f407_soc.h b/include/hw/arm/stm32f407_soc.h
> new file mode 100644
> index 00000000000..3497e91aa1c
> --- /dev/null
> +++ b/include/hw/arm/stm32f407_soc.h
> @@ -0,0 +1,74 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
> +
> +/*
> + * Copyright (c) liang yan <yanl1229@rt-thread.org>
> + * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
> + * The reference used is the STMicroElectronics RM0090 Reference manual
> + * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
> + */
> +
> +#ifndef STM32F407_SOC_H
> +#define STM32F407_SOC_H
> +
> +#include "hw/or-irq.h"
> +#include "hw/arm/armv7m.h"
> +#include "hw/misc/stm32f4xx_syscfg.h"
> +#include "hw/misc/stm32f4xx_exti.h"
> +#include "hw/char/stm32f2xx_usart.h"
> +#include "hw/timer/stm32f2xx_timer.h"
> +#include "hw/misc/stm32_rcc.h"
> +#include "qom/object.h"
> +
> +#define TYPE_STM32F407_SOC "stm32f407-soc"
> +OBJECT_DECLARE_SIMPLE_TYPE(STM32F407State, STM32F407_SOC)
> +
> +#define STM_NUM_USARTS      4
> +#define STM32F407_USART1    0x40011000
> +#define STM32F407_USART2    0x40004400
> +#define STM32F407_USART3    0x40004800
> +#define STM32F407_USART6    0x40011400
> +
> +#define STM_NUM_TIMERS      4
> +#define STM32F407_TIM1      0x40010000
> +#define STM32F407_TIM2      0x40000000
> +#define STM32F407_TIM3      0x40000400
> +#define STM32F407_TIM4      0x40000800
> +#define STM32F407_TIM5      0x40000c00
> +
> +#define RCC_BASE_ADDR       0x40023800
> +#define SYSCFG_BASE_ADDRESS 0x40013800
> +#define SYSCFG_IRQ  71
> +#define EXIT_BASE_ADDRESS 0x40013C00
> +
> +#define FLASH_BASE_ADDRESS  0x8000000
> +#define FLASH_SIZE          0x100000
> +#define SRAM_BASE_ADDRESS   0x20000000
> +#define SRAM_SIZE           (192 * 1024)
> +#define CCM_BASE_ADDRESS    0x10000000
> +#define CCM_SIZE            (64 * 1024)
> +
> +typedef struct STM32F407State {
> +    /*< private >*/
> +    SysBusDevice parent_obj;
> +    /*< public >*/
> +
> +    ARMv7MState armv7m;
> +
> +    STM32RccState rcc;
> +    STM32F4xxSyscfgState syscfg;
> +    STM32F4xxExtiState exti;
> +    STM32F2XXUsartState usart[STM_NUM_USARTS];
> +    STM32F2XXTimerState timer[STM_NUM_TIMERS];
> +
> +    MemoryRegion ccm;
> +    MemoryRegion sram;
> +    MemoryRegion flash;
> +    MemoryRegion flash_alias;
> +
> +    Clock *sysclk;
> +    Clock *refclk;
> +
> +
> +} STM32F407State;
> +
> +#endif
> --
> 2.43.0
>
>

[PATCH v3 2/3] hw/arm: Add support for the STM32F407-RT-SPARk board

[fanyihao]

From: Yihao Fan <fanyihao@rt-thread.org>

This commit adds a new STM32F4spark machine broad using the STM32F407 SoC.
The implementation is derived from the Netduino Plus 2 machine.

Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
---
 MAINTAINERS                            |  7 ++++
 docs/system/arm/STM32F407-RT-SPARK.rst | 41 +++++++++++++++++++
 docs/system/arm/stm32.rst              |  1 +
 docs/system/target-arm.rst             |  1 +
 hw/arm/Kconfig                         |  6 +++
 hw/arm/meson.build                     |  1 +
 hw/arm/stm32f4spark.c                  | 56 ++++++++++++++++++++++++++
 7 files changed, 113 insertions(+)
 create mode 100644 docs/system/arm/STM32F407-RT-SPARK.rst
 create mode 100644 hw/arm/stm32f4spark.c

diff --git a/MAINTAINERS b/MAINTAINERS
index ceef177740b..4934e3733d2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1056,6 +1056,13 @@ S: Maintained
 F: hw/arm/stm32vldiscovery.c
 F: docs/system/arm/stm32.rst
 
