This patchset provides minimal functionality to start a Realm VM
from an Arm RME capable host using the following command line:

qemu-system-aarch64 \
 -M confidential-guest-support=rme0 -object rme-guest,id=rme0 \
 -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..

It is a refactoring of Jean-Philippe Brucker's initial work dating from a while
back.  It is compatible with Steven Price's v14 revision [1] of his work adding
CCA support to KVM.

* We are currently working on rebasing the work to v15.

It was tested on the QEMU SBSA machine.  For convenience, a repository is hosted
here [2], along with the TF-A [3], RMM [4] and Linux kernel [5] for the SBSA
machine (compatible with Steven's v14 patchset).

Instructions to compile and run the entire stack can be found here [6].

Device Assignment is not included.

Thanks,
Mathieu

[1]. https://lore.kernel.org/kvm/20260513131757.116630-1-steven.price@arm.com/T/#m06dd14216aaf76acab65b0a76fb84653141ea64f
[2]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v2?ref_type=heads
[3]. https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads
[4]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v14?ref_type=heads
[5]. https://gitlab.com/Linaro/cca-public/linux/-/tree/upstream-v2?ref_type=heads 
[6]. https://gitlab.com/Linaro/cca-public/build-instructions

RFC v1:
https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02307.html

Changes for V2:
- Fixed linux headers to include correct bit shift for Realm VM (Gavin).
- Removed obsolete rme-guest options (Markus).
- Set ConfidentialGuestSupportClass::kvm_init() to kvm_arm_rme_init() (Gavin).
- Got rid of kvm_arm_rme_vm_type() (Gavin).
- Used kvm_vm_check_extension() instead of kvm_check_extension() to avoid
  error message when starting a Realm (Gavin).
- Removed obsolete kvm_arm_rme_init_guest_ram() (Gavin).
- Collected A-B and R-B.

Jean-Philippe Brucker (23):
  linux-headers: Add RME related definitions
  target/arm/kvm: Return immediately on error in kvm_arch_init()
  target/arm: Add confidential guest support
  target/arm/kvm: Split kvm_arch_get/put_registers
  target/arm/kvm-rme: Initialize vCPU
  target/arm/kvm: Create scratch Realm VM when requested
  target/arm/kvm: Use kvm_vm_check_extension() where necessary
  hw/core/loader: Add a ROM loader notifier
  target/arm/kvm-rme: Keep track of images loaded in Realm memory
  target/arm/kvm-rme: Populate Realm with runtime images
  target/arm/cpu: Set number of breakpoints and watchpoints in KVM
  target/arm/cpu: Set number of PMU counters in KVM
  target/arm/cpu: Don't read Realm registers
  hw/arm/virt: Set proper conduit method for Realms
  hw/arm/virt: Embed Realm VM type with IPA address space
  hw/arm/virt: Reserve one bit of guest physical address for RME
  hw/arm/virt: Disable DTB randomness for confidential VMs
  hw/arm/virt: Move virt_flash_create() to machvirt_init()
  hw/arm/virt: Use RAM instead of flash for confidential guest firmware
  target/arm/kvm-rme: Add DMA remapping for the shared memory region
  docs/interop/firmware.json: Add arm-rme firmware feature
  hw/arm/boot: Load DTB as is for confidential VMs
  hw/arm/boot: Skip bootloader for confidential guests

Mathieu Poirier (1):
  target/arm/kvm-rme: Add mechanic to initialize realms

 docs/interop/firmware.json                 |   5 +-
 docs/system/arm/virt.rst                   |   9 +-
 docs/system/confidential-guest-support.rst |   1 +
 hw/arm/boot.c                              |  70 ++++-
 hw/arm/virt.c                              | 142 ++++++++--
 hw/core/loader.c                           |  15 +
 include/hw/arm/boot.h                      |   9 +
 include/hw/arm/virt.h                      |   2 +-
 include/hw/core/loader.h                   |  17 ++
 linux-headers/asm-arm64/kvm.h              |   9 +
 linux-headers/linux/kvm.h                  |  10 +-
 qapi/qom.json                              |   1 +
 target/arm/arm-qmp-cmds.c                  |   1 +
 target/arm/cpu.c                           |   5 +
 target/arm/cpu.h                           |  10 +
 target/arm/cpu64.c                         | 122 ++++++++
 target/arm/kvm-rme.c                       | 313 +++++++++++++++++++++
 target/arm/kvm-stub.c                      |   9 +
 target/arm/kvm.c                           | 202 ++++++++++++-
 target/arm/kvm_arm.h                       |  20 ++
 target/arm/meson.build                     |   5 +-
 21 files changed, 927 insertions(+), 50 deletions(-)
 create mode 100644 target/arm/kvm-rme.c

