Re: [RFC v1 04/25] target/arm/kvm-rme: Add mechanic to initialize realms

2026-07-15 Thread Mathieu Poirier
On Mon, Jul 13, 2026 at 03:34:20PM +1000, Gavin Shan wrote:
> On 7/8/26 8:42 AM, Mathieu Poirier wrote:
> > From: Jean-Philippe Brucker 
> > 
> > Initialise an @rme_guest object and install a handler to get notified
> > when the Realm is ready to start.  That way we can finish reading the
> > Realm once we know everything is in place.
> > 
> > Signed-off-by: Jean-Philippe Brucker 
> > Signed-off-by: Mathieu Poirier 
> > ---
> >   target/arm/kvm-rme.c  | 50 +++
> >   target/arm/kvm-stub.c |  5 +
> >   target/arm/kvm.c  |  7 +-
> >   target/arm/kvm_arm.h  |  9 
> >   4 files changed, 70 insertions(+), 1 deletion(-)
> > 
> > diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
> > index 42e1d1e7b859..b86b9d6a25cb 100644
> > --- a/target/arm/kvm-rme.c
> > +++ b/target/arm/kvm-rme.c
> > @@ -13,6 +13,7 @@
> >   #include "kvm_arm.h"
> >   #include "migration/blocker.h"
> >   #include "qapi/error.h"
> > +#include "qemu/error-report.h"
> >   #include "qom/object_interfaces.h"
> >   #include "system/confidential-guest-support.h"
> >   #include "system/kvm.h"
> > @@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, 
> > rme_guest, RME_GUEST,
> > CONFIDENTIAL_GUEST_SUPPORT,
> > { TYPE_USER_CREATABLE }, { })
> > +static RmeGuest *rme_guest;
> > +
> > +static void rme_vm_state_change(void *opaque, bool running, RunState state)
> > +{
> > +if (!running) {
> > +return;
> > +}
> > +
> > +kvm_mark_guest_state_protected();
> 
> This would be called in kvm_arm_rme_init(), why we can't call this to mark the
> KVM state as protected in kvm_arm_rme_init() ?
>

One of the very last things happening in qemu_init() is a call to
qmp_x_exit_preconfig(), which ultimately ends up calling qemu_system_reset().
If we mark the guest state as protected before qemu_system_reset() is called, as
it would be the case if we move kvm_mark_guest_state_protected() to
kvm_arm_rme_init(), general purposes and the program counter registers don't get
pushed down to KVM, resulting in a failure to start the Realm.
 