+STM32F4SPARK
+M: yanl1229 <yanl1229@rt-thread.org>
+M: Yihao Fan <fanyihao@rt-thread.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/stm32f4spark.c
+
 Versatile Express
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
diff --git a/docs/system/arm/STM32F407-RT-SPARK.rst b/docs/system/arm/STM32F407-RT-SPARK.rst
new file mode 100644
index 00000000000..27bc8574387
--- /dev/null
+++ b/docs/system/arm/STM32F407-RT-SPARK.rst
@@ -0,0 +1,41 @@
+STM32F407-RT-SPARK (``stm32_f4spark``)
+============================================
+
+The STM32F407-RT-SPARK uses the STM32F407ZG SoC which is based on
+ARM Cortex-M4 core. TThe STM32F407 series runs at up to 168 MHz,
+integrating 196 KiB of SRAM (including 64 KiB CCM) and 1 MiB of
+on-chip Flash. The STM32F407-RT-SPARK board further features
+8 MiB NorFlash, an SD card holder, USB, RS-485, CAN bus.It also
+integrates the RW007 SPI high-speed Wi-Fi module, providing
+convenient network connectivity for IoT and RTOS development.
+
+Supported devices
+"""""""""""""""""
+
+Currently STM32F407-RT-SPARK machines support the following devices:
+
+- Cortex-M4 based STM32F407 SoC
+- stm32f4xx EXTI (Extended interrupts and events controller)
+- stm32f2xx SYSCFG (System configuration controller)
+- stm32 RCC (Reset and clock control)
+- stm32f2xx USARTs, UARTs and LPUART (Serial ports)
+
+Missing devices
+"""""""""""""""
+
+The STM32F407-RT-SPARK does *not* support the following devices:
+
+- Analog to Digital Converter (ADC)
+- SPI controller
+- Timer controller (TIMER)
+- GPIOs (General-purpose I/Os)
+
+Boot options
+""""""""""""
+
+The STM32F407-RT-SPARK machine can be started using the ``-kernel``
+option to load a firmware. Example:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M rt-spark -kernel firmware.bin
diff --git a/docs/system/arm/stm32.rst b/docs/system/arm/stm32.rst
index 511e3eb9ac1..3f085eb35ee 100644
--- a/docs/system/arm/stm32.rst
+++ b/docs/system/arm/stm32.rst
@@ -23,6 +23,7 @@ The following machines are based on this ARM Cortex-M4F chip :
 - ``netduinoplus2``     Netduino Plus 2 board with STM32F405RGT6 microcontroller
 - ``olimex-stm32-h405`` Olimex STM32 H405 board with STM32F405RGT6 microcontroller
 - ``b-l475e-iot01a``     :doc:`B-L475E-IOT01A IoT Node </system/arm/b-l475e-iot01a>` board with STM32L475VG microcontroller
+- ``STM32F407-RT-SPARK`` STM32F407-RT-SPARK board with STM32F407ZG microcontroller
 
 There are many other STM32 series that are currently not supported by QEMU.
 
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index a96d1867df1..475135d2eaa 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -82,6 +82,7 @@ Board-specific documentation
    arm/aspeed
    arm/bananapi_m2u.rst
    arm/b-l475e-iot01a.rst
+   arm/STM32F407-RT-SPARK.rst
    arm/sabrelite
    arm/highbank
    arm/digic
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index bbf675c158c..ddb2da45ae9 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -239,6 +239,12 @@ config STM32VLDISCOVERY
     depends on TCG && ARM
     select STM32F100_SOC
 
+config STM32F4SPARK
+    bool
+    default y
+    depends on TCG && ARM
+    select STM32F407_SOC
+
 config STRONGARM
     bool
     select PXA2XX_TIMER
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 1de2642620a..16f1938c29a 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -17,6 +17,7 @@ arm_common_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview.c'))
 arm_ss.add(when: 'CONFIG_SBSA_REF', if_true: files('sbsa-ref.c'))
 arm_common_ss.add(when: 'CONFIG_STELLARIS', if_true: files('stellaris.c'))
 arm_common_ss.add(when: 'CONFIG_STM32VLDISCOVERY', if_true: files('stm32vldiscovery.c'))
+arm_common_ss.add(when: 'CONFIG_STM32F4SPARK', if_true: files('stm32f4spark.c'))
 arm_common_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))
 arm_common_ss.add(when: 'CONFIG_SABRELITE', if_true: files('sabrelite.c'))
 