-- 
2.43.0

On 07/28 13:26, Mathieu Poirier wrote:
> This patchset provides minimal functionality to start a Realm VM
> from an Arm RME capable host using the following command line:
> 
> qemu-system-aarch64 \
>  -M confidential-guest-support=rme0 -object rme-guest,id=rme0 \
>  -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..
> 
> It is a refactoring of Jean-Philippe Brucker's initial work dating from a while
> back.  It is compatible with Steven Price's v14 revision [1] of his work adding
> CCA support to KVM.
> 
> * We are currently working on rebasing the work to v15.
> 
> It was tested on the QEMU SBSA machine.  For convenience, a repository is hosted
> here [2], along with the TF-A [3], RMM [4] and Linux kernel [5] for the SBSA
> machine (compatible with Steven's v14 patchset).
> 
> Instructions to compile and run the entire stack can be found here [6].
> 
> Device Assignment is not included.
> 
> Thanks,
> Mathieu

Hi Mathieu, thank you for your work on upstreaming CCA support. I've
tested this series in QEMU-TCG(x-rme=on) environments and confirmed
that the basic functionality works well.

I have a question about a QMP command for querying CCA capabilities.

Jean's tree contains the following commit adding such a QMP command. Was
this functionality intentionally omitted from this series?
https://git.codelinaro.org/linaro/dcap/qemu/-/commit/41f7852cc8590a38c47299a35a7238da09ff9a12

We are interested in adding this functionality because we are also
planning to upstream CCA support for libvirt, which will need a QMP
interface to query the CCA capabilities exposed by QEMU.

Since the Linux kernel dropped some configuration parameters such as the
hash algorithm, I need to rework the implementation of that QMP command
a bit. If it's okay with you, I'd be happy to send out the reworked
patch based on this series.

Thanks,
Kohei

> 
> [1]. https://lore.kernel.org/kvm/20260513131757.116630-1-steven.price@arm.com/T/#m06dd14216aaf76acab65b0a76fb84653141ea64f
> [2]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v2?ref_type=heads
> [3]. https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads
> [4]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v14?ref_type=heads
> [5]. https://gitlab.com/Linaro/cca-public/linux/-/tree/upstream-v2?ref_type=heads 
> [6]. https://gitlab.com/Linaro/cca-public/build-instructions
> 
> RFC v1:
> https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02307.html
> 
> Changes for V2:
> - Fixed linux headers to include correct bit shift for Realm VM (Gavin).
> - Removed obsolete rme-guest options (Markus).
> - Set ConfidentialGuestSupportClass::kvm_init() to kvm_arm_rme_init() (Gavin).
> - Got rid of kvm_arm_rme_vm_type() (Gavin).
> - Used kvm_vm_check_extension() instead of kvm_check_extension() to avoid
>   error message when starting a Realm (Gavin).
> - Removed obsolete kvm_arm_rme_init_guest_ram() (Gavin).
> - Collected A-B and R-B.

Hi Kohei - apologies for the delayed reply.

On Thu, Jul 30, 2026 at 02:11:57PM +0900, Kohei Enju wrote:
> On 07/28 13:26, Mathieu Poirier wrote:
> > This patchset provides minimal functionality to start a Realm VM
> > from an Arm RME capable host using the following command line:
> > 
> > qemu-system-aarch64 \
> >  -M confidential-guest-support=rme0 -object rme-guest,id=rme0 \
> >  -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..
> > 
> > It is a refactoring of Jean-Philippe Brucker's initial work dating from a while
> > back.  It is compatible with Steven Price's v14 revision [1] of his work adding
> > CCA support to KVM.
> > 
> > * We are currently working on rebasing the work to v15.
> > 
> > It was tested on the QEMU SBSA machine.  For convenience, a repository is hosted
> > here [2], along with the TF-A [3], RMM [4] and Linux kernel [5] for the SBSA
> > machine (compatible with Steven's v14 patchset).
> > 
> > Instructions to compile and run the entire stack can be found here [6].
> > 
> > Device Assignment is not included.
> > 
> > Thanks,
> > Mathieu
> 
> Hi Mathieu, thank you for your work on upstreaming CCA support. I've
> tested this series in QEMU-TCG(x-rme=on) environments and confirmed
> that the basic functionality works well.
> 
> I have a question about a QMP command for querying CCA capabilities.
> 
> Jean's tree contains the following commit adding such a QMP command. Was
> this functionality intentionally omitted from this series?
> https://git.codelinaro.org/linaro/dcap/qemu/-/commit/41f7852cc8590a38c47299a35a7238da09ff9a12
>

