Re: [RFC v4 03/24] target/arm: Add confidential guest support

[Gavin Shan <gshan@redhat.com>]

On 10/20/26 6:46 AM, Mathieu Poirier wrote:
> On Thu, Sep 24, 2026 at 12:12:35PM +0900, Kohei Enju wrote:
>> On 09/22 10:01, Lorenzo Pieralisi wrote:
>>> On Tue, Sep 15, 2026 at 04:27:21PM -0500, Michael Roth wrote:
>>>> On Thu, Sep 03, 2026 at 01:35:50PM -0600, Mathieu Poirier wrote:
>>>>> From: Jean-Philippe Brucker <jean-philippe@linaro.org>
>>>>>
>>>>> Add a new RmeGuest object, inheriting from ConfidentialGuestSupport, to
>>>>> support the Arm Realm Management Extension (RME). It is instantiated by
>>>>> passing on the command-line:
>>>>>
>>>>>    -M virt,confidential-guest-support=<id>
>>>>>    -object rme-guest,id=<id>
>>>>>
>>>>> This is only the skeleton. Support will be added in following patches.
>>>>>
>>>>> Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
>>>>> Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
>>>>> ---
>>>>>   docs/system/confidential-guest-support.rst |  1 +
>>>>>   qapi/qom.json                              | 13 +++++++
>>>>>   target/arm/kvm-rme.c                       | 42 ++++++++++++++++++++++
>>>>>   target/arm/meson.build                     |  5 ++-
>>>>>   4 files changed, 60 insertions(+), 1 deletion(-)
>>>>>   create mode 100644 target/arm/kvm-rme.c
>>>>>
>>>>> diff --git a/docs/system/confidential-guest-support.rst b/docs/system/confidential-guest-support.rst
>>>>> index 562a7c3c2852..abb56923ad13 100644
>>>>> --- a/docs/system/confidential-guest-support.rst
>>>>> +++ b/docs/system/confidential-guest-support.rst
>>>>> @@ -42,5 +42,6 @@ Currently supported confidential guest mechanisms are:
>>>>>   * POWER Protected Execution Facility (PEF) (see :ref:`power-papr-protected-execution-facility-pef`)
>>>>>   * s390x Protected Virtualization (PV) (see :doc:`s390x/protvirt`)
>>>>>   * AWS Nitro Enclaves (see :doc:`nitro`)
>>>>> +* Arm Realm Management Extension (RME)
>>>>>   
>>>>>   Other mechanisms may be supported in future.
>>>>> diff --git a/qapi/qom.json b/qapi/qom.json
>>>>> index 776b13027fd8..52997c29a32d 100644
>>>>> --- a/qapi/qom.json
>>>>> +++ b/qapi/qom.json
>>>>> @@ -1288,6 +1288,17 @@
>>>>>     'data': { '*pretty': 'bool',
>>>>>               '*close-action': 'MonitorQMPCloseAction' } }
>>>>>   
>>>>> +##
>>>>> +# @RmeGuestProperties:
>>>>> +#
>>>>> +# Properties for rme-guest objects.
>>>>> +#
>>>>> +# Since: 11.1
>>>>> +##
>>>>> +{ 'struct': 'RmeGuestProperties',
>>>>> +  'base': 'ConfidentialGuestSupportProperties',
>>>>
>>>> Just FYI, based on input from Markus I'm planning to drop this
>>>> ConfidentialGuestSupportProperties base type from my series
>>>> since it's probably only SNP/TDX that need to be able to switch
>>>> it on/off, whereas this series appears to use/require it from
>>>> the start.
>>>>
>>>> I'm not exactly sure what it will look like for v3 yet, but if you
>>>> were based on v2 you'd instead probably just do the following in the
>>>> instance_init function for your rme-guest instance:
>>>>
>>>>    cgs->allow_convert_in_place = true;
>>>>    cgs->convert_in_place = true;
>>>>
>>>> rather than exposing it as a cmdline option.
>>>
>>> Yep, it won't be an option for CCA Realms anyway since that will be
>>> the baseline.
>>
>> IIUC, in-place conversion requires RAM backed by a shared/mappable
>> guest_memfd. If in-place conversion is always enabled for CCA Realms,
>> could QEMU also select the equivalent of
>>
>>    -object memory-backend-guest-memfd,id=ram0,size=...,share=on
>>
>> automatically for the default RAM, so that specifying the RAM size with
>> `-m` is sufficient?
> 
> Are you suggesting that on Arm, we completely get rid of
> 
>      -object memory-backend-guest-memfd,id=ram0,size=$(RAMSIZE),share=on
> 
> or simply to get rid of "size=$(RAMSIZE)" in the above because it is redundant
> with "-m $(RAMSIZE)"?
> 
> Gavin and Michael, what is your take on that suggestion?
> 

I don't think that's what Kohei meant. He actually suggested the memory backend
shall be pinned to memory-backend-guest-memfd and its in-place conversion shall
be enabled when the memory backend isn't explicitly specified by users through
"-object memory-backend-xxxx". For this inexplicit case, where the memory backend
is determined by '-mem-path', the memory backend is either TYPE_MEMORY_BACKEND_FILE
or TYPE_MEMORY_BACKEND_RAM. Please refer to create_default_memdev().

