[PATCH v3 09/12] KVM: selftests: Port VMware backdoor coverage

[Zack Rusin]

Add vmware_backdoor_test, adapted from KVM-unit-tests' vmware_backdoors
test.  From CPL3, with CR4.PCE clear and no I/O permission bitmap in
the TSS, read the VMware pseudo-PMCs with RDPMC and issue backdoor
commands on the backdoor port with IN.  Verify that the pseudo-PMC
reads succeed and the port accesses exit to userspace only when the
backdoor is enabled and raise #GP otherwise, and that other PMC indices
and ports always raise #GP.  Repeat the pseudo-PMC checks at CPL3 with
CR4.PCE set and at CPL0, where RDPMC doesn't fault before KVM handles
it.  Skip the pseudo-PMC checks if KVM doesn't virtualize a PMU, as KVM
then injects #GP for every RDPMC.

Run the checks for a VM that relies on the enable_vmware_backdoor
default and for a VM that enables KVM_VMWARE_ENABLE_BACKDOOR, and
verify that KVM_CAP_X86_VMWARE rejects every flag it doesn't report.
KVM-unit-tests can only cover the module parameter, which applies to
every VM, while the selftest also covers the per-VM capability.

Suggested-by: Sean Christopherson <seanjc@xxxxxxxxxx>
Link: https://lore.kernel.org/r/aIEoNpe-LFoH6LBm@xxxxxxxxxx
Signed-off-by: Zack Rusin <zack.rusin@xxxxxxxxxxxx>
---
 MAINTAINERS                                   |   1 +
 tools/testing/selftests/kvm/Makefile.kvm      |   1 +
 .../selftests/kvm/x86/vmware_backdoor_test.c  | 272 ++++++++++++++++++
 3 files changed, 274 insertions(+)
 create mode 100644 tools/testing/selftests/kvm/x86/vmware_backdoor_test.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 017053e8f76e..39fa67a180f5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -15050,6 +15050,7 @@ S:	Supported
 T:	git git://git.kernel.org/pub/scm/virt/kvm/kvm.git
 T:	git https://github.com/kvm-x86/linux.git
 F:	arch/x86/kvm/vmware.*
+F:	tools/testing/selftests/kvm/x86/vmware_backdoor_test.c
 