diff --git a/hw/arm/stm32f4spark.c b/hw/arm/stm32f4spark.c
new file mode 100644
index 00000000000..1e241f6bf1b
--- /dev/null
+++ b/hw/arm/stm32f4spark.c
@@ -0,0 +1,56 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * Copyright (c) liang yan <yanl1229@rt-thread.org>
+ * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
+ * The reference used is the STMicroElectronics RM0090 Reference manual
+ * stm32f4spark implementation is derived from netduinoplus2
+ * https://github.com/RT-Thread-Studio/sdk-bsp-stm32f407-spark
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/boards.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-clock.h"
+#include "qemu/error-report.h"
+#include "hw/arm/stm32f407_soc.h"
+#include "hw/arm/boot.h"
+
+
+/* Main SYSCLK frequency in Hz (72MHz) */
+#define SYSCLK_FRQ 72000000ULL
+
+
+static void stm32f4spark_init(MachineState *machine)
+{
+    DeviceState *dev;
+    Clock *sysclk;
+
+    /* This clock doesn't need migration because it is fixed-frequency */
+    sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(sysclk, SYSCLK_FRQ);
+
+    dev = qdev_new(TYPE_STM32F407_SOC);
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(dev));
+    qdev_connect_clock_in(dev, "sysclk", sysclk);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+
+    armv7m_load_kernel(ARM_CPU(first_cpu),
+                       machine->kernel_filename,
+                       0, FLASH_SIZE);
+}
+
+static void stm32f4spark_machine_init(MachineClass *mc)
+{
+    static const char * const valid_cpu_types[] = {
+        ARM_CPU_TYPE_NAME("cortex-m4"),
+        NULL
+    };
+
+    mc->desc = "ST RT-spark (Cortex-M4)";
+    mc->init = stm32f4spark_init;
+    mc->valid_cpu_types = valid_cpu_types;
+}
+
+DEFINE_MACHINE("rt-spark", stm32f4spark_machine_init)
-- 
2.43.0

Re: [PATCH v3 2/3] hw/arm: Add support for the STM32F407-RT-SPARk board

[Peter Maydell]

On Sun, 26 Oct 2025 at 10:53, <fanyihao@rt-thread.org> wrote:
>
> From: Yihao Fan <fanyihao@rt-thread.org>
>
> This commit adds a new STM32F4spark machine broad using the STM32F407 SoC.
> The implementation is derived from the Netduino Plus 2 machine.
>
> Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
> ---
> --- /dev/null
> +++ b/docs/system/arm/STM32F407-RT-SPARK.rst
> @@ -0,0 +1,41 @@
> +STM32F407-RT-SPARK (``stm32_f4spark``)
> +============================================

I think it would be better to document this board
as part of stm32.rst, not as its own file.

Otherwise this looks OK.

thanks
-- PMM

[PATCH v3 3/3] hw/arm/stm32f407: Add PWR device to stm32f407 SoC

[fanyihao]

From: Yihao Fan <fanyihao@rt-thread.org>

Add the Power supply configuration device to the stm32f407 SoC.

Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
---
 docs/system/arm/stm32.rst       |   1 +
 hw/arm/Kconfig                  |   1 +
 hw/arm/stm32f407_soc.c          |   9 +++
 hw/misc/Kconfig                 |   3 +
 hw/misc/meson.build             |   1 +
 hw/misc/stm32f4xx_pwr.c         | 111 ++++++++++++++++++++++++++++++++
 include/hw/arm/stm32f407_soc.h  |   3 +
 include/hw/misc/stm32f4xx_pwr.h |  40 ++++++++++++
 8 files changed, 169 insertions(+)
 create mode 100644 hw/misc/stm32f4xx_pwr.c
 create mode 100644 include/hw/misc/stm32f4xx_pwr.h

diff --git a/docs/system/arm/stm32.rst b/docs/system/arm/stm32.rst
index 3f085eb35ee..c83276f6c12 100644
--- a/docs/system/arm/stm32.rst
+++ b/docs/system/arm/stm32.rst
@@ -38,6 +38,7 @@ Supported devices
  * System configuration (SYSCFG)
  * Timer controller (TIMER)
  * Reset and Clock Controller (RCC) (STM32F4 only, reset and enable only)
+ * Power supply configuration (PWR) (STM32F4 only)
 