> > +}
> > +
> >   static void rme_guest_class_init(ObjectClass *oc, const void *data)
> >   {
> >   }
> >   static void rme_guest_init(Object *obj)
> >   {
> > +if (rme_guest) {
> > +error_report("a single instance of RmeGuest is supported");
> > +exit(1);
> > +}
> > +rme_guest = RME_GUEST(obj);
> >   }
> >   static void rme_guest_finalize(Object *obj)
> >   {
> >   }
> > +
> > +int kvm_arm_rme_init(MachineState *ms, KVMState *s)
> > +{
> > +static Error *rme_mig_blocker;
> > +ConfidentialGuestSupport *cgs = ms->cgs;
> > +
> > +if (!rme_guest) {
> > +return 0;
> > +}
> > +
> > +if (!cgs) {
> > +error_report("missing -machine confidential-guest-support 
> > parameter");
> > +return -EINVAL;
> > +}
> > +
> > +if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) {
> > +error_report("KVM doesn't support Realms");
> > +return -ENODEV;
> > +}
> > +
> > +error_setg(&rme_mig_blocker, "RME: migration is not implemented");
> > +migrate_add_blocker(&rme_mig_blocker, &error_fatal);
> > +
> > +/*
> > + * The realm activation is done last, when the VM starts, after all 
> > images
> > + * have been loaded and all vcpus finalized.
> > + */
> > +qemu_add_vm_change_state_handler(rme_vm_state_change, NULL);
> > +
> > +cgs->require_guest_memfd = true;
> > +cgs->ready = true;
> > +return 0;
> > +}
> > diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
> > index 88cbe8d85c41..eec1ca3dd2e5 100644
> > --- a/target/arm/kvm-stub.c
> > +++ b/target/arm/kvm-stub.c
> > @@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx)
> >   {
> >   g_assert_not_reached();
> >   }
> > +
> > +int kvm_arm_rme_init(MachineState *ms, KVMState *s)
> > +{
> > +g_assert_not_reached();
> > +}
> > diff --git a/target/arm/kvm.c b/target/arm/kvm.c
> > index ed99be7fd80c..28d5643d6779 100644
> > --- a/target/arm/kvm.c
> > +++ b/target/arm/kvm.c
> > @@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
> >   hw_breakpoints = g_array_sized_new(true, true,
> >  sizeof(HWBreakpoint), max_hw_bps);
> > -return 0;
> > +ret = kvm_arm_rme_init(ms, s);
> > +if (ret) {
> > +error_report("Failed to enable RME: %s", strerror(-ret));
> > +}
> > +
> > +return ret;
> >   }
> >   unsigned long kvm_arch_vcpu_id(CPUState *cpu)
> > diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
> > index e7c40fb003e4..6d058b0e08a2 100644
> > --- a/target/arm/kvm_arm.h
> > +++ b/target/arm/kvm_arm.h
> > @@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, 
> > GICCapability *v3);
> >*/
> >   char *kvm_print_register_name(uint64_t regidx);
> > +/**
> > + * kvm_arm_rme_i

Re: [RFC v1 04/25] target/arm/kvm-rme: Add mechanic to initialize realms

2026-07-13 Thread Mathieu Poirier
On Mon, Jul 13, 2026 at 03:14:05PM +1000, Gavin Shan wrote:
> On 7/8/26 8:42 AM, Mathieu Poirier wrote:
> > From: Jean-Philippe Brucker 
> > 
> > Initialise an @rme_guest object and install a handler to get notified
> > when the Realm is ready to start.  That way we can finish reading the
> > Realm once we know everything is in place.
> > 
> > Signed-off-by: Jean-Philippe Brucker 
> > Signed-off-by: Mathieu Poirier 
> > ---
> >   target/arm/kvm-rme.c  | 50 +++
> >   target/arm/kvm-stub.c |  5 +
> >   target/arm/kvm.c  |  7 +-
> >   target/arm/kvm_arm.h  |  9 
> >   4 files changed, 70 insertions(+), 1 deletion(-)
> > 
> > diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
> > index 42e1d1e7b859..b86b9d6a25cb 100644
> > --- a/target/arm/kvm-rme.c
> > +++ b/target/arm/kvm-rme.c
> > @@ -13,6 +13,7 @@
> >   #include "kvm_arm.h"
> >   #include "migration/blocker.h"
> >   #include "qapi/error.h"
> > +#include "qemu/error-report.h"
> >   #include "qom/object_interfaces.h"
> >   #include "system/confidential-guest-support.h"
> >   #include "system/kvm.h"
> > @@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, 
> > rme_guest, RME_GUEST,
> > CONFIDENTIAL_GUEST_SUPPORT,
> > { TYPE_USER_CREATABLE }, { })
> > +static RmeGuest *rme_guest;
> > +
> > +static void rme_vm_state_change(void *opaque, bool running, RunState state)
> > +{
> > +if (!running) {
> > +return;
> > +}
> > +
> > +kvm_mark_guest_state_protected();
> > +}
> > +
> >   static void rme_guest_class_init(ObjectClass *oc, const void *data)
> >   {
> >   }
> >   static void rme_guest_init(Object *obj)
> >   {
> > +if (rme_guest) {
> > +error_report("a single instance of RmeGuest is supported");
> > +exit(1);
> > +}
> > +rme_guest = RME_GUEST(obj);
> >   }
> >   static void rme_guest_finalize(Object *obj)
> >   {
> >   }
> > +
> > +int kvm_arm_rme_init(MachineState *ms, KVMState *s)
> > +{
> > +static Error *rme_mig_blocker;
> > +ConfidentialGuestSupport *cgs = ms->cgs;
> > +
> > +if (!rme_guest) {
> > +return 0;
> > +}
> > +
> > +if (!cgs) {
> > +error_report("missing -machine confidential-guest-support 
> > parameter");
> > +return -EINVAL;
> > +}
> > +
> > +if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) {
> > +error_report("KVM doesn't support Realms");
> > +return -ENODEV;
> > +}
> > +
> > +error_setg(&rme_mig_blocker, "RME: migration is not implemented");
> > +migrate_add_blocker(&rme_mig_blocker, &error_fatal);
> > +
> > +/*
> > + * The realm activation is done last, when the VM starts, after all 
> > images
> > + * have been loaded and all vcpus finalized.
> > + */
> > +qemu_add_vm_change_state_handler(rme_vm_state_change, NULL);
> > +
> > +cgs->require_guest_memfd = true;
> > +cgs->ready = true;
> > +return 0;
> > +}
> 
> I think it's more reasonable to set ConfidentialGuestSupportClass::kvm_init to
> kvm_arm_rme_init in rme_guest_class_init(). confidential_guest_kvm_init()
> gets called in target/arm/kvm.c::kvm_arch_init(). With this, the pattern 
> matches
> with that for x86.

