processmission · zevorn · Jul 18, 2026 · Jul 18, 2026 · Jul 18, 2026 · Jul 18, 2026
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -217,25 +217,6 @@ jobs:
       - shell: freebsd {0}
         run: cd /home/qemu && ./build/qemu-system-x86_64 -nographic -plugin ./build/contrib/plugins/libstoptrigger,icount=1000000 -plugin ./build/tests/tcg/plugins/libinsn -plugin ./build/contrib/plugins/libcpp -d plugin
 
-  build-netbsd:
-    needs: checkapply
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@v6
-      - uses: vmactions/netbsd-vm@v1
-        with:
-          copyback: false
-          release: "10.1"
-      - run: rsync -av ./ netbsd:/home/qemu/
-      - shell: netbsd {0}
-        run: set -ex && pkg_add pkgin && pkgin -y install git gmake python314 pkgconf pixman bison flex glib ninja-build && ln -s /usr/pkg/bin/python3.14 /usr/bin/python3
-      - shell: netbsd {0}
-        run: cd /home/qemu && ./configure ${{ env.QEMU_WERROR }} && ninja -C build
-      # for some reason meson can't find c++ compiler, so no cpp plugin
-      # split-wx=on: https://gitlab.com/qemu-project/qemu/-/issues/2685
-      - shell: netbsd {0}
-        run: cd /home/qemu && ./build/qemu-system-x86_64 -accel tcg,split-wx=on -nographic -plugin ./build/contrib/plugins/libstoptrigger,icount=1000000 -plugin ./build/tests/tcg/plugins/libinsn -d plugin
-
   build-openbsd:
     needs: checkapply
     runs-on: ubuntu-24.04
@@ -355,21 +336,6 @@ jobs:
           docker.io/pboqemu/qemu-ci:debian-${{matrix.arch}}-cross
           bash -cx './configure ${{ env.QEMU_WERROR }} --disable-tcg $QEMU_CONFIGURE_OPTS && ninja -C build install'
 
-  build-xen-only:
-    needs: checkapply
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [arm64, amd64]
-    runs-on: ubuntu-24.04
-    steps:
-      - run: sudo rm -rf /opt/ /usr/local/.ghcup /usr/local/lib/android
-      - uses: actions/checkout@v6
-      - run: >
-          podman run --pull newer --init --rm -it -v $(pwd):$(pwd) -w $(pwd)
-          docker.io/pboqemu/qemu-ci:debian-${{matrix.arch}}-cross
-          bash -cx './configure ${{ env.QEMU_WERROR }} --disable-tcg --disable-kvm $QEMU_CONFIGURE_OPTS && ninja -C build install'
-
   build-minimal:
     needs: checkapply
     runs-on: ubuntu-24.04

diff --git a/MAINTAINERS b/MAINTAINERS
@@ -1028,6 +1028,21 @@ F: roms/vbootrom
 F: docs/system/arm/nuvoton.rst
 F: tests/functional/arm/test_quanta_gsj.py
 
+Rockchip RK3588 boards
+M: Chao Liu <[email protected]>
+L: [email protected]
+S: Maintained
+F: configs/devices/aarch64-softmmu/rk3588*.mak
+F: configs/devices/aarch64-softmmu/rock-5b-plus.mak
+F: docs/system/arm/rk3588.rst
+F: hw/arm/rk3588*
+F: hw/arm/rock5b_plus.c
+F: hw/*/rk3588*
+F: include/hw/*/rk3588*
+F: tests/functional/aarch64/test_rock5b_plus.py
+F: tests/qtest/rk3588*
+F: tests/qtest/rock5b-plus-test.c
+
 Raspberry Pi
 M: Peter Maydell <[email protected]>
 R: Philippe Mathieu-Daudé <[email protected]>