git.codelinaro.org is no longer accessible to me.  Please see if you can point
me to the same patch in this repository:

https://gitlab.com/Linaro/cca-public/qemu/-/commits/cca/2025-09-12?ref_type=heads

 
> We are interested in adding this functionality because we are also
> planning to upstream CCA support for libvirt, which will need a QMP
> interface to query the CCA capabilities exposed by QEMU.
> 
> Since the Linux kernel dropped some configuration parameters such as the
> hash algorithm, I need to rework the implementation of that QMP command
> a bit. If it's okay with you, I'd be happy to send out the reworked
> patch based on this series.
> 
> Thanks,
> Kohei
> 
> > 
> > [1]. https://lore.kernel.org/kvm/20260513131757.116630-1-steven.price@arm.com/T/#m06dd14216aaf76acab65b0a76fb84653141ea64f
> > [2]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v2?ref_type=heads
> > [3]. https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads
> > [4]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v14?ref_type=heads
> > [5]. https://gitlab.com/Linaro/cca-public/linux/-/tree/upstream-v2?ref_type=heads 
> > [6]. https://gitlab.com/Linaro/cca-public/build-instructions
> > 
> > RFC v1:
> > https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02307.html
> > 
> > Changes for V2:
> > - Fixed linux headers to include correct bit shift for Realm VM (Gavin).
> > - Removed obsolete rme-guest options (Markus).
> > - Set ConfidentialGuestSupportClass::kvm_init() to kvm_arm_rme_init() (Gavin).
> > - Got rid of kvm_arm_rme_vm_type() (Gavin).
> > - Used kvm_vm_check_extension() instead of kvm_check_extension() to avoid
> >   error message when starting a Realm (Gavin).
> > - Removed obsolete kvm_arm_rme_init_guest_ram() (Gavin).
> > - Collected A-B and R-B.

On 08/25 15:09, Mathieu Poirier wrote:
> Hi Kohei - apologies for the delayed reply.
> 
> On Thu, Jul 30, 2026 at 02:11:57PM +0900, Kohei Enju wrote:
> > On 07/28 13:26, Mathieu Poirier wrote:
> > > This patchset provides minimal functionality to start a Realm VM
> > > from an Arm RME capable host using the following command line:
> > > 
> > > qemu-system-aarch64 \
> > >  -M confidential-guest-support=rme0 -object rme-guest,id=rme0 \
> > >  -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..
> > > 
> > > It is a refactoring of Jean-Philippe Brucker's initial work dating from a while
> > > back.  It is compatible with Steven Price's v14 revision [1] of his work adding
> > > CCA support to KVM.
> > > 
> > > * We are currently working on rebasing the work to v15.
> > > 
> > > It was tested on the QEMU SBSA machine.  For convenience, a repository is hosted
> > > here [2], along with the TF-A [3], RMM [4] and Linux kernel [5] for the SBSA
> > > machine (compatible with Steven's v14 patchset).
> > > 
> > > Instructions to compile and run the entire stack can be found here [6].
> > > 
> > > Device Assignment is not included.
> > > 
> > > Thanks,
> > > Mathieu
> > 
> > Hi Mathieu, thank you for your work on upstreaming CCA support. I've
> > tested this series in QEMU-TCG(x-rme=on) environments and confirmed
> > that the basic functionality works well.
> > 
> > I have a question about a QMP command for querying CCA capabilities.
> > 
> > Jean's tree contains the following commit adding such a QMP command. Was
> > this functionality intentionally omitted from this series?
> > https://git.codelinaro.org/linaro/dcap/qemu/-/commit/41f7852cc8590a38c47299a35a7238da09ff9a12
> >
> 
> git.codelinaro.org is no longer accessible to me.  Please see if you can point
> me to the same patch in this repository:
> 
> https://gitlab.com/Linaro/cca-public/qemu/-/commits/cca/2025-09-12?ref_type=heads

Hi, thank you for taking a look.