 KVM X86 Xen (KVM/Xen)
 M:	David Woodhouse <dwmw2@xxxxxxxxxxxxx>
diff --git a/tools/testing/selftests/kvm/Makefile.kvm b/tools/testing/selftests/kvm/Makefile.kvm
index 95867977beb3..0ef08d7783ae 100644
--- a/tools/testing/selftests/kvm/Makefile.kvm
+++ b/tools/testing/selftests/kvm/Makefile.kvm
@@ -140,6 +140,7 @@ TEST_GEN_PROGS_x86 += x86/sync_regs_test
 TEST_GEN_PROGS_x86 += x86/ucna_injection_test
 TEST_GEN_PROGS_x86 += x86/userspace_io_test
 TEST_GEN_PROGS_x86 += x86/userspace_msr_exit_test
+TEST_GEN_PROGS_x86 += x86/vmware_backdoor_test
 TEST_GEN_PROGS_x86 += x86/vmx_apic_access_test
 TEST_GEN_PROGS_x86 += x86/vmx_apicv_updates_test
 TEST_GEN_PROGS_x86 += x86/vmx_exception_with_invalid_guest_state
diff --git a/tools/testing/selftests/kvm/x86/vmware_backdoor_test.c b/tools/testing/selftests/kvm/x86/vmware_backdoor_test.c
new file mode 100644
index 000000000000..e4e87d2ce3c3
--- /dev/null
+++ b/tools/testing/selftests/kvm/x86/vmware_backdoor_test.c
@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2025-2026 Broadcom. All Rights Reserved. The term
+ * "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
+ *
+ * Adapted from kvm-unit-tests' x86/vmware_backdoors.c.
+ */
+
+#include "kvm_util.h"
+#include "processor.h"
+#include "test_util.h"
+
+#define VMWARE_BACKDOOR_PMC_HOST_TSC		0x10000
+#define VMWARE_BACKDOOR_PMC_REAL_TIME		0x10001
+#define VMWARE_BACKDOOR_PMC_APPARENT_TIME	0x10002
+
+#define VMWARE_BACKDOOR_PORT	0x5658
+#define VMWARE_MAGIC		0x564d5868
+#define VMPORT_CMD_GETVERSION	0x0a
+#define VMPORT_CMD_ILLEGAL	0xfff
+#define VMPORT_DEFAULT_RETVAL	0xdeadbeef
+#define RANDOM_IO_PORT		0x1234
+#define RANDOM_PMC		0xfff
+
+struct insn_result {
+	u64 value;
+	u8 vector;
+};
+
+struct backdoor_results {
+	struct insn_result pmc[4];
+	struct insn_result port[3];
+};
+
+enum backdoor_mode {
+	USER_MODE,		/* CPL3, CR4.PCE clear */
+	USER_MODE_PCE,		/* CPL3, CR4.PCE set */
+	KERNEL_MODE,		/* CPL0 */
+};
+
+static struct backdoor_results results;
+static bool expect_backdoor;
+static bool test_pmcs;
+
+static struct insn_result guest_rdpmc(u32 pmc)
+{
+	struct insn_result result;
+	u32 eax;
+	u32 edx;
+	u64 error_code;
+
+	asm volatile(KVM_ASM_SAFE("rdpmc")
+		     : "=a"(eax), "=d"(edx),
+		       KVM_ASM_SAFE_OUTPUTS(result.vector, error_code)
+		     : "c"(pmc)
+		     : KVM_ASM_SAFE_CLOBBERS);
+	result.value = ((u64)edx << 32) | eax;
+	return result;
+}
+
+static struct insn_result guest_inl(u16 port, u32 command)
+{
+	struct insn_result result;
+	unsigned long rax = VMPORT_DEFAULT_RETVAL;
+	unsigned long rbx = VMPORT_DEFAULT_RETVAL;
+	unsigned long rcx = command;
+	unsigned long rdx = port;
+	u64 error_code;
+
+	asm volatile(KVM_ASM_SAFE("inl %%dx, %%eax")
+		     : "+a"(rax), "+b"(rbx), "+c"(rcx), "+d"(rdx),
+		       KVM_ASM_SAFE_OUTPUTS(result.vector, error_code)
+		     :
+		     : KVM_ASM_SAFE_CLOBBERS);
+	result.value = rbx;
+	return result;
+}
+
+static void guest_read_pmcs(void)
+{
+	results.pmc[0] = guest_rdpmc(VMWARE_BACKDOOR_PMC_HOST_TSC);
+	results.pmc[1] = guest_rdpmc(VMWARE_BACKDOOR_PMC_REAL_TIME);
+	results.pmc[2] = guest_rdpmc(VMWARE_BACKDOOR_PMC_APPARENT_TIME);
+	results.pmc[3] = guest_rdpmc(RANDOM_PMC);
+}
+
+static void guest_check_pmcs(void)
+{
+	int i;
+
+	for (i = 0; i < 3; i++) {
+		GUEST_ASSERT_EQ(results.pmc[i].vector,
+				expect_backdoor ? 0 : GP_VECTOR);
+		if (expect_backdoor)
+			GUEST_ASSERT_NE(results.pmc[i].value, 0);
+	}
+	GUEST_ASSERT_EQ(results.pmc[3].vector, GP_VECTOR);
+}
+
+static void guest_done_handler(struct ex_regs *regs)
+{
+	if (test_pmcs)
+		guest_check_pmcs();
+
+	GUEST_ASSERT_EQ(results.port[0].vector,
+			expect_backdoor ? 0 : GP_VECTOR);
+	GUEST_ASSERT_EQ(results.port[1].vector,
+			expect_backdoor ? 0 : GP_VECTOR);
+	if (expect_backdoor)
+		GUEST_ASSERT_EQ(results.port[0].value, VMWARE_MAGIC);
+	GUEST_ASSERT_EQ(results.port[2].vector, GP_VECTOR);
+
+	GUEST_DONE();
+}
+
+static void guest_user_code(void)
+{
+	if (test_pmcs)
