On Thu, Sep 03, 2026 at 01:35:50PM -0600, Mathieu Poirier wrote:
> From: Jean-Philippe Brucker <[email protected]>
>
> Add a new RmeGuest object, inheriting from ConfidentialGuestSupport, to
> support the Arm Realm Management Extension (RME). It is instantiated by
> passing on the command-line:
>
> -M virt,confidential-guest-support=<id>
> -object rme-guest,id=<id>
>
> This is only the skeleton. Support will be added in following patches.
>
> Signed-off-by: Jean-Philippe Brucker <[email protected]>
> Signed-off-by: Mathieu Poirier <[email protected]>
> ---
> docs/system/confidential-guest-support.rst | 1 +
> qapi/qom.json | 13 +++++++
> target/arm/kvm-rme.c | 42 ++++++++++++++++++++++
> target/arm/meson.build | 5 ++-
> 4 files changed, 60 insertions(+), 1 deletion(-)
> create mode 100644 target/arm/kvm-rme.c
>
> diff --git a/docs/system/confidential-guest-support.rst
> b/docs/system/confidential-guest-support.rst
> index 562a7c3c2852..abb56923ad13 100644
> --- a/docs/system/confidential-guest-support.rst
> +++ b/docs/system/confidential-guest-support.rst
> @@ -42,5 +42,6 @@ Currently supported confidential guest mechanisms are:
> * POWER Protected Execution Facility (PEF) (see
> :ref:`power-papr-protected-execution-facility-pef`)
> * s390x Protected Virtualization (PV) (see :doc:`s390x/protvirt`)
> * AWS Nitro Enclaves (see :doc:`nitro`)
> +* Arm Realm Management Extension (RME)
>
> Other mechanisms may be supported in future.
> diff --git a/qapi/qom.json b/qapi/qom.json
> index 776b13027fd8..52997c29a32d 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -1288,6 +1288,17 @@
> 'data': { '*pretty': 'bool',
> '*close-action': 'MonitorQMPCloseAction' } }
>
> +##
> +# @RmeGuestProperties:
> +#
> +# Properties for rme-guest objects.
> +#
> +# Since: 11.1
> +##
> +{ 'struct': 'RmeGuestProperties',
> + 'base': 'ConfidentialGuestSupportProperties',
Just FYI, based on input from Markus I'm planning to drop this
ConfidentialGuestSupportProperties base type from my series
since it's probably only SNP/TDX that need to be able to switch
it on/off, whereas this series appears to use/require it from
the start.
I'm not exactly sure what it will look like for v3 yet, but if you
were based on v2 you'd instead probably just do the following in the
instance_init function for your rme-guest instance:
cgs->allow_convert_in_place = true;
cgs->convert_in_place = true;
rather than exposing it as a cmdline option.
Thanks,
Mike
> + 'data': {} }
> +
> ##
> # @ObjectType:
> #
> @@ -1346,6 +1357,7 @@
> { 'name': 'pr-manager-helper',
> 'if': 'CONFIG_LINUX' },
> 'qtest',
> + 'rme-guest',
> 'rng-builtin',
> 'rng-egd',
> { 'name': 'rng-random',
> @@ -1427,6 +1439,7 @@
> 'pr-manager-helper': { 'type': 'PrManagerHelperProperties',
> 'if': 'CONFIG_LINUX' },
> 'qtest': 'QtestProperties',
> + 'rme-guest': 'RmeGuestProperties',
> 'rng-builtin': 'RngProperties',
> 'rng-egd': 'RngEgdProperties',
> 'rng-random': { 'type': 'RngRandomProperties',
> diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
> new file mode 100644
> index 000000000000..42e1d1e7b859
> --- /dev/null
> +++ b/target/arm/kvm-rme.c
> @@ -0,0 +1,42 @@
> +/*
> + * QEMU Arm RME support
> + *
> + * SPDX-License-Identifier: GPL-2.0-or-later
> + *
> + * Copyright Linaro 2026
> + */
> +
> +#include "qemu/osdep.h"
> +
> +#include "hw/core/boards.h"
> +#include "hw/core/cpu.h"
> +#include "kvm_arm.h"
> +#include "migration/blocker.h"
> +#include "qapi/error.h"
> +#include "qom/object_interfaces.h"
> +#include "system/confidential-guest-support.h"
> +#include "system/kvm.h"
> +#include "system/runstate.h"
> +
> +#define TYPE_RME_GUEST "rme-guest"
> +OBJECT_DECLARE_SIMPLE_TYPE(RmeGuest, RME_GUEST)
> +
> +struct RmeGuest {
> + ConfidentialGuestSupport parent_obj;
> +};
> +
> +OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, rme_guest, RME_GUEST,
> + CONFIDENTIAL_GUEST_SUPPORT,
> + { TYPE_USER_CREATABLE }, { })
> +
> +static void rme_guest_class_init(ObjectClass *oc, const void *data)
> +{
> +}
> +
> +static void rme_guest_init(Object *obj)
> +{
> +}
> +
> +static void rme_guest_finalize(Object *obj)
> +{
> +}
> diff --git a/target/arm/meson.build b/target/arm/meson.build
> index 0369f96b4cc6..9d322a7aad28 100644
> --- a/target/arm/meson.build
> +++ b/target/arm/meson.build
> @@ -31,7 +31,10 @@ arm_common_user_system_ss.add(when: 'TARGET_AARCH64',
> if_true: files(
> arm_common_system_ss.add(files(
> 'arm-qmp-cmds.c',
> ))
> -arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c',
> 'kvm.c'))
> +arm_system_ss.add(when: 'CONFIG_KVM', if_true: files(
> + 'hyp_gdbstub.c',
> + 'kvm.c',
> + 'kvm-rme.c'))
> arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
>
> arm_user_ss.add(files('cpu.c'))
> --
> 2.43.0
>
>