 Missing devices
 ---------------
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index ddb2da45ae9..2c07220eb0b 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -417,6 +417,7 @@ config STM32F407_SOC
     select ARM_V7M
     select STM32F4XX_SYSCFG
     select STM32F4XX_EXTI
+    select STM32F4XX_PWR
 
 config B_L475E_IOT01A
     bool
diff --git a/hw/arm/stm32f407_soc.c b/hw/arm/stm32f407_soc.c
index 8e20ddcd5b1..1512d922e5e 100644
--- a/hw/arm/stm32f407_soc.c
+++ b/hw/arm/stm32f407_soc.c
@@ -51,6 +51,7 @@ static void stm32f407_soc_initfn(Object *obj)
     object_initialize_child(obj, "syscfg", &s->syscfg, TYPE_STM32F4XX_SYSCFG);
     object_initialize_child(obj, "exti", &s->exti, TYPE_STM32F4XX_EXTI);
     object_initialize_child(obj, "rcc", &s->rcc, TYPE_STM32_RCC);
+    object_initialize_child(obj, "pwr", &s->pwr, TYPE_STM32F4XX_PWR);
 
     for (i = 0; i < STM_NUM_USARTS; i++) {
         object_initialize_child(obj, "usart[*]", &s->usart[i],
@@ -183,6 +184,14 @@ static void stm32f407_soc_realize(DeviceState *dev_soc, Error **errp)
         sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, timer_irq[i]));
     }
 
+    /* PWR controller */
+    dev = DEVICE(&s->pwr);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->pwr), errp)) {
+        return;
+    }
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, PWR_BASE_ADDR);
+
 }
 
 static void stm32f407_soc_class_init(ObjectClass *klass, void *data)
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 4e35657468b..ff4dc58b4d3 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -108,6 +108,9 @@ config STM32F4XX_SYSCFG
 config STM32F4XX_EXTI
     bool
 
