[PATCH v3 00/12] KVM: Improve VMware guest support
From: Zack Rusin
Date: Wed Nov 11 2026 - 01:01:46 EST
This series lets userspace VMMs run unmodified VMware guests on KVM;
VMware Workstation uses it to run on top of KVM. I'm sorry this
version took a lot longer than I'd have liked, but I think it addresses
all the comments and results in a very nice cleanup for KVM in general.
VMware guests talk to the hypervisor through the "backdoor", a set of
about one hundred commands implemented in VMware's userspace. Guests
reach it through IN/OUT/INS/OUTS on two I/O ports, which VMware allows
from CPL3 regardless of I/O permissions, through RDPMC on three
pseudo-PMCs, and, on newer guests, through VMCALL/VMMCALL with VMware's
magic value in EAX. KVM already emulates the I/O-port and pseudo-PMC
interfaces, but only behind a module parameter that applies to every VM
on the host.
Patch 1 makes the pseudo-PMCs honor enable_vmware_backdoor.
Patches 2-4 move VMware code to vmware.{c,h} and add CONFIG_KVM_VMWARE.
Patches 5-7 add a per-VM capability, hypercall exits and nested routing.
Patches 8-12 add CPL3 selftest helpers and tests.
Notes:
- Paolo asked in v1 for someone with the spec to go through the
commands; Doug did that in the v1 thread and none needs KVM
(SGDT/SIDT/SLDT/STR are obsolete with UMIP, GET_VCPU_INFO flags are
constants on KVM, GETTIME returns host time without the TSC,
STEALCLOCK is ESX-only).
- The I/O-port and pseudo-PMC interfaces share one flag, as two parts
of the legacy backdoor.
- VMware hypercalls are never claimed from L2, so a Hyper-V L2 TLB
flush that KVM handles in L0 stays a Hyper-V hypercall.
- SEV: KVM doesn't intercept #GP, so the flag can't bypass I/O
permissions there. Protected-state VMs can't enable hypercall exits,
and KVM doesn't forward hypercalls from protected vCPUs of legacy
SEV-ES VMs either.
- tools/include/uapi is left to the perf sync, per its README.
- Sean, Paolo: the new MAINTAINERS entry lists Doug and me; do you want
to be listed as for Hyper-V and Xen?
The series is based on kvm-x86/next.
Testing:
- every patch builds with GCC and Clang, CONFIG_KVM_VMWARE=y and =n
- KVM selftests and KVM-unit-tests on Intel and AMD, with and without
the series, enable_vmware_backdoor=0 and =1: no differences besides
the new tests
- a legacy KVM_SEV_ES_INIT guest on bare-metal AMD gets no
KVM_EXIT_VMWARE
- Windows 11 with VBS runs under VMware Workstation on the series
Changes since v2:
- New patch 1: the pseudo-PMCs honor enable_vmware_backdoor
- Split the first patch into code movement, helpers and Kconfig; all
code in vmware.{c,h}; CONFIG_KVM_VMWARE depends on KVM_X86 (Sean)
- kvm_is_vmware_*() predicates with the enabled check inside (Sean)
- One KVM_CAP_X86_VMWARE with flags in the x86 UAPI header instead of
three capabilities; flags are one-way and only accepted before vCPU
creation (Xin, Sean); "_L0" dropped from the nested flag (Sean)
- No stub for the hypercall handler, no #ifdef plus stub (Sean)
- struct kvm_vmware_exit in the x86 UAPI header (Sean); the exit now
carries only mode and CPL, registers go through KVM_SYNC_X86_REGS,
and exception completion is validated
- Only L1 hypercalls with VMware's magic are claimed
- Nested SVM fixed: v2's nested_svm_exit_special() hook never fired
- Selftests: KUT port (Sean), hypercall, Hyper-V coexistence and
nested routing tests
v2: https://lore.kernel.org/all/20250422161304.579394-1-zack.rusin@xxxxxxxxxxxx
v1: https://lore.kernel.org/all/20241030033514.1728937-1-zack.rusin@xxxxxxxxxxxx
Zack Rusin (12):
KVM: x86/pmu: Honor enable_vmware_backdoor for VMware pseudo-PMCs
KVM: x86: Move VMware backdoor support to separate files
KVM: x86: Encapsulate VMware backdoor checks
KVM: x86: Add CONFIG_KVM_VMWARE
KVM: x86: Add a unified VMware capability
KVM: x86: Forward VMware hypercalls to userspace
KVM: x86: Route nested VMware backdoors to KVM
KVM: selftests: Add helpers to run x86 guest code in user mode
KVM: selftests: Port VMware backdoor coverage
KVM: selftests: Test VMware hypercall exits
KVM: selftests: Test VMware hypercall exits with nested Hyper-V
flushes
KVM: selftests: Test nested VMware backdoor routing
Documentation/virt/kvm/api.rst | 119 +++++-
MAINTAINERS | 10 +
arch/x86/include/asm/kvm_host.h | 11 +
arch/x86/include/uapi/asm/kvm.h | 27 ++
arch/x86/kvm/Kconfig | 12 +
arch/x86/kvm/Makefile | 1 +
arch/x86/kvm/emulate.c | 9 +-
arch/x86/kvm/pmu.c | 41 +-
arch/x86/kvm/pmu.h | 5 -
arch/x86/kvm/svm/svm.c | 12 +-
arch/x86/kvm/vmware.c | 201 +++++++++
arch/x86/kvm/vmware.h | 102 +++++
arch/x86/kvm/vmx/nested.c | 5 +
arch/x86/kvm/vmx/vmx.c | 5 +-
arch/x86/kvm/x86.c | 63 ++-
arch/x86/kvm/x86.h | 2 -
include/uapi/linux/kvm.h | 6 +
tools/testing/selftests/kvm/Makefile.kvm | 3 +
.../selftests/kvm/include/x86/hyperv.h | 21 +
.../selftests/kvm/include/x86/processor.h | 7 +
.../testing/selftests/kvm/lib/x86/processor.c | 87 ++++
.../testing/selftests/kvm/x86/hyperv_evmcs.c | 27 +-
.../selftests/kvm/x86/hyperv_svm_test.c | 21 +-
.../selftests/kvm/x86/vmware_backdoor_test.c | 272 ++++++++++++
.../selftests/kvm/x86/vmware_hypercall_test.c | 388 ++++++++++++++++++
.../kvm/x86/vmware_nested_backdoor_test.c | 223 ++++++++++
.../selftests/kvm/x86/xen_vmcall_test.c | 12 +-
27 files changed, 1587 insertions(+), 105 deletions(-)
create mode 100644 arch/x86/kvm/vmware.c
create mode 100644 arch/x86/kvm/vmware.h
create mode 100644 tools/testing/selftests/kvm/x86/vmware_backdoor_test.c
create mode 100644 tools/testing/selftests/kvm/x86/vmware_hypercall_test.c
create mode 100644 tools/testing/selftests/kvm/x86/vmware_nested_backdoor_test.c
base-commit: c37cd5acfc3762e3fec1bf8418dc1471e3d6297d
--
2.53.0