The SSE-300 CPU0_PPU, MGMT_PPU, DEBUG_PPU had the wrong addresses
that were the same as the SSE-200 addresses.
Page 146 of the SSE-300 TRM defines the addresses of the PPUs.

SSE-300 TRM: https://support.arm.com/documentation/101773/latest/

Fixes: 8901bb414a24 ("hw/arm/armsse: Add SSE-300 support")
Signed-off-by: Simon Xu <simonxhy0404@gmail.com>
---
 hw/arm/armsse.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index e99b491bd9..55fbc2c290 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -452,7 +452,7 @@ static const ARMSSEDeviceInfo sse300_devices[] = {
         .name = "CPU0CORE_PPU",
         .type = TYPE_UNIMPLEMENTED_DEVICE,
         .index = 2,
-        .addr = 0x50023000,
+        .addr = 0x58023000,
         .size = 0x1000,
         .ppc = NO_PPC,
         .irq = NO_IRQ,
@@ -461,7 +461,7 @@ static const ARMSSEDeviceInfo sse300_devices[] = {
         .name = "MGMT_PPU",
         .type = TYPE_UNIMPLEMENTED_DEVICE,
         .index = 3,
-        .addr = 0x50028000,
+        .addr = 0x58028000,
         .size = 0x1000,
         .ppc = NO_PPC,
         .irq = NO_IRQ,
@@ -470,7 +470,7 @@ static const ARMSSEDeviceInfo sse300_devices[] = {
         .name = "DEBUG_PPU",
         .type = TYPE_UNIMPLEMENTED_DEVICE,
         .index = 4,
-        .addr = 0x50029000,
+        .addr = 0x58029000,
         .size = 0x1000,
         .ppc = NO_PPC,
         .irq = NO_IRQ,
-- 
2.53.0

On Wed, 5 Aug 2026 at 20:13, Simon Xu <simonxhy0404@gmail.com> wrote:
>
> The SSE-300 CPU0_PPU, MGMT_PPU, DEBUG_PPU had the wrong addresses
> that were the same as the SSE-200 addresses.
> Page 146 of the SSE-300 TRM defines the addresses of the PPUs.
>
> SSE-300 TRM: https://support.arm.com/documentation/101773/latest/
>
> Fixes: 8901bb414a24 ("hw/arm/armsse: Add SSE-300 support")
> Signed-off-by: Simon Xu <simonxhy0404@gmail.com>

I got the SYS_PPU address right, at least :-)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

thanks
-- PMM