I agree, it would be nice to align Arm with the other architectures that
support confidential guests.  Let me see what I can do.

Thanks for the review, I'll look at your other comment tomorrow.

Mathieu

> 
> More details can be found from commit 631a2ac5a4be ("i386/tdx: Implement 
> tdx_kvm_init()
> to initialize TDX VM context").
> 
> Thanks,
> Gavin
> 
> > diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
> > index 88cbe8d85c41..eec1ca3dd2e5 100644
> > --- a/target/arm/kvm-stub.c
> > +++ b/target/arm/kvm-stub.c
> > @@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx)
> >   {
> >   g_assert_not_reached();
> >   }
> > +
> > +int kvm_arm_rme_init(MachineState *ms, KVMState *s)
> > +{
> > +g_assert_not_reached();
> > +}
> > diff --git a/target/arm/kvm.c b/target/arm/kvm.c
> > index ed99be7fd80c..28d5643d6779 100644
> > --- a/target/arm/kvm.c
> > +++ b/target/arm/kvm.c
> > @@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
> >   hw_breakpoints = g_array_sized_new(true, true,
> >  sizeof(HWBreakpoint), max_hw_bps);
> > -return 0;
> > +ret = kvm_arm_rme_init(ms, s);
> > +if (ret) {
> > +error_report("Failed to enable RME: %s", strerror(-ret));
> > +}
> > +
> > +return ret;
> >   }
> >   unsigned long kvm_arch_vcpu_id(CPUState *cpu)
> > diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
> > index e7c40fb003e4..6d058b0e08a2 100644
> > --- a/target/arm/kvm_arm.h
> > +++ b/target/arm/kvm_arm.h
> > @@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, 
> > GICCapability *v3);
> >*/
> >   char *kvm_print_register_n

Re: [RFC v1 04/25] target/arm/kvm-rme: Add mechanic to initialize realms

2026-07-12 Thread Gavin Shan

On 7/8/26 8:42 AM, Mathieu Poirier wrote:

From: Jean-Philippe Brucker 

Initialise an @rme_guest object and install a handler to get notified
when the Realm is ready to start.  That way we can finish reading the
Realm once we know everything is in place.