diff --git a/README.md b/README.md
@@ -15,11 +15,12 @@ for new machine requests or bug reports.
 | RISC-V | [`k3-pico-itx`](docs/system/riscv/spacemit-k3.rst) | ✅ | ✅ | PM |
 | RISC-V | [`milkv-duo`](docs/system/riscv/milkv-duo.rst) | ✅ | ✅ | UP |
 | RISC-V | [`riscv-server-ref`](docs/system/riscv/riscv-server-ref.rst) | ✅ | ✅ | UP |
-| ARM | [`ax650x-pyramid`](docs/system/arm/ax650x-pyramid.rst) | ✅ | ❌ | PM |
+| ARM | [`ax650x-pyramid`](docs/system/arm/ax650x-pyramid.rst) | ✅ | - | PM |
 | ARM | [`phytium-pi`](docs/system/arm/phytium-pi.rst) | ✅ | ✅ | PM |
 | ARM | [`rk3588-evb`](docs/system/arm/rk3588.rst) | ✅ | ✅ | PM |
 | ARM | [`rk3588s-roc-pc`](docs/system/arm/rk3588.rst) | ✅ | ✅ | PM |
-| ARM | [`s32k566-cvb-r52`](docs/system/arm/s32k5.rst) | ✅ | ❌ | PM |
+| ARM | [`rock-5b-plus`](docs/system/arm/rk3588.rst) | ✅ | ✅ | PM |
+| ARM | [`s32k566-cvb-r52`](docs/system/arm/s32k5.rst) | ✅ | - | PM |
 
 Source legend:
 

diff --git a/configs/devices/aarch64-softmmu/rk3588-evb.mak b/configs/devices/aarch64-softmmu/rk3588-evb.mak
@@ -0,0 +1 @@
+CONFIG_RK3588_EVB=y
diff --git a/configs/devices/aarch64-softmmu/rk3588s-roc-pc.mak b/configs/devices/aarch64-softmmu/rk3588s-roc-pc.mak
@@ -0,0 +1 @@
+CONFIG_RK3588S_ROC_PC=y
diff --git a/configs/devices/aarch64-softmmu/rock-5b-plus.mak b/configs/devices/aarch64-softmmu/rock-5b-plus.mak
@@ -0,0 +1 @@
+CONFIG_ROCK_5B_PLUS=y
diff --git a/docs/system/arm/rk3588.rst b/docs/system/arm/rk3588.rst
@@ -10,7 +10,9 @@ boot path and a downstream firmware path that runs the Rockchip TPL/SPL image,
 validates the U-Boot FIT loadables, hands off to U-Boot proper, and lets
 U-Boot boot Linux or ZVM test images from modeled MMC media.
 
-Two board machines are available:
+Three board machines are available.  Each board has its own machine source
+file and build-time Kconfig entry; the common ``rk3588`` type is abstract and
+contains only shared SoC construction and boot orchestration:
 
 ``rk3588-evb``
   Rockchip RK3588 EVB-style board.  Firmware boot reads the Rockchip RKNS
@@ -25,6 +27,12 @@ Two board machines are available:
   ``mmc dev 1`` boot script.  This machine maps the fixed ZVM guest/shared RAM
   windows by default, corresponding to the real board's larger DRAM layout.
 
+``rock-5b-plus``
+  Radxa ROCK 5B+ with LPDDR5, the two board PCIe hosts, and the firmware
+  compatibility profile needed by Radxa's RK3588 SDK image.  Firmware boot
+  reads the raw Radxa image from ``if=sd,index=0`` and exposes it through the
+  non-removable eMMC controller.
+
 Supported devices
 -----------------
 
@@ -39,8 +47,10 @@ RK3588 kernel and ZVM smoke tests:
 * UART2 through QEMU's ``serial_mm`` 16550-compatible model, plus a vendor
   register cover for the DesignWare APB UART window.
 * Rockchip GPIO banks.
-* Rockchip RAM-backed syscon blocks for GRF, IOC and firewall-style register
-  banks.
+* Dedicated RK3588 PMU0/PMU1/SYS GRF banks, plus reusable Rockchip RAM-backed
+  syscon blocks for IOC and firewall-style register banks.
+* Dedicated RK3588 DDR controller/PHY windows and the BL31 DDR runtime
+  descriptor used by the vendor firmware.
 * Rockchip secure timer stub.
 * RK3588 CRU and SCMI-over-SMC clock/reset support.
 * SDHCI eMMC and Synopsys DesignWare MMC for the SD-card controller.
@@ -75,13 +85,15 @@ than as RK3588-only devices:
   Address mapping, compatible strings, MSI routing, and interrupt numbers stay
   in the RK3588 board code.
 