+		guest_read_pmcs();
+
+	results.port[0] = guest_inl(VMWARE_BACKDOOR_PORT,
+				    VMPORT_CMD_GETVERSION);
+	results.port[1] = guest_inl(VMWARE_BACKDOOR_PORT,
+				    VMPORT_CMD_ILLEGAL);
+	results.port[2] = guest_inl(RANDOM_IO_PORT, VMPORT_CMD_ILLEGAL);
+
+	asm volatile("int3");
+}
+
+/* At CPL0, only the pseudo-PMCs depend on the backdoor. */
+static void guest_kernel_code(void)
+{
+	guest_read_pmcs();
+	guest_check_pmcs();
+	GUEST_DONE();
+}
+
+static void handle_vmware_port(struct kvm_vcpu *vcpu)
+{
+	struct kvm_run *run = vcpu->run;
+	struct kvm_regs regs;
+	u32 *data;
+
+	TEST_ASSERT_EQ(run->io.direction, KVM_EXIT_IO_IN);
+	TEST_ASSERT_EQ(run->io.size, 4);
+	TEST_ASSERT_EQ(run->io.count, 1);
+	TEST_ASSERT_EQ(run->io.port, VMWARE_BACKDOOR_PORT);
+
+	data = (void *)run + run->io.data_offset;
+	*data = 0;
+
+	vcpu_regs_get(vcpu, &regs);
+	regs.rbx = VMWARE_MAGIC;
+	vcpu_regs_set(vcpu, &regs);
+}
+
+static void test_unsupported_flags(u64 supported)
+{
+	struct kvm_vm *vm = vm_create_barebones();
+	int bit, ret;
+
+	for (bit = 0; bit < 64; bit++) {
+		if (supported & BIT_ULL(bit))
+			continue;
+
+		errno = 0;
+		ret = __vm_enable_cap(vm, KVM_CAP_X86_VMWARE, BIT_ULL(bit));
+		TEST_ASSERT(ret == -1 && errno == EINVAL,
+			    "Unsupported VMware flag %d: ret=%d errno=%d",
+			    bit, ret, errno);
+	}
+	kvm_vm_free(vm);
+}
+
+static void run_backdoor_test(bool enable_cap, bool expected,
+			      enum backdoor_mode mode)
+{
+	struct kvm_sregs sregs;
+	struct idt_entry *idt;
+	struct kvm_vcpu *vcpu;
+	struct kvm_vm *vm;
+	int port_exits = 0;
+
+	expect_backdoor = expected;
+	memset(&results, 0, sizeof(results));
+
+	vm = vm_create(1);
+	sync_global_to_guest(vm, expect_backdoor);
+	sync_global_to_guest(vm, test_pmcs);
+	sync_global_to_guest(vm, results);
+	if (enable_cap)
+		vm_enable_cap(vm, KVM_CAP_X86_VMWARE,
+			      KVM_VMWARE_ENABLE_BACKDOOR);
+	if (mode == KERNEL_MODE) {
+		vcpu = vm_vcpu_add(vm, 0, guest_kernel_code);
+	} else {
+		vcpu = vm_vcpu_add(vm, 0, guest_user_code);
+
+		idt = addr_gva2hva(vm, vm->arch.idt);
+		idt[BP_VECTOR].dpl = 3;
+		vm_install_exception_handler(vm, BP_VECTOR, guest_done_handler);
+		vm_init_user_mode(vm);
+		vcpu_enter_user_mode(vcpu);
+	}
+
+	if (mode == USER_MODE_PCE) {
+		vcpu_sregs_get(vcpu, &sregs);
+		sregs.cr4 |= X86_CR4_PCE;
+		vcpu_sregs_set(vcpu, &sregs);
+	}
+
+	for (;;) {
+		struct kvm_run *run = vcpu->run;
+		struct ucall uc;
+
+		vcpu_run(vcpu);
+		TEST_ASSERT_KVM_EXIT_REASON(vcpu, KVM_EXIT_IO);
+
+		if (run->io.port == VMWARE_BACKDOOR_PORT) {
+			TEST_ASSERT(expected,
+				    "Disabled VMware backdoor reached userspace");
+			handle_vmware_port(vcpu);
+			port_exits++;
+			continue;
+		}
+
+		switch (get_ucall(vcpu, &uc)) {
+		case UCALL_ABORT:
+			REPORT_GUEST_ASSERT(uc);
+			break;
+		case UCALL_DONE:
+			TEST_ASSERT_EQ(port_exits,
+				       expected && mode != KERNEL_MODE ? 2 : 0);
+			kvm_vm_free(vm);
+			return;
+		default:
+			TEST_FAIL("Unexpected ucall 0x%lx", uc.cmd);
+		}
+	}
+}
+
+int main(int argc, char *argv[])
+{
+	unsigned int supported = kvm_check_cap(KVM_CAP_X86_VMWARE);
+	enum backdoor_mode mode;
+	bool module_default;
+
+	TEST_REQUIRE(supported & KVM_VMWARE_ENABLE_BACKDOOR);
+
+	test_unsupported_flags(supported);
+
+	/* KVM serves the pseudo-PMCs only if it virtualizes a PMU. */
+	test_pmcs = kvm_is_pmu_enabled();
+	if (!test_pmcs)
+		ksft_print_msg("vPMU disabled, skipping pseudo-PMC checks\n");
+
+	module_default = get_kvm_param_bool("enable_vmware_backdoor");
+	run_backdoor_test(false, module_default, USER_MODE);
+	run_backdoor_test(true, true, USER_MODE);
+
+	/*
+	 * RDPMC at CPL0, or at CPL3 with CR4.PCE set, doesn't raise the #GP
+	 * that the emulator handles, so check the pseudo-PMCs there as well.
+	 */
+	if (test_pmcs) {
+		for (mode = USER_MODE_PCE; mode <= KERNEL_MODE; mode++) {
+			run_backdoor_test(false, module_default, mode);
+			run_backdoor_test(true, true, mode);
+		}
+	}
+	return 0;
+}
-- 
2.53.0