Signed-off-by: Jean-Philippe Brucker 
Signed-off-by: Mathieu Poirier 
---
  target/arm/kvm-rme.c  | 50 +++
  target/arm/kvm-stub.c |  5 +
  target/arm/kvm.c  |  7 +-
  target/arm/kvm_arm.h  |  9 
  4 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
index 42e1d1e7b859..b86b9d6a25cb 100644
--- a/target/arm/kvm-rme.c
+++ b/target/arm/kvm-rme.c
@@ -13,6 +13,7 @@
  #include "kvm_arm.h"
  #include "migration/blocker.h"
  #include "qapi/error.h"
+#include "qemu/error-report.h"
  #include "qom/object_interfaces.h"
  #include "system/confidential-guest-support.h"
  #include "system/kvm.h"
@@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, 
rme_guest, RME_GUEST,
CONFIDENTIAL_GUEST_SUPPORT,
{ TYPE_USER_CREATABLE }, { })
  
+static RmeGuest *rme_guest;

+
+static void rme_vm_state_change(void *opaque, bool running, RunState state)
+{
+if (!running) {
+return;
+}
+
+kvm_mark_guest_state_protected();


This would be called in kvm_arm_rme_init(), why we can't call this to mark the
KVM state as protected in kvm_arm_rme_init() ?


+}
+
  static void rme_guest_class_init(ObjectClass *oc, const void *data)
  {
  }
  
  static void rme_guest_init(Object *obj)

  {
+if (rme_guest) {
+error_report("a single instance of RmeGuest is supported");
+exit(1);
+}
+rme_guest = RME_GUEST(obj);
  }
  
  static void rme_guest_finalize(Object *obj)

  {
  }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+static Error *rme_mig_blocker;
+ConfidentialGuestSupport *cgs = ms->cgs;
+
+if (!rme_guest) {
+return 0;
+}
+
+if (!cgs) {
+error_report("missing -machine confidential-guest-support parameter");
+return -EINVAL;
+}
+
+if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) {
+error_report("KVM doesn't support Realms");
+return -ENODEV;
+}
+
+error_setg(&rme_mig_blocker, "RME: migration is not implemented");
+migrate_add_blocker(&rme_mig_blocker, &error_fatal);
+
+/*
+ * The realm activation is done last, when the VM starts, after all images
+ * have been loaded and all vcpus finalized.
+ */
+qemu_add_vm_change_state_handler(rme_vm_state_change, NULL);
+
+cgs->require_guest_memfd = true;
+cgs->ready = true;
+return 0;
+}
diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 88cbe8d85c41..eec1ca3dd2e5 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx)
  {
  g_assert_not_reached();
  }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+g_assert_not_reached();
+}
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index ed99be7fd80c..28d5643d6779 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
  hw_breakpoints = g_array_sized_new(true, true,
 sizeof(HWBreakpoint), max_hw_bps);
  
-return 0;

+ret = kvm_arm_rme_init(ms, s);
+if (ret) {
+error_report("Failed to enable RME: %s", strerror(-ret));
+}
+
+return ret;
  }
  
  unsigned long kvm_arch_vcpu_id(CPUState *cpu)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index e7c40fb003e4..6d058b0e08a2 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, 
GICCapability *v3);
   */
  char *kvm_print_register_name(uint64_t regidx);
  
+/**

+ * kvm_arm_rme_init
+ * @ms: the machine state
+ * @s: State of KVM
+ *
+ * Prepare the machine to be a Realm, if the user enabled it.
+ */
+int kvm_arm_rme_init(MachineState *ms, KVMState *s);
+
  #endif


Thanks,
Gavin




Re: [RFC v1 04/25] target/arm/kvm-rme: Add mechanic to initialize realms

2026-07-12 Thread Gavin Shan

On 7/8/26 8:42 AM, Mathieu Poirier wrote:

From: Jean-Philippe Brucker 

Initialise an @rme_guest object and install a handler to get notified
when the Realm is ready to start.  That way we can finish reading the
Realm once we know everything is in place.