-The RK3588 CRU model, BootROM handoff, ATF DDR runtime descriptor, firmware
-MMIO catch-all, firmware USB2 host windows, PSCI/GIC handoff state for the
-firmware path, SPL-to-U-Boot handoff shim, and closed-BL31 runtime fallback
-patch logic are RK3588 machine code because their addresses and firmware
-assumptions are SoC- and image-specific.  The USB2 windows are not a complete
-reusable Rockchip USB host model; they only provide the reset-visible EHCI/OHCI
-state U-Boot needs while scanning boot devices.
+All MMIO register behavior is implemented outside the machine sources.  The
+RK3588 CRU, GRF, DDR, ATF DDR runtime descriptor, firmware compatibility MMIO,
+SCMI, secure OTP, and firmware USB2 host windows live in independently built
+devices under the corresponding ``hw/*`` subsystem directories.  The common
+machine source only maps and wires those devices and implements SoC boot-flow
+orchestration such as BootROM loading, PSCI/GIC handoff, and the
+SPL/BL31-to-U-Boot compatibility path.  The USB2 device is intentionally a
+firmware-oriented register model; it supplies the reset-visible EHCI/OHCI state
+U-Boot needs while scanning boot devices.
 
 Direct Linux Boot
 -----------------
@@ -129,6 +141,21 @@ The ROC PC machine supports the same direct Linux boot path:
        -serial mon:stdio \
        -display none
 
+ROCK 5B+ supports the same path with a Radxa SDK kernel.  For example:
+
+.. code-block:: bash
+
+   $ build/qemu-system-aarch64 \
+       -accel tcg \
+       -machine rock-5b-plus \
+       -smp 8 \
+       -m 1G \
+       -kernel Image \
+       -initrd initramfs.cpio.gz \
+       -append "console=ttyS2,1500000n8 earlycon=uart8250,mmio32,0xfeb50000,1500000n8 keep_bootcon rdinit=/init" \
+       -serial mon:stdio \
+       -display none
+
 Firmware U-Boot Boot
 --------------------
 
@@ -165,6 +192,30 @@ bootflow probing can continue without taking a synchronous abort on unmapped
 firmware MMIO.  It is intended for downstream firmware bring-up coverage, not
 as a complete replacement for a real RK3588 PMU/secure firmware environment.
 
+Radxa ROCK 5B+ Firmware Image
+-----------------------------
+
+The ``rock-5b-plus`` firmware profile also accepts a complete raw image made by
+the Radxa RK3588 SDK.  No extraction or repackaging is required:
+
+.. code-block:: bash
+
+   $ build/qemu-system-aarch64 \
+       -accel tcg \
+       -machine rock-5b-plus \
+       -smp 1 \
+       -m 2G \
+       -drive if=sd,index=0,file=rock-5b-plus_bookworm_kde_b2.output.img,format=raw \
+       -snapshot \
+       -serial mon:stdio \
+       -display none
+
+This path runs the image's DDR/TPL and SPL code, verifies all FIT loadables,
+uses the FIT metadata to select the U-Boot load address dynamically, enters
+U-Boot proper, and continues through its ``extlinux`` boot flow.  With the
+Radxa Bookworm image, U-Boot loads the SDK kernel, initramfs, and
+``rk3588-rock-5b-plus.dtb`` before printing ``Starting kernel ...``.
+
 U-Boot to Linux Boot
 --------------------
 

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
@@ -206,17 +206,19 @@ config SBSA_REF
     select IDE_BUS
     select IDE_DEV
 
-config RK3588_EVB
+config RK3588
     bool
-    default y
-    depends on TCG && AARCH64
     select ARM_GIC
+    select ARM_GICV5 if TCG
     select DEVICE_TREE
-    select DWMAC4
     select DW_MMC
     select DW_APB_UART_VENDOR
     select PCI_EXPRESS_DESIGNWARE
+    select RK3588_ATF_DDR
     select RK3588_CRU
+    select RK3588_DDR
+    select RK3588_FIRMWARE_MMIO
+    select RK3588_GRF
     select ROCKCHIP_DWCMSHC
     select ROCKCHIP_PCIE
     select ROCKCHIP_STIMER
@@ -225,7 +227,29 @@ config RK3588_EVB
     select ROCKCHIP_GPIO
     select SDHCI
     select SERIAL_MM
-    select UNIMP
+    select RK3588_USB2_HOST
+
+config RK3588_EVB
+    bool
+    default y
+    depends on TCG && AARCH64
+    select RK3588
+    select DWMAC4
+
+config RK3588S_ROC_PC
+    bool
+    default y
+    depends on TCG && AARCH64
+    select RK3588
+    select DWMAC4
+
+config ROCK_5B_PLUS
+    bool
+    default y
+    depends on TCG && AARCH64
+    select RK3588
+    select RK3588_SECURE_OTP
+    select ROCKCHIP_CRYPTO_V2
 