I think Kohei's suggestion makes sense. Besides, I think '-mem-path' should be
disallowed for CCA Realms as TYPE_MEMORY_BACKEND_FILE isn't what we want.

Thanks,
Gavin

> Thanks,
> Mathieu
> 
>>
>> Thanks,
>> Kohei
>>
>>>
>>> Thanks,
>>> Lorenzo
>>>
>>>> Thanks,
>>>>
>>>> Mike
>>>>
>>>>> +  'data': {} }
>>>>> +
>>>>>   ##
>>>>>   # @ObjectType:
>>>>>   #
>>>>> @@ -1346,6 +1357,7 @@
>>>>>       { 'name': 'pr-manager-helper',
>>>>>         'if': 'CONFIG_LINUX' },
>>>>>       'qtest',
>>>>> +    'rme-guest',
>>>>>       'rng-builtin',
>>>>>       'rng-egd',
>>>>>       { 'name': 'rng-random',
>>>>> @@ -1427,6 +1439,7 @@
>>>>>         'pr-manager-helper':          { 'type': 'PrManagerHelperProperties',
>>>>>                                         'if': 'CONFIG_LINUX' },
>>>>>         'qtest':                      'QtestProperties',
>>>>> +      'rme-guest':                  'RmeGuestProperties',
>>>>>         'rng-builtin':                'RngProperties',
>>>>>         'rng-egd':                    'RngEgdProperties',
>>>>>         'rng-random':                 { 'type': 'RngRandomProperties',
>>>>> diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
>>>>> new file mode 100644
>>>>> index 000000000000..42e1d1e7b859
>>>>> --- /dev/null
>>>>> +++ b/target/arm/kvm-rme.c
>>>>> @@ -0,0 +1,42 @@
>>>>> +/*
>>>>> + * QEMU Arm RME support
>>>>> + *
>>>>> + * SPDX-License-Identifier: GPL-2.0-or-later
>>>>> + *
>>>>> + * Copyright Linaro 2026
>>>>> + */
>>>>> +
>>>>> +#include "qemu/osdep.h"
>>>>> +
>>>>> +#include "hw/core/boards.h"
>>>>> +#include "hw/core/cpu.h"
>>>>> +#include "kvm_arm.h"
>>>>> +#include "migration/blocker.h"
>>>>> +#include "qapi/error.h"
>>>>> +#include "qom/object_interfaces.h"
>>>>> +#include "system/confidential-guest-support.h"
>>>>> +#include "system/kvm.h"
>>>>> +#include "system/runstate.h"
>>>>> +
>>>>> +#define TYPE_RME_GUEST "rme-guest"
>>>>> +OBJECT_DECLARE_SIMPLE_TYPE(RmeGuest, RME_GUEST)
>>>>> +
>>>>> +struct RmeGuest {
>>>>> +    ConfidentialGuestSupport parent_obj;
>>>>> +};
>>>>> +
>>>>> +OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, rme_guest, RME_GUEST,
>>>>> +                                          CONFIDENTIAL_GUEST_SUPPORT,
>>>>> +                                          { TYPE_USER_CREATABLE }, { })
>>>>> +
>>>>> +static void rme_guest_class_init(ObjectClass *oc, const void *data)
>>>>> +{
>>>>> +}
>>>>> +
>>>>> +static void rme_guest_init(Object *obj)
>>>>> +{
>>>>> +}
>>>>> +
>>>>> +static void rme_guest_finalize(Object *obj)
>>>>> +{
>>>>> +}
>>>>> diff --git a/target/arm/meson.build b/target/arm/meson.build
>>>>> index 0369f96b4cc6..9d322a7aad28 100644
>>>>> --- a/target/arm/meson.build
>>>>> +++ b/target/arm/meson.build
>>>>> @@ -31,7 +31,10 @@ arm_common_user_system_ss.add(when: 'TARGET_AARCH64', if_true: files(
>>>>>   arm_common_system_ss.add(files(
>>>>>     'arm-qmp-cmds.c',
>>>>>   ))
>>>>> -arm_system_ss.add(when: 'CONFIG_KVM', if_true: files('hyp_gdbstub.c', 'kvm.c'))
>>>>> +arm_system_ss.add(when: 'CONFIG_KVM', if_true: files(
>>>>> +  'hyp_gdbstub.c',
>>>>> +  'kvm.c',
>>>>> +  'kvm-rme.c'))
>>>>>   arm_system_ss.add(when: 'CONFIG_HVF', if_true: files('hyp_gdbstub.c'))
>>>>>   
>>>>>   arm_user_ss.add(files('cpu.c'))
>>>>> -- 
>>>>> 2.43.0
>>>>>
>>>>>
>