[PATCH v3 07/12] KVM: x86: Route nested VMware backdoors to KVM
From: Zack Rusin
Date: Wed Nov 11 2026 - 01:07:36 EST
Add KVM_VMWARE_ENABLE_NESTED_BACKDOOR. When it and the backdoor flag
are both enabled, handle the #GP from a CPL3 VMware backdoor I/O access
in L2 in KVM, as for L1, even if L1 intercepts #GP. Treat an access as
a backdoor access only if EAX holds VMware's magic value and DX selects
one of the two backdoor ports; L1 keeps receiving every other #GP.
VMware Tools use the I/O-port backdoor from user mode and rely on the
hypervisor ignoring the I/O permission checks for the backdoor ports.
When Hyper-V runs in the guest, e.g. for Windows virtualization-based
security (VBS), Windows and the Tools run as L2. The access then
raises #GP and normal nested routing delivers it to Hyper-V, which
doesn't implement the backdoor.
Make the routing opt-in, because a nested hypervisor that implements
the backdoor itself, such as ESXi, has to keep receiving its guests'
accesses. Cover only the I/O-port backdoor; L2 VMCALL and VMMCALL
handling doesn't change.
On VMX, claim the exit in nested_vmx_l0_wants_exit(). On SVM, a #GP
that L0 intercepts always reaches gp_interception() first, which
reinjects any #GP that KVM doesn't handle so that it reaches L1 if L1
intercepts #GP; check the filter there.
Link: https://lore.kernel.org/r/CADH9ctAGt_VriKA7Ch1L9U+xud-6M54GzaPOM_2sSA780TpAYw@xxxxxxxxxxxxxx
Link: https://lore.kernel.org/r/CABgObfb3Ttfg6H+_RpNQGSYKw9BLEwx3+EysXdL-wbpd1pkGHQ@xxxxxxxxxxxxxx
Link: https://lore.kernel.org/r/aAjrOgsooR4RYIJr@xxxxxxxxxx
Link: https://lore.kernel.org/r/aIEnm7Y1VN-PCfF8@xxxxxxxxxx
Signed-off-by: Zack Rusin <zack.rusin@xxxxxxxxxxxx>
---
Documentation/virt/kvm/api.rst | 9 +++++++++
arch/x86/include/uapi/asm/kvm.h | 1 +
arch/x86/kvm/svm/svm.c | 7 +++++--
arch/x86/kvm/vmware.c | 8 ++++++++
arch/x86/kvm/vmware.h | 22 ++++++++++++++++++++++
arch/x86/kvm/vmx/nested.c | 5 +++++
arch/x86/kvm/x86.c | 3 ++-
7 files changed, 52 insertions(+), 3 deletions(-)
diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst
index e2f0e329f748..14ce68600551 100644
--- a/Documentation/virt/kvm/api.rst
+++ b/Documentation/virt/kvm/api.rst
@@ -9293,6 +9293,15 @@ exception by setting ``vmware.hcall.exception.inject`` and filling in the
validated vector, error code, and address fields. When an exception is
requested, KVM does not advance past the hypercall instruction.
+``KVM_VMWARE_ENABLE_NESTED_BACKDOOR`` makes KVM handle VMware backdoor I/O
+from a nested guest itself, even when the nested hypervisor intercepts #GP.
+KVM claims only a #GP raised at CPL3 while EAX holds VMware's magic value and
+DX holds one of the two backdoor ports; the nested hypervisor still receives
+every other #GP, and VMCALL/VMMCALL from the nested guest are not affected.
+This is needed, for example, for a Windows guest with Hyper-V VBS enabled:
+Hyper-V does not implement the VMware backdoor used by VMware Tools. This
+flag has an effect only when ``KVM_VMWARE_ENABLE_BACKDOOR`` is also enabled.
+
8. Other capabilities.
======================
diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
index 3b9f53bce2d9..18c2d908eaa2 100644
--- a/arch/x86/include/uapi/asm/kvm.h
+++ b/arch/x86/include/uapi/asm/kvm.h
@@ -968,6 +968,7 @@ struct kvm_hyperv_eventfd {
#define KVM_VMWARE_ENABLE_BACKDOOR _BITULL(0)
#define KVM_VMWARE_ENABLE_HYPERCALL _BITULL(1)
+#define KVM_VMWARE_ENABLE_NESTED_BACKDOOR _BITULL(2)
struct kvm_vmware_exit {
#define KVM_EXIT_VMWARE_HCALL 1
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index a2196d8f60aa..bae7065fb360 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2408,9 +2408,12 @@ static int gp_interception(struct kvm_vcpu *vcpu)
/*
* VMware backdoor emulation on #GP interception only handles
- * IN{S}, OUT{S}, and RDPMC, and only for L1.
+ * IN{S}, OUT{S}, and RDPMC. Handle L2 accesses only when userspace
+ * explicitly requests that L0 own the nested VMware backdoor.