Signed-off-by: Jean-Philippe Brucker 
Signed-off-by: Mathieu Poirier 
---
  target/arm/kvm-rme.c  | 50 +++
  target/arm/kvm-stub.c |  5 +
  target/arm/kvm.c  |  7 +-
  target/arm/kvm_arm.h  |  9 
  4 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
index 42e1d1e7b859..b86b9d6a25cb 100644
--- a/target/arm/kvm-rme.c
+++ b/target/arm/kvm-rme.c
@@ -13,6 +13,7 @@
  #include "kvm_arm.h"
  #include "migration/blocker.h"
  #include "qapi/error.h"
+#include "qemu/error-report.h"
  #include "qom/object_interfaces.h"
  #include "system/confidential-guest-support.h"
  #include "system/kvm.h"
@@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, 
rme_guest, RME_GUEST,
CONFIDENTIAL_GUEST_SUPPORT,
{ TYPE_USER_CREATABLE }, { })
  
+static RmeGuest *rme_guest;

+
+static void rme_vm_state_change(void *opaque, bool running, RunState state)
+{
+if (!running) {
+return;
+}
+
+kvm_mark_guest_state_protected();
+}
+
  static void rme_guest_class_init(ObjectClass *oc, const void *data)
  {
  }
  
  static void rme_guest_init(Object *obj)

  {
+if (rme_guest) {
+error_report("a single instance of RmeGuest is supported");
+exit(1);
+}
+rme_guest = RME_GUEST(obj);
  }
  
  static void rme_guest_finalize(Object *obj)

  {
  }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+static Error *rme_mig_blocker;
+ConfidentialGuestSupport *cgs = ms->cgs;
+
+if (!rme_guest) {
+return 0;
+}
+
+if (!cgs) {
+error_report("missing -machine confidential-guest-support parameter");
+return -EINVAL;
+}
+
+if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) {
+error_report("KVM doesn't support Realms");
+return -ENODEV;
+}
+
+error_setg(&rme_mig_blocker, "RME: migration is not implemented");
+migrate_add_blocker(&rme_mig_blocker, &error_fatal);
+
+/*
+ * The realm activation is done last, when the VM starts, after all images
+ * have been loaded and all vcpus finalized.
+ */
+qemu_add_vm_change_state_handler(rme_vm_state_change, NULL);
+
+cgs->require_guest_memfd = true;
+cgs->ready = true;
+return 0;
+}


I think it's more reasonable to set ConfidentialGuestSupportClass::kvm_init to
kvm_arm_rme_init in rme_guest_class_init(). confidential_guest_kvm_init()
gets called in target/arm/kvm.c::kvm_arch_init(). With this, the pattern matches
with that for x86.

More details can be found from commit 631a2ac5a4be ("i386/tdx: Implement 
tdx_kvm_init()
to initialize TDX VM context").

Thanks,
Gavin


diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 88cbe8d85c41..eec1ca3dd2e5 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx)
  {
  g_assert_not_reached();
  }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+g_assert_not_reached();
+}
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index ed99be7fd80c..28d5643d6779 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
  hw_breakpoints = g_array_sized_new(true, true,
 sizeof(HWBreakpoint), max_hw_bps);
  
-return 0;

+ret = kvm_arm_rme_init(ms, s);
+if (ret) {
+error_report("Failed to enable RME: %s", strerror(-ret));
+}
+
+return ret;
  }
  
  unsigned long kvm_arch_vcpu_id(CPUState *cpu)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index e7c40fb003e4..6d058b0e08a2 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, 
GICCapability *v3);
   */
  char *kvm_print_register_name(uint64_t regidx);
  
+/**

+ * kvm_arm_rme_init
+ * @ms: the machine state
+ * @s: State of KVM
+ *
+ * Prepare the machine to be a Realm, if the user enabled it.
+ */
+int kvm_arm_rme_init(MachineState *ms, KVMState *s);
+
  #endif





[RFC v1 04/25] target/arm/kvm-rme: Add mechanic to initialize realms

2026-07-07 Thread Mathieu Poirier
From: Jean-Philippe Brucker 

Initialise an @rme_guest object and install a handler to get notified
when the Realm is ready to start.  That way we can finish reading the
Realm once we know everything is in place.