I checked the repository, but could not find the corresponding patch
there. If you agree, I would be happy to share a version of that patch,
updated as needed and rebased onto the latest v3 series.

Thanks,
Kohei

> 
>  
> > We are interested in adding this functionality because we are also
> > planning to upstream CCA support for libvirt, which will need a QMP
> > interface to query the CCA capabilities exposed by QEMU.
> > 
> > Since the Linux kernel dropped some configuration parameters such as the
> > hash algorithm, I need to rework the implementation of that QMP command
> > a bit. If it's okay with you, I'd be happy to send out the reworked
> > patch based on this series.
> > 
> > Thanks,
> > Kohei
> >

On Thu, Jul 30, 2026 at 02:11:57PM +0900, Kohei Enju wrote:
> On 07/28 13:26, Mathieu Poirier wrote:
> > This patchset provides minimal functionality to start a Realm VM
> > from an Arm RME capable host using the following command line:
> > 
> > qemu-system-aarch64 \
> >  -M confidential-guest-support=rme0 -object rme-guest,id=rme0 \
> >  -cpu host -M virt -enable-kvm -M gic-version=3,its=on -nodefaults ..
> > 
> > It is a refactoring of Jean-Philippe Brucker's initial work dating from a while
> > back.  It is compatible with Steven Price's v14 revision [1] of his work adding
> > CCA support to KVM.
> > 
> > * We are currently working on rebasing the work to v15.
> > 
> > It was tested on the QEMU SBSA machine.  For convenience, a repository is hosted
> > here [2], along with the TF-A [3], RMM [4] and Linux kernel [5] for the SBSA
> > machine (compatible with Steven's v14 patchset).
> > 
> > Instructions to compile and run the entire stack can be found here [6].
> > 
> > Device Assignment is not included.
> > 
> > Thanks,
> > Mathieu
> 
> Hi Mathieu, thank you for your work on upstreaming CCA support. I've
> tested this series in QEMU-TCG(x-rme=on) environments and confirmed
> that the basic functionality works well.
> 
> I have a question about a QMP command for querying CCA capabilities.
> 
> Jean's tree contains the following commit adding such a QMP command. Was
> this functionality intentionally omitted from this series?
> https://git.codelinaro.org/linaro/dcap/qemu/-/commit/41f7852cc8590a38c47299a35a7238da09ff9a12
> 
> We are interested in adding this functionality because we are also
> planning to upstream CCA support for libvirt, which will need a QMP
> interface to query the CCA capabilities exposed by QEMU.
> 
> Since the Linux kernel dropped some configuration parameters such as the
> hash algorithm, I need to rework the implementation of that QMP command
> a bit. If it's okay with you, I'd be happy to send out the reworked
> patch based on this series.

I am currently away from the office - I will get back to you after August 17th.

> 
> Thanks,
> Kohei
> 
> > 
> > [1]. https://lore.kernel.org/kvm/20260513131757.116630-1-steven.price@arm.com/T/#m06dd14216aaf76acab65b0a76fb84653141ea64f
> > [2]. https://gitlab.com/Linaro/cca-public/qemu/-/tree/upstream-v2?ref_type=heads
> > [3]. https://gitlab.com/Linaro/cca-public/tf-a/trusted-firmware-a/-/tree/cca/v13?ref_type=heads
> > [4]. https://gitlab.com/Linaro/cca-public/rmm/-/tree/cca/v14?ref_type=heads
> > [5]. https://gitlab.com/Linaro/cca-public/linux/-/tree/upstream-v2?ref_type=heads 
> > [6]. https://gitlab.com/Linaro/cca-public/build-instructions
> > 
> > RFC v1:
> > https://lists.gnu.org/archive/html/qemu-devel/2026-07/msg02307.html
> > 
> > Changes for V2:
> > - Fixed linux headers to include correct bit shift for Realm VM (Gavin).
> > - Removed obsolete rme-guest options (Markus).
> > - Set ConfidentialGuestSupportClass::kvm_init() to kvm_arm_rme_init() (Gavin).
> > - Got rid of kvm_arm_rme_vm_type() (Gavin).
> > - Used kvm_vm_check_extension() instead of kvm_check_extension() to avoid
> >   error message when starting a Realm (Gavin).
> > - Removed obsolete kvm_arm_rme_init_guest_ram() (Gavin).
> > - Collected A-B and R-B.