 config S32K5
     bool

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
@@ -15,7 +15,10 @@ arm_common_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx.c', 'npcm7xx_b
 arm_common_ss.add(when: 'CONFIG_NPCM8XX', if_true: files('npcm8xx.c', 'npcm8xx_boards.c'))
 arm_common_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview.c'))
 arm_common_ss.add(when: 'CONFIG_SBSA_REF', if_true: files('sbsa-ref.c'))
-arm_common_ss.add(when: 'CONFIG_RK3588_EVB', if_true: files('rk3588.c'))
+arm_common_ss.add(when: 'CONFIG_RK3588', if_true: files('rk3588.c'))
+arm_common_ss.add(when: 'CONFIG_RK3588_EVB', if_true: files('rk3588_evb.c'))
+arm_common_ss.add(when: 'CONFIG_RK3588S_ROC_PC', if_true: files('rk3588s_roc_pc.c'))
+arm_common_ss.add(when: 'CONFIG_ROCK_5B_PLUS', if_true: files('rock5b_plus.c'))
 arm_common_ss.add(when: 'CONFIG_PHYTIUMPI', if_true: files('phytium-pi.c'))
 arm_common_ss.add(when: 'CONFIG_STELLARIS', if_true: files('stellaris.c'))
 arm_common_ss.add(when: 'CONFIG_STM32VLDISCOVERY', if_true: files('stm32vldiscovery.c'))

diff --git a/hw/arm/rk3588-internal.h b/hw/arm/rk3588-internal.h
@@ -0,0 +1,57 @@
+/*
+ * Rockchip RK3588 machine extension interface
+ *
+ * Copyright (c) 2026 Chao Liu
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_ARM_RK3588_INTERNAL_H
+#define HW_ARM_RK3588_INTERNAL_H
+
+#include "hw/arm/machines-qom.h"
+#include "qom/object.h"
+
+#define TYPE_RK3588_MACHINE MACHINE_TYPE_NAME("rk3588")
+
+#define RK3588_BROM_BOOTSOURCE_EMMC 2
+#define RK3588_BROM_BOOTSOURCE_SD 5
+
+#define RK3588_DRAM_TYPE_LPDDR4X 8
+#define RK3588_DRAM_TYPE_LPDDR5 9
+
+typedef struct RK3588FirmwareProfile {
+    bool unfused_secure_otp;
+    bool crypto_v2_sha256;
+    bool dynamic_fit_handoff;
+    bool atags_core;
+    uint64_t fit_offset;
+    uint32_t fit_alignment;
+} RK3588FirmwareProfile;
+
+typedef struct RK3588BoardConfig {
+    const char *machine_name;
+    const char *desc;
+    const char *ram_id;
+    const char *fdt_model;
+    const char * const *fdt_compatible;
+    size_t fdt_compatible_count;
+    unsigned int firmware_sd_unit;
+    uint32_t brom_bootsource;
+    uint32_t dram_type;
+    uint32_t gmac_mask;
+    unsigned int pcie3x4_num_lanes;
+    unsigned int pcie3x2_num_lanes;
+    bool pcie3x4_link_down;
+    bool pcie3x2_link_down;
+    bool swap_gmac_aliases;
+    bool default_zvm_ram;
+    const RK3588FirmwareProfile *firmware_profile;
+} RK3588BoardConfig;
+
+void rk3588_machine_instance_configure(Object *obj,
+                                       const RK3588BoardConfig *board);
+void rk3588_machine_class_configure(ObjectClass *oc,
+                                    const RK3588BoardConfig *board);
+
+#endif