+config STM32F4XX_PWR
+    bool
+
 config STM32L4X5_EXTI
     bool
 
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index b1d8d8e5d2a..0e0f5c3a275 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -112,6 +112,7 @@ system_ss.add(when: 'CONFIG_STM32_RCC', if_true: files('stm32_rcc.c'))
 system_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
 system_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
 system_ss.add(when: 'CONFIG_STM32F4XX_EXTI', if_true: files('stm32f4xx_exti.c'))
+system_ss.add(when: 'CONFIG_STM32F4XX_PWR', if_true: files('stm32f4xx_pwr.c'))
 system_ss.add(when: 'CONFIG_STM32L4X5_EXTI', if_true: files('stm32l4x5_exti.c'))
 system_ss.add(when: 'CONFIG_STM32L4X5_SYSCFG', if_true: files('stm32l4x5_syscfg.c'))
 system_ss.add(when: 'CONFIG_STM32L4X5_RCC', if_true: files('stm32l4x5_rcc.c'))
diff --git a/hw/misc/stm32f4xx_pwr.c b/hw/misc/stm32f4xx_pwr.c
new file mode 100644
index 00000000000..83ce0e6a0a9
--- /dev/null
+++ b/hw/misc/stm32f4xx_pwr.c
@@ -0,0 +1,111 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * Copyright (c) liang yan <yanl1229@rt-thread.org>
+ * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
+ * The reference used is the STMicroElectronics RM0090 Reference manual
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "hw/misc/stm32f4xx_pwr.h"
+#include "hw/irq.h"
+#include "hw/qdev-properties.h"
+#include "qemu/module.h"
+#include "migration/vmstate.h"
+#include "qemu/module.h"
+
+#ifndef STM32F4XX_PWR_DEBUG
+#define STM32F4XX_PWR_DEBUG 0
+#endif
+
+#define DB_PRINT_L(lvl, fmt, args...) do { \
+    if (STM32F4XX_PWR_DEBUG >= lvl) { \
+        qemu_log("%s: " fmt, __func__, ## args); \
+    } \
+} while (0);
+
+#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)
+
+static uint64_t stm32f4xx_pwr_read(void *opaque, hwaddr offset, unsigned size)
+{
+    STM32F4XXPwrState *s = opaque;
+
+    switch (offset) {
+    case PWR_CR:
+        return s->pwr_cr;
+    case PWR_CSR:
+        return s->pwr_csr;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "STM32F4XX PWR: Bad read offset 0x%lx\n", offset);
+        return 0;
+    }
+}
+
+static void stm32f4xx_pwr_write(void *opaque, hwaddr offset, uint64_t value, unsigned size)
+{
+    STM32F4XXPwrState *s = opaque;
+
+    switch (offset) {
+    case PWR_CR:
+        s->pwr_cr = value;
+        if (value & PWR_CR_ODEN)
+            s->pwr_csr |= PWR_CSR_ODRDY;
+        if (value & PWR_CR_ODSWEN)
+            s->pwr_csr |= PWR_CSR_ODSWRDY;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "STM32F4XX PWR: Bad write offset 0x%lx\n", offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps stm32f4xx_pwr_ops = {
+    .read = stm32f4xx_pwr_read,
+    .write = stm32f4xx_pwr_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void stm32f4xx_pwr_init(Object *obj)
+{
+    STM32F4XXPwrState *s = STM32F4XX_PWR(obj);
+
+    memory_region_init_io(&s->mmio, obj, &stm32f4xx_pwr_ops, s, TYPE_STM32F4XX_PWR, 0x400);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+}
+
+static void stm32f4xx_pwr_reset(DeviceState *dev)
+{
+    STM32F4XXPwrState *s = STM32F4XX_PWR(dev);
+
+    s->pwr_cr  = 0x0000;
+    s->pwr_csr = 0x0000;
+}
+
+static void stm32f4xx_pwr_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    device_class_set_legacy_reset(dc, stm32f4xx_pwr_reset);
+}
+
+static const TypeInfo stm32f4xx_pwr_info = {
+    .name          = TYPE_STM32F4XX_PWR,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(STM32F4XXPwrState),
+    .instance_init = stm32f4xx_pwr_init,
+    .class_init    = stm32f4xx_pwr_class_init,
+};
+
+static void stm32f4xx_pwr_register_types(void)
+{
+    type_register_static(&stm32f4xx_pwr_info);
+}
+
+type_init(stm32f4xx_pwr_register_types)
diff --git a/include/hw/arm/stm32f407_soc.h b/include/hw/arm/stm32f407_soc.h
index 3497e91aa1c..f7e39ffaceb 100644
--- a/include/hw/arm/stm32f407_soc.h
+++ b/include/hw/arm/stm32f407_soc.h
@@ -17,6 +17,7 @@
 #include "hw/char/stm32f2xx_usart.h"
 #include "hw/timer/stm32f2xx_timer.h"
 #include "hw/misc/stm32_rcc.h"
+#include "hw/misc/stm32f4xx_pwr.h"
 #include "qom/object.h"
 
 #define TYPE_STM32F407_SOC "stm32f407-soc"
@@ -39,6 +40,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(STM32F407State, STM32F407_SOC)
 #define SYSCFG_BASE_ADDRESS 0x40013800
 #define SYSCFG_IRQ  71
 #define EXIT_BASE_ADDRESS 0x40013C00
+#define PWR_BASE_ADDR       0x40007000
 
 #define FLASH_BASE_ADDRESS  0x8000000
 #define FLASH_SIZE          0x100000
@@ -57,6 +59,7 @@ typedef struct STM32F407State {
     STM32RccState rcc;
     STM32F4xxSyscfgState syscfg;
     STM32F4xxExtiState exti;
+    STM32F4XXPwrState pwr;
     STM32F2XXUsartState usart[STM_NUM_USARTS];
     STM32F2XXTimerState timer[STM_NUM_TIMERS];
 
diff --git a/include/hw/misc/stm32f4xx_pwr.h b/include/hw/misc/stm32f4xx_pwr.h
new file mode 100644
index 00000000000..889fbc26ab0
--- /dev/null
+++ b/include/hw/misc/stm32f4xx_pwr.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * Copyright (c) liang yan <yanl1229@rt-thread.org>
+ * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
+ * The reference used is the STMicroElectronics RM0090 Reference manual
+ * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
+ */
+
+#ifndef STM32F4XX_PWR_H
+#define STM32F4XX_PWR_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define PWR_CR      0x00
+#define PWR_CSR     0x04
+
+#define PWR_CR_DBP      (1 << 8)
+#define PWR_CR_ODEN     (1 << 16)
+#define PWR_CR_ODSWEN   (1 << 17)
+
+#define PWR_CSR_ODRDY   (1 << 16)
+#define PWR_CSR_ODSWRDY (1 << 17)
+
+#define TYPE_STM32F4XX_PWR "stm32f4xx-pwr"
+OBJECT_DECLARE_SIMPLE_TYPE(STM32F4XXPwrState, STM32F4XX_PWR)
+
+struct STM32F4XXPwrState {
+    /* <private> */
+    SysBusDevice parent_obj;
+
+    /* <public> */
+    MemoryRegion mmio;
+
+    uint32_t pwr_cr;
+    uint32_t pwr_csr;
+};
+
+#endif
-- 
2.43.0