*/
- if (!kvm_is_vmware_backdoor_enabled(vcpu) || is_guest_mode(vcpu))
+ if (!kvm_is_vmware_backdoor_enabled(vcpu) ||
+ (is_guest_mode(vcpu) &&
+ !kvm_is_vmware_nested_backdoor(vcpu, svm_get_cpl(vcpu))))
goto reinject;
return kvm_emulate_instruction(vcpu, EMULTYPE_VMWARE_GP | EMULTYPE_NO_DECODE);
diff --git a/arch/x86/kvm/vmware.c b/arch/x86/kvm/vmware.c
index 8407dccf81fd..066f033e7ea3 100644
--- a/arch/x86/kvm/vmware.c
+++ b/arch/x86/kvm/vmware.c
@@ -117,6 +117,14 @@ int kvm_vmware_hypercall(struct kvm_vcpu *vcpu)
return 0;
}
+bool kvm_is_vmware_nested_backdoor(struct kvm_vcpu *vcpu, u32 cpl)
+{
+ return kvm_is_vmware_nested_backdoor_enabled(vcpu->kvm) && cpl == 3 &&
+ lower_32_bits(kvm_rax_read_raw(vcpu)) == VMWARE_HYPERVISOR_MAGIC &&
+ kvm_is_vmware_io_port(vcpu, kvm_rdx_read_raw(vcpu));
+}
+EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_is_vmware_nested_backdoor);
+
bool kvm_is_vmware_io_port(struct kvm_vcpu *vcpu, u16 port)
{
return kvm_is_vmware_backdoor_enabled(vcpu) &&
diff --git a/arch/x86/kvm/vmware.h b/arch/x86/kvm/vmware.h
index de1dc8971ec6..e2ba0b8b4400 100644
--- a/arch/x86/kvm/vmware.h
+++ b/arch/x86/kvm/vmware.h
@@ -24,9 +24,19 @@ kvm_is_vmware_backdoor_enabled(struct kvm_vcpu *vcpu)
}
bool kvm_is_vmware_hypercall(struct kvm_vcpu *vcpu);
+
+static __always_inline bool
+kvm_is_vmware_nested_backdoor_enabled(struct kvm *kvm)
+{
+ return kvm_is_vmware_cap_enabled(kvm, KVM_VMWARE_ENABLE_BACKDOOR) &&
+ kvm_is_vmware_cap_enabled(kvm,
+ KVM_VMWARE_ENABLE_NESTED_BACKDOOR);
+}
+
bool kvm_is_vmware_io_port(struct kvm_vcpu *vcpu, u16 port);
bool kvm_is_vmware_backdoor_pmc(struct kvm_vcpu *vcpu, u32 pmc_idx);
bool kvm_is_vmware_backdoor_opcode(u8 opcode_len, u8 opcode);
+bool kvm_is_vmware_nested_backdoor(struct kvm_vcpu *vcpu, u32 cpl);
#else /* !CONFIG_KVM_VMWARE */
@@ -52,6 +62,12 @@ static __always_inline bool kvm_is_vmware_hypercall(struct kvm_vcpu *vcpu)
return false;
}
+static __always_inline bool
+kvm_is_vmware_nested_backdoor_enabled(struct kvm *kvm)
+{
+ return false;
+}
+
static __always_inline bool
kvm_is_vmware_io_port(struct kvm_vcpu *vcpu, u16 port)
{
@@ -70,6 +86,12 @@ kvm_is_vmware_backdoor_opcode(u8 opcode_len, u8 opcode)
return false;
}
+static __always_inline bool
+kvm_is_vmware_nested_backdoor(struct kvm_vcpu *vcpu, u32 cpl)
+{
+ return false;
+}
+
#endif /* CONFIG_KVM_VMWARE */
void kvm_vmware_init_vm(struct kvm *kvm);
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
index 1a98f28651f7..2d1297036564 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
@@ -18,6 +18,7 @@
#include "posted_intr.h"
#include "sgx.h"
#include "trace.h"
+#include "vmware.h"
#include "vmx.h"
#include "smm.h"
#include "x86_ops.h"
@@ -6490,6 +6491,10 @@ static bool nested_vmx_l0_wants_exit(struct kvm_vcpu *vcpu,
return true;
else if (is_ve_fault(intr_info))
return true;
+ else if (is_gp_fault(intr_info) &&
+ kvm_is_vmware_nested_backdoor(vcpu,
+ vmx_get_cpl(vcpu)))
+ return true;
return false;
case EXIT_REASON_EXTERNAL_INTERRUPT:
return true;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index bd4142763f10..6b6ed02d6063 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -119,7 +119,8 @@ EXPORT_SYMBOL_FOR_KVM_INTERNAL(kvm_host);
#define KVM_CAP_PMU_VALID_MASK KVM_PMU_CAP_DISABLE
#define KVM_CAP_VMWARE_VALID_MASK (KVM_VMWARE_ENABLE_BACKDOOR | \
- KVM_VMWARE_ENABLE_HYPERCALL)
+ KVM_VMWARE_ENABLE_HYPERCALL | \
+ KVM_VMWARE_ENABLE_NESTED_BACKDOOR)
#define KVM_GUESTDBG_VALID_MASK \
(KVM_GUESTDBG_ENABLE | \
--
2.53.0