diff --git a/src/runtime-rs/crates/hypervisor/src/qemu/machine/probe.rs b/src/runtime-rs/crates/hypervisor/src/qemu/machine/probe.rs
index 8b7db31192..e34dddce12 100644
--- a/src/runtime-rs/crates/hypervisor/src/qemu/machine/probe.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/machine/probe.rs
@@ -8,11 +8,23 @@ pub(crate) struct HostTopology {
     pub sockets: Vec<SocketInfo>,
     pub gpu_smmu_groups: Vec<GpuSmmuGroup>,
     pub egm_sockets: Vec<EgmSocketInfo>,
+    /// `-numa dist` entries emitted after all NUMA nodes.  Each tuple is (src, dst, val).
+    pub numa_distances: Vec<(u32, u32, u32)>,
+    /// Number of pre-provisioned `pcie-root-port` devices on the Q35 default bus
+    /// (cold-plug topology; `cold_plug_vfio=root-port` in kata config).
+    pub cold_plug_ports: u32,
+    pub protection: Option<ProtectionDevice>,
 }
 
 pub(crate) struct SocketInfo {
     pub id: u32,
     pub cpu_range: Range<u32>,
+    /// Host NUMA node to bind this socket's memory to via `policy=bind`.
+    pub host_node: Option<u32>,
+    /// File-backed memory path (e.g. `/dev/shm`).  `None` → `memory-backend-ram`.
+    pub mem_path: Option<String>,
+    /// Per-socket memory size in bytes.  `None` → use the Platform-level default.
+    pub mem_size: Option<u64>,
 }
 
 /// GPUs sharing a physical SMMU must be placed on the same pxb-pcie + arm-smmuv3.
@@ -26,3 +38,33 @@ pub(crate) struct EgmSocketInfo {
     pub socket: u32,
     pub total_size: u64,
 }
+
+/// CoCo hardware protection capability detected by the host probe.
+///
+/// Drives three platform decisions: the `-object <type>-guest` preamble, the
+/// `kernel_irqchip=split` machine flag, and the `CpuModel` (EpycV4 for SNP,
+/// Host for TDX).
+#[derive(Clone)]
+pub(crate) enum ProtectionDevice {
+    SevSnp {
+        id: String,
+        cbitpos: u8,
+        reduced_phys_bits: u8,
+        kernel_hashes: bool,
+        policy: u64,
+        host_data: Option<String>,
+    },
+    /// TDX — fields TBD when a production capture is available.
+    Tdx {
+        id: String,
+    },
+}
+
+impl ProtectionDevice {
+    pub(crate) fn id(&self) -> &str {
+        match self {
+            ProtectionDevice::SevSnp { id, .. } => id,
+            ProtectionDevice::Tdx { id } => id,
+        }
+    }
+}
diff --git a/src/runtime-rs/crates/hypervisor/src/qemu/machine/q35.rs b/src/runtime-rs/crates/hypervisor/src/qemu/machine/q35.rs
index acf467dac0..8e42f325b4 100644
--- a/src/runtime-rs/crates/hypervisor/src/qemu/machine/q35.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/machine/q35.rs
@@ -6,9 +6,14 @@ use super::platform::BaseMachine;
 
 pub(crate) struct Q35 {
     pub base: BaseMachine,
+    /// `kernel_irqchip=split` is required for CoCo (SNP/TDX); absent on vanilla Q35.
     pub kernel_irqchip: Option<String>,
+    /// References the id of `Objects::protection`.  Set by `apply_host_defaults`
+    /// when `HostTopology::protection` is `Some`.
+    pub confidential_guest_support: Option<String>,
     /// Not bus-attached; contrast with BusIommu on PciRootComplex.
     pub intel_iommu: Option<IntelIommuConfig>,
+    // pub runtime: RuntimeFeatures,  -- Phase 3+
 }
 
 pub(crate) struct IntelIommuConfig {
diff --git a/src/runtime-rs/crates/hypervisor/src/qemu/machine/topology.rs b/src/runtime-rs/crates/hypervisor/src/qemu/machine/topology.rs
index cfcac5e94f..bafb137796 100644
--- a/src/runtime-rs/crates/hypervisor/src/qemu/machine/topology.rs
+++ b/src/runtime-rs/crates/hypervisor/src/qemu/machine/topology.rs
@@ -5,6 +5,9 @@
 pub(crate) struct PciTopology {
     pub default_bus: Option<String>,
     pub roots: Vec<PciRootComplex>,
+    /// Pre-provisioned root ports emitted on the default bus (Q35 cold-plug topology).
+    /// Contrast with `roots`, which are pxb-pcie complexes for GPU passthrough.
+    pub cold_plug_ports: Vec<PciRootPort>,
 }
 
 pub(crate) struct PciRootComplex {
@@ -20,18 +23,35 @@ pub(crate) struct PciRootComplex {
 pub(crate) struct PciRootPort {
     pub id: String,
     pub chassis: u8,
+    /// `slot=N` — required for Q35 root ports; absent on aarch64 Grace ports.
+    pub slot: Option<u8>,
+    /// `multifunction=on/off` — required for Q35; absent on Grace.
+    pub multifunction: Option<bool>,
+    /// `io-reserve=N` — required for aarch64 Grace ports; absent on Q35.
+    pub io_reserve: Option<u32>,
     pub device: Option<VfioDevice>,
 }
 
 pub(crate) struct VfioDevice {
     pub id: String,
     pub host: String,
-    pub rombar: bool,
+    pub rombar: Option<bool>,
     pub kind: VfioDeviceKind,
+    /// When set, an `-object iommufd,id=<iommufd_id>` is emitted immediately before
+    /// this device and referenced in the device string.  Used for CoCo x86 passthrough;
+    /// Grace uses a single shared `iommufd0` in `Objects::iommufd` instead.
+    pub iommufd_id: Option<String>,
+    /// `x-pci-vendor-id` override required for CoCo measured-boot attestation (#12329).
+    pub pci_vendor_id: Option<u16>,
+    /// `x-pci-device-id` override required for CoCo measured-boot attestation (#12329).
+    pub pci_device_id: Option<u16>,
 }
 
 pub(crate) enum VfioDeviceKind {
+    /// `vfio-pci-nohotplug` — aarch64 Grace static binding.
     Gpu,
+    /// `vfio-pci` — x86 Q35 / CoCo passthrough and NIC.
+    GpuPci,
     Nic,
 }