Re: [PATCH v3 3/3] hw/arm/stm32f407: Add PWR device to stm32f407 SoC

[Peter Maydell]

On Sun, 26 Oct 2025 at 10:53, <fanyihao@rt-thread.org> wrote:
>
> From: Yihao Fan <fanyihao@rt-thread.org>
>
> Add the Power supply configuration device to the stm32f407 SoC.
>
> Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>

Please put "implement new device" and "add new
device to SoC model" in separate patches.

> --- /dev/null
> +++ b/hw/misc/stm32f4xx_pwr.c
> @@ -0,0 +1,111 @@
> +/* SPDX-License-Identifier: GPL-2.0-or-later */
> +
> +/*
> + * Copyright (c) liang yan <yanl1229@rt-thread.org>
> + * Copyright (c) Yihao Fan <fanyihao@rt-thread.org>
> + * The reference used is the STMicroElectronics RM0090 Reference manual
> + * https://www.st.com/en/microcontrollers-microprocessors/stm32f407-417/documentation.html
> + */
> +
> +#include "qemu/osdep.h"
> +#include "qapi/error.h"
> +#include "qemu/log.h"
> +#include "hw/misc/stm32f4xx_pwr.h"
> +#include "hw/irq.h"
> +#include "hw/qdev-properties.h"
> +#include "qemu/module.h"
> +#include "migration/vmstate.h"
> +#include "qemu/module.h"
> +
> +#ifndef STM32F4XX_PWR_DEBUG
> +#define STM32F4XX_PWR_DEBUG 0
> +#endif
> +
> +#define DB_PRINT_L(lvl, fmt, args...) do { \
> +    if (STM32F4XX_PWR_DEBUG >= lvl) { \
> +        qemu_log("%s: " fmt, __func__, ## args); \
> +    } \
> +} while (0);
> +
> +#define DB_PRINT(fmt, args...) DB_PRINT_L(1, fmt, ## args)

No debug print macros in new code, please. Use tracepoints
or qemu_log* calls as appropriate.

> +
> +static uint64_t stm32f4xx_pwr_read(void *opaque, hwaddr offset, unsigned size)
> +{
> +    STM32F4XXPwrState *s = opaque;
> +
> +    switch (offset) {
> +    case PWR_CR:
> +        return s->pwr_cr;
> +    case PWR_CSR:
> +        return s->pwr_csr;
> +    default:
> +        qemu_log_mask(LOG_GUEST_ERROR, "STM32F4XX PWR: Bad read offset 0x%lx\n", offset);
> +        return 0;
> +    }
> +}
> +
> +static void stm32f4xx_pwr_write(void *opaque, hwaddr offset, uint64_t value, unsigned size)
> +{
> +    STM32F4XXPwrState *s = opaque;
> +
> +    switch (offset) {
> +    case PWR_CR:
> +        s->pwr_cr = value;
> +        if (value & PWR_CR_ODEN)
> +            s->pwr_csr |= PWR_CSR_ODRDY;

QEMU coding style requires braces on all if() bodies,
even one-line ones.

> +        if (value & PWR_CR_ODSWEN)
> +            s->pwr_csr |= PWR_CSR_ODSWRDY;

The reference manual says that the ODEN and ODSWEN
bits in PWRCR are only there for STM32F42xxx and
STM32F43xxx. I thought this model was for the STM32F407xx ?