Signed-off-by: Jean-Philippe Brucker 
Signed-off-by: Mathieu Poirier 
---
 target/arm/kvm-rme.c  | 50 +++
 target/arm/kvm-stub.c |  5 +
 target/arm/kvm.c  |  7 +-
 target/arm/kvm_arm.h  |  9 
 4 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm-rme.c b/target/arm/kvm-rme.c
index 42e1d1e7b859..b86b9d6a25cb 100644
--- a/target/arm/kvm-rme.c
+++ b/target/arm/kvm-rme.c
@@ -13,6 +13,7 @@
 #include "kvm_arm.h"
 #include "migration/blocker.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include "qom/object_interfaces.h"
 #include "system/confidential-guest-support.h"
 #include "system/kvm.h"
@@ -29,14 +30,63 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RmeGuest, 
rme_guest, RME_GUEST,
   CONFIDENTIAL_GUEST_SUPPORT,
   { TYPE_USER_CREATABLE }, { })
 
+static RmeGuest *rme_guest;
+
+static void rme_vm_state_change(void *opaque, bool running, RunState state)
+{
+if (!running) {
+return;
+}
+
+kvm_mark_guest_state_protected();
+}
+
 static void rme_guest_class_init(ObjectClass *oc, const void *data)
 {
 }
 
 static void rme_guest_init(Object *obj)
 {
+if (rme_guest) {
+error_report("a single instance of RmeGuest is supported");
+exit(1);
+}
+rme_guest = RME_GUEST(obj);
 }
 
 static void rme_guest_finalize(Object *obj)
 {
 }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+static Error *rme_mig_blocker;
+ConfidentialGuestSupport *cgs = ms->cgs;
+
+if (!rme_guest) {
+return 0;
+}
+
+if (!cgs) {
+error_report("missing -machine confidential-guest-support parameter");
+return -EINVAL;
+}
+
+if (!kvm_vm_check_extension(s, KVM_CAP_ARM_RMI)) {
+error_report("KVM doesn't support Realms");
+return -ENODEV;
+}
+
+error_setg(&rme_mig_blocker, "RME: migration is not implemented");
+migrate_add_blocker(&rme_mig_blocker, &error_fatal);
+
+/*
+ * The realm activation is done last, when the VM starts, after all images
+ * have been loaded and all vcpus finalized.
+ */
+qemu_add_vm_change_state_handler(rme_vm_state_change, NULL);
+
+cgs->require_guest_memfd = true;
+cgs->ready = true;
+return 0;
+}
diff --git a/target/arm/kvm-stub.c b/target/arm/kvm-stub.c
index 88cbe8d85c41..eec1ca3dd2e5 100644
--- a/target/arm/kvm-stub.c
+++ b/target/arm/kvm-stub.c
@@ -119,3 +119,8 @@ char *kvm_print_register_name(uint64_t regidx)
 {
 g_assert_not_reached();
 }
+
+int kvm_arm_rme_init(MachineState *ms, KVMState *s)
+{
+g_assert_not_reached();
+}
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index ed99be7fd80c..28d5643d6779 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -660,7 +660,12 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
 hw_breakpoints = g_array_sized_new(true, true,
sizeof(HWBreakpoint), max_hw_bps);
 
-return 0;
+ret = kvm_arm_rme_init(ms, s);
+if (ret) {
+error_report("Failed to enable RME: %s", strerror(-ret));
+}
+
+return ret;
 }
 
 unsigned long kvm_arch_vcpu_id(CPUState *cpu)
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index e7c40fb003e4..6d058b0e08a2 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -240,4 +240,13 @@ void arm_gic_cap_kvm_probe(GICCapability *v2, 
GICCapability *v3);
  */
 char *kvm_print_register_name(uint64_t regidx);
 
+/**
+ * kvm_arm_rme_init
+ * @ms: the machine state
+ * @s: State of KVM
+ *
+ * Prepare the machine to be a Realm, if the user enabled it.
+ */
+int kvm_arm_rme_init(MachineState *ms, KVMState *s);
+
 #endif
-- 
2.43.0