> +        break;
> +    default:
> +        qemu_log_mask(LOG_GUEST_ERROR, "STM32F4XX PWR: Bad write offset 0x%lx\n", offset);
> +        break;
> +    }
> +}
> +
> +static const MemoryRegionOps stm32f4xx_pwr_ops = {
> +    .read = stm32f4xx_pwr_read,
> +    .write = stm32f4xx_pwr_write,
> +    .endianness = DEVICE_NATIVE_ENDIAN,
> +    .valid = {
> +        .min_access_size = 4,
> +        .max_access_size = 4,
> +    },
> +};
> +
> +static void stm32f4xx_pwr_init(Object *obj)
> +{
> +    STM32F4XXPwrState *s = STM32F4XX_PWR(obj);
> +
> +    memory_region_init_io(&s->mmio, obj, &stm32f4xx_pwr_ops, s, TYPE_STM32F4XX_PWR, 0x400);
> +    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
> +}
> +
> +static void stm32f4xx_pwr_reset(DeviceState *dev)
> +{
> +    STM32F4XXPwrState *s = STM32F4XX_PWR(dev);
> +
> +    s->pwr_cr  = 0x0000;
> +    s->pwr_csr = 0x0000;

Just "0" will do.

The reference manual says the reset value for
PWR_CR.VOS is 1.

> +}
> +
> +static void stm32f4xx_pwr_class_init(ObjectClass *klass, void *data)
> +{
> +    DeviceClass *dc = DEVICE_CLASS(klass);
> +
> +    device_class_set_legacy_reset(dc, stm32f4xx_pwr_reset);

This is missing a VMStateInfo for migration support.

> +}
> +
> +static const TypeInfo stm32f4xx_pwr_info = {
> +    .name          = TYPE_STM32F4XX_PWR,
> +    .parent        = TYPE_SYS_BUS_DEVICE,
> +    .instance_size = sizeof(STM32F4XXPwrState),
> +    .instance_init = stm32f4xx_pwr_init,
> +    .class_init    = stm32f4xx_pwr_class_init,
> +};
> +
> +static void stm32f4xx_pwr_register_types(void)
> +{
> +    type_register_static(&stm32f4xx_pwr_info);
> +}

thanks
-- PMM

Re: [PATCH v3 0/3] hw/arm Add STM32F4 support and PWR device model

[Peter Maydell]

On Sun, 26 Oct 2025 at 10:53, <fanyihao@rt-thread.org> wrote:
>
> From: Yihao Fan <fanyihao@rt-thread.org>
>
> This patch series introduces basic support for the STM32F407 SoC and
> a new STM32F4spark machine in QEMU, along with a PWR device model.
>
> In addition, I have modified the header file referenced by the RCC
> driver to STM32RCC in accordance with the suggestions.
>
> This series includes:
> - A new SoC model (STM32F407) with initial integration.
> - A board model called STM32F4spark to instantiate and test the SoC.
> - A PWR device implementation for STM32F4xx family.
>
> Signed-off-by: Yihao Fan <fanyihao@rt-thread.org>
> ---
>
> Yihao Fan (3):
>   hw/arm: Add support for the STM32F407 SoC
>   hw/arm: Add support for the STM32F407-RT-SPARk board
>   hw/arm/stm32f407: Add PWR device to stm32f407 SoC
>
>  MAINTAINERS                            |  14 ++
>  docs/system/arm/STM32F407-RT-SPARK.rst |  41 +++++
>  docs/system/arm/stm32.rst              |   2 +
>  docs/system/target-arm.rst             |   1 +
>  hw/arm/Kconfig                         |  13 ++
>  hw/arm/meson.build                     |   2 +
>  hw/arm/stm32f407_soc.c                 | 217 +++++++++++++++++++++++++
>  hw/arm/stm32f4spark.c                  |  56 +++++++
>  hw/misc/Kconfig                        |   3 +
>  hw/misc/meson.build                    |   1 +
>  hw/misc/stm32f4xx_pwr.c                | 111 +++++++++++++
>  include/hw/arm/stm32f407_soc.h         |  77 +++++++++
>  include/hw/misc/stm32f4xx_pwr.h        |  40 +++++
>  13 files changed, 578 insertions(+)
>  create mode 100644 docs/system/arm/STM32F407-RT-SPARK.rst
>  create mode 100644 hw/arm/stm32f407_soc.c
>  create mode 100644 hw/arm/stm32f4spark.c
>  create mode 100644 hw/misc/stm32f4xx_pwr.c
>  create mode 100644 include/hw/arm/stm32f407_soc.h
>  create mode 100644 include/hw/misc/stm32f4xx_pwr.h

Thanks for sending this; I have some review comments,
but they're mostly fairly minor.

Please can you include a functional test under
tests/functional/arm/ which runs the new board model
with some kind of guest image to check that it can
successfully run code ?

thanks
-- PMM